I don't know why your answer was downvoted, you are spot on.
Also if you wanted to make it secure you could restrict hash passwords to work only from certain IP addresses so you either have to be using a company internal machine or say the IP addresses from a police station.
He was referring to my rebuttal, which was initially downvoted for some reason.