SHA-1 is around long enough, that they build precomputation tables. NSA and other state-backed organizations have the capacity to do that. The community should at least up the ante to 256 bit to make things harder.