passwords are easily brute-forceable

[marado]

If you type another user's username, you'll be stuck in the password prompt forever until you figure out the password. That is the perfect scenario for someone aiming to do a brute force attack.