It says they are only doing 1000 (or 2000) hash iterations to derive the key, and it seems like it is too few iterations to be much of a brute force deterrent these days. I would have expected something like 100000 iterations, or 1 second or more of calculation time on a modern CPU.