But the suggestion is to carry out a simple hash on the input phrase — one could use the second or third letter, for instance. (Or the first, second, third, first, second, third…)

How could a dictionary-style attack predict all possible such arrangments?