No, they weren't. According to the "Release Notes", they were using a DES-based crypt scheme. Read up on tptacek's (http://news.ycombinator.com/user?id=tptacek) comments on the matter.

Yes, as you told, I was writing from my memory and I remembered having read DES encryption with password in source somewhere.

But It seems it was a DES based hashing: http://www.duosecurity.com/blog/entry/brief_analysis_of_the_...

[edit] deleted the parent post because I could not find the article I remembered (which was probably wrong anyways).

Do you have a reference for that? Everything I've read (not really authoritative) indicated they were using the standard crypt interface, which does use DES, but is a lot closer to salted hash then encrypted. I can see the issue getting confused either way (people see DES, don't know what to think), but using crypt seems a lot more likely.

Brute force? Yes.

Rainbow tables? No. That's the purpose of a salt. The table needs to be several orders of magnitude bigger.