According to my napkin math it would take longer than an hour if the tape was ~3.3*10^218 sec long (or three million trillion trillion… (18 trillions) …trillion years). Assuming you have only have two options to choose between but can pick which alternative in in 5 seconds (2^720) and you want to get down to a 1 minute intervall.

So i mean its not impossible to find a tape long enough though it seems unlikely that we would be so off in our estimates of the age of the universe.

If you read the report there’s both context there and also on their site mullvad have commented on the found issues stating either reasons or what they are doing to fix it.

Couldn’t it just be that they’re using something like bcrypt which won’t take any chars above its limit into account (knowing that there’s a limit will pretty much never matter to a user but why obscure the fact)? What does it even mean to store it reversibly, just because they have a char limit doesn’t mean they are encrypting the password, could just be some frontend shenannigans as well.