> This is stupid. If your key is generated from a pass phrase I guarantee you it's exponentially easier to guess than if it wasn't generated by some simple pass

> This is stupid. If your key is generated from a pass phrase I guarantee you it's exponentially easier to guess than if it wasn't generated by some simple pass phrase. I don't think the author ever claims that a password-derived key is more secure than a random one? This is clearly a conveniance vs security tradeoff, and it doesn't seem like an unreasonable one.