If this is true for this particular implementation, it may not necessarily doom the concept. You could switch to a standard key generation algorithm such as pb

If this is true for this particular implementation, it may not necessarily doom the concept. You could switch to a standard key generation algorithm such as pbkdf2, which is supported in sjcl and is thus available anywhere that can run javascript.