I'm not entirely sure how the Mega entropy gathering system works, but I can take a guess. Through the sign up process try ask for users to both enter informat

I'm not entirely sure how the Mega entropy gathering system works, but I can take a guess. Through the sign up process try ask for users to both enter information with the keyboard, and click buttons with the mouse. There's not a whole lot of randomness in either action, and relying on it too much could start to reveal things about the user in the encryption key generated. For this, lets assume I can predict the random numbers with minimal computation. That's realistic. PHP session variables can have their random seed extracted in a very short time frame using similar methods (<30 minutes). They would first be relying on the randomness of the path that users take with their mouse between buttons. That's unfortunately fairly predictable, most of the users will click on the buttons in the same order, and probably take reasonably similar paths to get there. If we could work out the probabilities, the key search could be focused on the most likely path a user might take. So we move on to keystrokes. There's not a whole lot of variation there either. If we use the keystrokes themselves, we might begin to reveal personal information in the key. I'm sure you wouldn't want your password baked into the keys you are relying on to protect your freedom / anonymity. The length of keystroke is what they would use, how much time the button stays down and the distance in time between keystrokes. There's some randomness there, but I wager that most people type with the same sort of characteristics. If they're on a touch screen device like an iPhone, you get no real timing information except for delay between letters. There's no denying that it is still brute force and very unlikely, but using attacks like that could be the difference between decades of computation and hours