Should also be using a KDF or PBKDF to generate the key from a password, instead of using the text of the password as the key.