They also pretty commonly use in-browser JS SHA256 to derive private keys from human-generated passphrases: https://brainwallet.github.io/ There have been reports of pretty obscure, but still guessable, keys being cracked this way.
Bitcoin is fascinating just because it makes these sorts of things worth untraceable money, sometimes a lot of money, and puts it in the hands of people who have never had that sort of responsibility. Whatever else cryptocurrency does, maybe it will teach laypeople about these things, devise new ways to teach them and new technological measures to increase their safety.
