Shawn Farkas has an article and code [1] on how to convert a password into a key for symmetric encryption. Good read.
One of the things he mentions is the possible vulnerability of the password choices that we make. This was covered in "Writing Secure Code" and I had expanded on it in a previous blog entry as well. [2]
[1] http://blogs.msdn.com/shawnfa/archive/2004/04/14/113514.aspx
[2] http://cyberforge.com/weblog/aniltj/articles/253.aspx
[Now Playing: Siente Mi Amor - Once Upon a Time in Mexico]