>But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker.

I think the Gawker leak alone is enough of a precedent to ensure that this can never be assumed.