I think you need to allow for a user configured PSK on the account page so as not to use the same weak one for everyone. only then you'll have great security!