Using hashed password as shared secrets. Good or bad idea?
I'm not sure about your specific system; this only addresses "can a key derived from the password make a good shared secret?"


The most common password hashing functions are actually designed for exactly this purpose -- deriving a cryptographic key from a (weak) password. That's actually what PBKDF2 stands for: "password-based key derivation function #2" (scrypt and bcrypt don't have it in their name, but are also key derivation functions). It's also used in GPG, and for file and disk encryption, etc. Kerberos does so as a login mechanism - when you send the KDC your username, you get information that lets you authenticate as that user, encrypted with a key derived from the user's password.

Passwords tend to be low-entropy, far below that required of a cryptographic key. PBKDFs mitigate that by having a salt (to prevent dictionary attacks, for instance by having a list of the keys derived from the 10000 most common passwords) and by being as time-consuming as you please, which means that while an attacker doesn't have to try as many possibilities as with a random key, it takes them a long time to try each possible password.

So in general, password-derived keys make fine shared secrets. There are some catches (notably: if an attacker compromises them, they've compromised the shared secret; this is why Kerberos KDCs have to be so secure). But there's nothing generally wrong with the concept.