The vault does no good if you're passwords can be identically recreated by the attacker. Which the "crappy and predictable seed value", in combination with acco

The vault does no good if you're passwords can be identically recreated by the attacker. Which the "crappy and predictable seed value", in combination with account creation time data, makes trivial. That creation time may be explicitly shown by the service, or at least hinted at through something like the timestamp of the user's first post.