>Am I misunderstanding something here? No, not at all. The point is that while ECB is a silly choice, it does not make it easier for the attacker to crack your

>Am I misunderstanding something here? No, not at all. The point is that while ECB is a silly choice, it does not make it easier for the attacker to crack your vault. It does allow the attacker to see if you're reusing passwords, but does not reveal to the attacker what those passwords are. On the other hand, If the attacker were to discover one of your passwords from another source, they'd be able to confirm reuse anyway by simply attempting to use that password on other websites.