> It's not nothing, and it's weird to be strident about it To an outsider, hearing people talk about how LastPass used Very Bad ECB mode makes it sound like a

> It's not nothing, and it's weird to be strident about it To an outsider, hearing people talk about how LastPass used Very Bad ECB mode makes it sound like a fuckup with immediate and dramatic effect on the security of their passwords, that isn't exactly true. Nobody should have been using LastPass, but we can still be realistic about the threats facing those who did. > but the obvious problem here is the offline cracking of the vault passwords; this isn't worth arguing about. Of course not, but that's a completely separate issue from their choice of AES mode.