Comment by kijin

21 hours ago

I've integrated with production APIs that tell the client to encrypt sensitive data using an IV consisting of 16 null bytes.

Some people just follow a spec and don't stop to think what that spec is supposed to accomplish.