The dongle (Scrambler) uses 4 keys / passwords.
1 - 10 characters long is used to identify clusters (when more than one dongle is used to boost throughput).
2 - this is the actual key for SHA1-HMAC
3 - this is used for initialisation vectors.
4 - encryption key for remote commands ENSCRAMBLE and ENGETID. This key is shared with the client (Wordpress in our case) to provide end-to-end encryption of passwords sent for scrambling.

S-CRIB Scrambler Design Basics We use the same hardware as for our Password S-CRIB and only re-implemented the firmware to add required functionality. The keys / passwords now have 32 characters so they can be directly used with AES-256. Each password can give provide up to 199 bits of entropy as we use 76 different characters. The source of passwords is a combination of a "dongle key" (unique for each Scrambler) and a random SHA1 key generated using microsecond timer applied on communication between Scrambler and the host PC.

University of Cambridge's S-CRIB Scrambler resides in a Raspberry Pi...

The current implementation uses Raspberry Pi as an "untrusted" host for web service. It is an inexpensive but sufficiently powerful platform for our password scrambling system.

Not if one stores a long, fixed salt in the device.

(Here fixed means fixed over all users.)

10 random chars are good for 65bits. Log(92^10)/Log(2) = 65.24

By keeping your mouth shut about these holes, you are pretty much guaranteeing that they will remain open for exploitation. People in positions with the authority to make decisions about patching the holes will remain oblivious, because let's face it, very few of said people have a fucking clue.

He really did a convincing work on the montage and the voice-over, but NPOV must agree the majority of the video came from the deniers. Now I don't know how far fair use goes, but maybe they really have a case there. How did MST3K handle that?

Nothing in your post explains WHY it is a government concern that people get some minimum amount of vacation time. You say that the government should mandate some minimum amount of vacation time because otherwise an employer might not offer any. But that begs the question by assuming that it is a government interest that people get some minimum amount of vacation time.

How hard do you think it is to have ATM's[sic] scan serial numbers on the bills they dispense so the machine/bank/gov't knows who they were given to, and have the bank scan in the deposits so they know who is receiving the bills?

Then post but also run Adblock and disable Google's tracking scripts.