> 3. They should be authenticated.

I covered that:

> Furthermore, not authenticating your ciphertext means padding oracle attacks can be launched against the app.

The list above was just the requirements for the initialization vector, not the list of problems with the code.