Is it safe to use no IV, or the same IV for scrypt, if the encrypted data is readily available to a hacker? The only time we use IVs is for a web login system to prevent rainbow tables, right? Since the data is client side and therefore in the hacker's hands, is there a need to use an IV?