[icanhasfay]

Obligatory Doom principle link. http://www.thoughtcrime.org/blog/the-cryptographic-doom-prin...

Encrypt Then Authenticate, dammit!

[meowface]

Or, from the inverse perspective: always authenticate and/or verify the integrity of data before processing it at all, whether that processing be decryption, string manipulation, or otherwise.

[StavrosK]

Which you can't do if the MAC is within the encrypted message.

[meowface]

Of course. EtM is the only way to go. Just saying it can be applied to other areas, too.