If you really care about security, all data at rest must be encrypted (in addition to the data in transit). We're so used to HTTPS, SSMPT, POPS, IMAPS, etc and

If you really care about security, all data at rest must be encrypted (in addition to the data in transit). We're so used to HTTPS, SSMPT, POPS, IMAPS, etc and we tend to look for it. But the data at rest is actually much easier to capture.