It sounds to me like you read a different article than I wrote. The point of my article was not "Encryption-At-Rest Is Bad" as you seem to have taken it to mea

It sounds to me like you read a different article than I wrote. The point of my article was not "Encryption-At-Rest Is Bad" as you seem to have taken it to mean. Rather, the point is that other techniques, when you sit down and actually think them through, do not provide any significant value over just phoning it in with Full Disk Encryption. How you get from "software libraries that encrypt-at-rest routinely fail to provide value on top of full disk encryption" to "Scott says FDE is bad" is unclear. Additionally: From a software perspective, the risks you all outlined are morally equivalent to the hard drives grew legs and walked because they are the same risk; namely, loss of control of the actual hard drives. The article in question is focused on threats when those drives are plugged in and the keys are being used to encrypt/decrypt data. As several others have pointed out already, I explicitly state this, repeatedly. I don't know how to make it more clear.