alt Hacker NewsThis is a common sentiment, but the security story isn’t so clear cut as that. Encrypted at rest really just means that if you yank the disk out of the server, an adversary can’t read it. But if it’s a system that is online serving a database and you gain access to the application reading from the database, encryption at rest doesn’t save you. It’s obvious the application server must be able to read the decrypted data. If an adversary breaches the application, they get the data.
>It’s obvious the application server must be able to read the decrypted data
Interestingly, that's not true. Homomorphic encryption can let you perform the same operations on encrypted data as on the plaintext, with the same results once decrypted. But it's vastly slower and less efficient - I know there are libraries like Microsoft SEAL but I've never seen anything that uses it in practice.