> Most people have encrypted home or full disk encryption
I don't see the point. Once your home is unlocked, every process can see the file contents
> Most people have encrypted home or full disk encryption
I don't see the point. Once your home is unlocked, every process can see the file contents
I guess you missed my "containerisation" point: if not restricted, every rogue package or agent has access to your full $HOME too. A secret is there to protect access to data you care about. If that data is there, well, not much achieved.
Eg. imagine there's the source code for a service you deploy to AWS — rogue sw can modify it letting you unknowingly update it the next time (or why do you have those AWS keys anyway?).
But not if they are part of non-classic Snap on Ubuntu or properly containerised Flatpak (on Linux, at least), or in a VM or LXC/Docker/Podman container.
[dead]