“We Encrypt With AES-256” Is Not a Security Architecture (opens in new tab)

The questions nobody asks — and the attacks that follow when they don’t