The argument
Distance is a defence.
Software security is mostly about making remote access conditional: passwords, tokens, rate limits, anomaly detection. All of it exists because the door is open to the entire world and has to be watched.
A card in a drawer changes the geometry. To attempt anything at all, someone has to be where the card is. That does not make it invulnerable, it makes attacks local, physical and expensive.
It also removes whole categories of risk that have nothing to do with you: a provider's misconfigured bucket, a stolen employee laptop, a database left on a test server.
What disappears
Risks that stop applying.
-
I
Mass compromise
There is no central store of vaults, so there is no single mistake that exposes everybody at once.
-
II
Credential stuffing
No account, no login page, nothing to try a leaked password against.
-
III
Silent access
Reading a card requires holding it. Absence is noticeable in a way that a copied database is not.
-
IV
Provider dependency
No servers to keep running means nothing to shut down, sell or change the terms of.
The strongest boundary
is still a wall.Offline storage has its own costs, you are the backup, and forgetting is final. We think that trade is the right one for a small number of secrets.