[mseebach]

> FileVault use largely happens on more or less insecure computers, so it is an interesting case.

That's not a good idea, an encrypted filesystem is only as secure as the computer you decrypt it on. Yes, of course, if you're carrying a USB drive around with you, it's strictly better that it's encrypted than not (protection against theft and loss), but it's not exactly difficult to imagine that a public computer should have malware installed.

For the leaker/whistle-blower scenario, disk encryption is your absolute last line of defence. When the MiB comes knocking, you absolutely want all your drives fully encrypted, but the vast majority of your security efforts should be spent on not getting identified in the first place. But what you don't want is for the MiB to find out that you're using the computers in a certain library, go there and install keyloggers and only come to your house once they have your passphrase.