Why would we need an un-encrypted folder that contains the data we want to encrypt; is that not the mother of all security flaws?