| ▲ | sandeepkd 16 minutes ago | |
Yes, this storage would be growing exponentially making the disk space and latency problems harder (add the disaster recovery/backups). I think the choice of using client side is not too bad if you ensure that its secured properly. Also the company can excuse itself from the liability of storing sensitive data on its servers, thats a big deal in itself to be compliant for enterprise audits 1. The down side is that it cannot be used across the clients even for the same user 2. Using the same encryption key was a bad choice here, a per user key would have solved this issue for sure. | ||
| ▲ | aix1 4 minutes ago | parent [-] | |
Having thought about this a little more, it's clear that server-side storage is not compatible with Zero Data Retention (ZDR). However, in non-ZDR settings, it seems likely that the providers are capturing all that data anyway? > a per user key would have solved this issue for sure It would have helped with PII leakage, but not with plain-text trace extraction attacks, right? | ||