- You're using HTTPS to encrypt data in transit
- You're using server side encryption to encrypt data at rest
- You want an ever growing amount of security for data
- You want to store data centrally on a server
- You want to access data from multiple different devices
While this is a great model, this naturally does end up in the situation whereby your data could still be decrypted should an unauthorised person get access to the server as the encryption key will be sat on there in one form or another.
This is one of the biggest weaknesses of server side encryption.
Then you look at client side encryption, which resolves this issue, yet brings up another issue which is around how you decouple the security from the device itself. For example when dealing with accessing via multiple devices, and/or, dealing with when your device breaks etc.
Is there a security model / design pattern that deals with these two challenges to offer maximum security?