Reading the tutorial here: https://github.com/defuse/php-encryption/blob/master/docs/Tutorial.md (scenario #2)

It is advised to store the encryption key in a session variable. I was wondering, is it safer to store the key in a cookie variable instead?

My assumption:

- $_SESSION is stored in the server
- $_COOKIE is stored in the client's device (browser)


Threat model:

- Against employees of hosting provider snooping data
- Against hackers (they will likely attack the server instead of a user's device)