> You should ultimately be putting in systems that, if in the event of a compromise, you can mitigate the cost to the user. Completely agreed - that's the gist

> You should ultimately be putting in systems that, if in the event of a compromise, you can mitigate the cost to the user. Completely agreed - that's the gist of the DB bits there. Right now, you can terminate a compromised AR-backed session by logging out, but if you lose that session ID, then you have no control over the compromised session. If someone jacks your SID while you're on a public terminal, using ARStore alone isn't going to save you.