Re:Show HN: OormiPass – free, cross platform and open source...
by mirashii on Saturday January 26, 2019 @11:44AM
(#19007015)
> That is, I do not find an adversary replacing, trashing, or performing zero-knowledge modifications on my credentials to be an attack vector that has any importance.
I wanted to pick this sentence out to point out the general most important thing that any project that claims to be security-oriented should have: A documented threat model. You should know exactly what this thing does try to prevent, and what it explicitly does not try to prevent. A lack of one should be taken as a sign that it isn't ready for any use that requires security.
Re:Show HN: OormiPass – free, cross platform and open source...
by arghwhat on Sunday January 27, 2019 @06:26AM
(#19011314)
Hear, hear! The concept of documented threat models is far too rarely used. And, to be frank, the threat model needs to be in place before you design the product.
I wanted to pick this sentence out to point out the general most important thing that any project that claims to be security-oriented should have: A documented threat model. You should know exactly what this thing does try to prevent, and what it explicitly does not try to prevent. A lack of one should be taken as a sign that it isn't ready for any use that requires security.