14:46:53 <RRSAgent> RRSAgent has joined #threat-modeling
14:46:57 <RRSAgent> logging to https://www.w3.org/2024/09/25-threat-modeling-irc
14:46:57 <tpac-breakout-bot> RRSAgent, do not leave
14:46:58 <tpac-breakout-bot> RRSAgent, make logs public
14:46:59 <tpac-breakout-bot> Meeting: Threat Modeling @ W3C
14:46:59 <tpac-breakout-bot> Chair: Simone Onofri
14:46:59 <tpac-breakout-bot> Agenda: https://github.com/w3c/tpac2024-breakouts/issues/12
14:46:59 <Zakim> Zakim has joined #threat-modeling
14:47:00 <tpac-breakout-bot> Zakim, clear agenda
14:47:00 <Zakim> agenda cleared
14:47:00 <tpac-breakout-bot> Zakim, agenda+ Pick a scribe
14:47:01 <Zakim> agendum 1 added
14:47:01 <tpac-breakout-bot> Zakim, agenda+ Reminders: code of conduct, health policies, recorded session policy
14:47:02 <Zakim> agendum 2 added
14:47:02 <tpac-breakout-bot> Zakim, agenda+ Goal of this session
14:47:02 <Zakim> agendum 3 added
14:47:02 <tpac-breakout-bot> Zakim, agenda+ Discussion
14:47:03 <Zakim> agendum 4 added
14:47:03 <tpac-breakout-bot> Zakim, agenda+ Next steps / where discussion continues
14:47:03 <Zakim> agendum 5 added
14:47:03 <tpac-breakout-bot> tpac-breakout-bot has left #threat-modeling
20:01:46 <michaelchampion> michaelchampion has joined #threat-modeling
21:41:24 <simone> simone has joined #threat-modeling
21:44:01 <mgarrish> mgarrish has joined #threat-modeling
21:46:56 <reillyg> reillyg has joined #threat-modeling
21:47:06 <reillyg> present+
21:47:08 <reillyg> scribe+
21:47:12 <simone> present+
21:47:26 <ChrisLilley> ChrisLilley has joined #threat-modeling
21:47:42 <ChrisLilley> present+
21:48:12 <simone> Slides: https://docs.google.com/presentation/d/1zauMqnZ_e0U3JlNe3bCJacNh9h1VOkBX4_UynjqvQeg/edit#slide=id.g303b479e16d_0_15
21:48:28 <reillyg> slideset https://docs.google.com/presentation/d/1zauMqnZ_e0U3JlNe3bCJacNh9h1VOkBX4_UynjqvQeg/edit
21:48:38 <bdekoz> bdekoz has joined #threat-modeling
21:48:54 <reillyg> [slide 1]
21:49:03 <Bert> Bert has joined #threat-modeling
21:49:13 <Bert> present+
21:49:20 <maximeg> maximeg has joined #threat-modeling
21:49:27 <reillyg> simone: Earlier today we were trying to threat model the Digital Credentials API. Here we're going to discuss threat modeling in general.
21:49:42 <tzviya8> tzviya8 has joined #threat-modeling
21:49:59 <pchampin> pchampin has joined #threat-modeling
21:50:15 <tzviya8> present+
21:50:16 <aykut> aykut has joined #threat-modeling
21:50:26 <reillyg> [slide 2]
21:51:03 <anusha> anusha has joined #threat-modeling
21:51:30 <reillyg> [slide 3]
21:52:21 <reillyg> RRSAgent, draft minutes
21:52:23 <RRSAgent> I have made the request to generate https://www.w3.org/2024/09/25-threat-modeling-minutes.html reillyg
21:53:24 <reillyg> [slide 4]
21:53:36 <reillyg> [slide 5]
21:54:40 <reillyg> simone: I have a threat of dropping my phone, so I use a rugged cover. I have a thread of shoulder surfing, so I use a privacy screen.
21:54:53 <reillyg> s/thread/threat
21:54:59 <reillyg> s/thread/threat/
21:55:02 <reillyg> RRSAgent, draft minutes
21:55:03 <RRSAgent> I have made the request to generate https://www.w3.org/2024/09/25-threat-modeling-minutes.html reillyg
21:55:11 <reillyg> [slide 6]
21:55:51 <reillyg> [slide 7]
21:56:30 <reillyg> [slide 8]
21:58:50 <ChrisLilley> Security and Privacy section*s*
21:59:56 <reillyg> [slide 9]
22:01:44 <jojo> jojo has joined #threat-modeling
22:01:51 <reillyg> [slide 10]
22:03:42 <reillyg> [slide 11]
22:04:17 <reillyg> [slide 12]
22:06:41 <reillyg> s/Slideset/My slides/
22:06:46 <reillyg> s/slideset/Slideset/
22:06:52 <reillyg> [slide 13]
22:07:03 <reillyg> RRSAgent, draft minutes
22:07:04 <RRSAgent> I have made the request to generate https://www.w3.org/2024/09/25-threat-modeling-minutes.html reillyg
22:07:21 <reillyg> simone: What is the best model? It depends on what we're trying to do!
22:07:49 <reillyg> s/Slideset/My slides/
22:08:01 <reillyg> [slide 14]
22:08:05 <reillyg> RRSAgent, draft minutes
22:08:06 <RRSAgent> I have made the request to generate https://www.w3.org/2024/09/25-threat-modeling-minutes.html reillyg
22:08:36 <reillyg> s/Slideset:/Slideset/
22:08:43 <reillyg> s/My slides/Slideset:/
22:08:47 <reillyg> RRSAgent, draft minutes
22:08:49 <RRSAgent> I have made the request to generate https://www.w3.org/2024/09/25-threat-modeling-minutes.html reillyg
22:09:38 <reillyg> [slide 15]
22:09:41 <reillyg> [slide 16]
22:09:55 <reillyg> [slide 17]
22:10:20 <reillyg> [slide 18]
22:10:59 <reillyg> [slide 19]
22:11:34 <reillyg> [slide 20]
22:12:07 <reillyg> [slide 21]
22:12:26 <reillyg> [slide 22]
22:14:06 <reillyg> simone: It can be difficult to switch your mind to the attacker's perspective.
22:14:11 <reillyg> [slide 23]
22:15:24 <reillyg> [slide 24]
22:16:14 <reillyg> [slide 25]
22:19:29 <reillyg> [slide 26]
22:21:37 <reillyg> [slide 27]
22:22:49 <reillyg> ?, you mention authentication. Is authorization rolled into that?
22:23:06 <reillyg> simone: In OSSTTM yes.
22:24:09 <reillyg> ... This was an important question because words may have different meanings for different people.
22:24:28 <reillyg> [slide 28]
22:27:23 <reillyg> [slide 29]
22:28:38 <reillyg> [slide 30]
22:29:36 <reillyg> [slide 31]
22:31:27 <reillyg> [slide 32]
22:32:14 <reillyg> [slide 33]
22:33:30 <reillyg> simone: For example, https://github.com/w3c/security-request/issues/71#issuecomment-2307483632.
22:34:49 <reillyg> [slide 34]
22:34:57 <reillyg> [slide 35]
22:36:22 <reillyg> [slide 36]
22:37:00 <denkeni> denkeni has joined #threat-modeling
22:37:08 <reillyg> [slide 37]
22:37:55 <reillyg> [slide 38]
22:38:56 <reillyg> [slide 39]
22:40:00 <reillyg> ?, how does third party risk from software ecosystems fit into what you've discussed?
22:40:15 <reillyg> ? is Susan
22:42:27 <reillyg> simone: I used to work in threat response. Absolutely (gives recent examples).
22:42:46 <reillyg> ... A threat actor will just ignore your threat model if it allows an attack.
22:43:14 <reillyg> Maxim: Who gets to decide what is out of scope (e.g. malware vs. WebAuthn)?
22:43:56 <reillyg> simone: These are areas where there's ongoing work.
22:44:10 <reillyg> ... Sometimes the mitigation is in a different group, or requires a completely different approach.
22:45:01 <reillyg> ... E.g. Passkeys were design to remove passwords because if you don't have a password it can't be phished.
22:46:50 <reillyg> reillyg: In the malware example. It creates so many other problems that trying to mitigate it in just one place is unhelpful.
22:47:37 <reillyg> RRSAgent, please publish the minutes
22:47:38 <RRSAgent> I have made the request to generate https://www.w3.org/2024/09/25-threat-modeling-minutes.html reillyg
22:48:43 <reillyg> reillyg has left #threat-modeling