A threat model is a structured description of a system’s assets, adversaries, capabilities, and attack scenarios. It clarifies what an application must protect and which defenses, such as end-to-end encryption, fit that goal. section 10.1
Use a threat model to make security decisions explicit:
- Identify what data or communications require protection, including messages, uploaded content, and metadata. section 10.1 section 16.7
- Consider who may gain access, including service operators and governments, rather than assuming the central application is harmless. section 10.1
- Decide whether the operator is trusted or whether the design should prevent even the operator from accessing users’ data. section 16.7
Figure 10.1 In most systems, a central server (top diagram) relays messages between users. A secure connection is usually established between a user and the central server, which can thus see all user messages. A protocol providing end-to-end encryption (bottom diagram) encrypts communications from one user up to its intended recipient, preventing any server in the middle from observing messages in cleartext.
Compare ordinary server-mediated encryption with end-to-end encryption: the server can read messages in the first arrangement but not in the second. section 10.1
