Soatok's Informal Guide to Threat Models

Discussion (5 Comments)Read Original on HackerNews

Cider9986•25 minutes ago

This was a fun read.

My introduction to threat modeling was from this post: https://www.privacyguides.org/en/basics/threat-modeling/

It's a bit shorter and focused for people interested in privacy.

mapontosevenths•about 4 hours ago

This is the best gay furry blog post about threat modeling I've seen all day!

teravor•about 1 hour ago

    > Hybrid PQ+ECDH is a hedged bet against an algorithm break before Q-Day, but is utterly fucking useless over Pure PQ once Q-Day occurs.

there is also the likelihood that Q-Day never arrives, either because something we don't know prevents the construction of sufficiently large quantum computers (eg. quantum gravity) or because the entire field was a scam. in that scenario abandoning ECC would have been pretty stupid.

some_furry•about 1 hour ago

Hi, I'm the author of this blog post!

> there is also the likelihood that Q-Day never arrives, either because something we don't know prevents the construction of sufficiently large quantum computers (eg. quantum gravity)

That is possible, but given the recent 2029 timelines from large Internet providers, I think it's prudent to prepare for Q-Day even if it never arrives.

> or because the entire field was a scam.

The field is like... a magnet for scams, sure. But it, itself, isn't one.

And, like, the Quantum Village at DEFCON has really failed to establish credibility in my eyes.

https://soatok.blog/2022/08/18/burning-trust-at-the-quantum-...

https://soatok.blog/2023/08/20/defcon-quantum-village-2-elec...

> in that scenario abandoning ECC would have been pretty stupid.

Not really, no. See https://blog.trailofbits.com/2024/07/01/quantum-is-unimporta... for a counter-point.

evanprodromou•about 4 hours ago

Wow, excellent guide! And I love the E2EE example.

Soatok's Informal Guide to Threat Models

⚡ Community Insights

Discussion (5 Comments)Read Original on HackerNews