WIP: Add LWS threat model document#202
Conversation
Initial threat model covering three threats: - T1: Injected Identity Providers - T2: Impersonation Through Credentials - T3: Client ID Impersonation Based on the respec-threats rendering library (Apache 2.0).
|
Awesome @renyuneyun 🎉 I'm going to add few more things to this PR branch tomorrow. @acoburn can we allocate 5 min on Monday to introduce this work during the WG call? We could also use some pointers to how PR previews are setup for this repo.
That lib/template already has an issue to track it moving to W3C github org |
| Data Flow Diagram for LWS Threat Model | ||
| </h3> | ||
| <figure id="lws-threat-model"> | ||
| <img height="1890" src="minimalist-web-threat-model.png" |
There was a problem hiding this comment.
Tomorrow I will replace it with https://hackers4peace.github.io/likec4-example-customization/#lws
|
A preview of this document is at https://htmlpreview.github.io/?https://github.com/renyuneyun/lws-protocol/blob/threat-model/threat-model/index.html We will want to adjust the formatting to bring it in line with W3C conventions |
- T2: changed affected elements to P3, P4, P5 - T3: revised threat description and responses, changed elements to P3, P2
Thanks @acoburn for having the preview. But... It appears the preview only included the html, without css and js? That leads to incorrect rendering, and incomplete content (of the threats, which are based on js). |
|
This one seems to work better: https://raw.githack.com/renyuneyun/lws-protocol/threat-model/threat-model/index.html |
4 participants
Work In Progress
Creating this PR to get discussion going.
[preview]
Info
Initial threat model covering three threats:
More to be added.
Question
Based on the respec-threats rendering library (Apache 2.0). Does that have any copyright issues with LWS Spec when it comes to maturity?