Threat model

Status: Accepted · Version: 0.1

Titip is more sensitive than a notes app. A false release harms families. A stolen secret vault would harm them differently, which is why secrets are out of scope. This model lists the cases the design must already answer. Penetration-test evidence belongs in a future security repository; the scenarios do not wait for that repository.

Assets to protect

Actors

Owner, trusted contact, recipient, reviewer, employee, external attacker, malicious insider, notification provider, compromised AI prompt.

Scenarios

Scenario What we refuse to do Control
Abusive partner tries to trigger release Do not treat “someone said so” or a single missed check as release State machine, minimum confirmations, manual review, owner can return to ACTIVE at any time
Attacker takes over owner email Do not make email possession equal to “confirm alive” forever, and do not email vault bodies Session revocation; confirmation is explicit but MVP must add step-up for policy edits before real release; no content in email
Malicious trusted contact Do not let one contact both satisfy policy and receive all vaults Contact role ≠ recipient role; minimum_confirmations can be raised; review can reject
Recipient impersonation Do not unlock vaults from a forwarded link alone Recipient-bound token, channel check plus step-up, short expiry, audit
Employee misuse Do not give staff a plaintext console No admin vault reader; break-glass is a production-readiness item with audit
SIM swap Do not use SMS as the only proof of identity for release SMS is an alternate notice channel; recipient step-up is separate
Forged death notification Do not accept a death certificate upload to support as an API No death-registry path in prototype; support cannot set ELIGIBLE
Accidental inactivity Do not collapse travel or a lost phone into release Multiple reminders, second channel, 14-day grace, owner confirmation wins
Notification provider outage Do not count a failed send as a completed attempt that starts grace State stays at the unsent step (TITIP-007)
Data leak / backup theft Do not store restricted plaintext Envelope encryption (ADR-006)
Malicious document Do not execute uploaded files; do not trust filenames Documents are stored encrypted, served with download headers, scanned before production
AI prompt injection Do not let a prompt emit eligibility or call release tools AI has no release tools (TITIP-012)
User tries to store a secret Do not provide a field or keep the write ADR-002

Abuse of the product promise

Titip must not market certainty it does not have. Copy that says “we will know if you have died” is a defect.

Out of model for prototype implementation

We still name these now so nobody builds a shortcut: nation-state device compromise, coerced owner (abusive partner standing over the phone), legal compulsion. Production readiness requires an explicit stance before launch. The prototype stance is: simulation only, no real delivery, no real customer secrets because there is nothing secret to store and no production data.