Threat Modeling Connect (TMC) Barcelona Meetup - Threat Modeling @ W3C - Age Verficiation Systems with W3C Verifiable Credentials

Threat Modeling @ W3C: Age Verification Systems with W3C Verifiable Credentials” was presented at the TMC Barcelona Meetup on November 28, 2024, by security experts Simone Onofri and Kim Cerra. The session began by introducing the presenters—Kim, an independent security researcher with over a decade of experience in both proactive and reactive security, and Simone, the W3C Security Lead, noted for his contributions to web application security and digital identity. Their combined expertise set the stage for a deep dive into threat modeling practices as applied to modern web technologies. The presentation outlined how threat modeling is an iterative, structured process essential to securing digital systems. Emphasizing frameworks like Shostack’s Four Question Framework—What are we working on? What can go wrong? What are we going to do about it? Did we do a good job?—the speakers explained how this method helps identify potential vulnerabilities, enumerate threats, and prioritize countermeasures. They highlighted that threat modeling is not a one-off task; it must evolve alongside technological advancements and emerging risks. Two primary case studies were discussed. The first focused on the Vibration API, a feature in modern mobile devices that enables web applications to provide tactile feedback. While the API enhances user interactivity, it also poses risks such as spoofing, fingerprinting, and battery-draining denial-of-service attacks. The speakers recommended several mitigations, including limiting vibration duration, introducing randomness, requesting user consent, and restricting API usage to reduce potential abuse. The second case study examined the Spanish Age Verification System, which utilizes decentralized digital identity methods based on W3C Verifiable Credentials (VC) and Decentralized Identifiers (DID). This system is designed to verify a user’s age for access to online content while preserving privacy. The approach minimizes data disclosure by issuing government-backed credentials that do not reveal personal information. The system architecture involves three key parties: the Issuer (the government), the Holder (the user), and the Verifier (the website). Detailed diagrams and multiple iterations of the threat model illustrated how credential issuance, selection, and verification are managed to prevent linking and replay attacks, thereby maintaining both security and user anonymity. Concluding the session, Simone and Kim reflected on the future of threat modeling at W3C. They stressed the need for continuous, collaborative improvement in security practices, especially as digital systems grow more complex and as regulatory requirements tighten. The speakers encouraged ongoing engagement with initiatives like the W3C Security Interest Group and the Threat Modeling Community Group, underlining that effective threat modeling is a cornerstone of building a secure and trustworthy web ecosystem.