diff options
| author | georg | 2019-11-28 02:15:20 +0000 |
|---|---|---|
| committer | jvoisin | 2019-11-30 01:14:41 -0800 |
| commit | 697cb36b814d7e01da336c43b1932264302a2528 (patch) | |
| tree | c14075024469adf5aa30614c95173cada156229c /doc/threat_model.md | |
| parent | 6e52661cfb4e79a76a6ff80637d5adf495a15479 (diff) | |
This is mat2, not MAT2
Closes #131
Diffstat (limited to '')
| -rw-r--r-- | doc/threat_model.md | 24 |
1 files changed, 12 insertions, 12 deletions
diff --git a/doc/threat_model.md b/doc/threat_model.md index 31bfe91..8b97c67 100644 --- a/doc/threat_model.md +++ b/doc/threat_model.md | |||
| @@ -3,7 +3,7 @@ Threat Model | |||
| 3 | 3 | ||
| 4 | The Metadata Anonymisation Toolkit 2 adversary has a number | 4 | The Metadata Anonymisation Toolkit 2 adversary has a number |
| 5 | of goals, capabilities, and counter-attack types that can be | 5 | of goals, capabilities, and counter-attack types that can be |
| 6 | used to guide us towards a set of requirements for the MAT2. | 6 | used to guide us towards a set of requirements for the mat2. |
| 7 | 7 | ||
| 8 | This is an overhaul of MAT's (the first iteration of the software) one. | 8 | This is an overhaul of MAT's (the first iteration of the software) one. |
| 9 | 9 | ||
| @@ -53,7 +53,7 @@ Adversary | |||
| 53 | user. This is the strongest position for the adversary to | 53 | user. This is the strongest position for the adversary to |
| 54 | have. In this case, the adversary is capable of inserting | 54 | have. In this case, the adversary is capable of inserting |
| 55 | arbitrary, custom watermarks specifically for tracking | 55 | arbitrary, custom watermarks specifically for tracking |
| 56 | the user. In general, MAT2 cannot defend against this | 56 | the user. In general, mat2 cannot defend against this |
| 57 | adversary, but we list it for completeness' sake. | 57 | adversary, but we list it for completeness' sake. |
| 58 | 58 | ||
| 59 | - The adversary created the document for a group of users. | 59 | - The adversary created the document for a group of users. |
| @@ -65,7 +65,7 @@ Adversary | |||
| 65 | - The adversary did not create the document, the weakest | 65 | - The adversary did not create the document, the weakest |
| 66 | position for the adversary to have. The file format is | 66 | position for the adversary to have. The file format is |
| 67 | (most of the time) standard, nothing custom is added: | 67 | (most of the time) standard, nothing custom is added: |
| 68 | MAT2 must be able to remove all metadata from the file. | 68 | mat2 must be able to remove all metadata from the file. |
| 69 | 69 | ||
| 70 | 70 | ||
| 71 | Requirements | 71 | Requirements |
| @@ -73,28 +73,28 @@ Requirements | |||
| 73 | 73 | ||
| 74 | * Processing | 74 | * Processing |
| 75 | 75 | ||
| 76 | - MAT2 *should* avoid interactions with information. | 76 | - mat2 *should* avoid interactions with information. |
| 77 | Its goal is to remove metadata, and the user is solely | 77 | Its goal is to remove metadata, and the user is solely |
| 78 | responsible for the information of the file. | 78 | responsible for the information of the file. |
| 79 | 79 | ||
| 80 | - MAT2 *must* warn when encountering an unknown | 80 | - mat2 *must* warn when encountering an unknown |
| 81 | format. For example, in a zipfile, if MAT2 encounters an | 81 | format. For example, in a zipfile, if mat2 encounters an |
| 82 | unknown format, it should warn the user, and ask if the | 82 | unknown format, it should warn the user, and ask if the |
| 83 | file should be added to the anonymised archive that is | 83 | file should be added to the anonymised archive that is |
| 84 | produced. | 84 | produced. |
| 85 | 85 | ||
| 86 | - MAT2 *must* not add metadata, since its purpose is to | 86 | - mat2 *must* not add metadata, since its purpose is to |
| 87 | anonymise files: every added items of metadata decreases | 87 | anonymise files: every added items of metadata decreases |
| 88 | anonymity. | 88 | anonymity. |
| 89 | 89 | ||
| 90 | - MAT2 *should* handle unknown/hidden metadata fields, | 90 | - mat2 *should* handle unknown/hidden metadata fields, |
| 91 | like proprietary extensions of open formats. | 91 | like proprietary extensions of open formats. |
| 92 | 92 | ||
| 93 | - MAT2 *must not* fail silently. Upon failure, | 93 | - mat2 *must not* fail silently. Upon failure, |
| 94 | MAT2 *must not* modify the file in any way. | 94 | mat2 *must not* modify the file in any way. |
| 95 | 95 | ||
| 96 | - MAT2 *might* leak the fact that MAT2 was used on the file, | 96 | - mat2 *might* leak the fact that mat2 was used on the file, |
| 97 | since it might be uncommon for some file formats to come | 97 | since it might be uncommon for some file formats to come |
| 98 | without any kind of metadata, an adversary might suspect that | 98 | without any kind of metadata, an adversary might suspect that |
| 99 | the user used MAT2 on certain files. | 99 | the user used mat2 on certain files. |
| 100 | 100 | ||
