Thread · 3 tweets · 25 Aug 2019

Of course, but that's not at all what I mean. It feels like the document is taking benefits to attackers into account, as benefits. It's a bit like working on ad fraud and including the fact that there are families in Macedonia who live from this.

Which isn't necessarily unreasonable (even for ad fraud, it overtook journalism in industry size a few years ago and that makes it big money) but it's a different exercise from threat modelling.

In fact, it looks like you're closer to following a DPIA methodology than pure threat modelling? Is that the intent?