Frank Hecker has mentioned in his draft of a metapolicy that a threat model should be used. AFAIK, there is only a fairly poor attempt at a threat model for browser security, a great lack in the original design.
Here is my attempt at a threat model:
http://iang.org/ssl/browser_threat_model.html
Comments welcome. One thing - I've not found any doco on how a threat model is written out, so I'm in the dark a bit. But, ignorance is no excuse for not trying...
iang _______________________________________________ mozilla-crypto mailing list [EMAIL PROTECTED] http://mail.mozilla.org/listinfo/mozilla-crypto
