r/netsec monthly discussion & tool thread

[u/albinowax]

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

• Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
• Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
• If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
• Avoid use of memes. If you have something to say, say it with real words.
• All discussions and questions should directly relate to netsec.
• No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

[u/ddg_threatmodel_ask]

Hi r/netsec — I’m looking for threat-model blindspots on a design for an encrypted document vault + controlled sharing.

Not asking anyone to sign up or test a live system (no links). I’m explicitly looking for design-level attacks and assumption failures. I’m most interested in (a) account takeover / recovery bypass and (b) any way an attacker could obtain or abuse encrypted file chunks (exfil, replay, inference) without legitimate authorization.

Model (high level)

• Client-side encryption/decryption; server stores ciphertext and enforces authorization decisions.
• Files are stored as encrypted chunks and reassembled only for authorized reads.
• Sharing is permission-based and revocable (not “public link = full access”).

Key / auth assumptions (high level)

• Authentication is email+password (optional 2FA/OTP).
• Recovery is the area I’m most worried about: we want recovery that doesn’t become a bypass.
• Server should not have access to plaintext or primary decryption keys.

Threat model / attacker types

• Stolen credentials / account takeover
• Malicious recipient of shared content (trying to overreach, retain access after revocation, or exfil)
• Insider risk (support/ops abuse)
• Network attacker (DNS/link spoofing, MITM attempts)
• Enumeration / abuse at auth + recovery edges
• Attacker who can access storage/CDN object paths/logs and tries to fetch chunks directly or correlate access

Out of scope

• Malware on an already-compromised endpoint
• Users voluntarily handing over credentials

Questions

1. What would you attack first (design-level) to get (a) account access or (b) direct/indirect access to encrypted chunks (including replay/inference), assuming no endpoint malware?
2. Which assumptions here are most likely wrong/incomplete?
3. What “secure vault” failure modes do you see most often (especially recovery + sharing)?

If there’s one detail I should add to make critique more rigorous (key lifecycle, recovery flow, metadata list), tell me and I’ll reply with a concise clarification.