--- title: "Soatok’s Informal Guide to Threat Models" url: https://daily.dev/posts/soatok-s-informal-guide-to-threat-models-bf3d13k87 source_url: https://soatok.blog/2026/06/30/soatoks-informal-guide-to-threat-models type: article source: "Dhole Moments" published: 2026-06-30T10:01:11.836Z updated: 2026-06-30T10:01:50.515Z tags: ["security", "quantum-computing", "cryptography", "encryption", "passkeys"] reading_time: 18 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Soatok’s Informal Guide to Threat Models **[Dhole Moments](https://daily.dev/sources/soatok)** · 18 min read · 0 upvotes · 0 comments ## Summary A practical, opinionated guide to threat modeling aimed at developers who want to build security intuition without formal methodology overhead. Covers the essential questions a threat model must answer, the importance of stating assumptions explicitly, and how to spot incomplete threat models — using Matrix's sparse threat model as a negative example. Also explores how threat modeling applies to real-world scenarios: passkey adoption to defeat credential stuffing, E2EE design challenges in decentralized systems like ATProto vs ActivityPub, and the ongoing IETF debate over pure vs hybrid post-quantum KEMs (ML-KEM). Argues that threat modeling skills help developers cut through technical FUD and make better architectural decisions early. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#quantum-computing](https://daily.dev/tags/quantum-computing), [#cryptography](https://daily.dev/tags/cryptography), [#encryption](https://daily.dev/tags/encryption), [#passkeys](https://daily.dev/tags/passkeys) [View this post on daily.dev](https://daily.dev/posts/soatok-s-informal-guide-to-threat-models-bf3d13k87)