Connected Safe Privacy Threat Model Research Note

Connected Safe Privacy Threat Model Research Note

A connected safe can create information about the property it protects. Relevant assets include camera footage, audio, location, access history, authorized users, failed attempts, movement, environmental readings, temporary access, biometric templates, recovery answers, device keys, sessions, update state, and support records.

Trust boundaries include the safe, local network, primary phone, other authorized phones, vendor account, vendor cloud, infrastructure providers, push or messaging providers, support staff, update system, temporary users, later owners, corporate successors, and lawful disclosure recipients.

SPACE's March 2023 privacy policy permits broad collection and says recordings may be kept locally and in the cloud. It includes wallet and blockchain language that may be broader or older than the current product. The policy must not be converted into a verified architecture.

The required evidence is a current product-specific data-flow diagram, subprocessor list, encryption description, biometric-template location, access-control model, employee-access log, retention schedule, deletion map, ownership-transfer process, incident policy, and end-of-life plan.

The principal abuse cases are account takeover, phone compromise, stale shared access, weak recovery, insider access, cloud exposure, excessive retention, camera misuse, forwarded temporary codes, notification leakage, malicious updates, unsupported devices, and corporate transfer.

The design question is necessity. Remote viewing, cloud recording, audio, detailed history, shared access, and notifications should be enabled only when they serve the user's actual threat.