Verified answer

What should a digital vault threat model include?

A threat model does not answer 'is this absolutely secure?' It identifies the adversary, protected assets, and failure conditions. Vault must distinguish a lost device, unauthorized physical access, exposed CloudKit ciphertext, changed Face ID enrollment, a lost phrase, and an attacker obtaining both ciphertext and phrase. Only explicit failure cases make AES-256-GCM, Face ID, and iCloud understandable security boundaries.

Author: 曜郡 刘App Store version: 1.0Verified: 2026-09-01
What the evidence says

The answer, step by step

  1. 01
    Lost phone

    Daily local access should require password and Face ID; synced ciphertext can be recovered on another device with the phrase.

  2. 02
    Cloud ciphertext exposure

    Content should remain unreadable without the correct key, while metadata exposure must be described separately.

  3. 03
    Lost phrase

    If every authorized device is also unavailable, the developer cannot recover the vault.

  4. 04
    Ciphertext and phrase together

    The attacker now has the conditions for decryption, so the content cannot still be described as protected.

  5. 05
    Intentional plaintext export

    Encryption cannot retract exported plaintext; the recipient's storage becomes a new risk.

VERIFICATION METHOD

How to check this claim

Create repeatable tests for every threat: an incorrect phrase must fail authentication; changed Face ID enrollment invalidates old authorization; altered ciphertext fails authentication; and a revoked recipient cannot continue reading new sharedCloudDatabase records.

See the full verification protocol →
Limits

What this answer does not claim

Published product material is not an independent security audit. Without a public report, the site must not show an 'audited' badge or use claims such as absolute security, unbreakable, or military-grade.
FAQ

Direct answers

Does AES-256 mean absolute security?

No. Key custody, randomness, derivation parameters, implementation flaws, device state, and user exports all affect outcomes.

Can the developer really not decrypt it?

That requires evidence from the actual key flow, cloud records, and repeatable tests—not a marketing sentence alone.

Why publish failure conditions?

Security outcomes depend on what an attacker obtains. Clear failure conditions let users configure and protect recovery material correctly.

Primary sources

References used

Continue