This interactive workshop focuses on the presentation phase of digital identity systems, with specific attention to the W3C Digital Credentials API. Rather than treating threat modeling as a static checklist exercise, the session frames it as a structured, participatory process.
The workshop uses LEGO® SERIOUS PLAY® as its facilitation method. Through the core process of listen, build, share, and reflect, participants will work through a hands-on threat modeling exercise designed to surface security threats, harms, and socio-technical impacts that can emerge when credentials are requested, mediated, and presented. Participants will analyze a concrete interaction flow involving relying parties, wallets, users, and browsers, and will collaboratively build and discuss threats to digital credential presentation.
The goal is not to produce a complete threat model in one sitting. Rather, the workshop shows how LEGO® SERIOUS PLAY® can support early-stage threat and harms modeling by helping participants externalize assumptions, construct shared understanding, and explore possible mitigations and trade-offs in a collaborative way. This makes the session both a practical exercise and an introduction to a reusable method for threat modeling.
