Security

• Threat Model
  • Actors Matrix
  • Anonymity Matrix
  • Communication Security Matrix
  • Identity Disclosure Matrix
  • GlobaLeaks Security Matrix
  • Data Security Matrix
  • Threats to Privacy and Anonymity
    • Browser History and Cache
    • Metadata
    • Environmental Factors
    • Incorrect Data Retention Policies
    • Human Negligence
    • Data Stored Outside GlobaLeaks
    • Advanced Traffic Analysis
• Application Security
  • Key Concepts
    • Report
    • Whistleblower Interactions with the Platform
    • Recipient Interactions with the Platform
  • Authentication
    • Authentication Matrix
    • Authentication Methods
  • Password Security
    • Authentication Security
    • Password Storage
    • Password Strength
    • Two Factor Authentication (2FA)
    • Password Change on First Login
    • Periodic Password Change
    • Proof of Work on Login
    • Slowdown on Failed Login Attempts
    • Password Recovery
    • Entropy Sources
  • Web Application Security
    • Session management
    • XSRF Prevention
    • Input Validation (backend)
    • Input Validation (client)
    • Security related HTTP headers
      • Strict-Transport-Security
      • Content-Security-Policy
      • Feature-Policy
      • Referrer-Policy
      • X-Content-Type-Options
      • X-XSS-Protection
      • Crawlers Policy
    • Web Browser Privacy
      • Cache-control and other cache related headers
      • Anchor Tags and External URLs
    • Cookies
    • Form Autocomplete OFF (client)
  • Data Encryption
  • DoS Resiliency Approach
  • Network Sandboxing
  • Application Sandboxing
  • Other Measures
    • Encryption of Temporary Files
    • Secure File Delete
    • Secure Deletion of Database Entries
    • Exception Logging and Redaction
    • UUIDv4 Randomness
    • TLS for SMTP Notification
• Encryption Protocol
  • Encryption’s Workflow
  • Encryption’s Details
    • Algorithms
    • Users’ Credentials
    • Users’ Keys
    • Data Encryption’s Leys
  • Key Recovery
  • Key Escrow
• Penetration Tests