Security

• Threat model
  • Users matrix
  • Anonymity matrix
  • Communication security matrix
  • Identity disclosure matrix
  • Usage scenarios matrix
  • Data security matrix
  • Threats to anonymity and confidentiality
    • Browser history and cache
    • Metadata
    • Malware and trojans
    • Network and reverse proxies
    • Data stored outside the platform
    • Environmental factors
    • Incorrect data retention policies
    • Human negligence
    • Advanced traffic analysis
• Application security
  • Architecture
  • Anonymity
  • Authentication
    • Password
    • Receipt
  • Password security
    • Password storage
    • Password complexity
    • Two-factor authentication
    • Slowdown on failed login attempts
    • Password change on first login
    • Periodic password change
    • Password recovery
  • Web application security
    • Session management
    • Session encryption
    • Cookies and xsrf prevention
    • HTTP headers
      • Strict-Transport-Security
      • Content-Security-Policy
      • Cross-Origin-Embedder-Policy
      • Cross-Origin-Opener-Policy
      • Cross-Origin-Resource-Policy
      • Permissions-Policy
      • X-Frame-Options
      • Referrer-Policy
      • X-Content-Type-Options
      • Cache-Control
    • Crawlers policy
    • Anchor tags and external urls
    • Input validation
      • On the backend
      • On the client
    • Form autocomplete off
  • Network security
    • Connection anonymity
    • Connection encryption
    • Network sandboxing
  • Data encryption
  • Application sandboxing
  • Database security
    • Secure deletion
    • Auto vacuum
    • Limited database trust
    • Limited database functionalities
  • DoS resiliency
    • Proof of work on users’ sessions
    • Rate limit on users’ sessions
    • Rate limit on whistleblowers’ reports and attachments
  • Other measures
    • Browser history and forensic traces
    • Secure file management
      • Secure file download
      • Safe file opening
      • PGP encryption
    • Encryption of temporary files
    • Secure file delete
    • Exception logging and redaction
    • Entropy sources
    • UUIDv4 randomness
    • TLS for smtp notification
• Encryption protocol
  • Encryption’s workflow
  • Encryption’s details
    • Algorithms
    • Users’ credentials
    • Users’ keys
    • Data encryption’s keys
  • Key generation
  • Key recovery
  • Key escrow
• Security audits