Component: Source Tor Browser

Tor Browser / Tor client the source uses to reach the onion service.

Threats Affecting This Component

Threat	Status	Risk	After mitigations	Mitigations
Source submits identifying information THREAT88	partially mitigated	9 high	9 high	Journalist guide mentions that metadata should be removed from documents
Source goes to wrong source interface onion URL THREAT89	partially mitigated	9 high	9 high	Landing page deployment guide explains some security best practices for the webserver hosting the onion URL; Landing page must have HTTPS by default; Landing page must have no mixed content; No third party trackers, analytics, or ads on the landing page; securedrop.org directory explains sources should compare the onion URL in the directory with the one on the news org page
Source visits torproject.org THREAT91	accepted	8 high	8 high
Source visits securedrop.org, freedom.press THREAT92	partially mitigated	8 high	8 high	Direct links to securedrop.org and freedom.press strongly discouraged on landing page
Source uses tor2web THREAT75	out of scope	9 high	6 medium	Warning displayed when Tor2Web headers are present
Tor network exploit THREAT77	accepted	4 medium	4 medium
Source resides in geographical location with very low Tor usage THREAT155	accepted	4 medium	4 medium
Tor browser exploit THREAT79	accepted	3 low	3 low	Tor security slider set to high
Watering hole attack on client THREAT80	mitigated	4 medium	2 low	Tor security slider set to high