Component: Tor software
Defined in model.py:328
Tor daemon / onion-service protocol dependency (client and server side).
Threats Affecting This Component
| Threat | Status | Risk | After mitigations | Mitigations |
|---|---|---|---|---|
| Known weakness in hidden service cryptography THREAT39 | accepted | 9 high | 6 medium | Use v3 onion services |
| Known vulnerabilities in Tor (incl. Onion Service cryptography, authentication) THREAT35 | mitigated | 6 medium | 6 medium | Nighly security update; Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software; HidServAuth token on journalist interface; HidServAuth token on SSH |
| Unknown vulnerabilities in Tor (incl. Onion Service cryptography, authentication) THREAT37 | partially mitigated | 6 medium | 6 medium | Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software; SSH password auth disabled, requires key; Passphrases for journalists and admins are generated to be 7 word diceware; 2FA token required for login to admin or journalist interfaces |