mirror of
https://github.com/privacyguides/i18n.git
synced 2025-06-16 16:01:15 +00:00
New Crowdin translations by GitHub Action
This commit is contained in:
Crowdin Bot
parent
537a749186
commit
07eda0ee57
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
|
||||
- Encrypts email account data at rest with zero-access encryption.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Operates on owned infrastructure, i.e. not built upon third-party email service providers.
|
||||
|
||||
**Best Case:**
|
||||
@ -328,6 +327,7 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
- Support for a temporary mailbox for external users. This is useful when you want to send an encrypted email, without sending an actual copy to your recipient. These emails usually have a limited lifespan and then are automatically deleted. They also don't require the recipient to configure any cryptography like OpenPGP.
|
||||
- Availability of the email provider's services via an [onion service](https://en.wikipedia.org/wiki/.onion).
|
||||
- [Sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) support.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
|
||||
- Encrypts email account data at rest with zero-access encryption.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Operates on owned infrastructure, i.e. not built upon third-party email service providers.
|
||||
|
||||
**Best Case:**
|
||||
@ -328,6 +327,7 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
- Support for a temporary mailbox for external users. This is useful when you want to send an encrypted email, without sending an actual copy to your recipient. These emails usually have a limited lifespan and then are automatically deleted. They also don't require the recipient to configure any cryptography like OpenPGP.
|
||||
- Availability of the email provider's services via an [onion service](https://en.wikipedia.org/wiki/.onion).
|
||||
- [Sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) support.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
|
||||
- Encrypts email account data at rest with zero-access encryption.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Operates on owned infrastructure, i.e. not built upon third-party email service providers.
|
||||
|
||||
**Best Case:**
|
||||
@ -328,6 +327,7 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
- Support for a temporary mailbox for external users. This is useful when you want to send an encrypted email, without sending an actual copy to your recipient. These emails usually have a limited lifespan and then are automatically deleted. They also don't require the recipient to configure any cryptography like OpenPGP.
|
||||
- Availability of the email provider's services via an [onion service](https://en.wikipedia.org/wiki/.onion).
|
||||
- [Sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) support.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
|
||||
- Encrypts email account data at rest with zero-access encryption.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Operates on owned infrastructure, i.e. not built upon third-party email service providers.
|
||||
|
||||
**Best Case:**
|
||||
@ -328,6 +327,7 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
- Support for a temporary mailbox for external users. This is useful when you want to send an encrypted email, without sending an actual copy to your recipient. These emails usually have a limited lifespan and then are automatically deleted. They also don't require the recipient to configure any cryptography like OpenPGP.
|
||||
- Availability of the email provider's services via an [onion service](https://en.wikipedia.org/wiki/.onion).
|
||||
- [Sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) support.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave ermöglicht die Auswahl zusätzlicher Inhaltsfilter auf der internen Seite
|
||||
|
||||
1. Die Deaktivierung des V8-Optimierungstool verringert deine Angriffsfläche, indem [*einige*](https://grapheneos.social/@GrapheneOS/112708049232710156) Teile der JavaScript-Just-In-Time-Kompilierung (JIT) deaktiviert werden.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Browserdaten beim Schließen löschen</p>
|
||||
|
||||
- [x] Wähle **Websitedaten löschen, die auf deinem Gerät gespeichert wurden, wenn du alle Fenster schließt** unter *Website- und Schutzeinstellungen* → *Inhalte* → *Zusätzliche Inhaltseinstellungen* → *Websitedaten auf dem Gerät*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor-Fenster
|
||||
|
||||
[**Privates Fenster mit Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) ermöglicht es dir, deinen Datenverkehr durch das Tor-Netzwerk im Inkognito-Fenster zu leiten und auf .onion-Dienste zuzugreifen, was in einigen Fällen nützlich sein kann. Allerdings ist Brave **nicht** so resistent gegen Fingerprinting wie der Tor-Browser und es gibt viel weniger Leute, die Brave zusammen mit Tor benutzen, sodass du auffallen wirst. Wenn dein Bedrohungsmodell starke Anonymität erfordert, benutze den [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ Wir halten diese Merkmale für wichtig, um einen sicheren und optimalen Service
|
||||
|
||||
- Verschlüsselt die Daten von E-Mail-Konten im Ruhezustand mit Zero-Access-Verschlüsselung.
|
||||
- Exportmöglichkeit als [Mbox](https://de.wikipedia.org/wiki/Mbox) oder individuelle .EML mit [RFC5322](https://datatracker.ietf.org/doc/rfc5322)-Standard.
|
||||
- Erlaubt es dem Nutzer, seinen eigenen [Domainnamen](https://de.wikipedia.org/wiki/Domain_(Internet)) zu verwenden. Benutzerdefinierte Domänennamen sind für die Nutzer wichtig, da du so deine Identität von dem Dienst fernhalten kannst, falls dieser sich als schlecht erweist oder von einem anderen Unternehmen übernommen wird, bei dem der Datenschutz keine Rolle spielt.
|
||||
- Arbeitet auf einer eigenen Infrastruktur, d.h. nicht auf der eines Drittanbieters von E-Mail-Diensten.
|
||||
|
||||
**Im besten Fall:**
|
||||
@ -328,8 +327,9 @@ Wir halten diese Merkmale für wichtig, um einen sicheren und optimalen Service
|
||||
- Unterstützung für eine temporäre Mailbox für externe Benutzer. Dies ist nützlich, wenn du eine verschlüsselte E-Mail versenden möchtest, ohne eine Kopie an den Empfänger zu senden. Diese E-Mails haben in der Regel eine begrenzte Lebensdauer und werden dann automatisch gelöscht. Sie erfordern auch nicht, dass der Empfänger eine Kryptographie wie OpenPGP konfiguriert.
|
||||
- Verfügbarkeit der Dienste des E-Mail-Anbieters über einen [onion service](https://de.wikipedia.org/wiki/.onion).
|
||||
- Unterstützung [von Unteradressen](https://en.wikipedia.org/wiki/Email_address#Sub-addressing).
|
||||
- Catch-All- oder Alias-Funktionalität für diejenigen, die ihre eigenen Domains verwenden.
|
||||
- Verwendung von Standard-E-Mail-Zugriffsprotokollen wie IMAP, SMTP oder [JMAP](https://de.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standardzugriffsprotokolle stellen sicher, dass die Kunden alle ihre E-Mails problemlos herunterladen können, sollten sie zu einem anderen Anbieter wechseln wollen.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Benutzerdefinierte Domänennamen sind für die Nutzer wichtig, da du so deine Identität von dem Dienst fernhalten kannst, falls dieser sich als schlecht erweist oder von einem anderen Unternehmen übernommen wird, bei dem der Datenschutz keine Rolle spielt.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
### Datenschutz
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
|
||||
- Encrypts email account data at rest with zero-access encryption.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Operates on owned infrastructure, i.e. not built upon third-party email service providers.
|
||||
|
||||
**Best Case:**
|
||||
@ -328,6 +327,7 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
- Support for a temporary mailbox for external users. This is useful when you want to send an encrypted email, without sending an actual copy to your recipient. These emails usually have a limited lifespan and then are automatically deleted. They also don't require the recipient to configure any cryptography like OpenPGP.
|
||||
- Availability of the email provider's services via an [onion service](https://en.wikipedia.org/wiki/.onion).
|
||||
- [Sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) support.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
|
||||
- Encrypts email account data at rest with zero-access encryption.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Operates on owned infrastructure, i.e. not built upon third-party email service providers.
|
||||
|
||||
**Best Case:**
|
||||
@ -328,6 +327,7 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
- Support for a temporary mailbox for external users. This is useful when you want to send an encrypted email, without sending an actual copy to your recipient. These emails usually have a limited lifespan and then are automatically deleted. They also don't require the recipient to configure any cryptography like OpenPGP.
|
||||
- Availability of the email provider's services via an [onion service](https://en.wikipedia.org/wiki/.onion).
|
||||
- [Sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) support.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recientemente, varias organizaciones han intentado resolver algunos de los probl
|
||||
|
||||
Los repetidores multiparte (MPR) utilizan varios nodos propiedad de distintas partes, de modo que ninguna sabe quién eres y a qué te conectas. Esta es la idea básica detrás de Tor, pero ahora hay algunos servicios de pago que intentan emular este modelo.
|
||||
|
||||
Los MPR tratan de resolver un problema inherente a las VPN: el hecho de que hay que confiar plenamente en ellas. Logran este objetivo segmentando las responsabilidades entre dos o más empresas diferentes. Por ejemplo, Relay Privado de iCloud+ de Apple dirige tu tráfico a través de dos servidores:
|
||||
Los MPR tratan de resolver un problema inherente a las VPN: el hecho de que hay que confiar plenamente en ellas. Logran este objetivo segmentando las responsabilidades entre dos o más empresas diferentes.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. En primer lugar, un servidor operado por Apple.
|
||||
|
||||
@ -101,15 +103,15 @@ Los MPR tratan de resolver un problema inherente a las VPN: el hecho de que hay
|
||||
|
||||
Este servidor realiza la conexión con el sitio web de destino, pero no tiene conocimiento de tu dispositivo. La única dirección IP que conoce es la del servidor de Apple.
|
||||
|
||||
Otros MPR gestionados por empresas diferentes, como Google o INVISV, funcionan de manera muy similar. Esta protección por segmentación solo existe si confías en que las dos empresas no confabularán entre sí para desanonimizarte.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### VPN Descentralizadas
|
||||
|
||||
Otro intento de resolver los problemas de los servicios VPN centralizados son las dVPN. Se basan en la tecnología blockchain y pretenden eliminar la confianza en una sola parte distribuyendo los nodos entre muchas personas diferentes. Sin embargo, en muchas ocasiones una dVPN utilizará por defecto un único nodo, lo que significa que tendrás que confiar plenamente en ese nodo, al igual que en una VPN tradicional. A diferencia de una VPN tradicional, este único nodo que puede ver todo tu tráfico es una persona cualquiera en lugar de tu proveedor de VPN, que puede ser auditado y tiene responsabilidades legales para mantener su política de privacidad. Para solucionarlo se necesitan multisaltos, pero eso conlleva un coste de estabilidad y rendimiento.
|
||||
Another attempt at solving the issues with centralized VPN services are dVPNs. These are based on blockchain technology and claim to eliminate trust in a single party by distributing the nodes across lots of different people. However, many times a dVPN will default to a single node, meaning you need to trust that node completely, just like a traditional VPN. Unlike a traditional VPN, this one node that can see all your traffic is a random person instead of your VPN provider that can be audited and has legal responsibilities to uphold their privacy policy. Multi-hop is needed to solve this, but that comes with a stability and performance cost.
|
||||
|
||||
Otra consideración es la responsabilidad legal. El nodo de salida tendrá que lidiar con problemas legales derivados del mal uso de la red, un problema con el que la red Tor ha lidiado durante toda su existencia. Esto disuade a la gente normal de ejecutar nodos y hace que sea más atractivo para un actor malicioso con muchos recursos alojar uno. Esto es un gran problema si el servicio es de un solo nodo, ya que el nodo de salida potencialmente malicioso puede ver quién eres y a qué te estás conectando.
|
||||
Another consideration is legal liability. The exit node will need to deal with legal problems from misuse of the network, an issue that the Tor network has contended with for its entire existence. This discourages regular people from running nodes and makes it more attractive for a malicious actor with lots of resources to host one. This is a big problem if the service is single-node, as the potentially malicious exit node can see who you are and what you're connecting to.
|
||||
|
||||
Muchas dVPN se utilizan para impulsar una criptomoneda en lugar de hacer el mejor servicio. También suelen ser redes más pequeñas con menos nodos, lo que las hace más vulnerables a los [ataques de Sybil](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
Many dVPNs are used to push a cryptocurrency rather than to make the best service. They also tend to be smaller networks with fewer nodes, making them more vulnerable to [Sybil attacks](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
|
||||
## Información Relacionada con las VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave te permite seleccionar filtros de contenido adicionales en la página inte
|
||||
|
||||
1. Desactivar el optimizador V8 reduce tu superficie de ataque al desactivar [*algunas*](https://grapheneos.social/@GrapheneOS/112708049232710156) partes de la compilación Just-In-Time (JIT) de JavaScript.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Desinfectar al cerrar</p>
|
||||
|
||||
- [x] Selecciona **Eliminar los datos que los sitios guardan en tu dispositivo cuando cierras todas las ventanas** en *Configuración del sitio y de los Escudos* → *Contenido* → *Configuración de contenido adicional* → *Datos de sitios en el dispositivo*.
|
||||
|
||||
Si deseas permanecer conectado a un sitio concreto que visitas a menudo, puedes establecer excepciones por sitio en la sección *Comportamientos personalizados*.
|
||||
|
||||
</div>
|
||||
|
||||
##### Ventanas Tor
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS asegura el ordenador aislando subsistemas (por ejemplo, redes, USB, etc
|
||||
|
||||
Para más información sobre el funcionamiento de Qubes, consulta nuestra página [Qubes OS overview](os/qubes-overview.md).
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
Aunque en la mayoría de los casos [desaconsejamos](os/linux-overview.md#release-cycle) las distribuciones "perpetuamente obsoletas" como Debian para uso de escritorio, Kicksecure es un sistema operativo basado en Debian que ha sido reforzado para ser mucho más que una instalación típica de Linux.
|
||||
|
||||
@ -317,7 +317,6 @@ Consideramos que estas características son importantes para ofrecer un servicio
|
||||
|
||||
- Cifra los datos de las cuentas de correo electrónico en reposo con cifrado de acceso cero.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Permitir a los usuarios utilizar su propio [nombre de dominio](https://en.wikipedia.org/wiki/Domain_name). Los nombres de dominio personalizados son importantes para los usuarios porque les permiten mantener su agencia del servicio, en caso de que éste se estropee o sea adquirido por otra empresa que no dé prioridad a la privacidad.
|
||||
- Operaciones en infraestructura propia, es decir, no construidas sobre proveedores de servicios de correo electrónico de terceros.
|
||||
|
||||
**Mejor caso:**
|
||||
@ -328,8 +327,9 @@ Consideramos que estas características son importantes para ofrecer un servicio
|
||||
- Soporte para un buzón temporal para usuarios externos. Esto es útil cuando quieres enviar un correo electrónico encriptado, sin enviar una copia real a tu destinatario. Estos correos electrónicos suelen tener una vida útil limitada y luego se eliminan automáticamente. Tampoco requieren que el destinatario configure ninguna criptografía como OpenPGP.
|
||||
- Disponibilidad de los servicios del proveedor de correo electrónico a través de un [ servicio onion](https://en.wikipedia.org/wiki/.onion).
|
||||
- Soporte de [subdireccionamiento](https://en.wikipedia.org/wiki/Email_address#Sub-addressing).
|
||||
- Funcionalidad Catch-all o alias para quienes utilizan sus propios dominios.
|
||||
- Uso de protocolos estándar de acceso al correo electrónico como IMAP, SMTP o [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Los protocolos de acceso estándar garantizan que los clientes puedan descargar fácilmente todo su correo electrónico en caso de que quieran cambiar de proveedor.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Los nombres de dominio personalizados son importantes para los usuarios porque les permiten mantener su agencia del servicio, en caso de que éste se estropee o sea adquirido por otra empresa que no dé prioridad a la privacidad.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
### Privacidad
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ La mayoría de las soluciones de **gestión de fotografías en la nube**, como G
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** es un servicio de copia de seguridad cifrada de fotos de extremo a extremo que admite copias de seguridad automáticas en iOS y Android. Su código es totalmente abierto, tanto en el lado del cliente como en el del servidor. También es [autoalojable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** es un servicio de copia de seguridad cifrada de fotos de extremo a extremo que admite copias de seguridad automáticas en iOS y Android. Su código es totalmente abierto, tanto en el lado del cliente como en el del servidor. También es [autoalojable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Página Principal](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Política de Privacidad" }
|
||||
|
||||
@ -680,6 +680,7 @@ Para cifrar su unidad de SO, normalmente recomendamos utilizar la herramienta de
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
|
||||
- Encrypts email account data at rest with zero-access encryption.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Operates on owned infrastructure, i.e. not built upon third-party email service providers.
|
||||
|
||||
**بهترین شرایط:**
|
||||
@ -328,6 +327,7 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
- Support for a temporary mailbox for external users. This is useful when you want to send an encrypted email, without sending an actual copy to your recipient. These emails usually have a limited lifespan and then are automatically deleted. They also don't require the recipient to configure any cryptography like OpenPGP.
|
||||
- Availability of the email provider's services via an [onion service](https://en.wikipedia.org/wiki/.onion).
|
||||
- [Sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) support.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Récemment, plusieurs organisations ont tenté de résoudre certains problèmes
|
||||
|
||||
Les relais multipartites (MPR) utilisent plusieurs nœuds appartenant à différentes parties, de sorte qu'aucune partie ne sait à la fois qui vous êtes et à quoi vous vous connectez. C'est l'idée de base de Tor, mais il existe aujourd'hui des services payants qui tentent d'imiter ce modèle.
|
||||
|
||||
Les MPRs cherchent à résoudre un problème inhérent aux VPN: le fait que vous devez leur faire entièrement confiance. Elles atteignent cet objectif en segmentant les responsabilités entre deux ou plusieurs entreprises différentes. Par exemple, le relais privé iCloud+ d'Apple achemine votre trafic à travers deux serveurs :
|
||||
Les MPRs cherchent à résoudre un problème inhérent aux VPN: le fait que vous devez leur faire entièrement confiance. Elles atteignent cet objectif en segmentant les responsabilités entre deux ou plusieurs entreprises différentes.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Premièrement, un serveur géré par Apple.
|
||||
|
||||
@ -101,15 +103,15 @@ Les MPRs cherchent à résoudre un problème inhérent aux VPN: le fait que vous
|
||||
|
||||
Ce serveur établit la connexion avec votre site web de destination, mais n'a aucune connaissance de votre appareil. La seule adresse IP qu'il connaît est celle du serveur d'Apple.
|
||||
|
||||
D'autres MPRs gérés par différentes entreprises comme Google ou INVISV fonctionnent de manière très similaire. Cette protection par segmentation n'existe que si vous avez confiance dans le fait que les deux entreprises ne s'entendent pas pour vous désanonymiser.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### VPNs décentralisés
|
||||
|
||||
Les dVPNs constituent une autre tentative de résoudre les problèmes posés par les services VPN centralisés. Ils sont basés sur la technologie blockchain et prétendent éliminer la confiance en une seule partie en répartissant les nœuds entre un grand nombre de personnes différentes. Cependant, il arrive souvent qu'un dVPN soit attribué par défaut à un seul nœud, ce qui signifie que vous devez faire entièrement confiance à ce nœud, tout comme dans le cas d'un VPN traditionnel. Contrairement à un VPN traditionnel, ce nœud unique qui peut voir tout votre trafic est une personne aléatoire au lieu de votre fournisseur VPN qui peut être audité et a des responsabilités légales de respecter sa politique de confidentialité. Le multi-saut est nécessaire pour résoudre ce problème, mais cela est accompagné d'un coût de stabilité et de performance.
|
||||
Another attempt at solving the issues with centralized VPN services are dVPNs. These are based on blockchain technology and claim to eliminate trust in a single party by distributing the nodes across lots of different people. However, many times a dVPN will default to a single node, meaning you need to trust that node completely, just like a traditional VPN. Unlike a traditional VPN, this one node that can see all your traffic is a random person instead of your VPN provider that can be audited and has legal responsibilities to uphold their privacy policy. Multi-hop is needed to solve this, but that comes with a stability and performance cost.
|
||||
|
||||
Une autre considération est la responsabilité juridique. Le noeud de sortie devra résoudre les problèmes légaux liés à l'utilisation abusive du réseau, un problème auquel le réseau Tor a été confronté tout au long de son existence. Cela décourage les personnes ordinaires de gérer des nœuds et rend plus attrayant l'hébergement d'un nœud par un acteur malveillant disposant de beaucoup de ressources. C'est un gros problème si le service est à nœud unique, car le nœud de sortie potentiellement malveillant peut voir qui vous êtes et à quoi vous vous connectez.
|
||||
Another consideration is legal liability. The exit node will need to deal with legal problems from misuse of the network, an issue that the Tor network has contended with for its entire existence. This discourages regular people from running nodes and makes it more attractive for a malicious actor with lots of resources to host one. This is a big problem if the service is single-node, as the potentially malicious exit node can see who you are and what you're connecting to.
|
||||
|
||||
De nombreux dVPNs sont utilisés pour pousser une crypto-monnaie plutôt que pour offrir le meilleur service. Ils ont également tendance à être des réseaux plus petits avec moins de nœuds, ce qui les rend plus vulnérables aux [attaques Sybil](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
Many dVPNs are used to push a cryptocurrency rather than to make the best service. They also tend to be smaller networks with fewer nodes, making them more vulnerable to [Sybil attacks](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
|
||||
## Informations VPN liées
|
||||
|
||||
|
||||
@ -312,15 +312,6 @@ Brave vous permet de sélectionner des filtres de contenu supplémentaires dans
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Suppression à la fermeture</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS sécurise l'ordinateur en isolant les sous-systèmes (par exemple, le r
|
||||
|
||||
Pour plus d'informations sur le fonctionnement de Qubes, lisez notre page [Introduction à Qubes](os/qubes-overview.md).
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ Nous considérons ces caractéristiques comme importantes afin de fournir un ser
|
||||
|
||||
- Chiffre les données du compte e-mail au repos avec un chiffrement à accès zéro.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Permet aux utilisateurs d'utiliser leur propre [nom de domaine](https://en.wikipedia.org/wiki/Domain_name). Les noms de domaine personnalisés sont importants pour les utilisateurs car ils leur permettent de conserver leur indépendance du service, au cas où celui-ci tournerait mal ou serait racheté par une autre société qui ne donne pas priorité à la vie privée.
|
||||
- Fonctionne sur sa propre infrastructure, c'est-à-dire qu'elle ne repose pas sur des fournisseurs de services d'e-mail tiers.
|
||||
|
||||
**Dans le meilleur des cas :**
|
||||
@ -328,8 +327,9 @@ Nous considérons ces caractéristiques comme importantes afin de fournir un ser
|
||||
- Prise en charge d'une boîte mail temporaire pour les utilisateurs externes. Cette fonction est utile lorsque vous souhaitez envoyer un e-mail chiffré, sans envoyer une copie réelle à votre destinataire. Ces e-mails ont généralement une durée de vie limitée et sont ensuite automatiquement supprimés. Ils n'obligent pas non plus le destinataire à configurer un système de chiffrement comme OpenPGP.
|
||||
- Disponibilité des services du fournisseur d'e-mail via un [service onion](https://en.wikipedia.org/wiki/.onion).
|
||||
- Support du [sous-adressage](https://en.wikipedia.org/wiki/Email_address#Sub-addressing).
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Les noms de domaine personnalisés sont importants pour les utilisateurs car ils leur permettent de conserver leur indépendance du service, au cas où celui-ci tournerait mal ou serait racheté par une autre société qui ne donne pas priorité à la vie privée.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Les protocoles d'accès standard garantissent que les clients peuvent facilement télécharger l'ensemble de leurs e-mails, s'ils souhaitent changer de fournisseur.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
### Confidentialité
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -673,6 +673,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ Stalwart does **not** have an integrated webmail, so you will need to use it wit
|
||||
|
||||
- מצפין נתוני חשבון אימייל במצב מנוחה עם הצפנה ללא גישה.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- מאפשר למשתמשים להשתמש ב[שם דומיין](https://en.wikipedia.org/wiki/Domain_name) משלהם. שמות דומיין מותאמים אישית חשובים למשתמשים מכיוון שהם מאפשרים להם לתחזק את הסוכנות שלהם מהשירות, אם היא תהפוך לגרועה או תירכש על ידי חברה אחרת שאינה מתעדפת פרטיות.
|
||||
- פועל על תשתית בבעלות, כלומר לא בנוי על ספקי שירותי דואר אלקטרוני של צד שלישי.
|
||||
|
||||
**המקרה הטוב ביותר:**
|
||||
@ -328,8 +327,9 @@ Stalwart does **not** have an integrated webmail, so you will need to use it wit
|
||||
- תמיכה בתיבת דואר זמנית למשתמשים חיצוניים. פעולה זו שימושית כאשר ברצונך לשלוח דוא"ל מוצפן, מבלי לשלוח עותק בפועל לנמען שלך. למיילים אלה יש בדרך כלל תוחלת חיים מוגבלת ולאחר מכן נמחקות אוטומטית. הם גם לא דורשים מהנמען להגדיר שום קריפטוגרפיה כמו OpenPGP.
|
||||
- זמינות שירותי ספק הדואר האלקטרוני באמצעות [שירות onion](https://en.wikipedia.org/wiki/.onion).
|
||||
- [Sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) support.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). שמות דומיין מותאמים אישית חשובים למשתמשים מכיוון שהם מאפשרים להם לתחזק את הסוכנות שלהם מהשירות, אם היא תהפוך לגרועה או תירכש על ידי חברה אחרת שאינה מתעדפת פרטיות.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). פרוטוקולי גישה סטנדרטיים מבטיחים שלקוחות יכולים להוריד בקלות את כל האימייל שלהם, אם הם רוצים לעבור לספק אחר.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
### פרטיות
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
|
||||
- Encrypts email account data at rest with zero-access encryption.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Operates on owned infrastructure, i.e. not built upon third-party email service providers.
|
||||
|
||||
**Best Case:**
|
||||
@ -328,6 +327,7 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
- Support for a temporary mailbox for external users. This is useful when you want to send an encrypted email, without sending an actual copy to your recipient. These emails usually have a limited lifespan and then are automatically deleted. They also don't require the recipient to configure any cryptography like OpenPGP.
|
||||
- Availability of the email provider's services via an [onion service](https://en.wikipedia.org/wiki/.onion).
|
||||
- [Sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) support.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ Ezeket a funkciókat fontosnak tartjuk a biztonságos és optimális szolgáltat
|
||||
|
||||
- Az email fiókok adatai alapértelmezetten zéró hozzáféréssel legyenek titkosítva.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Lehetővé teszi a felhasználók számára, hogy saját [domainnevüket](https://en.wikipedia.org/wiki/Domain_name) használják. Az egyéni domain nevek azért fontosak a felhasználók számára, mert lehetővé teszik számukra, hogy megőrizzék a függetlenedési képességüket a szolgáltatástól, ha az rosszra fordulna, vagy ha egy másik vállalat felvásárolná, amely nem helyezi előtérbe az adatvédelmet.
|
||||
- Saját infrastruktúrán működik, azaz nem harmadik féltől származó e-mail szolgáltatóra épül.
|
||||
|
||||
**Legjobb esetben:**
|
||||
@ -328,8 +327,9 @@ Ezeket a funkciókat fontosnak tartjuk a biztonságos és optimális szolgáltat
|
||||
- Ideiglenes postafiók támogatása külső felhasználók számára. Ez akkor hasznos, ha titkosított e-mailt szeretne küldeni anélkül, hogy a címzettnek tényleges másolatot küldene. Ezek az e-mailek általában korlátozott élettartamúak, majd automatikusan törlődnek. A címzettnek nem kell semmilyen titkosítást konfigurálnia, mint az OpenPGP esetében.
|
||||
- Az emailszolgáltató weboldalának elérhetősége egy [.onion szolgáltatáson](https://en.wikipedia.org/wiki/.onion) keresztül.
|
||||
- Az [alcímzés](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) támogatása.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Az egyéni domain nevek azért fontosak a felhasználók számára, mert lehetővé teszik számukra, hogy megőrizzék a függetlenedési képességüket a szolgáltatástól, ha az rosszra fordulna, vagy ha egy másik vállalat felvásárolná, amely nem helyezi előtérbe az adatvédelmet.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). A szabványos hozzáférési protokollok biztosítják, hogy az ügyfelek könnyen letölthessék az összes e-mailjüket, ha másik szolgáltatóhoz szeretnének váltani.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
### Adatvédelem
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,7 +103,7 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
|
||||
- Encrypts email account data at rest with zero-access encryption.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Operates on owned infrastructure, i.e. not built upon third-party email service providers.
|
||||
|
||||
**Kasus Terbaik:**
|
||||
@ -328,6 +327,7 @@ We regard these features as important in order to provide a safe and optimal ser
|
||||
- Support for a temporary mailbox for external users. This is useful when you want to send an encrypted email, without sending an actual copy to your recipient. These emails usually have a limited lifespan and then are automatically deleted. They also don't require the recipient to configure any cryptography like OpenPGP.
|
||||
- Availability of the email provider's services via an [onion service](https://en.wikipedia.org/wiki/.onion).
|
||||
- [Sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) support.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad or be acquired by another company which doesn't prioritize privacy.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Di recente, sono stati compiuti alcuni tentativi da varie organizzazioni, per ri
|
||||
|
||||
I Ripetitori Multiparte (MPR) sono più nodi di proprietà di parti differenti, tali che nessuna parte individuale conosca chi sei e a chi ti stai collegando. Questa è l'idea fondamentale dietro Tor, tuttavia, ora esistono servizi a pagamento che provano a emulare tale modello.
|
||||
|
||||
I MPR cercano di risolvere un problema inerente alle VPN: il fatto che devi affidarti completamente a esse. Compiono tale obiettivo segmentando le responsabilità tra due o più aziende differenti. Ad esempio, il Ripetitore Privato di Apple iCloud+, indirizza il tuo traffico attraverso due server:
|
||||
I MPR cercano di risolvere un problema inerente alle VPN: il fatto che devi affidarti completamente a esse. Compiono tale obiettivo segmentando le responsabilità tra due o più aziende differenti.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Prima di tutto, un server gestito da Apple.
|
||||
|
||||
@ -101,15 +103,15 @@ I MPR cercano di risolvere un problema inerente alle VPN: il fatto che devi affi
|
||||
|
||||
In realtà, questo server effettua la connessione al tuo sito web di destinazione, ma non ha alcuna conoscenza del tuo dispositivo. Il solo indirizzo IP che conosce è quello del server di Apple.
|
||||
|
||||
Altri MPR operati da aziende differenti, come Google o INVISV, operano in un modo molto simile. Questa protezione tramite la segmentazione esiste soltanto se ti fidi del fatto che le due aziende non colludano tra loro per deanonimizzarti.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### VPN Decentralizzate
|
||||
|
||||
Un altro tentativo di risoluzione dei poblemi con i servizi VPN centralizzati, sono le dVPN. Questi, si basano sulla tecnologia della blockchain e pretendono di eliminare la fiducia in una singola parte, distribuendo i nodi tra molte persone differenti. Tuttavia, molte volte una dVPN si affiderà predefinitamente a un singolo nodo, a significare che dovrai affidarti completamente a esso, proprio come in una VPN tradizionale. A differenza della VPN tradizionale, quel nodo che può visualizzare tutto il tuo traffico è una persona casuale, invece del fornitore della tua VPN, che può essere controllata e ha responsabilità legali per quanto concerne la tutela della privacy. Per risolvere questo problema, è necessario il salto multiplo, che però ha un costo in termini di stabilità e prestazioni.
|
||||
Another attempt at solving the issues with centralized VPN services are dVPNs. These are based on blockchain technology and claim to eliminate trust in a single party by distributing the nodes across lots of different people. However, many times a dVPN will default to a single node, meaning you need to trust that node completely, just like a traditional VPN. Unlike a traditional VPN, this one node that can see all your traffic is a random person instead of your VPN provider that can be audited and has legal responsibilities to uphold their privacy policy. Multi-hop is needed to solve this, but that comes with a stability and performance cost.
|
||||
|
||||
Un'altra considerazione riguarda la responsabilità legale. Il nodo d'uscita dovrà affrontare dei problemi legali dall'utilizzo improprio della rete, un problema con cui la rete di Tor ha dovuto confrontarsi per la propria intera esistenza. Ciò scoraggia le persone regolari dall'operare nodi e rende più interessante, per un malintenzionato fornito di molte risorse, ospitarne uno. Questo è un grande problema se il servizio è a nodo singolo, poiché il nodo d'uscita potenzialmente malintenzionato, può vedere chi sei e a cosa ti stai connettendo.
|
||||
Another consideration is legal liability. The exit node will need to deal with legal problems from misuse of the network, an issue that the Tor network has contended with for its entire existence. This discourages regular people from running nodes and makes it more attractive for a malicious actor with lots of resources to host one. This is a big problem if the service is single-node, as the potentially malicious exit node can see who you are and what you're connecting to.
|
||||
|
||||
Molte dVPN sono utilizzate per spingere una criptovaluta, piuttosto che per offrire il servizio migliore. Inoltre, tendono a essere reti più piccole con meno nodi, rendendole più vulnerabili agli [attacchi Sybil](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
Many dVPNs are used to push a cryptocurrency rather than to make the best service. They also tend to be smaller networks with fewer nodes, making them more vulnerable to [Sybil attacks](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
|
||||
## Informazioni correlate alle VPN
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave consente di selezionare filtri aggiuntivi per i contenuti nella pagina int
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizzazione alla chiusura</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS protegge il computer isolando i sottosistemi (ad esempio, rete, USB, ec
|
||||
|
||||
Per ulteriori informazioni sul funzionamento di Qubes, leggi la nostra pagina [Panoramica su Qubes OS](os/qubes-overview.md).
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ Consideriamo queste funzionalità come importanti per poter fornire un servizio
|
||||
|
||||
- Crittografia dei dati degli account email a riposo con crittografia ad "accesso zero".
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Consente agli utenti di utilizzare il proprio [nome di dominio](https://en.wikipedia.org/wiki/Domain_name). I nomi di dominio personalizzati sono importanti per gli utenti, poiché consentono loro di mantenere la propria autonomia dal servizio, dovesse diventare negativo o essere acquisito da un'altra azienda che non dà priorità alla privacy.
|
||||
- Opera su un'infrastruttura proprietaria, cioè, non basata su fornitori del servizio email di terze parti.
|
||||
|
||||
**Miglior Caso:**
|
||||
@ -328,8 +327,9 @@ Consideriamo queste funzionalità come importanti per poter fornire un servizio
|
||||
- Supporto per una casella temporanea per gli utenti esterni. Questo è utile quando desideri inviare un'email crittografata, senza inviare una copia effettiva al tuo destinatario. Queste email, solitamente, hanno una durata limitata, prima di essere eliminate automaticamente. Inoltre, non richiedono al destinatario di configurare alcuna crittografia, come OpenPGP.
|
||||
- Disponibilità dei servizi del fornitore email tramite un [servizio onion](https://en.wikipedia.org/wiki/.onion).
|
||||
- Supporto per il [sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing).
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). I nomi di dominio personalizzati sono importanti per gli utenti, poiché consentono loro di mantenere la propria autonomia dal servizio, dovesse diventare negativo o essere acquisito da un'altra azienda che non dà priorità alla privacy.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). I protocolli d'accesso standard assicurano ai clienti di scaricare facilmente tutte le proprie email, qualora dovessero passare a un altro fornitore.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
### Privacy
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** è un servizio di backup delle foto crittografato end-to-end che supporta i backup automatici su iOS e Android. Il loro codice è completamente open source, sia dal lato del client che del server. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** è un servizio di backup delle foto crittografato end-to-end che supporta i backup automatici su iOS e Android. Il loro codice è completamente open source, sia dal lato del client che del server. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,13 +103,13 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### 分散型VPN
|
||||
|
||||
Another attempt at solving the issues with centralized VPN services are dVPNs. These are based on blockchain technology and claim to eliminate trust in a single party by distributing the nodes across lots of different people. However, many times a dVPN will default to a single node, meaning you need to trust that node completely, just like a traditional VPN. Unlike a traditional VPN, this one node that can see all your traffic is a random person instead of your VPN provider that can be audited and has legal responsibilities to uphold their privacy policy. Multi-hop is needed to solve this, but that comes with a stability and performance cost.
|
||||
|
||||
もう一つ考慮すべきは、法的責任です。 The exit node will need to deal with legal problems from misuse of the network, an issue that the Tor network has contended with for its entire existence. This discourages regular people from running nodes and makes it more attractive for a malicious actor with lots of resources to host one. This is a big problem if the service is single-node, as the potentially malicious exit node can see who you are and what you're connecting to.
|
||||
Another consideration is legal liability. The exit node will need to deal with legal problems from misuse of the network, an issue that the Tor network has contended with for its entire existence. This discourages regular people from running nodes and makes it more attractive for a malicious actor with lots of resources to host one. This is a big problem if the service is single-node, as the potentially malicious exit node can see who you are and what you're connecting to.
|
||||
|
||||
Many dVPNs are used to push a cryptocurrency rather than to make the best service. They also tend to be smaller networks with fewer nodes, making them more vulnerable to [Sybil attacks](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Braveの[シールド](https://support.brave.com/hc/articles/360022973471-What-i
|
||||
|
||||
1. V8オプティマイザーを無効にすることでJavaScriptの実行時(JIT)コンパイルの[*一部*](https://grapheneos.social/@GrapheneOS/112708049232710156)を無効化し、アタックサーフェスを減らすことができます。
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">終了時のクリーンアップ</p>
|
||||
|
||||
- [x] *サイトとシールドの設定* → *コンテンツ* → *その他のコンテンツの設定* → *デバイス上のサイトデータ*から**すべてのウィンドウを閉じるときに、サイトによりデバイスに保存されたデータを削除する**を選択。
|
||||
|
||||
よく見る特定のサイトのログインを維持したい場合、*動作のカスタマイズ*からサイトごとに例外を設定することができます。
|
||||
|
||||
</div>
|
||||
|
||||
##### Torウィンドウ
|
||||
|
||||
[**Tor搭載のプライベートウィンドウ**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity)を使うことで、プライベートウィンドウの通信はTorネットワークを経由し、.onionにアクセスでき、場合によっては役立つこともあります。 ただし、BraveはTor Browserよりもフィンガープリンティングに対して強く**ない**ことに加え、BraveでTorを使う人は非常に少ないため目立ってしまいます。 脅威モデルにより強い匿名性が必要な場合、[Tor Browser](tor.md#tor-browser)を使用します。
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ Stalwartにはウェブメールが**ない**ため、[専用のEメールクラ
|
||||
|
||||
- ゼロアクセス暗号化によりEメールアカウントのデータを暗号化していること。
|
||||
- [Mbox](https://en.wikipedia.org/wiki/Mbox)もしくは[RFC5322](https://datatracker.ietf.org/doc/rfc5322)に基づいた個別の.EMLファイルとしてエクスポートできること。
|
||||
- ユーザーの独自[ドメイン名](https://en.wikipedia.org/wiki/Domain_name)が利用できること。 プロバイダーが悪化したり、プライバシーを重視しない他の会社に買収されたりした場合に備えることができるため、カスタムドメイン名はユーザーにとって非常に重要である。
|
||||
- 自社所有のインフラで運用されていること。第三者のEメールサービスプロバイダーによるサービス提供ではないこと。
|
||||
|
||||
**満たされることが望ましい基準：**
|
||||
@ -328,8 +327,9 @@ Stalwartにはウェブメールが**ない**ため、[専用のEメールクラ
|
||||
- 外部ユーザー用の一時的なメールボックスがあること。 受信者に実際のメールのコピーを送るのではなく、暗号化されたメールを送る際に役立ちます。 通常の場合、一時的なメールボックスのメールには期限があり、自動的に削除されます。 また、受信者はOpenPGPのような暗号化を設定する必要がありません。
|
||||
- [.onionサービス](https://en.wikipedia.org/wiki/.onion)経由でEメールプロバイダーのサービスが利用できること。
|
||||
- [サブアドレス](https://en.wikipedia.org/wiki/Email_address#Sub-addressing)に対応していること。
|
||||
- 独自ドメインを利用した際、キャッチオール機能もしくはエイリアス機能があること。
|
||||
- IMAP、SMTPや[JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol)などの標準的なEメールプロトコルを使用していること。 標準的なプロトコルを採用していることで、他のプロバイダーへ変更する際にすべてのメールを簡単にダウンロードすることができます。
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). プロバイダーが悪化したり、プライバシーを重視しない他の会社に買収されたりした場合に備えることができるため、カスタムドメイン名はユーザーにとって非常に重要である。
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
### プライバシー
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year.
|
||||
**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 10 GB of storage as long as you use the service at least once a year.
|
||||
|
||||
[:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@ -679,6 +679,7 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
|
||||
- { .twemoji loading=lazy } [NixOS](desktop.md#nixos)
|
||||
- { .twemoji loading=lazy } [Whonix (Tor)](desktop.md#whonix)
|
||||
- { .twemoji loading=lazy } [Tails (Live Boot)](desktop.md#tails)
|
||||
- { .twemoji loading=lazy } [Secureblue](desktop.md#secureblue)
|
||||
- { .twemoji loading=lazy } [Kicksecure](desktop.md#kicksecure)
|
||||
|
||||
</div>
|
||||
|
||||
@ -91,7 +91,9 @@ Recently, some attempts have been made by various organizations to address some
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies.
|
||||
|
||||
One example of a commercially available MPR is Apple's iCloud+ Private Relay, which routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
@ -101,15 +103,15 @@ MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
Other MPRs run by different companies operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
Another attempt at solving the issues with centralized VPN services are dVPNs. These are based on blockchain technology and claim to eliminate trust in a single party by distributing the nodes across lots of different people. However, many times a dVPN will default to a single node, meaning you need to trust that node completely, just like a traditional VPN. Unlike a traditional VPN, this one node that can see all your traffic is a random person instead of your VPN provider that can be audited and has legal responsibilities to uphold their privacy policy. Multi-hop is needed to solve this, but that comes with a stability and performance cost.
|
||||
|
||||
Another consideration is legal liability. 출구 노드는 네트워크 오용으로 인한 법적 문제를 해결해야 하며, 이는 Tor 네트워크가 존재해온 내내 논란이 되어온 문제입니다. This discourages regular people from running nodes and makes it more attractive for a malicious actor with lots of resources to host one. This is a big problem if the service is single-node, as the potentially malicious exit node can see who you are and what you're connecting to.
|
||||
Another consideration is legal liability. The exit node will need to deal with legal problems from misuse of the network, an issue that the Tor network has contended with for its entire existence. This discourages regular people from running nodes and makes it more attractive for a malicious actor with lots of resources to host one. This is a big problem if the service is single-node, as the potentially malicious exit node can see who you are and what you're connecting to.
|
||||
|
||||
많은 dVPN이 최고의 서비스를 제공하기보다는 암호화폐를 홍보하는 데 사용됩니다. They also tend to be smaller networks with fewer nodes, making them more vulnerable to [Sybil attacks](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
Many dVPNs are used to push a cryptocurrency rather than to make the best service. They also tend to be smaller networks with fewer nodes, making them more vulnerable to [Sybil attacks](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
|
||||
## VPN 관련 추가 정보
|
||||
|
||||
|
||||
@ -318,15 +318,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
@ -214,6 +214,25 @@ Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, et
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
### Secureblue
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Secureblue** is a security-focused operating system based on [Fedora Atomic Desktops](#fedora-atomic-desktops). It includes a number of [security features](https://secureblue.dev/features) intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with [Trivalent](https://github.com/secureblue/Trivalent), their hardened, Chromium-based web browser.
|
||||
|
||||
[:octicons-home-16: Homepage](https://secureblue.dev){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://secureblue.dev/install){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/secureblue/secureblue){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://secureblue.dev/donate){ .card-link title="Contribute" }
|
||||
|
||||
</div>
|
||||
|
||||
**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](android/distributions.md#grapheneos)'s Vanadium browser.
|
||||
|
||||
Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks).
|
||||
|
||||
### Kicksecure
|
||||
|
||||
While we [recommend against](os/linux-overview.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install.
|
||||
|
||||
@ -317,7 +317,6 @@ Stalwart does **not** have an integrated webmail, so you will need to use it wit
|
||||
|
||||
- Zero Access Encryption을 통해 이메일 계정 데이터를 암호화해야 합니다.
|
||||
- Export capability as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- 사용자가 자신의 [도메인 이름](https://en.wikipedia.org/wiki/Domain_name)을 사용할 수 있어야 합니다. 사용자 지정 도메인 이름은 서비스가 부실해지거나 프라이버시 보호를 우선시하지 않는 다른 회사에 인수되는 경우에도 에이전시를 유지할 수 있도록 해주기 때문에 사용자에게 중요합니다.
|
||||
- 자체 인프라에서 운영되어야 합니다. 다른 이메일 서비스 제공 업체의 인프라를 기반으로 만들어진 서비스여선 안 됩니다.
|
||||
|
||||
**우대 사항:**
|
||||
@ -328,8 +327,9 @@ Stalwart does **not** have an integrated webmail, so you will need to use it wit
|
||||
- 외부 사용자를 위해 임시 메일함을 지원해야 합니다. 수신자에게 실제 사본을 보내지 않고 암호화된 이메일을 보내고자 할 때 유용합니다. 이러한 이메일은 보통 수명이 제한돼 있으며 이후 자동으로 삭제됩니다. 수신자가 OpenPGP 등의 암호화를 설정할 필요가 없습니다.
|
||||
- [Onion 서비스](https://en.wikipedia.org/wiki/.onion)를 통해 이메일 서비스를 이용할 수 있어야 합니다.
|
||||
- [하위 주소](https://en.wikipedia.org/wiki/Email_address#Sub-addressing) 지원.
|
||||
- Allows users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). 사용자 지정 도메인 이름은 서비스가 부실해지거나 프라이버시 보호를 우선시하지 않는 다른 회사에 인수되는 경우에도 에이전시를 유지할 수 있도록 해주기 때문에 사용자에게 중요합니다.
|
||||
- Catch-all or alias functionality for those who use their own domains.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). 표준 액세스 프로토콜을 사용함으로써, 사용자는 다른 서비스 제공 업체로 전환하고자 할 경우 모든 이메일을 쉽게 다운로드할 수 있습니다.
|
||||
- Use of standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
|
||||
|
||||
### 프라이버시
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user