From a3c3518bbd9d14995fdedf869a661ee0192b4721 Mon Sep 17 00:00:00 2001 From: Crowdin Bot Date: Tue, 24 Dec 2024 06:37:45 +0000 Subject: [PATCH] New Crowdin translations by GitHub Action --- i18n/ar/android/distributions.md | 42 --------------------------- i18n/ar/device-integrity.md | 40 ------------------------- i18n/ar/mobile-browsers.md | 41 -------------------------- i18n/ar/tools.md | 10 ------- i18n/bn-IN/android/distributions.md | 42 --------------------------- i18n/bn-IN/device-integrity.md | 40 ------------------------- i18n/bn-IN/mobile-browsers.md | 41 -------------------------- i18n/bn-IN/tools.md | 10 ------- i18n/bn/android/distributions.md | 42 --------------------------- i18n/bn/device-integrity.md | 40 ------------------------- i18n/bn/mobile-browsers.md | 41 -------------------------- i18n/bn/tools.md | 10 ------- i18n/cs/android/distributions.md | 42 --------------------------- i18n/cs/device-integrity.md | 40 ------------------------- i18n/cs/mobile-browsers.md | 41 -------------------------- i18n/cs/tools.md | 10 ------- i18n/de/android/distributions.md | 42 --------------------------- i18n/de/device-integrity.md | 40 ------------------------- i18n/de/mobile-browsers.md | 41 -------------------------- i18n/de/tools.md | 10 ------- i18n/el/android/distributions.md | 42 --------------------------- i18n/el/device-integrity.md | 40 ------------------------- i18n/el/mobile-browsers.md | 41 -------------------------- i18n/el/tools.md | 10 ------- i18n/eo/android/distributions.md | 42 --------------------------- i18n/eo/device-integrity.md | 40 ------------------------- i18n/eo/mobile-browsers.md | 41 -------------------------- i18n/eo/tools.md | 10 ------- i18n/es/android/distributions.md | 42 --------------------------- i18n/es/device-integrity.md | 40 ------------------------- i18n/es/mobile-browsers.md | 41 -------------------------- i18n/es/tools.md | 14 ++------- i18n/fa/android/distributions.md | 42 --------------------------- i18n/fa/device-integrity.md | 40 ------------------------- i18n/fa/mobile-browsers.md | 41 -------------------------- i18n/fa/tools.md | 10 ------- i18n/fr/android/distributions.md | 42 --------------------------- i18n/fr/device-integrity.md | 40 ------------------------- i18n/fr/mobile-browsers.md | 41 -------------------------- i18n/fr/tools.md | 10 ------- i18n/he/android/distributions.md | 42 --------------------------- i18n/he/device-integrity.md | 40 ------------------------- i18n/he/mobile-browsers.md | 41 -------------------------- i18n/he/tools.md | 10 ------- i18n/hi/android/distributions.md | 42 --------------------------- i18n/hi/device-integrity.md | 40 ------------------------- i18n/hi/mobile-browsers.md | 41 -------------------------- i18n/hi/tools.md | 10 ------- i18n/hu/android/distributions.md | 42 --------------------------- i18n/hu/device-integrity.md | 40 ------------------------- i18n/hu/mobile-browsers.md | 41 -------------------------- i18n/hu/tools.md | 10 ------- i18n/id/android/distributions.md | 42 --------------------------- i18n/id/device-integrity.md | 40 ------------------------- i18n/id/mobile-browsers.md | 41 -------------------------- i18n/id/tools.md | 10 ------- i18n/it/android/distributions.md | 42 --------------------------- i18n/it/device-integrity.md | 40 ------------------------- i18n/it/mobile-browsers.md | 41 -------------------------- i18n/it/tools.md | 10 ------- i18n/ja/android/distributions.md | 42 --------------------------- i18n/ja/device-integrity.md | 40 ------------------------- i18n/ja/mobile-browsers.md | 41 -------------------------- i18n/ja/tools.md | 10 ------- i18n/ko/android/distributions.md | 42 --------------------------- i18n/ko/device-integrity.md | 40 ------------------------- i18n/ko/mobile-browsers.md | 41 -------------------------- i18n/ko/tools.md | 10 ------- i18n/ku-IQ/android/distributions.md | 42 --------------------------- i18n/ku-IQ/device-integrity.md | 40 ------------------------- i18n/ku-IQ/mobile-browsers.md | 41 -------------------------- i18n/ku-IQ/tools.md | 10 ------- i18n/nl/android/distributions.md | 42 --------------------------- i18n/nl/device-integrity.md | 40 ------------------------- i18n/nl/mobile-browsers.md | 41 -------------------------- i18n/nl/tools.md | 10 ------- i18n/pl/android/distributions.md | 42 --------------------------- i18n/pl/device-integrity.md | 40 ------------------------- i18n/pl/mobile-browsers.md | 41 -------------------------- i18n/pl/tools.md | 10 ------- i18n/pt-BR/android/distributions.md | 42 --------------------------- i18n/pt-BR/device-integrity.md | 40 ------------------------- i18n/pt-BR/mobile-browsers.md | 41 -------------------------- i18n/pt-BR/tools.md | 10 ------- i18n/pt/android/distributions.md | 42 --------------------------- i18n/pt/device-integrity.md | 40 ------------------------- i18n/pt/mobile-browsers.md | 41 -------------------------- i18n/pt/tools.md | 10 ------- i18n/ru/android/distributions.md | 42 --------------------------- i18n/ru/device-integrity.md | 40 ------------------------- i18n/ru/mobile-browsers.md | 41 -------------------------- i18n/ru/tools.md | 10 ------- i18n/sv/android/distributions.md | 42 --------------------------- i18n/sv/device-integrity.md | 40 ------------------------- i18n/sv/mobile-browsers.md | 41 -------------------------- i18n/sv/tools.md | 10 ------- i18n/tr/android/distributions.md | 42 --------------------------- i18n/tr/device-integrity.md | 40 ------------------------- i18n/tr/mobile-browsers.md | 41 -------------------------- i18n/tr/tools.md | 10 ------- i18n/uk/android/distributions.md | 42 --------------------------- i18n/uk/device-integrity.md | 40 ------------------------- i18n/uk/mobile-browsers.md | 41 -------------------------- i18n/uk/tools.md | 10 ------- i18n/vi/android/distributions.md | 42 --------------------------- i18n/vi/device-integrity.md | 40 ------------------------- i18n/vi/mobile-browsers.md | 41 -------------------------- i18n/vi/tools.md | 10 ------- i18n/zh-Hant/android/distributions.md | 42 --------------------------- i18n/zh-Hant/device-integrity.md | 40 ------------------------- i18n/zh-Hant/mobile-browsers.md | 41 -------------------------- i18n/zh-Hant/tools.md | 10 ------- i18n/zh/android/distributions.md | 42 --------------------------- i18n/zh/device-integrity.md | 40 ------------------------- i18n/zh/mobile-browsers.md | 41 -------------------------- i18n/zh/tools.md | 10 ------- 116 files changed, 2 insertions(+), 3859 deletions(-) diff --git a/i18n/ar/android/distributions.md b/i18n/ar/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/ar/android/distributions.md +++ b/i18n/ar/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/ar/device-integrity.md b/i18n/ar/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/ar/device-integrity.md +++ b/i18n/ar/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/ar/mobile-browsers.md b/i18n/ar/mobile-browsers.md index 845c5418..929d6285 100644 --- a/i18n/ar/mobile-browsers.md +++ b/i18n/ar/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/ar/tools.md b/i18n/ar/tools.md index afedc5c5..cb137da2 100644 --- a/i18n/ar/tools.md +++ b/i18n/ar/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/bn-IN/android/distributions.md b/i18n/bn-IN/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/bn-IN/android/distributions.md +++ b/i18n/bn-IN/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/bn-IN/device-integrity.md b/i18n/bn-IN/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/bn-IN/device-integrity.md +++ b/i18n/bn-IN/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/bn-IN/mobile-browsers.md b/i18n/bn-IN/mobile-browsers.md index 845c5418..929d6285 100644 --- a/i18n/bn-IN/mobile-browsers.md +++ b/i18n/bn-IN/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/bn-IN/tools.md b/i18n/bn-IN/tools.md index 80b17afd..44dd5a59 100644 --- a/i18n/bn-IN/tools.md +++ b/i18n/bn-IN/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/bn/android/distributions.md b/i18n/bn/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/bn/android/distributions.md +++ b/i18n/bn/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/bn/device-integrity.md b/i18n/bn/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/bn/device-integrity.md +++ b/i18n/bn/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/bn/mobile-browsers.md b/i18n/bn/mobile-browsers.md index 845c5418..929d6285 100644 --- a/i18n/bn/mobile-browsers.md +++ b/i18n/bn/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/bn/tools.md b/i18n/bn/tools.md index 80b17afd..44dd5a59 100644 --- a/i18n/bn/tools.md +++ b/i18n/bn/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/cs/android/distributions.md b/i18n/cs/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/cs/android/distributions.md +++ b/i18n/cs/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/cs/device-integrity.md b/i18n/cs/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/cs/device-integrity.md +++ b/i18n/cs/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/cs/mobile-browsers.md b/i18n/cs/mobile-browsers.md index 845c5418..929d6285 100644 --- a/i18n/cs/mobile-browsers.md +++ b/i18n/cs/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/cs/tools.md b/i18n/cs/tools.md index 80b17afd..44dd5a59 100644 --- a/i18n/cs/tools.md +++ b/i18n/cs/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/de/android/distributions.md b/i18n/de/android/distributions.md index 85ebcdf3..f62f3439 100644 --- a/i18n/de/android/distributions.md +++ b/i18n/de/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://de.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ Standardmäßig stellt Android viele Netzwerkverbindungen zu Google her, um DNS- Wenn du Informationen wie diese vor einem Angreifer in deinem Netzwerk oder vor deinem ISP verbergen möchtest, **musst** du ein [vertrauenswürdiges VPN](../vpn.md) verwenden und zusätzlich die Einstellung für die Verbindungsprüfung auf **Standard (Google)** ändern. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -Wenn GrapheneOS nicht mit deinem Handy kompatibel ist, ist DivestOS eine gute Alternative. Es unterstützt eine Vielzahl von Telefonen mit _unterschiedlichen_ Sicherheitsstufen und Qualitätskontrollen. - -
- -![DivestOS-Logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** ist ein Soft-Fork von [LineageOS](https://lineageos.org). -DivestOS erbt viele [unterstützte Geräte](https://divestos.org/index.php?page=devices\&base=LineageOS) von LineageOS. Es hat signierte Builds, die es möglich machen, [verified boot](../os/android-overview.md#verified-boot) auf einigen Nicht-Pixel-Geräten zu verwenden. Nicht alle unterstützten Geräte unterstützen Verfied-Boot oder andere Sicherheitsfunktionen. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Datenschutzrichtlinie" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Dokumentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Quellcode" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Spenden" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Kriterien **Bitte beachte, dass wir mit keinem der Projekte, die wir empfehlen, in Verbindung stehen.** Zusätzlich zu [unseren Standardkriterien](../about/criteria.md) haben wir eine Reihe klarer Anforderungen entwickelt, die es uns ermöglichen, objektive Empfehlungen zu geben. Wir empfehlen dir, dich mit der Liste vertraut zu machen, bevor du dich für ein Projekt entscheidest, und deine eigenen Recherchen anzustellen, um sicherzustellen, dass es die richtige Wahl für dich ist. diff --git a/i18n/de/device-integrity.md b/i18n/de/device-integrity.md index f33e430a..5cce842e 100644 --- a/i18n/de/device-integrity.md +++ b/i18n/de/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Angriffe](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warnung

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/de/mobile-browsers.md b/i18n/de/mobile-browsers.md index 7999b73e..aed7891d 100644 --- a/i18n/de/mobile-browsers.md +++ b/i18n/de/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull-Logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** ist ein datenschutzorientierter und puristischer Android-Browser, der auf Firefox basiert. Im Vergleich zu Firefox bietet er einen wesentlich besseren Schutz vor Fingerabdrücken und deaktiviert die Just-in-Time-Kompilierung (JIT) von JavaScript, um die Sicherheit zu erhöhen. Außerdem werden alle proprietären Elemente aus Firefox entfernt, wie z. B. das Ersetzen der Verweise auf Google Play-Services. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Gefahr

- -Firefox (Gecko)-basierten Browsern auf Android [fehlt](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] eine leistungsstarke Sicherheitsfunktion, die davor schützt, dass eine bösartige Website einen [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-ähnlichen Angriff durchführt, um Zugriff auf den Speicher einer anderen von dir geöffneten Website zu erlangen[^2] Chromium-basierte Browser wie [Brave](#brave) bieten einen zuverlässigeren Schutz vor bösartigen Websites. - -
- -Aktiviere das [F-Droid Repository](https://divestos.org/fdroid/official) von DivestOS, um Updates direkt vom Entwickler zu erhalten. Wenn du Mull aus dem Standard-F-Droid-Repository herunterlädst, können sich Updates um einige Tage oder länger verzögern. - -Mull aktiviert viele Funktionen, die vom [Tor Uplift-Projekt](https://wiki.mozilla.org/Security/Tor_Uplift) entwickelt wurden, indem es Einstellungen von [Arkenfox](desktop-browsers.md#arkenfox-advanced) verwendet. Proprietäre Blobs werden mit den für Fennec F-Droid entwickelten Skripten aus Mozillas Code entfernt. - -### Empfohlene Mull Konfiguration - -Wir empfehlen die Installation von [uBlock Origin](browser-extensions.md#ublock-origin) als Inhaltsblocker, wenn du Tracker in Mull blockieren möchtest. - -Mull verfügt über bereits standardmäßig konfigurierte Einstellungen zum Schutz der Privatsphäre. Du kannst die Option **Browserdaten beim Beenden löschen** in den Einstellungen von Mull konfigurieren, wenn du alle offenen Tabs beim Beenden der App automatisch schließen oder andere Daten wie den Browserverlauf und Cookies automatisch löschen möchtest. - -Da in Mull im Vergleich zu den meisten Browsern standardmäßig ein erweiterter und strengerer Schutz der Privatsphäre aktiviert ist, können einige Websites möglicherweise nicht geladen werden oder nicht richtig funktionieren, wenn du diese Einstellungen nicht anpasst. Du kannst diese [Liste mit bekannten Problemen und Umgehungsmöglichkeiten](https://divestos.org/pages/broken#mull) konsultieren, um Ratschläge für eine mögliche Lösung zu erhalten, wenn du auf eine fehlerhafte Website stoßt. Wenn du eine Einstellung änderst, um eine Website zu reparieren, kann sich dies auf deine Privatsphäre/Sicherheit auswirken. Vergewisser dich daher, dass du alle Anweisungen, die du befolgst, vollständig verstehst. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/de/tools.md b/i18n/de/tools.md index a3c7281f..e3a9e8fc 100644 --- a/i18n/de/tools.md +++ b/i18n/de/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/el/android/distributions.md b/i18n/el/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/el/android/distributions.md +++ b/i18n/el/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/el/device-integrity.md b/i18n/el/device-integrity.md index 5ea8fcc4..6fe582ac 100644 --- a/i18n/el/device-integrity.md +++ b/i18n/el/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/el/mobile-browsers.md b/i18n/el/mobile-browsers.md index 1b0985fc..22e1ea61 100644 --- a/i18n/el/mobile-browsers.md +++ b/i18n/el/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/el/tools.md b/i18n/el/tools.md index c396dc4f..6bfd965e 100644 --- a/i18n/el/tools.md +++ b/i18n/el/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/eo/android/distributions.md b/i18n/eo/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/eo/android/distributions.md +++ b/i18n/eo/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/eo/device-integrity.md b/i18n/eo/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/eo/device-integrity.md +++ b/i18n/eo/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/eo/mobile-browsers.md b/i18n/eo/mobile-browsers.md index 845c5418..929d6285 100644 --- a/i18n/eo/mobile-browsers.md +++ b/i18n/eo/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/eo/tools.md b/i18n/eo/tools.md index 80b17afd..44dd5a59 100644 --- a/i18n/eo/tools.md +++ b/i18n/eo/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/es/android/distributions.md b/i18n/es/android/distributions.md index d7cb8402..3e5be78a 100644 --- a/i18n/es/android/distributions.md +++ b/i18n/es/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ Por defecto, Android realiza muchas conexiones de red a Google para realizar com Si quieres ocultar información como esta a un adversario de tu red o ISP, **debes** utilizar una [VPN de confianza](../vpn.md) además de cambiar la configuración de comprobación de conectividad a **Estándar (Google)**. Se puede encontrar en :gear: **Configuración** → **Red e Internet** → **Comprobaciones de conectividad a Internet**. Esta opción te permite conectarte a los servidores de Google para comprobar la conectividad, lo que, junto con el uso de una VPN, te ayuda a mezclarte con un grupo mayor de dispositivos Android. -### DivestOS - -Si GrapheneOS no es compatible con tu teléfono, DivestOS es una buena alternativa. Admite una amplia variedad de teléfonos con _varios_ niveles de protecciones de seguridad y control de calidad. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** es un soft-fork de [LineageOS](https://lineageos.org). -DivestOS hereda muchos [dispositivos compatibles](https://divestos.org/index.php?page=devices\&base=LineageOS) de LineageOS. Tiene builds firmados, haciendo posible tener [arranque verificado](../os/android-overview.md#verified-boot) en algunos dispositivos que no son Pixel. No todos los dispositivos compatibles admiten el arranque verificado u otras funciones de seguridad. - -[:octicons-home-16: Página Principal](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Servicio Onion" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Política de Privacidad" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentación" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Código Fuente" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribuir" } - -
- -El [estado](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) de las actualizaciones de firmware en particular variará significativamente dependiendo del modelo de tu teléfono. Mientras que los errores y vulnerabilidades estándar de AOSP pueden solucionarse con actualizaciones de software estándar como las proporcionadas por DivestOS, algunas vulnerabilidades no pueden parchearse sin el apoyo del fabricante del dispositivo, lo que hace que los dispositivos al final de su vida útil sean menos seguros incluso con una ROM alternativa actualizada como DivestOS. - -DivestOS dispone de [parcheo](https://gitlab.com/divested-mobile/cve_checker) automático de vulnerabilidades del kernel ([CVE](https://es.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)), menos blobs propietarios y un archivo [hosts](https://divested.dev/index.php?page=dnsbl) personalizado. Su WebView reforzado, [Mulch](https://gitlab.com/divested-mobile/mulch), permite la [integridad del flujo de control](https://en.wikipedia.org/wiki/Control-flow_integrity) para todas las arquitecturas y la [partición del estado de la red](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), y recibe actualizaciones fuera de banda. - -DivestOS también incluye parches del núcleo de GrapheneOS y activa todas las funciones de seguridad del núcleo disponibles a través de [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). Todos los kernels más nuevos que la versión 3.4 incluyen [sanitización](https://lwn.net/Articles/334747) de página completa y todos los kernels compilados por Clang ~22 tienen activado [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471). - -DivestOS implementa algunos parches de endurecimiento del sistema desarrollados originalmente para GrapheneOS. DivestOS 16.0 y superior implementa el cambio de permisos `INTERNET` y `SENSORS` de GrapheneOS, [asignador de memoria endurecido](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Interfaz Nativa Java [constificación](https://en.wikipedia.org/wiki/Const_\(programación_informática\)), y parches de endurecimiento parciales [biónicos](https://en.wikipedia.org/wiki/Bionic_\(software\)). La versión 17.1 y superiores incluyen aleatorización completa de direcciones MAC por red, control [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html), reinicio automático y [opciones de tiempo de espera](https://grapheneos.org/features#attack-surface-reduction) Wi-Fi/Bluetooth. - -DivestOS utiliza F-Droid como su tienda de aplicaciones por defecto. Normalmente [recomendamos evitar F-Droid](obtaining-apps.md#f-droid), pero hacerlo en DivestOS no es viable; los desarrolladores actualizan sus aplicaciones a través de su propio repositorio F-Droid, [DivestOS Oficial](https://divestos.org/fdroid/official). Para estas aplicaciones debes seguir usando F-Droid **con el repositorio DivestOS habilitado** para mantener esos componentes actualizados. Para otras aplicaciones, se siguen aplicando nuestros [métodos de obtención](obtaining-apps.md) recomendados. - -DivestOS sustituye muchas de las conexiones de red en segundo plano de Android a los servicios de Google por servicios alternativos, como el uso de OpenEUICC para la activación de eSIM, NTP.org para la hora de red y Quad9 para DNS. Estas conexiones pueden modificarse, pero su desviación de las conexiones de red de un teléfono Android estándar podría significar que es más fácil para un adversario en tu red deducir qué sistema operativo tienes instalado en tu teléfono. Si esto te preocupa, considera la posibilidad de utilizar una [VPN de confianza](../vpn.md) y activar el [kill switch](../os/android-overview.md#vpn-killswitch) nativo de VPN para ocultar este tráfico de red de tu red local e ISP. - ## Criterios **Por favor, ten en cuenta que no estamos afiliados a ninguno de los proyectos que recomendamos.** Además de [nuestros criterios estándar](../about/criteria.md), hemos desarrollado un conjunto claro de requisitos que nos permiten ofrecer recomendaciones objetivas. Sugerimos que te familiarices con esta lista, antes de decidir utilizar un proyecto y realizar tu propia investigación para asegurarte de que es la elección ideal para ti. diff --git a/i18n/es/device-integrity.md b/i18n/es/device-integrity.md index 2b00b615..c9071e97 100644 --- a/i18n/es/device-integrity.md +++ b/i18n/es/device-integrity.md @@ -188,43 +188,3 @@ Es importante señalar que Auditor solo puede detectar eficazmente cambios **des No se envía información personal identificable al servicio de certificación. Recomendamos que te registres con una cuenta anónima y actives la atestación remota para una supervisión continua. Si tu [modelo de amenaza](basics/threat-modeling.md) requiere privacidad, podrías considerar utilizar [Orbot](tor.md#orbot) o una VPN para ocultar tu dirección IP al servicio de atestación. - -## Escáneres en el Dispositivo - -Protege contra la(s) siguiente(s) amenaza(s): - -- [:material-bug-outline: Ataques pasivos](basics/common-threats.md#security-and-privacy){ .pg-orange } - -Se trata de aplicaciones que puedes instalar en tu dispositivo y que lo escanean en busca de señales de peligro. - -
-

Advertencia

- -El uso de estas aplicaciones no basta para determinar que un dispositivo está "limpio" y no es objetivo de una herramienta de spyware concreta. - -
- -### Hypatia (Android) - -
- -![Logo de Hypatia](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Logo de Hypatia](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** es un escáner de malware en tiempo real de código abierto para Android, del desarrollador de [DivestOS](android/distributions.md#divestos). Este accede a Internet para descargar actualizaciones de la base de datos de firmas, pero no sube tus archivos o cualquier metadato a la nube (los escaneos son realizados de manera local). - -[:octicons-home-16: Página principal](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Política de privacidad" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Código fuente" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribuir"} - -
-Downloads "Descargas" - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia es especialmente buena en la detección de stalkerware común: Si sospechas que eres víctima de stalkerware, deberías [visitar esta página](https://stopstalkerware.org/information-for-survivors) para obtener asesoramiento. diff --git a/i18n/es/mobile-browsers.md b/i18n/es/mobile-browsers.md index 0d4a012d..da859bac 100644 --- a/i18n/es/mobile-browsers.md +++ b/i18n/es/mobile-browsers.md @@ -263,47 +263,6 @@ Estas opciones se encuentran en :material-menu: → :gear: **Configuración** Esto desactiva las comprobaciones de actualización para el filtro adblock Bromite, que no recibe mantenimiento. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** es un navegador para Android orientado a la privacidad y depurado, basado en Firefox. A comparación con Firefox, este ofrece una protección mayor contra las huellas digitales y desactiva la compilación Just-In-Time (JIT) de JavaScript para mejorar la seguridad. Este también elimina todos los elementos propietarios de Firefox, como el reemplazo de las referencias a los Servicios de Google Play. - -[:octicons-home-16: Página Principal](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Política de Privacidad" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentación" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Código Fuente" } - -
-Descargas - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Peligro

- -Los navegadores basados en Firefox (Gecko) para Android [carecen](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) del [aislamiento de sitios](https://wiki.mozilla.org/Project_Fission),[^1] una potente función de seguridad que protege contra un sitio malicioso que realice un ataque similar a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)) para obtener acceso a la memoria de otro sitio web que tienes abierto.[^2] Los navegadores basados en Chromium como [Brave](#brave) proporcionan una protección más robusta contra sitios maliciosos. - -
- -Habilita el [repositorio F-Droid](https://divestos.org/fdroid/official) de DivestOS para recibir actualizaciones directamente del desarrollador. La descarga de Mull desde el repositorio oficial de F-Droid puede significar que las actualizaciones se atrasen por algunos días o incluso más. - -Mull activa varias características del [proyecto Tor uplift](https://wiki.mozilla.org/Security/Tor_Uplift) usando las preferencias de [Arkenfox](desktop-browsers.md#arkenfox-advanced). Los blobs propietarios son eliminados desde el código de Mozilla usando script desarrollador para Fennec F-Droid. - -### Configuración Recomendada de Mull - -Sugerimos instalar [uBlock Origin](browser-extensions.md#ublock-origin) como bloqueador de contenido si quieres bloquear los rastreadores en Mull. - -Mull viene con ajustes para la protección de la privacidad activados por defecto. Puedes considerar configurar las opciones para **Eliminar los datos de navegación al salir** en los ajustes de Mull si quieres cerrar automáticamente todas las pestañas abiertas al salir de la aplicación, o eliminar otros datos como el historial de navegación y las cookies de manera automática. - -Debido a que Mull tiene protecciones más avanzadas y estrictas activadas por defecto a comparación de otros navegadores, algunos sitios web podrían no cargar o dejar de funcionar correctamente, a menos que se ajusten esas configuraciones. Puedes consultar esta [lista de problemas conocidos y soluciones](https://divestos.org/pages/broken#mull) para obtener consejos sobre una posible solución si encuentras un sitio roto. Ajustar una configuración para el correcto funcionamiento de un sitio web podría impactar tu privacidad y/o seguridad, por lo que debes asegurarte de comprender totalmente cualquier instrucción que sigues. - ## Safari (iOS) En iOS, cualquier aplicación que pueda navegar por la web está [restringida](https://developer.apple.com/app-store/review/guidelines) a utilizar un [framework WebKit](https://developer.apple.com/documentation/webkit) proporcionado por Apple, por lo que un navegador como [Brave](#brave) no utiliza el motor Chromium como sus homólogos en otros sistemas operativos. diff --git a/i18n/es/tools.md b/i18n/es/tools.md index 1f58078c..8d3b6381 100644 --- a/i18n/es/tools.md +++ b/i18n/es/tools.md @@ -76,21 +76,13 @@ Para obtener más información sobre cada proyecto, por qué han sido elegidos y **Cromite** es un navegador para Android basado en Chromium con bloqueo de anuncios y [mejoras de privacidad] integradas(https://github.com/uazo/cromite/blob/master/docs/FEATURES.md). Se trata de una bifurcación del popular navegador Bromite, ya descontinuado. - - [Lea la Reseña Completa :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) - -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** es un navegador basado en Firefox para Android centrado en la privacidad y la eliminación de componentes propietarios. - - - [Lea la Reseña Completa :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) + - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- - Recomendamos **Safari** por sus funciones [anti-huella digital](https://webkit.org/blog/15697/private-browsing-2-0) y bloqueo de rastreadores por defecto. También separa sus cookies en el modo de navegación privada para evitar el seguimiento entre pestañas. + We recommend **Safari** due to its [anti-fingerprinting](https://webkit.org/blog/15697/private-browsing-2-0) features and default tracker blocking. También separa sus cookies en el modo de navegación privada para evitar el seguimiento entre pestañas. - [Lea la Reseña Completa :material-arrow-right-drop-circle:](mobile-browsers.md#safari-ios) @@ -621,7 +613,6 @@ Para cifrar su unidad de SO, normalmente recomendamos utilizar la herramienta de
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -702,7 +693,6 @@ Estas herramientas pueden ser útiles para determinadas personas. Proporcionan f - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/fa/android/distributions.md b/i18n/fa/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/fa/android/distributions.md +++ b/i18n/fa/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/fa/device-integrity.md b/i18n/fa/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/fa/device-integrity.md +++ b/i18n/fa/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/fa/mobile-browsers.md b/i18n/fa/mobile-browsers.md index 3181b44c..9a1f1170 100644 --- a/i18n/fa/mobile-browsers.md +++ b/i18n/fa/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/fa/tools.md b/i18n/fa/tools.md index ff005a95..534e2822 100644 --- a/i18n/fa/tools.md +++ b/i18n/fa/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/fr/android/distributions.md b/i18n/fr/android/distributions.md index 4f28cbbb..1bcf6981 100644 --- a/i18n/fr/android/distributions.md +++ b/i18n/fr/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Critères **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. Nous vous suggérons de vous familiariser avec cette liste avant de choisir d'utiliser un projet, et de mener vos propres recherches pour vous assurer que c'est le bon choix pour vous. diff --git a/i18n/fr/device-integrity.md b/i18n/fr/device-integrity.md index c96866fa..3e0c2596 100644 --- a/i18n/fr/device-integrity.md +++ b/i18n/fr/device-integrity.md @@ -188,43 +188,3 @@ Il est important de noter que l'auditeur ne peut détecter efficacement les chan Aucune donnée à charactère personnel n'est soumise au service d'attestation. Nous vous recommandons de vous inscrire avec un compte anonyme et d'activer l'attestation à distance pour un contrôle continu. Si votre [modèle de menace](basics/threat-modeling.md) nécessite une certaine confidentialité, vous pouvez envisager d'utiliser [Orbot](tor.md#orbot) ou un VPN pour cacher votre adresse IP au service d'attestation. - -## Scanners embarqués - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -Il s'agit d'applications que vous pouvez installer sur votre appareil et qui l'analysent pour détecter des signes de compromission. - -
-

Avertissement

- -L'utilisation de ces applications ne suffit pas à déterminer qu'un appareil est "propre" et qu'il n'est pas la cible d'un logiciel espion particulier. - -
- -### Hypatia (Android) - -
- -![logo Hypatia](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![logo Hypatia](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Page d'accueil](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Politique de confidentialité" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Code source" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribuer } - -
-Téléchargements - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/fr/mobile-browsers.md b/i18n/fr/mobile-browsers.md index 4ebbbd1a..49b7f404 100644 --- a/i18n/fr/mobile-browsers.md +++ b/i18n/fr/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Logo Mull](assets/img/browsers/mull.svg){ align=right } - -**Mull** est un navigateur Android basé sur Firefox, orienté vers la protection de la vie privée et déblobé. Par rapport à Firefox, il offre d'emblée une bien meilleure protection contre la capture d'empreintes numérique et désactive la compilation JavaScript Just-in-Time (JIT) pour une sécurité accrue. Il supprime également tous les éléments propriétaires de Firefox, comme le remplacement des références à Google Play Services. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Téléchargements - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Les navigateurs basés sur Firefox (Gecko) sur Android [n'ont pas](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [d'isolation de site](https://wiki.mozilla.org/Project_Fission),[^1] une fonction de sécurité puissante qui protège contre un site malveillant effectuant une attaque de type [Spectre](https://fr.wikipedia.org/wiki/Spectre_(vuln%C3%A9rabilit%C3%A9)) pour accéder à la mémoire d'un autre site web que vous avez ouvert.[^2] Les navigateurs basés sur Chromium comme [Brave](#brave) fourniront une protection plus robuste contre les sites web malveillants. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. En téléchargeant Mull à partir du dépôt par défaut de F-Droid, vos mises à jour pourraient être retardées de quelques jours ou plus. - -Mull active de nombreuses fonctionnalités récupérées du [projet Tor uplift](https://wiki.mozilla.org/Security/Tor_Uplift) en utilisant les préférences d'[Arkenfox](desktop-browsers.md#arkenfox-advanced). Les blobs propriétaires sont supprimés du code de Mozilla à l'aide des scripts développés pour Fennec F-Droid. - -### Recommended Mull Configuration - -Nous vous conseillons d'installer [uBlock Origin](browser-extensions.md#ublock-origin) comme bloqueur de contenu si vous souhaitez bloquer les traqueurs dans Mull. - -Mull est livré avec des paramètres de protection de la vie privée configurés par défaut. Vous pouvez envisager de configurer les options **Supprimer les données de navigation lorsque l'on quitte l'application** dans les paramètres de Mull si vous souhaitez fermer automatiquement tous vos onglets ouverts lorsque vous quittez l'application, ou effacer automatiquement d'autres données telles que l'historique de navigation et les cookies. - -Les protections de la vie privée activées par défaut sur Mull étant plus avancées et plus strictes que celles de la plupart des navigateurs, il est possible que certains sites web ne se chargent pas ou ne fonctionnent pas correctement si vous n'ajustez pas ces paramètres. Vous pouvez consulter cette [liste de problèmes connus et de solutions de contournement](https://divestos.org/pages/broken#mull) pour obtenir des conseils sur une solution potentielle si vous rencontrez un site défectueux. Le fait d'ajuster un paramètre afin de corriger un site web peut avoir un impact sur votre vie privée/sécurité, assurez-vous donc de bien comprendre toutes les instructions que vous suivez. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/fr/tools.md b/i18n/fr/tools.md index 03806333..bcae71c9 100644 --- a/i18n/fr/tools.md +++ b/i18n/fr/tools.md @@ -78,14 +78,6 @@ Pour avoir plus de détails sur chaque projet, pour savoir pourquoi ils ont ét - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/he/android/distributions.md b/i18n/he/android/distributions.md index ea00f068..56897b5c 100644 --- a/i18n/he/android/distributions.md +++ b/i18n/he/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## קריטריונים **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. אנו מציעים לך להכיר את הרשימה הזו לפני שתבחר להשתמש בפרויקט, ולערוך מחקר משלך כדי להבטיח שזו הבחירה הנכונה עבורך. diff --git a/i18n/he/device-integrity.md b/i18n/he/device-integrity.md index 6dfcb508..db491be6 100644 --- a/i18n/he/device-integrity.md +++ b/i18n/he/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/he/mobile-browsers.md b/i18n/he/mobile-browsers.md index 9f02609c..54f7cf1e 100644 --- a/i18n/he/mobile-browsers.md +++ b/i18n/he/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/he/tools.md b/i18n/he/tools.md index 8a48890a..35f15ed0 100644 --- a/i18n/he/tools.md +++ b/i18n/he/tools.md @@ -78,14 +78,6 @@ If you want assistance figuring out the best privacy tools and alternative progr - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/hi/android/distributions.md b/i18n/hi/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/hi/android/distributions.md +++ b/i18n/hi/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/hi/device-integrity.md b/i18n/hi/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/hi/device-integrity.md +++ b/i18n/hi/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/hi/mobile-browsers.md b/i18n/hi/mobile-browsers.md index 845c5418..929d6285 100644 --- a/i18n/hi/mobile-browsers.md +++ b/i18n/hi/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/hi/tools.md b/i18n/hi/tools.md index 80b17afd..44dd5a59 100644 --- a/i18n/hi/tools.md +++ b/i18n/hi/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/hu/android/distributions.md b/i18n/hu/android/distributions.md index b72d0fb6..388d5325 100644 --- a/i18n/hu/android/distributions.md +++ b/i18n/hu/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Követelmények **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. Javasoljuk, hogy ismerkedj meg ezzel a listával, mielőtt kiválasztanál egy projektet, és végezz saját kutatásokat, hogy megbizonyosodj arról, hogy ez a megfelelő választás számodra. diff --git a/i18n/hu/device-integrity.md b/i18n/hu/device-integrity.md index 2501c6c1..ef518125 100644 --- a/i18n/hu/device-integrity.md +++ b/i18n/hu/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Figyelmeztetés

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/hu/mobile-browsers.md b/i18n/hu/mobile-browsers.md index fddaf982..b3f351f2 100644 --- a/i18n/hu/mobile-browsers.md +++ b/i18n/hu/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/hu/tools.md b/i18n/hu/tools.md index 60832f26..b08f5076 100644 --- a/i18n/hu/tools.md +++ b/i18n/hu/tools.md @@ -78,14 +78,6 @@ Ha további információt szeretnél megtudni az egyes projektekről, hogy miér - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/id/android/distributions.md b/i18n/id/android/distributions.md index 49fe0b07..4dd1d406 100644 --- a/i18n/id/android/distributions.md +++ b/i18n/id/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Kriteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. Kami sarankan Anda membiasakan diri dengan daftar ini sebelum memilih untuk menggunakan sebuah proyek, dan melakukan penelitian sendiri untuk memastikan bahwa itu adalah pilihan yang tepat untuk Anda. diff --git a/i18n/id/device-integrity.md b/i18n/id/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/id/device-integrity.md +++ b/i18n/id/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/id/mobile-browsers.md b/i18n/id/mobile-browsers.md index 3ea67813..eb1fd734 100644 --- a/i18n/id/mobile-browsers.md +++ b/i18n/id/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/id/tools.md b/i18n/id/tools.md index a862d20c..70294d75 100644 --- a/i18n/id/tools.md +++ b/i18n/id/tools.md @@ -78,14 +78,6 @@ Untuk detail lebih lanjut tentang setiap proyek, mengapa proyek tersebut dipilih - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/it/android/distributions.md b/i18n/it/android/distributions.md index 973e3259..839effc8 100644 --- a/i18n/it/android/distributions.md +++ b/i18n/it/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteri **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. Ti suggeriamo di familiarizzare con questo elenco prima di scegliere di utilizzare un progetto e di condurre le tue ricerche per assicurarti che si tratti della scelta adatta a te. diff --git a/i18n/it/device-integrity.md b/i18n/it/device-integrity.md index 620be259..47f71953 100644 --- a/i18n/it/device-integrity.md +++ b/i18n/it/device-integrity.md @@ -188,43 +188,3 @@ Auditor esegue l'attestazione e il rilevamento delle intrusioni con **due** disp Nessuna informazione personalmente identificabile è inviata al servizio di attestazione. Ti consigliamo di iscriverti con un profilo anonimo e di abilitare l'attestazione da remoto per il monitoraggio costante. Se il tuo [modello di minaccia](basics/threat-modeling.md) richiede la privacy, potresti considerare l'utilizzo di [Orbot](tor.md#orbot) o di una VPN, per nascondere il tuo indirizzo IP dal servizio di attestazione. - -## Scanner su dispositivo - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -Si tratta di app che puoi installare sul tuo dispositivo, che lo scansionano in cerca di segni di compromissione. - -
-

Avviso

- -L'utilizzo di queste app non è sufficiente per determinare che un dispositivo sia "pulito" e non preso di mira da uno strumento spyware in particolare. - -
- -### Hypatia (Android) - -
- -![Logo Hypatia](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Logo Hypatia](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Informativa sulla Privacy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Codice Sorgente" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribuisci } - -
-Scarica - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/it/mobile-browsers.md b/i18n/it/mobile-browsers.md index 77bac2a9..07c79e1e 100644 --- a/i18n/it/mobile-browsers.md +++ b/i18n/it/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Logo Mull](assets/img/browsers/mull.svg){ align=right } - -**Mull** è un browser Android orientato alla privacy e deblobbed, basato su Firefox. Rispetto a Firefox, offre una maggiore protezione dalle impronte digitali e disabilita la compilazione di JavaScript Just-in-Time (JIT) per una maggiore sicurezza. Inoltre, rimuove tutti gli elementi proprietari da Firefox, come la sostituzione dei riferimenti a Google Play Services. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Scarica - -- [:simple-fdroid: F-Droid](https://f-droid.org/it/packages/us.spotco.fennec_dos/) - -
- -
- -
-

Attenzione

- -I browser basati su Firefox (Gecko) su Android [non dispongono](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) dell' [isolamento dei siti](https://wiki.mozilla.org/Project_Fission),[^1] una potente funzione di sicurezza che protegge da un sito dannoso che esegue un attacco simile a [Spectre](https://it.wikipedia.org/wiki/Spectre_(vulnerabilità_di_sicurezza))per accedere alla memoria di un altro sito web che hai aperto.[^2] I browser basati su Chromium come [Brave](#brave) forniscono una protezione più solida contro i siti web dannosi. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Scaricando Mull dal repository predefinito di F-Droid, i tuoi aggiornamenti potrebbero ritardare di qualche giorno o più. - -Mull abilita molte delle funzionalità sviluppate dal [progetto Tor uplift](https://wiki.mozilla.org/Security/Tor_Uplift) utilizzando le preferenze di [Arkenfox](desktop-browsers.md#arkenfox-advanced). I blob proprietari vengono rimossi dal codice di Mozilla utilizzando gli script sviluppati per Fennec F-Droid. - -### Recommended Mull Configuration - -Suggeriamo di installare [uBlock Origin](browser-extensions.md#ublock-origin) come blocco dei contenuti se si desidera bloccare i tracker all'interno di Mull. - -Mull è dotato di impostazioni di protezione della privacy configurate di default. Si può prendere in considerazione la possibilità di configurare l'opzione **Elimina dati di navigazione all'uscita ** nelle impostazioni di Mull, se si desidera chiudere automaticamente tutte le schede aperte all'uscita dell'applicazione, oppure cancellare automaticamente altri dati come la cronologia di navigazione e i cookie. - -Poiché Mull ha attivato come impostazione predefinita protezioni della privacy più avanzate e rigorose rispetto alla maggior parte dei browser, alcuni siti web potrebbero non essere caricati o funzionare correttamente se non si regolano le impostazioni. È possibile consultare questo [elenco di problemi e soluzioni note](https://divestos.org/pages/broken#mull) per ottenere consigli su una possibile soluzione se incontri un sito non funzionante. La regolazione di un'impostazione per correggere un sito web potrebbe avere un impatto sulla tua privacy/sicurezza, quindi assicurati di aver compreso appieno le istruzioni che segui. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/it/tools.md b/i18n/it/tools.md index 29597983..afc82333 100644 --- a/i18n/it/tools.md +++ b/i18n/it/tools.md @@ -78,14 +78,6 @@ Per ulteriori dettagli su ogni progetto, perché è stato scelto e ulteriori con - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ Questi strumenti possono essere utili per alcuni individui. Forniscono funzional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/ja/android/distributions.md b/i18n/ja/android/distributions.md index 6d697040..e1f331c7 100644 --- a/i18n/ja/android/distributions.md +++ b/i18n/ja/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## 規準 **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. プロジェクトを利用する前に、このリストをよく理解し、ご自身で調査を行って、そのプロジェクトがあなたにとって適切な選択かどうかをご確認ください。 diff --git a/i18n/ja/device-integrity.md b/i18n/ja/device-integrity.md index 017addc3..29446150 100644 --- a/i18n/ja/device-integrity.md +++ b/i18n/ja/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## オンデバイス・スキャナー - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/ja/mobile-browsers.md b/i18n/ja/mobile-browsers.md index 6d738da2..bbdbdda1 100644 --- a/i18n/ja/mobile-browsers.md +++ b/i18n/ja/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/ja/tools.md b/i18n/ja/tools.md index 4d022361..ba9a2aaa 100644 --- a/i18n/ja/tools.md +++ b/i18n/ja/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/ko/android/distributions.md b/i18n/ko/android/distributions.md index 1fb13ea6..7f3805df 100644 --- a/i18n/ko/android/distributions.md +++ b/i18n/ko/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## 평가 기준 **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. 어떠한 프로젝트를 선택해 사용하기 전에, 이러한 요구 사항들을 숙지하고 여러분 스스로 조사하는 과정을 거쳐 적절한 선택을 하시기 바랍니다. diff --git a/i18n/ko/device-integrity.md b/i18n/ko/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/ko/device-integrity.md +++ b/i18n/ko/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/ko/mobile-browsers.md b/i18n/ko/mobile-browsers.md index e5f7e462..f77b8df4 100644 --- a/i18n/ko/mobile-browsers.md +++ b/i18n/ko/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/ko/tools.md b/i18n/ko/tools.md index 977b2799..06ba351c 100644 --- a/i18n/ko/tools.md +++ b/i18n/ko/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/ku-IQ/android/distributions.md b/i18n/ku-IQ/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/ku-IQ/android/distributions.md +++ b/i18n/ku-IQ/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/ku-IQ/device-integrity.md b/i18n/ku-IQ/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/ku-IQ/device-integrity.md +++ b/i18n/ku-IQ/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/ku-IQ/mobile-browsers.md b/i18n/ku-IQ/mobile-browsers.md index 845c5418..929d6285 100644 --- a/i18n/ku-IQ/mobile-browsers.md +++ b/i18n/ku-IQ/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/ku-IQ/tools.md b/i18n/ku-IQ/tools.md index 626ce2ef..1a6c942b 100644 --- a/i18n/ku-IQ/tools.md +++ b/i18n/ku-IQ/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/nl/android/distributions.md b/i18n/nl/android/distributions.md index 3712df03..48150d0c 100644 --- a/i18n/nl/android/distributions.md +++ b/i18n/nl/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. Wij stellen voor dat je jezelf vertrouwd maakt met deze lijst voordat je een project kiest, en jouw eigen onderzoek uitvoert om er zeker van te zijn dat je de juiste keuze maakt. diff --git a/i18n/nl/device-integrity.md b/i18n/nl/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/nl/device-integrity.md +++ b/i18n/nl/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/nl/mobile-browsers.md b/i18n/nl/mobile-browsers.md index 20c58c77..2d74d61a 100644 --- a/i18n/nl/mobile-browsers.md +++ b/i18n/nl/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/nl/tools.md b/i18n/nl/tools.md index e6d69347..99321bc0 100644 --- a/i18n/nl/tools.md +++ b/i18n/nl/tools.md @@ -78,14 +78,6 @@ Voor meer details over elk project, waarom ze werden gekozen, en extra tips of t - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/pl/android/distributions.md b/i18n/pl/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/pl/android/distributions.md +++ b/i18n/pl/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/pl/device-integrity.md b/i18n/pl/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/pl/device-integrity.md +++ b/i18n/pl/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/pl/mobile-browsers.md b/i18n/pl/mobile-browsers.md index f5a2a485..5379e549 100644 --- a/i18n/pl/mobile-browsers.md +++ b/i18n/pl/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/pl/tools.md b/i18n/pl/tools.md index 9f6af845..03d9528a 100644 --- a/i18n/pl/tools.md +++ b/i18n/pl/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/pt-BR/android/distributions.md b/i18n/pt-BR/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/pt-BR/android/distributions.md +++ b/i18n/pt-BR/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/pt-BR/device-integrity.md b/i18n/pt-BR/device-integrity.md index 90683207..ff2f2d51 100644 --- a/i18n/pt-BR/device-integrity.md +++ b/i18n/pt-BR/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Aviso

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/pt-BR/mobile-browsers.md b/i18n/pt-BR/mobile-browsers.md index 66aeea4b..85fc47f7 100644 --- a/i18n/pt-BR/mobile-browsers.md +++ b/i18n/pt-BR/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/pt-BR/tools.md b/i18n/pt-BR/tools.md index b1479d3e..e3de22a6 100644 --- a/i18n/pt-BR/tools.md +++ b/i18n/pt-BR/tools.md @@ -78,14 +78,6 @@ Para mais detalhes sobre cada projeto, porque foram escolhidos, e dicas ou truqu - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/pt/android/distributions.md b/i18n/pt/android/distributions.md index 5e7067bd..c450ae64 100644 --- a/i18n/pt/android/distributions.md +++ b/i18n/pt/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Framadate **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/pt/device-integrity.md b/i18n/pt/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/pt/device-integrity.md +++ b/i18n/pt/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/pt/mobile-browsers.md b/i18n/pt/mobile-browsers.md index a2e2ddc2..d93d8d88 100644 --- a/i18n/pt/mobile-browsers.md +++ b/i18n/pt/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/pt/tools.md b/i18n/pt/tools.md index 764f1af4..2039798f 100644 --- a/i18n/pt/tools.md +++ b/i18n/pt/tools.md @@ -78,14 +78,6 @@ Para obter mais detalhes sobre cada projeto, o motivo pelo qual foi escolhido e - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/ru/android/distributions.md b/i18n/ru/android/distributions.md index 52299c47..8b5bb01c 100644 --- a/i18n/ru/android/distributions.md +++ b/i18n/ru/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Критерии **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. Перед тем, как вы решите выбрать какой-либо проект, мы рекомендуем вам ознакомиться со списком критериев и провести собственное исследование, чтобы убедиться в правильности своего выбора. diff --git a/i18n/ru/device-integrity.md b/i18n/ru/device-integrity.md index 699b36d2..9f8bf085 100644 --- a/i18n/ru/device-integrity.md +++ b/i18n/ru/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Предупреждение

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/ru/mobile-browsers.md b/i18n/ru/mobile-browsers.md index 96328f1a..3e1127cb 100644 --- a/i18n/ru/mobile-browsers.md +++ b/i18n/ru/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/ru/tools.md b/i18n/ru/tools.md index f3adcf2f..706f979f 100644 --- a/i18n/ru/tools.md +++ b/i18n/ru/tools.md @@ -78,14 +78,6 @@ If you want assistance figuring out the best privacy tools and alternative progr - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/sv/android/distributions.md b/i18n/sv/android/distributions.md index 23fd5044..fa9dadf6 100644 --- a/i18n/sv/android/distributions.md +++ b/i18n/sv/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Kriterier **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. Vi föreslår att du bekantar dig med den här listan innan du väljer att använda ett projekt, och att du gör din egen forskning för att se till att det är rätt val för dig. diff --git a/i18n/sv/device-integrity.md b/i18n/sv/device-integrity.md index e9c79274..d27f1cb0 100644 --- a/i18n/sv/device-integrity.md +++ b/i18n/sv/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Varning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/sv/mobile-browsers.md b/i18n/sv/mobile-browsers.md index 45dc36b8..a0fcd6ad 100644 --- a/i18n/sv/mobile-browsers.md +++ b/i18n/sv/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Hemsida](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Integritetspolicy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Dokumentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Källkod" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-baserade webbläsare på Android [saknar](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [sidisolering](https://wiki.mozilla.org/Project_Fission),[^1] en kraftfull säkerhetsfunktion som skyddar när en hemsida försöker utföra en [Spectre](https://sv.wikipedia.org/wiki/Spectre_(s%C3%A4kerhetsh%C3%A5l))-liknande attack för att få tillgång till minnet av en annan hemsida du har öppen.[^2] Chromiumbaserade webbläsare som [Brave](#brave) ger bättre skydd mote farliga hemsidor. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -Vi föreslår att du installerar [uBlock Origin](browser-extensions.md#ublock-origin) som en innehållsblockerare om du vill blockera trackers inom Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Eftersom att Mull har mer avancerade och strikta integritetsskyddsinställningar aktiverade automatiskt jämfört med många webbläsare kan en del hemsidor stoppas från att laddas, eller inte fungera som tänkt, om du inte ändrar de inställningarna. Den här [listan med kända fel och lösningar](https://divestos.org/pages/broken#mull) kan ge dig tips om hur du kan åtgärda felen när du råkar på en sida som inte laddar korrekt. Att ändra inställningar för att fixa en sida som laddar fel kan påverka integritet och säkerhet, så var säker på att du förstår alla instruktioner du följer. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/sv/tools.md b/i18n/sv/tools.md index be1fa113..f1cb19d6 100644 --- a/i18n/sv/tools.md +++ b/i18n/sv/tools.md @@ -78,14 +78,6 @@ Om du vill ha mer information om varje projekt, varför de valdes ut och ytterli - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/tr/android/distributions.md b/i18n/tr/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/tr/android/distributions.md +++ b/i18n/tr/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/tr/device-integrity.md b/i18n/tr/device-integrity.md index 216b0a90..4430f650 100644 --- a/i18n/tr/device-integrity.md +++ b/i18n/tr/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/tr/mobile-browsers.md b/i18n/tr/mobile-browsers.md index a824b68a..85a9ec27 100644 --- a/i18n/tr/mobile-browsers.md +++ b/i18n/tr/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/tr/tools.md b/i18n/tr/tools.md index 74903b7a..2e6878b2 100644 --- a/i18n/tr/tools.md +++ b/i18n/tr/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/uk/android/distributions.md b/i18n/uk/android/distributions.md index 2966a58c..7952d774 100644 --- a/i18n/uk/android/distributions.md +++ b/i18n/uk/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/uk/device-integrity.md b/i18n/uk/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/uk/device-integrity.md +++ b/i18n/uk/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/uk/mobile-browsers.md b/i18n/uk/mobile-browsers.md index 8cf2485f..a63978aa 100644 --- a/i18n/uk/mobile-browsers.md +++ b/i18n/uk/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/uk/tools.md b/i18n/uk/tools.md index 4c4b239a..cbd143c8 100644 --- a/i18n/uk/tools.md +++ b/i18n/uk/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/vi/android/distributions.md b/i18n/vi/android/distributions.md index 08f2960b..04ebc9a2 100644 --- a/i18n/vi/android/distributions.md +++ b/i18n/vi/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Framadate **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/vi/device-integrity.md b/i18n/vi/device-integrity.md index fd35bf03..623a4839 100644 --- a/i18n/vi/device-integrity.md +++ b/i18n/vi/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

Warning

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/vi/mobile-browsers.md b/i18n/vi/mobile-browsers.md index e1a0b687..2ad544ce 100644 --- a/i18n/vi/mobile-browsers.md +++ b/i18n/vi/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/vi/tools.md b/i18n/vi/tools.md index ca542e61..e476461f 100644 --- a/i18n/vi/tools.md +++ b/i18n/vi/tools.md @@ -78,14 +78,6 @@ For more details about each project, why they were chosen, and additional tips o - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/zh-Hant/android/distributions.md b/i18n/zh-Hant/android/distributions.md index 9f53e244..e6753775 100644 --- a/i18n/zh-Hant/android/distributions.md +++ b/i18n/zh-Hant/android/distributions.md @@ -19,16 +19,6 @@ schema: "@context": http://schema.org "@type": 網頁 url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": 網頁 - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -70,38 +60,6 @@ GrapheneOS 支援 [沙盒化 Google Play](https://grapheneos.org/usage#sandboxed 如果您想要隱藏類似此類的資訊，以避免被您網路上或 ISP 上的對手發現，除了將連線檢查設定變更為 **Standard (Google)** 之外，您還 **必須** 使用 [可信賴的 VPN](../vpn.md)。 它可以在 :gear: **設定** → **網路與網際網路** → **Internet connectivity checks** 中找到. 此選項可讓您連線至 Google 伺服器進行連線檢查，加上 VPN 的使用，可協助您混入更多的 Android 裝置中。 -### DivestOS - -如果 GrapheneOS 與您的手機不相容，DivestOS 是一個很好的替代方案。 它支援各式各樣的手機，具有 _不同_ 等級的安全防護和品質控制。 - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** 是一個 [LineageOS](https://lineageos.org) 的軟分叉。 -DivestOS 從 LineageOS 繼承了許多 [支援的裝置](https://divestos.org/index.php?page=devices\&base=LineageOS) 。 它具有已簽名的構建，使其在某些非 Pixel 裝置上可以使用 [verified boot](../os/android-overview.md#verified-boot) 。 並非所有支援的裝置都支援驗證開機或其他安全功能。 - -[:octicons-home-16: 首頁](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="洋蔥服務" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="隱私權政策" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="文檔" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="原始碼" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="捐款" } - -
- -特別是韌體更新的 [狀態](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) ，會因為您的手機型號不同而有很大的差異。 雖然標準的 AOSP Bug 和漏洞可以透過標準的軟體更新（例如 DivestOS 提供的更新）來修補，但有些漏洞在沒有裝置製造商支援的情況下是無法修補的，因此即使使用最新的替代 ROM（例如 DivestOS），產品壽命結束的裝置安全性也會降低。 - -DivestOS 具有自動核心漏洞 ([CVE](https://zh.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [修補](https://gitlab.com/divested-mobile/cve_checker)，更少的專有設備驅動程式，和自訂的 [hosts](https://divested.dev/index.php?page=dnsbl) 文件。 其加固的 WebView： [Mulch](https://gitlab.com/divested-mobile/mulch) ，可針對所有架構啟用 [控制流完整性](https://en.wikipedia.org/wiki/Control-flow_integrity) ，以及 [網路狀態分割](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning) ，且接受 緊急更新 。 - -DivestOS 還包含來自GrapheneOS 的核心補丁，並透過 [defconfig 加固](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758) 啟用所有可用的核心安全功能。 所有高於3.4版本的核心都包含 整頁的[核心記憶體清理](https://lwn.net/Articles/334747) ，並且所有~22 Clang 編譯的核心都有啟用 [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) 。 - -DivestOS 也實現了一些最初專為 GrapheneOS 開發的系統加固補丁。 DivestOS 16.0 及更高版本實作了 GrapheneOS 的 `網路` 與 `傳感器` 權限切換、[加固的記憶體分配器](https://github.com/GrapheneOS/hardened_malloc)、[exec-spawning](https://grapheneos.org/usage#exec-spawning)、Java本地接口 [constification](https://zh.wikipedia.org/zh-tw/Const) 以及部分 [bionic](https://zh.wikipedia.org/zh-tw/Bionic_%28%E8%BB%9F%E9%AB%94%29) 加固補丁集。 17.1 及更高版本具備「根據每個網路完整的 MAC 位址隨機化」、[`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) 控制、自動重新開機，以及 Wi-Fi/Bluetooth [超時關閉選項](https://grapheneos.org/features#attack-surface-reduction) 。 - -DivestOS 使用 F-Droid 作為其預設應用程式商店。 我們通常 [建議避免使用 F-Droid](obtaining-apps.md#f-droid) ，但在 DivestOS 上這樣做是不可行的；開發人員透過自己的 F-Droid 儲存庫：[DivestOS Official](https://divestos.org/fdroid/official) 來更新他們的應用程式。 對於這些應用程式，您應該繼續使用 F-Droid ＋ **DivestOS 儲存庫** ，以保持這些元件為最新。 對於其他應用程式，我們推薦的 [應用程式獲取途徑](obtaining-apps.md) 仍然適用。 - -DivestOS 以替代服務取代 Android 與 Google 服務的許多背景網路連線，例如使用 OpenEUICC 來啟動 eSIM；使用 NTP.org 來設定網路時間；以及使用 Quad9 來設定 DNS。 這些連線可以修改，但它們與標準 Android 手機的網路連線不同，可能意味著您所使用的網路中的對手更容易推測出您手機上安裝的作業系統。 如果您擔心這一點，請考慮使用 [受信任的 VPN](../vpn.md) 並啟用本機 VPN [kill switch](../os/android-overview.md#vpn-killswitch) 來對您的區域網路和 ISP 隱藏此網路流量。 - ## 標準 \*\*請注意，我們與推薦的任何項目均無關。\*\*除了[我們的通用標準](../about/criteria.md)外，我們還制定了一套明確的要求，以便我們能夠提供客觀的建議。 我們建議您在選擇使用項目之前先熟悉此列表，並進行自己的研究，以確保它是您的正確選擇。 diff --git a/i18n/zh-Hant/device-integrity.md b/i18n/zh-Hant/device-integrity.md index f997d1e1..9620c4c2 100644 --- a/i18n/zh-Hant/device-integrity.md +++ b/i18n/zh-Hant/device-integrity.md @@ -189,43 +189,3 @@ Auditor 使用 **兩個** 設備執行證明和入侵檢測，即一個 _被驗 沒有個人識別資料被提交給證明服務。 建議使用匿名帳戶註冊，並啟用遠程認證，以進行持續監控。 如果您的 [威脅模型](basics/threat-modeling.md) 需要隱私性，可以考慮使用[Orbot](tor.md#orbot) 或VPN，從證明服務中隱藏 IP地址。 - -## 設備掃瞄器 - -防護下列威脅： - -- [:material-bug-outline: 被動攻擊](basics/common-threats.md#security-and-privacy){ .pg-orange } - -可在設備上安裝這些應用程式，這些應用程式會掃描裝置是否有遭駭洩漏跡象。 - -
-

警告

- -使用這些應用程式不足以確定設備是“乾淨的”，並不是特定間諜軟體工具的目標。 - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** 是 Android 的開放原始碼即時惡意軟體掃描器，由 [DivestOS](android/distributions.md#divestos) 的開發者開發。 它會訪問網際網路以下載已簽署的資料庫更新，但不會上傳您的檔案或任何元資料到雲端（掃描完全在本機執行）。 - -[:octicons-home-16: 首頁](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="隱私權政策" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="原始碼" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=捐款 } - -
-下載 - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia 特別擅長偵測常見的追蹤軟體（stalkerware）：如果懷疑自己是追蹤軟體的受害者，請 [造訪此頁面](https://stopstalkerware.org/information-for-survivors/) 尋求建議。 diff --git a/i18n/zh-Hant/mobile-browsers.md b/i18n/zh-Hant/mobile-browsers.md index 559d1273..c9fccb65 100644 --- a/i18n/zh-Hant/mobile-browsers.md +++ b/i18n/zh-Hant/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** 是一款基於 Firefox 的以隱私為重點，去除專有 二進位大型物件（blob） 的 Android 瀏覽器。 與 Firefox 相比，它提供了更強的開箱即用指紋識別保護，並禁用 JavaScript 即時 (JIT) 編譯以增強安全性。 它還刪除了 Firefox 中的所有商業專有元素，例如取代 Google Play 服務引用。 - -[:octicons-home-16: 首頁](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="隱私權政策" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="說明文件" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="原始碼" } - -
-下載 - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger "危險"

- -Android 上基於Firefox (Gecko) 的瀏覽器[缺乏](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [網站隔離](https://wiki.mozilla.org/Project_Fission)[^1] ，這是一個強大的安全功能，可防止惡意網站執行類似 [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)) 的攻擊以獲取您開啟的另一個網站的記憶體存取權限[^2] ；基於 Chromium 的瀏覽器（例如：​​[Brave](#brave)）將針對惡意網站提供更強大的保護。 - -
- -啟用 DivestOS 的[F-Droid 儲存庫](https://divestos.org/fdroid/official)，以便直接從開發者接收更新。 從預設的 F-Droid 儲存庫下載 Mull 將意味著更新可能會延遲幾天或更長時間。 - -Mull 透過[Tor 提升專案](https://wiki.mozilla.org/Security/Tor_Uplift)的[Arkenfox](desktop-browsers.md#arkenfox-advanced)的偏好來啟動許多上游高級功能。 使用為 Fennec F-Droid 開發的腳本從 Mozilla 程式碼中刪除商業專有 blob。 - -### 建議的 Mull 設定 - -如想封鎖 Mull 中的追蹤器，建議安裝 [uBlock Origin](browser-extensions.md#ublock-origin) 作為內容封鎖程式。 - -Mull 隨附預設配置的隱私保護設定。 如果想在退出應用程式時自動關閉所有開啟的標籤頁，或清除瀏覽等其他數據，可以考慮在Mull 的設定中配置**退出時刪除瀏覽資料**選項自動歷史記錄和cookie。 - -與大多數瀏覽器相比，Mull 預設啟用更高級、更嚴格的隱私保護，因此某些網站可能無法載入或正常運作，除非調整這些設定。 如果遇到損壞的網站，可以查閱此[已知問題和解決方法清單](https://divestos.org/pages/broken#mull)，以獲取有關潛在修復的建議。 調整設定以修復網站可能會影響隱私/安全，因此請確保完全理解所遵循的任何說明。 - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/zh-Hant/tools.md b/i18n/zh-Hant/tools.md index 010e0ae4..0a6b8e3e 100644 --- a/i18n/zh-Hant/tools.md +++ b/i18n/zh-Hant/tools.md @@ -78,14 +78,6 @@ description: Privacy Guides 社群所推薦的隱私工具、服務、軟體及 - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android) diff --git a/i18n/zh/android/distributions.md b/i18n/zh/android/distributions.md index 8ef42a87..035755bd 100644 --- a/i18n/zh/android/distributions.md +++ b/i18n/zh/android/distributions.md @@ -17,16 +17,6 @@ schema: "@context": http://schema.org "@type": WebPage url: ./ - - "@context": http://schema.org - "@type": CreativeWork - name: Divest - image: /assets/img/android/divestos.svg - url: https://divestos.org/ - sameAs: https://en.wikipedia.org/wiki/DivestOS - subjectOf: - "@context": http://schema.org - "@type": WebPage - url: ./ robots: nofollow, max-snippet:-1, max-image-preview:large --- @@ -68,38 +58,6 @@ By default, Android makes many network connections to Google to perform DNS conn If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../vpn.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. -### DivestOS - -If GrapheneOS isn't compatible with your phone, DivestOS is a good alternative. It supports a wide variety of phones with _varying_ levels of security protections and quality control. - -
- -![DivestOS logo](../assets/img/android/divestos.svg){ align=right } - -**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org). -DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices\&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](../os/android-overview.md#verified-boot) on some non-Pixel devices. Not all supported devices support verified boot or other security features. - -[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary } -[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" } -[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title="Documentation" } -[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title="Contribute" } - -
- -The [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) of firmware updates in particular will vary significantly depending on your phone model. While standard AOSP bugs and vulnerabilities can be fixed with standard software updates like those provided by DivestOS, some vulnerabilities cannot be patched without support from the device manufacturer, making end-of-life devices less safe even with an up-to-date alternative ROM like DivestOS. - -DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [control-flow integrity](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. - -DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled. - -DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's `INTERNET` and `SENSORS` permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), Java Native Interface [constification](https://en.wikipedia.org/wiki/Const_\(computer_programming\)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_\(software\)) hardening patchsets. 17.1 and higher features per-network full MAC address randomization, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, automatic reboot, and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction). - -DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). For these apps you should continue to use F-Droid **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply. - -DivestOS replaces many of Android's background network connections to Google services with alternative services, such as using OpenEUICC for eSIM activation, NTP.org for network time, and Quad9 for DNS. These connections can be modified, but their deviation from a standard Android phone's network connections could mean it is easier for an adversary on your network to deduce what operating system you have installed on your phone. If this is a concern to you, consider using a [trusted VPN](../vpn.md) and enabling the native VPN [kill switch](../os/android-overview.md#vpn-killswitch) to hide this network traffic from your local network and ISP. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. diff --git a/i18n/zh/device-integrity.md b/i18n/zh/device-integrity.md index 251811e8..24448eb4 100644 --- a/i18n/zh/device-integrity.md +++ b/i18n/zh/device-integrity.md @@ -188,43 +188,3 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. - -## On-Device Scanners - -Protects against the following threat(s): - -- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - -These are apps you can install on your device which scan your device for signs of compromise. - -
-

警告

- -Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. - -
- -### Hypatia (Android) - -
- -![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } -![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } - -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } -[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" } -[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner) - -
- -
- -Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors) for advice. diff --git a/i18n/zh/mobile-browsers.md b/i18n/zh/mobile-browsers.md index f0395e3d..53f9aa5a 100644 --- a/i18n/zh/mobile-browsers.md +++ b/i18n/zh/mobile-browsers.md @@ -263,47 +263,6 @@ These options can be found in :material-menu: → :gear: **Settings** → **Lega This disables update checks for the unmaintained Bromite adblock filter. -## Mull (Android) - -
- -![Mull logo](assets/img/browsers/mull.svg){ align=right } - -**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables JavaScript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing Google Play Services references. - -[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary } -[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title="Documentation" } -[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos) - -
- -
- -
-

Danger

- -Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/show_bug.cgi?id=1610822) [site isolation](https://wiki.mozilla.org/Project_Fission),[^1] a powerful security feature that protects against a malicious site performing a [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))-like attack to gain access to the memory of another website you have open.[^2] Chromium-based browsers like [Brave](#brave) will provide more robust protection against malicious websites. - -
- -Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer. - -Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid. - -### Recommended Mull Configuration - -We would suggest installing [uBlock Origin](browser-extensions.md#ublock-origin) as a content blocker if you want to block trackers within Mull. - -Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically. - -Because Mull has more advanced and strict privacy protections enabled by default compared to most browsers, some websites may not load or work properly unless you adjust those settings. You can consult this [list of known issues and workarounds](https://divestos.org/pages/broken#mull) for advice on a potential fix if you do encounter a broken site. Adjusting a setting in order to fix a website could impact your privacy/security, so make sure you fully understand any instructions you follow. - ## Safari (iOS) On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so a browser like [Brave](#brave) does not use the Chromium engine like its counterparts on other operating systems. diff --git a/i18n/zh/tools.md b/i18n/zh/tools.md index dc3f7fd9..8690f312 100644 --- a/i18n/zh/tools.md +++ b/i18n/zh/tools.md @@ -78,14 +78,6 @@ If you want assistance figuring out the best privacy tools and alternative progr - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#cromite-android) -- ![Mull logo](assets/img/browsers/mull.svg){ .lg .middle .twemoji } **Mull (Android)** - - --- - - **Mull** is a Firefox-based browser for Android centered around privacy and removing proprietary components. - - - [Read Full Review :material-arrow-right-drop-circle:](mobile-browsers.md#mull-android) - - ![Safari logo](assets/img/browsers/safari.svg){ .lg .middle .twemoji } **Safari (iOS)** --- @@ -620,7 +612,6 @@ For encrypting your OS drive, we typically recommend using the encryption tool y
- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji loading=lazy }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos) -- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
@@ -701,7 +692,6 @@ These tools may provide utility for certain individuals. They provide functional - ![MVT logo](assets/img/device-integrity/mvt.webp){ .twemoji loading=lazy } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit) - ![iMazing logo](assets/img/device-integrity/imazing.png){ .twemoji loading=lazy } [iMazing (iOS)](device-integrity.md#imazing-ios) - ![Auditor logo](assets/img/device-integrity/auditor.svg#only-light){ .twemoji loading=lazy }![Auditor logo](assets/img/device-integrity/auditor-dark.svg#only-dark){ .twemoji loading=lazy } [Auditor (Android)](device-integrity.md#auditor-android) -- ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ .twemoji loading=lazy }![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ .twemoji loading=lazy } [Hypatia (Android)](device-integrity.md#hypatia-android)