mirror of
https://github.com/privacyguides/privacyguides.org.git
synced 2026-05-25 04:41:28 +00:00
style!: Remove all mkdocs-material icon references
This commit is contained in:
@@ -53,7 +53,7 @@ Once you have opted-out of all of these sites for the first time, it's best to w
|
||||
|
||||
Otherwise, privacy journalist Yael Grauer has compiled an excellent list of data broker sites with direct links to their search tools and opt-out pages. You can take some time to go through each site to determine whether they have your information, and remove it:
|
||||
|
||||
[:simple-github: Big Ass Data Broker Opt-Out List](https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-List)
|
||||
[Big Ass Data Broker Opt-Out List](https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-List)
|
||||
{ .pg:buttons }
|
||||
|
||||
If you don't use an automatic scanner to find results about you, consider setting a reminder to re-do this process every 3, 6, or 12 months depending on your risk level and the amount of personal data you have out there. Unfortunately, it is common for your data to re-appear over time or show up on brand-new people search sites even after you opt out.
|
||||
|
||||
@@ -24,11 +24,11 @@ These are our favorite public DNS resolvers based on their privacy and security
|
||||
|
||||
| DNS Provider | Protocols | Logging / Privacy Policy | [ECS](../../../wiki/advanced/dns-overview/index.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||
|---|---|---|---|---|---|
|
||||
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext <br>DoH/3 <br>DoT <br>DoQ <br>DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardSDNSFilter) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) |
|
||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext <br>DoH/3 <br>DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) |
|
||||
| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext <br>DoH/3 <br>DoT <br>DoQ | No[^3] | No | Based on server choice. | Yes <br>[:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) <br>[:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) |
|
||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH <br>DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) |
|
||||
| [**Quad9**](https://quad9.net) | Cleartext <br>DoH/3 <br>DoT <br>DoQ <br>DNSCrypt | Anonymized[^5] | Optional | Based on server choice. Malware blocking is included by default. | Yes <br>[:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) <br>[:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) |
|
||||
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext <br>DoH/3 <br>DoT <br>DoQ <br>DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [Link](https://github.com/AdguardTeam/AdGuardSDNSFilter) | Yes [Link](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) |
|
||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext <br>DoH/3 <br>DoT | Anonymized[^2] | No | Based on server choice. | No [Link](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) |
|
||||
| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext <br>DoH/3 <br>DoT <br>DoQ | No[^3] | No | Based on server choice. | Yes <br>[iOS](https://docs.controld.com/docs/ios-platform) <br>[macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) |
|
||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH <br>DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [Link](https://github.com/mullvad/dns-adblock) | Yes [Link](https://github.com/mullvad/encrypted-dns-profiles) |
|
||||
| [**Quad9**](https://quad9.net) | Cleartext <br>DoH/3 <br>DoT <br>DoQ <br>DNSCrypt | Anonymized[^5] | Optional | Based on server choice. Malware blocking is included by default. | Yes <br>[iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) <br>[macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) |
|
||||
|
||||
[^1]:
|
||||
AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours.
|
||||
@@ -132,7 +132,6 @@ While RethinkDNS takes up the Android VPN slot, you can still use a VPN or Orbot
|
||||
> [!WARNING]
|
||||
> The anonymized DNS feature does [not](../../../wiki/advanced/dns-overview/index.md#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic.
|
||||
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../../../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
@@ -23,13 +23,13 @@ For everything else, we recommend a variety of email providers based on sustaina
|
||||
|
||||
| Provider | OpenPGP / WKD | IMAP / SMTP | Encrypted Storage | Anonymous Payment Methods |
|
||||
|---|---|---|---|---|
|
||||
| [Proton Mail](#proton-mail) | :material-check:{ .pg-green } | :material-information-outline:{ .pg-blue } Paid plans only | :material-check:{ .pg-green } | Cash <br>Monero via third party |
|
||||
| [Mailbox Mail](#mailbox-mail) | :material-check:{ .pg-green } | :material-check:{ .pg-green } | :material-information-outline:{ .pg-blue } Mail only | Cash |
|
||||
| [Tuta](#tuta) | :material-alert-outline:{ .pg-orange } | :material-alert-outline:{ .pg-orange } | :material-check:{ .pg-green } | Monero via third party <br>Cash via third party |
|
||||
| [Proton Mail](#proton-mail) | Yes | Paid plans only | Yes | Cash <br>Monero via third party |
|
||||
| [Mailbox Mail](#mailbox-mail) | Yes | Yes | Mail only | Cash |
|
||||
| [Tuta](#tuta) | Partial | Partial | Yes | Monero via third party <br>Cash via third party |
|
||||
|
||||
In addition to (or instead of) an email provider recommended here, you may wish to consider a dedicated [email aliasing service](../email-aliasing/index.md#recommended-providers) to protect your privacy. Among other things, these services can help protect your real inbox from spam, prevent marketers from correlating your accounts, and encrypt all incoming messages with PGP.
|
||||
|
||||
- [More Information :material-arrow-right-drop-circle:](../email-aliasing/index.md)
|
||||
- [More Information](../email-aliasing/index.md)
|
||||
|
||||
## OpenPGP Compatible Services
|
||||
|
||||
@@ -44,12 +44,11 @@ These providers natively support OpenPGP encryption/decryption and the [Web Key
|
||||
|
||||
> [!WARNING]
|
||||
> When using E2EE technology like OpenPGP your email will still have some metadata that is not encrypted in the header of the email, generally including the subject line! Read more about [email metadata](../../../wiki/basics/email-security/index.md#email-metadata-overview).
|
||||
>
|
||||
>
|
||||
> OpenPGP also does not support forward secrecy, which means if the private key of either you or the message recipient is ever stolen, all previous messages encrypted with it will be exposed.
|
||||
>
|
||||
>
|
||||
> - [How do I protect my private keys?](../../../wiki/basics/email-security/index.md#how-do-i-protect-my-private-keys)
|
||||
|
||||
|
||||
### Proton Mail
|
||||
|
||||
**Proton Mail** is an email service with a focus on privacy, encryption, security, and ease of use. They have been in operation since 2013. Proton AG is based in Geneva, Switzerland.
|
||||
@@ -77,47 +76,47 @@ Proton Mail has internal crash reports that are **not** shared with third partie
|
||||
|
||||
=== "Web"
|
||||
|
||||
From your inbox, select :gear: → **All Settings** → **Account** → **Security and privacy** → **Privacy and data collection**.
|
||||
From your inbox, select Settings → **All Settings** → **Account** → **Security and privacy** → **Privacy and data collection**.
|
||||
|
||||
- [ ] Disable **Collect usage dignostics**
|
||||
- [ ] Disable **Send crash reports**
|
||||
|
||||
=== "Mobile"
|
||||
|
||||
From your inbox, select :material-menu: → :gear: **Settings** → select your username.
|
||||
From your inbox, select the menu → **Settings** → select your username.
|
||||
|
||||
- [ ] Disable **Send crash reports**
|
||||
- [ ] Disable **Collect usage dignostics**
|
||||
|
||||
#### :material-check:{ .pg-green } Custom Domains and Aliases
|
||||
#### Custom Domains and Aliases
|
||||
|
||||
Paid Proton Mail subscribers can use their own domain with the service or a [catch-all](https://proton.me/support/catch-all) address. Proton Mail also supports [sub-addressing](https://proton.me/support/creating-aliases), which is useful for people who don't want to purchase a domain.
|
||||
|
||||
#### :material-check:{ .pg-green } Private Payment Methods
|
||||
#### Private Payment Methods
|
||||
|
||||
Proton Mail [accepts](https://proton.me/support/payment-options) **cash** by mail in addition to standard credit/debit card, [Bitcoin](../../../wiki/advanced/payments/index.md#other-coins-bitcoin-ethereum-etc), and PayPal payments. Additionally, you can use [**Monero**](../../software/cryptocurrency/index.md#monero) to purchase vouchers for Proton Mail Plus or Proton Unlimited via their [official](https://discuss.privacyguides.net/t/add-monero-as-an-anonymous-payment-method-for-proton-services/31058/15) reseller [ProxyStore](https://dys2p.com/en/2025-09-09-proton.html).
|
||||
|
||||
#### :material-check:{ .pg-green } Account Security
|
||||
#### Account Security
|
||||
|
||||
Proton Mail supports TOTP [two-factor authentication](https://proton.me/support/two-factor-authentication-2fa) and [hardware security keys](https://proton.me/support/2fa-security-key) using FIDO2 or U2F standards. The use of a hardware security key requires setting up TOTP two-factor authentication first.
|
||||
|
||||
#### :material-check:{ .pg-green } Data Security
|
||||
#### Data Security
|
||||
|
||||
Proton Mail stores your [emails](https://proton.me/blog/zero-access-encryption) and [calendars](https://proton.me/news/protoncalendar-security-model) with PGP-based encryption at rest, where only you have the decryption keys needed to access them later.
|
||||
|
||||
Certain information stored in [Proton Contacts](https://proton.me/support/proton-contacts), such as display names and email addresses, are **not** secured with your own encryption keys, so Proton is able to read them. Contact fields which are protected with your own encryption keys, such as phone numbers, are indicated with a padlock icon.
|
||||
|
||||
#### :material-check:{ .pg-green } Email Encryption
|
||||
#### Email Encryption
|
||||
|
||||
Proton Mail has [integrated OpenPGP encryption](https://proton.me/support/how-to-use-pgp) in their webmail. Emails to other Proton Mail accounts are encrypted automatically, and encryption to non-Proton Mail addresses with an OpenPGP key can be enabled easily in your account settings. Proton also supports automatic external key discovery with WKD. This means that emails sent to other providers which use WKD will be automatically encrypted with OpenPGP as well, without the need to manually exchange public PGP keys with your contacts. They also allow you to [encrypt messages to non-Proton Mail addresses without OpenPGP](https://proton.me/support/password-protected-emails), without the need for them to sign up for a Proton Mail account.
|
||||
|
||||
Proton Mail also publishes the public keys of Proton accounts via HTTP from their WKD. This allows people who don't use Proton Mail to find the OpenPGP keys of Proton Mail accounts easily for cross-provider E2EE. This only applies to email addresses ending in one of Proton's own domains, like `@proton.me`. If you use a custom domain, you must [configure WKD](../../../wiki/basics/email-security/index.md#what-is-the-web-key-directory-standard) separately.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Account Termination
|
||||
#### Account Termination
|
||||
|
||||
If you have a paid account and your [bill is unpaid](https://proton.me/support/delinquency) after 14 days, you won't be able to access your data. After 30 days, your account will become delinquent and won't receive incoming mail. You will continue to be billed during this period. Proton will [delete inactive free accounts](https://proton.me/support/inactive-accounts) after one year. You **cannot** reuse the email address of a deactivated account.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Additional Functionality
|
||||
#### Additional Functionality
|
||||
|
||||
Proton Mail's [Unlimited](https://proton.me/support/proton-plans#proton-unlimited) plan also enables access to other Proton services in addition to providing multiple custom domains, unlimited hide-my-email aliases, and 500 GB of storage.
|
||||
|
||||
@@ -134,35 +133,35 @@ Accounts start with up to 2 GB storage, which can be upgraded as needed.
|
||||
|
||||
[{{< badge content="Web" >}}](https://login.mailbox.org)
|
||||
|
||||
#### :material-check:{ .pg-green } Custom Domains and Aliases
|
||||
#### Custom Domains and Aliases
|
||||
|
||||
Mailbox Mail lets you use your own domain, and they support [catch-all](https://kb.mailbox.org/en/private/custom-domains/use-your-own-domain-with-catch-all/) addresses. Mailbox Mail also supports [sub-addressing](https://kb.mailbox.org/en/private/e-mail/what-is-an-alias-and-how-do-i-use-it/), which is useful if you don't want to purchase a domain.
|
||||
|
||||
#### :material-check:{ .pg-green } Private Payment Methods
|
||||
#### Private Payment Methods
|
||||
|
||||
Mailbox Mail doesn't accept any cryptocurrencies as a result of their payment processor BitPay suspending operations in Germany. However, they do accept **cash** by mail, **cash** payment to bank account, bank transfer, credit card, PayPal, and a couple of German-specific processors: Paydirekt and Sofortüberweisung.
|
||||
|
||||
#### :material-check:{ .pg-green } Account Security
|
||||
#### Account Security
|
||||
|
||||
Mailbox Mail supports [two-factor authentication](https://kb.mailbox.org/en/private/security-and-privacy/how-to-use-two-factor-authentication-2fa/) for their webmail only. You can use either TOTP or a [YubiKey](../../hardware/security-keys/index.md#yubikey) via the [YubiCloud](https://yubico.com/products/services-software/yubicloud). Web standards such as [WebAuthn](../../../wiki/basics/multi-factor-authentication/index.md#fido-fast-identity-online) are not yet supported.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Data Security
|
||||
#### Data Security
|
||||
|
||||
Mailbox Mail allows for encryption of incoming mail using their [encrypted mailbox](https://kb.mailbox.org/en/private/encryption/your-encrypted-mailbox/). New messages that you receive will then be immediately encrypted with your public key.
|
||||
|
||||
However, [Open-Xchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox Mail, [does not support](https://kb.mailbox.org/en/business/security-privacy-article/encryption-of-calendar-and-address-book/) the encryption of your address book and calendar. A [standalone option](../calendar/index.md) may be more appropriate for that data.
|
||||
|
||||
#### :material-check:{ .pg-green } Email Encryption
|
||||
#### Email Encryption
|
||||
|
||||
Mailbox Mail has [integrated encryption](https://kb.mailbox.org/en/private/encryption/how-can-e-mails-be-encrypted-with-pgp/) in their webmail, which simplifies sending messages to people with public OpenPGP keys. They also allow [remote recipients to decrypt an email](https://kb.mailbox.org/en/private/encryption/my-recipient-does-not-use-pgp/) on Mailbox Mail's servers. This feature is useful when the remote recipient does not have OpenPGP and cannot decrypt a copy of the email in their own mailbox.
|
||||
|
||||
Mailbox Mail also supports the discovery of public keys via HTTP from their WKD. This allows people outside of Mailbox Mail to find the OpenPGP keys of Mailbox Mail accounts easily for cross-provider E2EE. This only applies to email addresses ending in one of Mailbox Mail's own domains, like `@mailbox.org`. If you use a custom domain, you must [configure WKD](../../../wiki/basics/email-security/index.md#what-is-the-web-key-directory-standard) separately.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Account Termination
|
||||
#### Account Termination
|
||||
|
||||
Your account will be set to a restricted user account when your contract ends. It will be irrevocably deleted after [30 days](https://kb.mailbox.org/en/en/private/account/reactivate-a-deleted-account/).
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Additional Functionality
|
||||
#### Additional Functionality
|
||||
|
||||
You can access your Mailbox Mail account via IMAP/SMTP using their [.onion service](https://kb.mailbox.org/en/en/private/security-privacy/using-the-tor-exit-node-from-mailbox/). However, their webmail interface cannot be accessed via their .onion service, and you may experience TLS certificate errors.
|
||||
|
||||
@@ -201,31 +200,31 @@ Free accounts start with 1 GB of storage.
|
||||
|
||||
Tuta doesn't support the [IMAP protocol](https://tuta.com/support#imap) or the use of third-party [email clients](../../software/email-clients/index.md), and you also won't be able to add [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) to the Tuta app. [Email import](https://github.com/tutao/tutanota/issues/630) is not currently supported either, though this is [due to be changed](https://tuta.com/blog/kickoff-import). Emails can be exported [individually or by bulk selection](https://tuta.com/support#generalMail) per folder, which may be inconvenient if you have many folders.
|
||||
|
||||
#### :material-check:{ .pg-green } Custom Domains and Aliases
|
||||
#### Custom Domains and Aliases
|
||||
|
||||
Paid Tuta accounts can use either 15 or 30 aliases depending on their plan and unlimited aliases on [custom domains](https://tuta.com/support#custom-domain). Tuta doesn't allow for [sub-addressing (plus addresses)](https://tuta.com/support#plus), but you can use a [catch-all](https://tuta.com/support#settings-global) with a custom domain.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Private Payment Methods
|
||||
#### Private Payment Methods
|
||||
|
||||
Tuta only directly accepts credit cards and PayPal, however you can use [**cryptocurrency**](../../software/cryptocurrency/index.md) to purchase gift cards via their [partnership](https://tuta.com/support/#cryptocurrency) with ProxyStore.
|
||||
|
||||
#### :material-check:{ .pg-green } Account Security
|
||||
#### Account Security
|
||||
|
||||
Tuta supports [two-factor authentication](https://tuta.com/support#2fa) with either TOTP or U2F.
|
||||
|
||||
#### :material-check:{ .pg-green } Data Security
|
||||
#### Data Security
|
||||
|
||||
Tuta stores your [emails](https://tuta.com/support#what-encrypted), [address book contacts](https://tuta.com/support#encrypted-address-book), and [calendars](https://tuta.com/support#calendar) with strong encryption where only you have the decryption keys. This means the messages and other data stored in your account cannot be read by anyone other than you after they are stored.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Email Encryption
|
||||
#### Email Encryption
|
||||
|
||||
Tuta [does not use OpenPGP](https://tuta.com/support/#pgp). Tuta accounts can only receive encrypted emails from non-Tuta email accounts when sent via a [temporary Tuta mailbox](https://tuta.com/support/#encrypted-email-external).
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Account Termination
|
||||
#### Account Termination
|
||||
|
||||
Tuta will [delete inactive free accounts](https://tuta.com/support#inactive-accounts) after six months. You can reuse a deactivated free account if you pay.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Additional Functionality
|
||||
#### Additional Functionality
|
||||
|
||||
Tuta offers the business version of [Tuta to non-profit organizations](https://tuta.com/blog/secure-email-for-non-profit) for free or with a heavy discount.
|
||||
|
||||
|
||||
@@ -60,7 +60,7 @@ The protocol was independently [audited](https://eprint.iacr.org/2016/1013.pdf)
|
||||
|
||||
### Molly (Android)
|
||||
|
||||
If you use Android and your threat model requires protecting against [:material-target-account: Targeted Attacks](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals){ .pg-red } you may consider using this alternative app, which features a number of security and usability improvements, to access the Signal network.
|
||||
If you use Android and your threat model requires protecting against [Targeted Attacks](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals){ .pg-red } you may consider using this alternative app, which features a number of security and usability improvements, to access the Signal network.
|
||||
|
||||
**Molly** is an alternative Signal client for Android which allows you to encrypt the local database with a passphrase at rest, to have unused RAM data securely shredded, to route your connection via Tor, and [more](https://blog.privacyguides.org/2022/07/07/signal-configuration-and-hardening#privacy-and-security-features). It also has usability improvements including scheduled backups, automatic locking, and the ability to use your Android phone as a linked device instead of the primary device for a Signal account.
|
||||
|
||||
@@ -83,7 +83,7 @@ Both versions of Molly provide the same security improvements and support [repro
|
||||
|
||||
## SimpleX Chat
|
||||
|
||||
**SimpleX Chat** is an instant messenger that doesn't depend on any unique identifiers such as phone numbers or usernames. Its decentralized network makes SimpleX Chat an effective tool against [:material-close-outline: Censorship](../../../wiki/basics/common-threats/index.md#avoiding-censorship){ .pg-blue-gray }.
|
||||
**SimpleX Chat** is an instant messenger that doesn't depend on any unique identifiers such as phone numbers or usernames. Its decentralized network makes SimpleX Chat an effective tool against [Censorship](../../../wiki/basics/common-threats/index.md#avoiding-censorship){ .pg-blue-gray }.
|
||||
|
||||
{{< cards >}}
|
||||
{{< card link="https://simplex.chat" title="Homepage" icon="home" >}}
|
||||
@@ -108,7 +108,7 @@ SimpleX Chat was independently audited in [July 2024](https://simplex.chat/blog/
|
||||
|
||||
## Briar
|
||||
|
||||
**Briar** is an encrypted instant messenger that [connects](https://briarproject.org/how-it-works) to other clients using the [Tor network](../../advanced/alternative-networks/index.md#tor), making it an effective tool at circumventing [:material-close-outline: Censorship](../../../wiki/basics/common-threats/index.md#avoiding-censorship){ .pg-blue-gray }. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar’s local mesh mode can be useful when internet availability is a problem.
|
||||
**Briar** is an encrypted instant messenger that [connects](https://briarproject.org/how-it-works) to other clients using the [Tor network](../../advanced/alternative-networks/index.md#tor), making it an effective tool at circumventing [Censorship](../../../wiki/basics/common-threats/index.md#avoiding-censorship){ .pg-blue-gray }. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar’s local mesh mode can be useful when internet availability is a problem.
|
||||
|
||||
{{< cards >}}
|
||||
{{< card link="https://briarproject.org" title="Homepage" icon="home" >}}
|
||||
|
||||
@@ -25,9 +25,9 @@ Consider using a [VPN](../vpn/index.md) or [Tor](../../software/tor/index.md) if
|
||||
|
||||
| Provider | Search Index | Tor Hidden Service | Logging / Privacy Policy | Country of Operation |
|
||||
|---|---|---|---|---|
|
||||
| [Brave Search](#brave-search) | [Independent](https://brave.com/search-independence) | :material-check:{ .pg-green } | Anonymized[^1] | United States |
|
||||
| [DuckDuckGo](#duckduckgo) | [Bing](https://help.duckduckgo.com/results/sources) | :material-check:{ .pg-green } | Anonymized[^2] | United States |
|
||||
| [Startpage](#startpage) | [Google and Bing](https://support.startpage.com/hc/articles/4522435533844-What-is-the-relationship-between-Startpage-and-your-search-partners-like-Google-and-Microsoft-Bing) | :material-check:{ .pg-green } | Anonymized[^3] | Netherlands |
|
||||
| [Brave Search](#brave-search) | [Independent](https://brave.com/search-independence) | Yes | Anonymized[^1] | United States |
|
||||
| [DuckDuckGo](#duckduckgo) | [Bing](https://help.duckduckgo.com/results/sources) | Yes | Anonymized[^2] | United States |
|
||||
| [Startpage](#startpage) | [Google and Bing](https://support.startpage.com/hc/articles/4522435533844-What-is-the-relationship-between-Startpage-and-your-search-partners-like-Google-and-Microsoft-Bing) | Yes | Anonymized[^3] | Netherlands |
|
||||
|
||||
[^1]:
|
||||
Brave Search collects aggregated usage metrics, which includes the OS and the user agent. However, they do not collect PII. To serve [anonymous local results](https://search.brave.com/help/anonymous-local-results), IP addresses are temporarily processed, but are not retained.
|
||||
|
||||
@@ -30,9 +30,9 @@ Our recommended providers use encryption, support WireGuard & OpenVPN, and have
|
||||
|
||||
| Provider | Countries | WireGuard | Port Forwarding | IPv6 | Anonymous Payments |
|
||||
|---|---|---|---|---|---|
|
||||
| [Proton](#proton-vpn) | 127+ | :material-check:{ .pg-green } | :material-alert-outline:{ .pg-orange } Partial Support | :material-information-outline:{ .pg-blue } Limited Support | Cash |
|
||||
| [IVPN](#ivpn) | 41+ | :material-check:{ .pg-green } | :material-alert-outline:{ .pg-orange } | :material-information-outline:{ .pg-blue } Outgoing Only | Monero Cash |
|
||||
| [Mullvad](#mullvad) | 49+ | :material-check:{ .pg-green } | :material-alert-outline:{ .pg-orange } | :material-check:{ .pg-green } | Monero Cash |
|
||||
| [Proton](#proton-vpn) | 127+ | Yes | Partial Support | Limited Support | Cash |
|
||||
| [IVPN](#ivpn) | 41+ | Yes | No | Outgoing Only | Monero Cash |
|
||||
| [Mullvad](#mullvad) | 49+ | Yes | No | Yes | Monero Cash |
|
||||
|
||||
### Proton VPN
|
||||
|
||||
@@ -50,7 +50,7 @@ Our recommended providers use encryption, support WireGuard & OpenVPN, and have
|
||||
[{{< badge content="App Store" color="blue" >}}](https://apps.apple.com/app/id1437005085)
|
||||
[{{< badge content="GitHub" >}}](https://github.com/ProtonVPN/android-app/releases)
|
||||
|
||||
#### :material-check:{ .pg-green } 127 Countries
|
||||
#### 127 Countries
|
||||
|
||||
Proton VPN has [servers in 127 countries](https://protonvpn.com/vpn-servers)(1) or [10](https://protonvpn.com/support/how-to-create-free-vpn-account) if you use their [free plan](https://protonvpn.com/blog/product-roadmap-winter-2025-2026).(2) Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
|
||||
{ .annotate }
|
||||
@@ -60,48 +60,48 @@ Proton VPN has [servers in 127 countries](https://protonvpn.com/vpn-servers)(1)
|
||||
|
||||
We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
|
||||
|
||||
#### :material-check:{ .pg-green } Independently Audited
|
||||
#### Independently Audited
|
||||
|
||||
Independent security researcher Ruben Santamarta conducted audits for Proton VPN's [browser extensions](https://drive.proton.me/urls/RWDD2SHT98#v7ZrwNcafkG8) and [apps](https://drive.proton.me/urls/RVW8TXG484#uTXX5Fc9GADo) in September 2024 and January 2025, respectively. Proton VPN's infrastrcture has undergone [annual audits](https://protonvpn.com/blog/no-logs-audit) by Securitum since 2022.
|
||||
|
||||
Previously, Proton VPN underwent an independent audit by SEC Consult in January 2020. SEC Consult found some medium and low risk vulnerabilities in Proton VPN's Windows, Android, and iOS applications, all of which were "properly fixed" by Proton VPN before the reports were published. None of the issues identified would have provided an attacker remote access to your device or traffic. You can view individual reports for each platform in their dedicated [blog post](https://web.archive.org/web/20250307041036/https://protonvpn.com/blog/open-source) on the audit.
|
||||
|
||||
#### :material-check:{ .pg-green } Open-Source Clients
|
||||
#### Open-Source Clients
|
||||
|
||||
Proton VPN provides the source code for their desktop and mobile clients in their [GitHub organization](https://github.com/ProtonVPN).
|
||||
|
||||
#### :material-check:{ .pg-green } Accepts Cash
|
||||
#### Accepts Cash
|
||||
|
||||
Proton VPN, in addition to accepting credit/debit cards, PayPal, and [Bitcoin](../../../wiki/advanced/payments/index.md#other-coins-bitcoin-ethereum-etc), also accepts **cash/local currency** as an anonymous form of payment.
|
||||
|
||||
#### :material-check:{ .pg-green } WireGuard Support
|
||||
#### WireGuard Support
|
||||
|
||||
Proton VPN supports the WireGuard® protocol. [WireGuard](https://wireguard.com) is a newer protocol that uses state-of-the-art [cryptography](https://wireguard.com/protocol). Additionally, WireGuard aims to be simpler and more performant.
|
||||
|
||||
Proton VPN [recommends](https://protonvpn.com/blog/wireguard) the use of WireGuard with their service. Proton VPN also offers a WireGuard configuration generator for use with the official WireGuard [apps](https://wireguard.com/install).
|
||||
|
||||
#### :material-alert-outline:{ .pg-orange } Limited IPv6 Support
|
||||
#### Limited IPv6 Support
|
||||
|
||||
Proton [now supports IPv6](https://protonvpn.com/support/prevent-ipv6-vpn-leaks) in their browser extension and Linux client, but only 80% of their servers are IPv6-compatible. On other platforms, the Proton VPN client will block all outgoing IPv6 traffic, so you don't have to worry about your IPv6 address being leaked, but you will not be able to connect to any IPv6-only sites, nor will you be able to connect to Proton VPN from an IPv6-only network.
|
||||
|
||||
#### :material-information-outline:{ .pg-info } Remote Port Forwarding
|
||||
#### Remote Port Forwarding
|
||||
|
||||
Proton VPN currently only supports ephemeral remote [port forwarding](https://protonvpn.com/support/port-forwarding) via NAT-PMP, with 60 second lease times. The official Windows and Linux apps provide an easy-to-access option for it, while on other operating systems you'll need to run your own [NAT-PMP client](https://protonvpn.com/support/port-forwarding-manual-setup). Torrent applications often support NAT-PMP natively.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Anti-Censorship
|
||||
#### Anti-Censorship
|
||||
|
||||
Proton VPN has their [Stealth](https://protonvpn.com/blog/stealth-vpn-protocol) protocol which *may* help in situations where VPN protocols like OpenVPN or WireGuard are blocked with various rudimentary techniques. Stealth encapsulates the VPN tunnel in TLS session in order to look like more generic internet traffic.
|
||||
|
||||
Unfortunately, it does not work very well in countries where sophisticated filters that analyze all outgoing traffic in an attempt to discover encrypted tunnels are deployed. Stealth is available on Android, iOS, Windows, and macOS, but it's not yet available on Linux.
|
||||
|
||||
#### :material-check:{ .pg-green } Mobile Clients
|
||||
#### Mobile Clients
|
||||
|
||||
Proton VPN has published [App Store](https://apps.apple.com/app/id1437005085) and [Google Play](https://play.google.com/store/apps/details?id=ch.protonvpn.android) clients, both supporting an easy-to-use interface as opposed to requiring you to manually configure your WireGuard connection. The Android client is also available on [GitHub](https://github.com/ProtonVPN/android-app/releases).
|
||||
|
||||
> [!TIP]
|
||||
> On Android, Proton hides telemetry settings under the misleadingly labeled "**Help us fight censorship**" menu in the settings panel. On other platforms these settings can be found under the "**Usage statistics**" menu. We are noting this because while we don't necessarily recommend against sharing anonymous usage statistics with developers, it is important that these settings are easily found and clearly labeled.
|
||||
|
||||
#### :material-alert-outline:{ .pg-orange } Additional Notes
|
||||
#### Additional Notes
|
||||
|
||||
Proton VPN clients support two-factor authentication on all platforms. Proton VPN has their own servers and datacenters in Switzerland, Iceland and Sweden. They offer content blocking and known-malware blocking with their DNS service. Additionally, Proton VPN also offers "Tor" servers allowing you to easily connect to onion sites, but we still strongly recommend using [the official Tor Browser](../../software/tor/index.md#tor-browser) for this purpose.
|
||||
|
||||
@@ -128,7 +128,7 @@ Additionally, system crashes [may occur](https://protonvpn.com/support/macos-t2-
|
||||
[{{< badge content="Accrescent" >}}](https://accrescent.app/app/net.ivpn.client)
|
||||
[{{< badge content="GitHub" >}}](https://github.com/ivpn/android-app/releases)
|
||||
|
||||
#### :material-check:{ .pg-green } 41 Countries
|
||||
#### 41 Countries
|
||||
|
||||
IVPN has [servers in 41 countries](https://ivpn.net/status).(1) Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
|
||||
{ .annotate }
|
||||
@@ -137,41 +137,41 @@ IVPN has [servers in 41 countries](https://ivpn.net/status).(1) Picking a VPN pr
|
||||
|
||||
We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
|
||||
|
||||
#### :material-check:{ .pg-green } Independently Audited
|
||||
#### Independently Audited
|
||||
|
||||
IVPN has had multiple [independent audits](https://ivpn.net/en/blog/tags/audit) since 2019 and has publicly announced their commitment to [annual security audits](https://ivpn.net/blog/ivpn-apps-security-audit-concluded).
|
||||
|
||||
#### :material-check:{ .pg-green } Open-Source Clients
|
||||
#### Open-Source Clients
|
||||
|
||||
As of February 2020 [IVPN applications are now open source](https://ivpn.net/blog/ivpn-applications-are-now-open-source). Source code can be obtained from their [GitHub organization](https://github.com/ivpn).
|
||||
|
||||
#### :material-check:{ .pg-green } Accepts Cash and Monero
|
||||
#### Accepts Cash and Monero
|
||||
|
||||
In addition to accepting credit/debit cards and PayPal, IVPN accepts Bitcoin, **Monero** and **cash/local currency** (on annual plans) as anonymous forms of payment. You can also purchase [prepaid cards](https://ivpn.net/knowledgebase/billing/voucher-cards-faq) with redeem codes.
|
||||
|
||||
#### :material-check:{ .pg-green } WireGuard Support
|
||||
#### WireGuard Support
|
||||
|
||||
IVPN supports the WireGuard® protocol. [WireGuard](https://wireguard.com) is a newer protocol that uses state-of-the-art [cryptography](https://wireguard.com/protocol). Additionally, WireGuard aims to be simpler and more performant.
|
||||
|
||||
IVPN [recommends](https://ivpn.net/wireguard) the use of WireGuard with their service and, as such, the protocol is the default on all of IVPN's apps. IVPN also offers a WireGuard configuration generator for use with the official WireGuard [apps](https://wireguard.com/install).
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } IPv6 Support
|
||||
#### IPv6 Support
|
||||
|
||||
IVPN allows you to [connect to services using IPv6](https://ivpn.net/knowledgebase/general/do-you-support-ipv6) but doesn't allow you to connect from a device using an IPv6 address.
|
||||
|
||||
#### :material-alert-outline:{ .pg-orange } Remote Port Forwarding
|
||||
#### Remote Port Forwarding
|
||||
|
||||
IVPN previously supported port forwarding, but removed the option in [June 2023](https://ivpn.net/blog/gradual-removal-of-port-forwarding). Missing this feature could negatively impact certain applications, especially peer-to-peer applications like torrent clients.
|
||||
|
||||
#### :material-check:{ .pg-green } Anti-Censorship
|
||||
#### Anti-Censorship
|
||||
|
||||
IVPN has obfuscation modes using [V2Ray](https://v2ray.com/en/index) which helps in situations where VPN protocols like OpenVPN or WireGuard are blocked. It has two modes where it can use [VMess](https://guide.v2fly.org/en_US/basics/vmess) over QUIC or TCP connections. QUIC is a modern protocol with better congestion control and therefore may be faster with reduced latency. The TCP mode makes your data appear as regular HTTP traffic.
|
||||
|
||||
#### :material-check:{ .pg-green } Mobile Clients
|
||||
#### Mobile Clients
|
||||
|
||||
IVPN has published [App Store](https://apps.apple.com/app/id1193122683) and [Google Play](https://play.google.com/store/apps/details?id=net.ivpn.client) clients, both supporting an easy-to-use interface as opposed to requiring you to manually configure your WireGuard connection. The Android client is also available on [GitHub](https://github.com/ivpn/android-app/releases).
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Additional Notes
|
||||
#### Additional Notes
|
||||
|
||||
IVPN clients support two-factor authentication. IVPN also provides "[AntiTracker](https://ivpn.net/antitracker)" functionality, which blocks advertising networks and trackers from the network level.
|
||||
|
||||
@@ -191,7 +191,7 @@ IVPN clients support two-factor authentication. IVPN also provides "[AntiTracker
|
||||
[{{< badge content="App Store" color="blue" >}}](https://apps.apple.com/app/id1488466513)
|
||||
[{{< badge content="GitHub" >}}](https://github.com/mullvad/mullvadvpn-app/releases)
|
||||
|
||||
#### :material-check:{ .pg-green } 49 Countries
|
||||
#### 49 Countries
|
||||
|
||||
Mullvad has [servers in 49 countries](https://mullvad.net/servers).(1) Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
|
||||
{ .annotate }
|
||||
@@ -200,34 +200,34 @@ Mullvad has [servers in 49 countries](https://mullvad.net/servers).(1) Picking a
|
||||
|
||||
We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
|
||||
|
||||
#### :material-check:{ .pg-green } Independently Audited
|
||||
#### Independently Audited
|
||||
|
||||
Mullvad has had multiple [independent audits](https://mullvad.net/en/blog/tag/audits) and has publicly announced their endeavors to conduct [annual audits](https://mullvad.net/en/blog/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit) of their apps and infrastructure.
|
||||
|
||||
#### :material-check:{ .pg-green } Open-Source Clients
|
||||
#### Open-Source Clients
|
||||
|
||||
Mullvad provides the source code for their desktop and mobile clients in their [GitHub organization](https://github.com/mullvad/mullvadvpn-app).
|
||||
|
||||
#### :material-check:{ .pg-green } Accepts Cash and Monero
|
||||
#### Accepts Cash and Monero
|
||||
|
||||
Mullvad, in addition to accepting credit/debit cards and PayPal, accepts Bitcoin, Bitcoin Cash, **Monero** and **cash/local currency** as anonymous forms of payment. You can also purchase [prepaid cards](https://mullvad.net/en/help/partnerships-and-resellers) with redeem codes. Mullvad also accepts Swish and bank wire transfers, as well as a few European payment systems.
|
||||
|
||||
#### :material-check:{ .pg-green } WireGuard Support
|
||||
#### WireGuard Support
|
||||
|
||||
Mullvad supports the WireGuard® protocol. [WireGuard](https://wireguard.com) is a newer protocol that uses state-of-the-art [cryptography](https://wireguard.com/protocol). Additionally, WireGuard aims to be simpler and more performant.
|
||||
|
||||
Mullvad [recommends](https://mullvad.net/en/help/why-wireguard) the use of WireGuard with their service. It is the only protocol supported on their mobile apps, and their desktop apps will [lose OpenVPN support](https://mullvad.net/en/blog/reminder-that-openvpn-is-being-removed) in 2025. Additionally, their servers will stop accepting OpenVPN connections by January 15, 2026.
|
||||
Mullvad also offers a WireGuard configuration generator for use with the official WireGuard [apps](https://wireguard.com/install).
|
||||
|
||||
#### :material-check:{ .pg-green } IPv6 Support
|
||||
#### IPv6 Support
|
||||
|
||||
Mullvad allows you to [access services hosted on IPv6](https://mullvad.net/en/blog/2014/9/15/ipv6-support) and connect from a device using an IPv6 address.
|
||||
|
||||
#### :material-alert-outline:{ .pg-orange } Remote Port Forwarding
|
||||
#### Remote Port Forwarding
|
||||
|
||||
Mullvad previously supported port forwarding, but removed the option in [May 2023](https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports). Missing this feature could negatively impact certain applications, especially peer-to-peer applications like torrent clients.
|
||||
|
||||
#### :material-check:{ .pg-green } Anti-Censorship
|
||||
#### Anti-Censorship
|
||||
|
||||
Mullvad offers several features to help bypass censorship and access the internet freely:
|
||||
|
||||
@@ -236,11 +236,11 @@ Mullvad offers several features to help bypass censorship and access the interne
|
||||
- **Custom server IPs**: To counter IP-blocking, you can request custom server IPs from Mullvad's support team. Once you receive the custom IPs, you can input the text file in the "Server IP override" settings, which will override the chosen server IP addresses with ones that aren't known to the censor.
|
||||
- **Bridges and proxies**: Mullvad also allows you to use bridges or proxies to reach their API (needed for authentication), which can help bypass censorship attempts that block access to the API itself.
|
||||
|
||||
#### :material-check:{ .pg-green } Mobile Clients
|
||||
#### Mobile Clients
|
||||
|
||||
Mullvad has published [App Store](https://apps.apple.com/app/id1488466513) and [Google Play](https://play.google.com/store/apps/details?id=net.mullvad.mullvadvpn) clients, both supporting an easy-to-use interface as opposed to requiring you to manually configure your WireGuard connection. The Android client is also available on [GitHub](https://github.com/mullvad/mullvadvpn-app/releases).
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } Additional Notes
|
||||
#### Additional Notes
|
||||
|
||||
Mullvad is very transparent about which nodes they [own or rent](https://mullvad.net/en/servers). They also provide the option to enable Defense Against AI-guided Traffic Analysis ([DAITA](https://mullvad.net/en/blog/daita-defense-against-ai-guided-traffic-analysis)) in their apps. DAITA protects against the threat of advanced traffic analysis which can be used to connect patterns in VPN traffic with specific websites.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user