What is the best tool?
-For each proposed alternative, you should always first consider your own [threat model](../../basics/threat-modeling.md). One tool might be ideal for one person or organization, but another tool might be better for another. Make sure to understand well your threat model in order to choose the tools that are the best for your unique situation. +For each proposed alternative, you should always first consider your own [threat model](../../wiki/basics/threat-modeling/_index.md). One tool might be ideal for one person or organization, but another tool might be better for another. Make sure to understand well your threat model in order to choose the tools that are the best for your unique situation.Service providers disclosure and compatibility
@@ -90,13 +90,13 @@ Here's a list of alternative solutions you can start adopting to improve data prImportant notices
-The content here is not legal or financial advice. We do not endorse or encourage illicit activities, and we do not endorse or encourage anything which violates a company's terms of service. Check with a professional to confirm that these recommendations are legal and available in your jurisdiction. [See all notices](/about/notices). +The content here is not legal or financial advice. We do not endorse or encourage illicit activities, and we do not endorse or encourage anything which violates a company's terms of service. Check with a professional to confirm that these recommendations are legal and available in your jurisdiction. [See all notices](../../../about/notices.md).Note on Web-based Encryption
-In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../../tools/services/messengers/_index.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../../../tools/services/messengers/_index.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). On the other hand, web-based E2EE implementations, such as Proton Mail's web app or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. @@ -200,7 +200,7 @@ Censorship online can be carried out (to varying degrees) by actors including to Censorship on corporate platforms is increasingly common, as platforms like Twitter and Facebook give in to public demand, market pressures, and pressures from government agencies. Government pressures can be covert requests to businesses, such as the White House [requesting the takedown](https://nytimes.com/2012/09/17/technology/on-the-web-a-fine-line-on-free-speech-across-globe.html) of a provocative YouTube video, or overt, such as the Chinese government requiring companies to adhere to a strict regime of censorship. -People concerned with the threat of censorship can use technologies like [Tor](../../advanced/tor-overview/_index.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../../tools/software/social-networks/_index.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. +People concerned with the threat of censorship can use technologies like [Tor](../../advanced/tor-overview/_index.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../../../tools/software/social-networks/_index.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. > [!TIP] > While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. diff --git a/content/wiki/basics/email-security/_index.md b/content/wiki/basics/email-security/_index.md index f7c3efc4..37cf5204 100644 --- a/content/wiki/basics/email-security/_index.md +++ b/content/wiki/basics/email-security/_index.md @@ -11,9 +11,9 @@ As a result, email is best used for receiving transactional emails (like notific ## Email Encryption Overview -The standard way to add E2EE to emails between different email providers is by using OpenPGP. There are different implementations of the OpenPGP standard, the most common being [GnuPG](../../tools/software/encryption/_index.md#gnu-privacy-guard) and [OpenPGP.js](https://openpgpjs.org). +The standard way to add E2EE to emails between different email providers is by using OpenPGP. There are different implementations of the OpenPGP standard, the most common being [GnuPG](../../../tools/software/encryption/_index.md#gnu-privacy-guard) and [OpenPGP.js](https://openpgpjs.org). -Even if you use OpenPGP, it does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if the private key of either you or the message recipient is ever stolen, all previous messages encrypted with it will be exposed. This is why we recommend [instant messengers](../../tools/services/messengers/_index.md) which implement forward secrecy over email for person-to-person communications whenever possible. +Even if you use OpenPGP, it does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if the private key of either you or the message recipient is ever stolen, all previous messages encrypted with it will be exposed. This is why we recommend [instant messengers](../../../tools/services/messengers/_index.md) which implement forward secrecy over email for person-to-person communications whenever possible. There is another standard which is popular with business called [S/MIME](https://en.wikipedia.org/wiki/S/MIME), however it requires a certificate issued from a [Certificate Authority](https://en.wikipedia.org/wiki/Certificate_authority) (not all of them issue S/MIME certificates, and often a yearly payment is required). In some cases it is more usable than PGP because it has support in popular/mainstream email applications like Apple Mail, [Google Workplace](https://support.google.com/a/topic/9061730), and [Outlook](https://support.office.com/article/encrypt-messages-by-using-s-mime-in-outlook-on-the-web-878c79fc-7088-4b39-966f-14512658f480). However, S/MIME does not solve the issue of lack of forward secrecy, and isn't particularly more secure than PGP. @@ -21,7 +21,7 @@ There is another standard which is popular with business called [S/MIME](https:/ The [Web Key Directory (WKD)](https://wiki.gnupg.org/WKD) standard allows email clients to discover the OpenPGP key for other mailboxes, even those hosted on a different provider. Email clients which support WKD will ask the recipient's server for a key based on the email address' domain name. For example, if you emailed `jonah@privacyguides.org`, your email client would ask `privacyguides.org` for Jonah's OpenPGP key, and if `privacyguides.org` has a key for that account, your message would be automatically encrypted. -In addition to the [email clients we recommend](../../tools/software/email-clients/_index.md) which support WKD, some webmail providers also support WKD. Whether *your own* key is published to WKD for others to use depends on your domain configuration. If you use an [email provider](../../tools/services/email/_index.md#openpgp-compatible-services) which supports WKD, such as Proton Mail or Mailbox Mail, they can publish your OpenPGP key on their domain for you. +In addition to the [email clients we recommend](../../../tools/software/email-clients/_index.md) which support WKD, some webmail providers also support WKD. Whether *your own* key is published to WKD for others to use depends on your domain configuration. If you use an [email provider](../../../tools/services/email/_index.md#openpgp-compatible-services) which supports WKD, such as Proton Mail or Mailbox Mail, they can publish your OpenPGP key on their domain for you. If you use your own custom domain, you will need to configure WKD separately. If you control your domain name, you can set up WKD regardless of your email provider. One easy way to do this is to use the "[WKD as a Service](https://keys.openpgp.org/about/usage#wkd-as-a-service)" feature from the `keys.openpgp.org` server: Set a CNAME record on the `openpgpkey` subdomain of your domain pointed to `wkd.keys.openpgp.org`, then upload your key to [keys.openpgp.org](https://keys.openpgp.org). Alternatively, you can [self-host WKD on your own web server](https://wiki.gnupg.org/WKDHosting). @@ -29,11 +29,11 @@ If you use a shared domain from a provider which doesn't support WKD, like `@gma ### What Email Clients Support E2EE? -Email providers which allow you to use standard access protocols like IMAP and SMTP can be used with any of the [email clients we recommend](../../tools/software/email-clients/_index.md). Depending on the authentication method, this may lead to decreased security if either the provider or the email client does not support [OAuth](../account-creation/_index.md#sign-in-with-oauth) or a bridge application as [multifactor authentication](../multi-factor-authentication/_index.md) is not possible with plain password authentication. +Email providers which allow you to use standard access protocols like IMAP and SMTP can be used with any of the [email clients we recommend](../../../tools/software/email-clients/_index.md). Depending on the authentication method, this may lead to decreased security if either the provider or the email client does not support [OAuth](../account-creation/_index.md#sign-in-with-oauth) or a bridge application as [multifactor authentication](../multi-factor-authentication/_index.md) is not possible with plain password authentication. ### How Do I Protect My Private Keys? -A smart card (such as a [YubiKey](https://support.yubico.com/hc/articles/360013790259-Using-Your-YubiKey-with-OpenPGP) or [Nitrokey](../../tools/hardware/security-keys/_index.md#nitrokey)) works by receiving an encrypted email message from a device (phone, tablet, computer, etc.) running an email/webmail client. The message is then decrypted by the smart card and the decrypted content is sent back to the device. +A smart card (such as a [YubiKey](https://support.yubico.com/hc/articles/360013790259-Using-Your-YubiKey-with-OpenPGP) or [Nitrokey](../../../tools/hardware/security-keys/_index.md#nitrokey)) works by receiving an encrypted email message from a device (phone, tablet, computer, etc.) running an email/webmail client. The message is then decrypted by the smart card and the decrypted content is sent back to the device. It is advantageous for the decryption to occur on the smart card to avoid possibly exposing your private key to a compromised device. diff --git a/content/wiki/basics/hardware/_index.md b/content/wiki/basics/hardware/_index.md index 72d10a49..2f558457 100644 --- a/content/wiki/basics/hardware/_index.md +++ b/content/wiki/basics/hardware/_index.md @@ -57,7 +57,7 @@ Android defines three [security classes](https://source.android.com/docs/securit ### Device Encryption -If your device is [encrypted](../../tools/software/encryption/_index.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. +If your device is [encrypted](../../../tools/software/encryption/_index.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. @@ -69,7 +69,7 @@ Some threats can't be protected against by your internal components alone. Many Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. -[Recommended Hardware Keys :material-arrow-right-drop-circle:](../../tools/hardware/security-keys/_index.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](../multi-factor-authentication/_index.md#hardware-security-keys){ .md-button } +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../../../tools/hardware/security-keys/_index.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](../multi-factor-authentication/_index.md#hardware-security-keys){ .md-button } ### Camera/Microphone @@ -135,6 +135,6 @@ The most important thing to think about with routers is keeping them up-to-date. If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. -Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../../tools/os/router-firmware/_index.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../../../tools/os/router-firmware/_index.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/content/wiki/basics/multi-factor-authentication/_index.md b/content/wiki/basics/multi-factor-authentication/_index.md index b30cfd4a..34551aae 100644 --- a/content/wiki/basics/multi-factor-authentication/_index.md +++ b/content/wiki/basics/multi-factor-authentication/_index.md @@ -35,7 +35,7 @@ Unlike [WebAuthn](#fido-fast-identity-online), TOTP offers no protection against An adversary could set up a website to imitate an official service in an attempt to trick you into giving out your username, password and current TOTP code. If the adversary then uses those recorded credentials they may be able to log into the real service and hijack the account. -Although not perfect, TOTP is secure enough for most people, and when [hardware security keys](../../tools/hardware/security-keys/_index.md) are not supported [authenticator apps](../../tools/software/multi-factor-authentication/_index.md) are still a good option. +Although not perfect, TOTP is secure enough for most people, and when [hardware security keys](../../../tools/hardware/security-keys/_index.md) are not supported [authenticator apps](../../../tools/software/multi-factor-authentication/_index.md) are still a good option. ### Hardware security keys @@ -99,7 +99,7 @@ When configuring your MFA method, keep in mind that it is only as secure as your You should always have backups for your MFA method. Hardware security keys can get lost, stolen or simply stop working over time. It is recommended that you have a pair of hardware security keys with the same access to your accounts instead of just one. -When using TOTP with an authenticator app, be sure to back up your recovery keys or the app itself, or copy the "shared secrets" to another instance of the app on a different phone or to an encrypted container (e.g. [VeraCrypt](../../tools/software/encryption/_index.md#veracrypt-disk)). +When using TOTP with an authenticator app, be sure to back up your recovery keys or the app itself, or copy the "shared secrets" to another instance of the app on a different phone or to an encrypted container (e.g. [VeraCrypt](../../../tools/software/encryption/_index.md#veracrypt-disk)). ### Initial Set Up @@ -111,7 +111,7 @@ If you have to use email for MFA, make sure that the email account itself is sec If you use SMS MFA, use a carrier who will not switch your phone number to a new SIM card without account access, or use a dedicated VoIP number from a provider with similar security to avoid a [SIM swap attack](https://en.wikipedia.org/wiki/SIM_swap_scam). -[MFA tools we recommend](../../tools/software/multi-factor-authentication/_index.md){ .md-button } +[MFA tools we recommend](../../../tools/software/multi-factor-authentication/_index.md){ .md-button } ## More Places to Set Up MFA diff --git a/content/wiki/basics/passwords-overview/_index.md b/content/wiki/basics/passwords-overview/_index.md index c3cb5e35..75247f7b 100644 --- a/content/wiki/basics/passwords-overview/_index.md +++ b/content/wiki/basics/passwords-overview/_index.md @@ -18,7 +18,7 @@ This is called [credential stuffing](https://en.wikipedia.org/wiki/Credential_st You should **never** rely on yourself to come up with a good password. We recommend using [randomly generated passwords](#passwords) or [diceware passphrases](#diceware-passphrases) with sufficient entropy to protect your accounts and devices. -All of our [recommended password managers](../../tools/software/passwords/_index.md) include a built-in password generator that you can use. +All of our [recommended password managers](../../../tools/software/passwords/_index.md) include a built-in password generator that you can use. ### Rotating Passwords @@ -30,7 +30,7 @@ When it comes to passwords that you don't have to remember (such as passwords stChecking for data breaches
-If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../../tools/software/news-aggregators/_index.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../../../tools/software/news-aggregators/_index.md).Don't place your passwords and TOTP tokens inside the same password manager
-When using [TOTP codes as multifactor authentication](../multi-factor-authentication/_index.md#time-based-one-time-password-totp), the best security practice is to keep your TOTP codes in a [separate app](../../tools/software/multi-factor-authentication/_index.md). +When using [TOTP codes as multifactor authentication](../multi-factor-authentication/_index.md#time-based-one-time-password-totp), the best security practice is to keep your TOTP codes in a [separate app](../../../tools/software/multi-factor-authentication/_index.md). Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. @@ -174,4 +174,4 @@ Furthermore, we do not recommend storing single-use recovery codes in your passw ### Backups -You should store an [encrypted](../../tools/software/encryption/_index.md) backup of your passwords on multiple storage devices or a cloud storage provider. This can help you access your passwords if something happens to your primary device or the service you are using. +You should store an [encrypted](../../../tools/software/encryption/_index.md) backup of your passwords on multiple storage devices or a cloud storage provider. This can help you access your passwords if something happens to your primary device or the service you are using. diff --git a/content/wiki/basics/vpn-overview/_index.md b/content/wiki/basics/vpn-overview/_index.md index 8c5ce68d..c40692f6 100644 --- a/content/wiki/basics/vpn-overview/_index.md +++ b/content/wiki/basics/vpn-overview/_index.md @@ -14,7 +14,7 @@ Normally, an ISP can see the flow of internet traffic entering and exiting your Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. > [!NOTE] -> When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../../tools/services/vpn/_index.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +> When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../../../tools/services/vpn/_index.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. ## How does a VPN work? @@ -70,7 +70,7 @@ You should not use that feature: The primary advantage of using Tor is that you Currently, Tor only supports the TCP protocol. UDP (used by [WebRTC](https://en.wikipedia.org/wiki/WebRTC), [HTTP3/QUIC](https://en.wikipedia.org/wiki/HTTP/3), and other protocols), [ICMP](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol), and other packets will be dropped. To compensate for this, VPN providers typically will route all non-TCP packets through their VPN server (your first hop). This is the case with [ProtonVPN](https://protonvpn.com/support/tor-vpn). Additionally, when using this Tor over VPN setup, you do not have control over other important Tor features such as [Isolated Destination Address](https://whonix.org/wiki/Stream_Isolation) (using a different Tor circuit for every domain you visit). -The feature should be viewed as a *convenient* way to access hidden services on Tor, not to stay anonymous. For proper anonymity, use the actual [Tor Browser](../../tools/software/tor/_index.md). +The feature should be viewed as a *convenient* way to access hidden services on Tor, not to stay anonymous. For proper anonymity, use the actual [Tor Browser](../../../tools/software/tor/_index.md). ## Commercial VPN Ownership @@ -78,7 +78,7 @@ Most VPN services are owned by the same [few companies](https://vpnpro.com/blog/ You should also be wary that many VPN review sites are merely advertising vehicles open to the highest bidder. Privacy Guides does not make money from recommending external products, and never uses affiliate programs. -[Our VPN Recommendations](../../tools/services/vpn/_index.md){ .md-button } +[Our VPN Recommendations](../../../tools/services/vpn/_index.md){ .md-button } ## Modern VPN Alternatives diff --git a/content/wiki/basics/why-privacy-matters/_index.md b/content/wiki/basics/why-privacy-matters/_index.md index 91875c4e..b7b641a3 100644 --- a/content/wiki/basics/why-privacy-matters/_index.md +++ b/content/wiki/basics/why-privacy-matters/_index.md @@ -26,11 +26,11 @@ Many people get the concepts of **privacy**, **security**, and **anonymity** con **Anonymity** -: Anonymity is the ability to act without a persistent identifier. You might achieve this online with [Tor](../../tools/software/tor/_index.md), which allows you to browse the internet with a random IP address and network connection instead of your own. +: Anonymity is the ability to act without a persistent identifier. You might achieve this online with [Tor](../../../tools/software/tor/_index.md), which allows you to browse the internet with a random IP address and network connection instead of your own. : **Pseudonymity** is a similar concept, but it allows you to have a persistent identifier without it being tied to your real identity. If everybody knows you as `@GamerGuy12` online, but nobody knows your real name, that is your pseudonym. -All of these concepts overlap, but it is possible to have any combination of these. The sweet spot for most people is when all three of these concepts overlap. However, it's trickier to achieve than many initially believe. Sometimes, you have to compromise on some of these, and that's okay too. This is where **threat modeling** comes into play, allowing you to make informed decisions about the [software and services](../../tools/_index.md) you use. +All of these concepts overlap, but it is possible to have any combination of these. The sweet spot for most people is when all three of these concepts overlap. However, it's trickier to achieve than many initially believe. Sometimes, you have to compromise on some of these, and that's okay too. This is where **threat modeling** comes into play, allowing you to make informed decisions about the [software and services](../../../tools/_index.md) you use. [:material-book-outline: Learn More About Threat Modeling](../threat-modeling/_index.md){ .md-button } @@ -48,7 +48,7 @@ Take cookie consent forms, for example. You may encounter these dozens of times Control over your privacy inside most apps is an illusion. It's a shiny dashboard with all sorts of choices you can make about your data, but rarely the choices you're looking for, like "only use my data to help me." This type of control is meant to make you feel guilty about your choices, that you "had the choice" to make the apps you use more private, and you chose not to. -Privacy is something we need to have baked into the [software and services](../../tools/_index.md) we use by default, you can't bend most apps into being private on your own. +Privacy is something we need to have baked into the [software and services](../../../tools/_index.md) we use by default, you can't bend most apps into being private on your own. [:material-movie-open-play-outline: Video: 5 Steps to Improve Your Privacy](https://www.privacyguides.org/videos/2025/02/14/5-easy-steps-to-protect-yourself-online){ class="md-button" } diff --git a/content/wiki/os/_index.md b/content/wiki/os/_index.md index b5852718..ae94e8db 100644 --- a/content/wiki/os/_index.md +++ b/content/wiki/os/_index.md @@ -10,15 +10,15 @@ We publish configuration guides for the major operating systems, because you can ## Mobile Operating Systems {{< cards >}} - {{< card link="advanced/android-overview" title="Android Overview" subtitle="The Android Open Source Project is a secure mobile operating system featuring strong app sandboxing, Verified Boot (AVB), and a robust permission control system." tag="featured" >}} - {{< card link="advanced/ios-overview" title="iOS Overview" subtitle="iOS and iPadOS are proprietary mobile operating systems developed by Apple for their iPhone and iPad products, respectively. If you have an Apple mobile device, you can increase your privacy by disabling some built-in telemetry features, and hardening some privacy and security settings which are built in to the system." >}} + {{< card link="os/android" title="Android Overview" subtitle="The Android Open Source Project is a secure mobile operating system featuring strong app sandboxing, Verified Boot (AVB), and a robust permission control system." tag="featured" >}} + {{< card link="os/ios" title="iOS Overview" subtitle="iOS and iPadOS are proprietary mobile operating systems developed by Apple for their iPhone and iPad products, respectively. If you have an Apple mobile device, you can increase your privacy by disabling some built-in telemetry features, and hardening some privacy and security settings which are built in to the system." >}} {{< /cards >}} ## Desktop Operating Systems {{< cards >}} - {{< card link="advanced/linux" title="Linux Overview" subtitle="Linux is an open-source, privacy-focused desktop operating system alternative. In the face of pervasive telemetry and other privacy-encroaching technologies in mainstream operating systems, desktop Linux has remained the clear choice for people looking for total control over their computers from the ground up." tag="featured" >}} - {{< card link="advanced/qubes" title="Qubes Overview" subtitle="Qubes OS is an open-source operating system which uses the Xen hypervisor to provide strong security for desktop computing through isolated qubes, (which are Virtual Machines). You can assign each qube a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of badness enumeration." >}} - {{< card link="advanced/macos" title="macOS Overview" subtitle="macOS is a Unix operating system developed by Apple for their Mac computers. To enhance privacy on macOS, you can disable telemetry features and harden existing privacy and security settings." >}} - {{< card link="advanced/windows" title="Windows Overview" subtitle="Microsoft Windows is a common OS shipped with many PCs by default. The following guides aim to provide some ways to improve privacy and reduce the default telemetry and data stored by disabling some unnecessary features. Over time, Microsoft adds features to the OS which can sometimes rely on cloud-based services. These features will often require certain types of optional data that is sometimes sent to remote servers for processing." >}} + {{< card link="os/linux" title="Linux Overview" subtitle="Linux is an open-source, privacy-focused desktop operating system alternative. In the face of pervasive telemetry and other privacy-encroaching technologies in mainstream operating systems, desktop Linux has remained the clear choice for people looking for total control over their computers from the ground up." tag="featured" >}} + {{< card link="os/qubes" title="Qubes Overview" subtitle="Qubes OS is an open-source operating system which uses the Xen hypervisor to provide strong security for desktop computing through isolated qubes, (which are Virtual Machines). You can assign each qube a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of badness enumeration." >}} + {{< card link="os/macos" title="macOS Overview" subtitle="macOS is a Unix operating system developed by Apple for their Mac computers. To enhance privacy on macOS, you can disable telemetry features and harden existing privacy and security settings." >}} + {{< card link="os/windows" title="Windows Overview" subtitle="Microsoft Windows is a common OS shipped with many PCs by default. The following guides aim to provide some ways to improve privacy and reduce the default telemetry and data stored by disabling some unnecessary features. Over time, Microsoft adds features to the OS which can sometimes rely on cloud-based services. These features will often require certain types of optional data that is sometimes sent to remote servers for processing." >}} {{< /cards >}} diff --git a/content/wiki/os/windows/_index.md b/content/wiki/os/windows/_index.md index d1eec17d..1ad4d864 100644 --- a/content/wiki/os/windows/_index.md +++ b/content/wiki/os/windows/_index.md @@ -12,7 +12,7 @@ Unfortunately, this feature was added without too much thought about the privacy You can enhance your privacy and security on Windows without downloading any third-party tools with these guides: - Initial Installation (coming soon) -- [Group Policy Settings](group-policies/) +- [Group Policy Settings](./group-policies/_index.md) - Privacy Settings (coming soon) - Application Sandboxing (coming soon) - Security Hardening (coming soon)