diff --git a/blog/posts/i18n-announcement.md b/blog/posts/i18n-announcement.md index 1dc21b633..321f2bfb6 100644 --- a/blog/posts/i18n-announcement.md +++ b/blog/posts/i18n-announcement.md @@ -76,6 +76,6 @@ For example: ![Software logo](assets/img/path/to/image.svg){ align=right } ``` -We have sometimes found that the syntax for inserting an image like above was missing the `![` or an extra space was placed between the text and the path, e.g. `](`. If a translation string is clearly not correct, we encourage you to **delete** it by pressing the trash icon [or vote](https://support.crowdin.com/enterprise/getting-started-for-volunteers/#voting-view) which one you think sounds best. When invalid strings are deleted they are removed from the organization's [translation memory](https://support.crowdin.com/enterprise/translation-memory), meaning that when the source string is seen again, it won't suggest the incorrect translation. +We have sometimes found that the syntax for inserting an image like above was missing the `![` or an extra space was placed between the text and the path, e.g. `] (` with no space between those characters. If a translation string is clearly not correct, we encourage you to **delete** it by pressing the trash icon [or vote](https://support.crowdin.com/enterprise/getting-started-for-volunteers/#voting-view) which one you think sounds best. When invalid strings are deleted they are removed from the organization's [translation memory](https://support.crowdin.com/enterprise/translation-memory), meaning that when the source string is seen again, it won't suggest the incorrect translation. We'd like to thank the [translation team](https://crowdin.com/project/privacyguides/reports/top-members) who spent many hours on translating the content, that we now have. We're going to launch in Dutch, French and Hebrew. diff --git a/content/about/_index.md b/content/about/_index.md index 8b78628e1..b8d83b383 100644 --- a/content/about/_index.md +++ b/content/about/_index.md @@ -15,9 +15,9 @@ cascade: Privacy Guides is built by volunteers and staff members around the world. All changes to our recommendations and resources are reviewed by at least two [trusted](https://discuss.privacyguides.net/u?group=team&order=solutions&period=all) individuals, and we work diligently to ensure our content is updated as quickly as possible to adapt to the ever-changing cybersecurity threat landscape. -In addition to our core team, [many other people](about/contributors.md) have made contributions to the project. You can too! We're open source on GitHub, and accepting translation suggestions on [Crowdin](https://crowdin.com/project/privacyguides). +In addition to our core team, [many other people](contributors.md) have made contributions to the project. You can too! We're open source on GitHub, and accepting translation suggestions on [Crowdin](https://crowdin.com/project/privacyguides). -[Job Openings :material-arrow-right-drop-circle:](about/jobs.md) +[Job Openings :material-arrow-right-drop-circle:](jobs.md) ## :material-email-edit: Contact Us @@ -195,7 +195,7 @@ Also featured on: [Ars Technica](https://arstechnica.com/gadgets/2022/02/is-fire ## :material-history: History -Privacy Guides was launched in September 2021 as a continuation of the [defunct](about/privacytools.md) "PrivacyTools" open-source educational project. We recognized the importance of independent, criteria-focused product recommendations and general knowledge in the privacy space, which is why we needed to preserve the work that had been created by so many contributors since 2015 and make sure that information had a stable home on the web indefinitely. +Privacy Guides was launched in September 2021 as a continuation of the [defunct](privacytools.md) "PrivacyTools" open-source educational project. We recognized the importance of independent, criteria-focused product recommendations and general knowledge in the privacy space, which is why we needed to preserve the work that had been created by so many contributors since 2015 and make sure that information had a stable home on the web indefinitely. In 2022, we completed the transition of our main website framework from Jekyll to MkDocs, using the `mkdocs-material` documentation software. This change made open-source contributions to our site significantly easier for outsiders, because instead of needing to know complicated syntax to write posts effectively, contributing is now as easy as writing a standard Markdown document. diff --git a/content/about/criteria.md b/content/about/criteria.md index 1026533c6..3c97027b0 100644 --- a/content/about/criteria.md +++ b/content/about/criteria.md @@ -32,4 +32,4 @@ We have these requirements in regard to developers which wish to submit their pr - Why should anyone use it over the alternatives? - Must state what the exact threat model is with their project. - - It should be clear to potential users what the project can provide, and what it cannot. Ideally, a developer should be able to identify what [common threat(s)](../wiki/basics/common-threats/_index.md) their project protects against. + - It should be clear to potential users what the project can provide, and what it cannot. Ideally, a developer should be able to identify what [common threat(s)](../wiki/basics/common-threats/index.md) their project protects against. diff --git a/content/about/jobs/journalist.md b/content/about/jobs/journalist.md index 9325e11f9..bad404548 100644 --- a/content/about/jobs/journalist.md +++ b/content/about/jobs/journalist.md @@ -26,7 +26,7 @@ Privacy Guides is a small, largely volunteer-driven nonprofit media organization Your responsibilities will include, but aren’t limited to: -- Creating high-quality articles for our [knowledge base](../../wiki/basics/why-privacy-matters/_index.md). +- Creating high-quality articles for our [knowledge base](../../wiki/basics/why-privacy-matters/index.md). - Performing product reviews for our [reviews](https://www.privacyguides.org/articles/category/reviews) section and [tool recommendations](../../tools/_index.md). - Researching new topics to cover. - Interviewing and fact-checking all relevant sources. diff --git a/content/about/meta/translations.md b/content/about/meta/translations.md index 1f67cd988..bf000a8c7 100644 --- a/content/about/meta/translations.md +++ b/content/about/meta/translations.md @@ -19,7 +19,7 @@ For example: ![Software logo](assets/img/path/to/image.svg){ align=right } ``` -We have sometimes found that the syntax for inserting an image like above was missing the `![` or an extra space was placed between the text and the path, e.g. `](`. If a translation string is clearly not correct, we encourage you to **delete** it by pressing the trash icon [or vote](https://support.crowdin.com/enterprise/getting-started-for-volunteers/#voting-view) on which one you think sounds best. When invalid strings are deleted, they are removed from the organization's [translation memory](https://support.crowdin.com/enterprise/translation-memory), meaning that when the source string is seen again, it won't suggest the incorrect translation. +We have sometimes found that the syntax for inserting an image like above was missing the `![` or an extra space was placed between the text and the path, e.g. `] (` with no space between those characters. If a translation string is clearly not correct, we encourage you to **delete** it by pressing the trash icon [or vote](https://support.crowdin.com/enterprise/getting-started-for-volunteers/#voting-view) on which one you think sounds best. When invalid strings are deleted, they are removed from the organization's [translation memory](https://support.crowdin.com/enterprise/translation-memory), meaning that when the source string is seen again, it won't suggest the incorrect translation. ## Punctuation diff --git a/content/about/privacytools.md b/content/about/privacytools.md index 3c42cc70b..a9eb790e7 100644 --- a/content/about/privacytools.md +++ b/content/about/privacytools.md @@ -73,7 +73,7 @@ BurungHantu also made a [twitter post](https://twitter.com/privacytoolsIO/status ## PrivacyTools.io Now -As of September 25th 2022 we are seeing BurungHantu's overall plans come to fruition on privacytools.io, and this is the very reason we decided to create this explainer page today. The website he is operating appears to be a heavily SEO-optimized version of the site which recommends tools in exchange for financial compensation. Very recently, IVPN and Mullvad, two VPN providers near-universally [recommended](../tools/services/vpn/_index.md) by the privacy community and notable for their stance against affiliate programs were removed from PrivacyTools. In their place? NordVPN, Surfshark, ExpressVPN, and hide.me; Giant VPN corporations with untrustworthy platforms and business practices, notorious for their aggressive marketing and affiliate programs. +As of September 25th 2022 we are seeing BurungHantu's overall plans come to fruition on privacytools.io, and this is the very reason we decided to create this explainer page today. The website he is operating appears to be a heavily SEO-optimized version of the site which recommends tools in exchange for financial compensation. Very recently, IVPN and Mullvad, two VPN providers near-universally [recommended](../tools/services/vpn/index.md) by the privacy community and notable for their stance against affiliate programs were removed from PrivacyTools. In their place? NordVPN, Surfshark, ExpressVPN, and hide.me; Giant VPN corporations with untrustworthy platforms and business practices, notorious for their aggressive marketing and affiliate programs. ==**PrivacyTools has become exactly the type of site we [warned against](https://web.archive.org/web/20210729205249/https://blog.privacytools.io/the-trouble-with-vpn-and-privacy-reviews) on the PrivacyTools blog in 2019.**== We've tried to keep our distance from PrivacyTools since the transition, but their continued harassment towards our project and now their absurd abuse of the credibility their brand gained over 6 years of open-source contributions is extremely troubling to us. Those of us actually fighting for privacy are not fighting against each other, and are not getting our advice from the highest bidder. diff --git a/content/activism/_index.md b/content/activism/_index.md index f05785f93..ce6de5874 100644 --- a/content/activism/_index.md +++ b/content/activism/_index.md @@ -18,7 +18,7 @@ This section contains information to help you become a better defender of privac Fighting to improve our privacy cannot *only* be a matter of individual protections. -When [regulations keep attacking](https://www.privacyguides.org/articles/2025/09/08/chat-control-must-be-stopped/) the tools and services we rely on to protect our personal information, when corporations [exploit our data](../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) more aggressively every day, and when platforms exponentially [erode online pseudonymity](https://www.privacyguides.org/articles/2025/10/15/real-name-policies/), we must broaden our reach to fight for our rights. +When [regulations keep attacking](https://www.privacyguides.org/articles/2025/09/08/chat-control-must-be-stopped/) the tools and services we rely on to protect our personal information, when corporations [exploit our data](../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) more aggressively every day, and when platforms exponentially [erode online pseudonymity](https://www.privacyguides.org/articles/2025/10/15/real-name-policies/), we must broaden our reach to fight for our rights. ==For privacy to become a valued and respected human right, we must work together== to defend privacy rights as a community. diff --git a/content/activism/toolbox/tip-consider-everyones-unique-situation.md b/content/activism/toolbox/tip-consider-everyones-unique-situation.md index ccbda8938..ec718cd36 100644 --- a/content/activism/toolbox/tip-consider-everyones-unique-situation.md +++ b/content/activism/toolbox/tip-consider-everyones-unique-situation.md @@ -8,7 +8,7 @@ Everyone has different needs, and everyone faces different dangers when their pe To give actionable privacy advices and recommendations, it's essential to **keep in mind everyone's situation**. There isn't a one-size-fits-all approach when it comes to data privacy. -Here's how you can get better at evaluating each person's unique [*threat model*](../../wiki/basics/threat-modeling/_index.md): +Here's how you can get better at evaluating each person's unique [*threat model*](../../wiki/basics/threat-modeling/index.md): ## What is a threat model? @@ -70,6 +70,6 @@ To be a good privacy advocate is to provide information and support when needed. ## More resources -- [More detailed information on threat modeling (*Privacy Guides*)](../../wiki/basics/threat-modeling/_index.md) +- [More detailed information on threat modeling (*Privacy Guides*)](../../wiki/basics/threat-modeling/index.md) -- [Examples of common threats (*Privacy Guides*)](../../wiki/basics/common-threats/_index.md) +- [Examples of common threats (*Privacy Guides*)](../../wiki/basics/common-threats/index.md) diff --git a/content/activism/toolbox/tip-dont-stop-at-individual-solutions.md b/content/activism/toolbox/tip-dont-stop-at-individual-solutions.md index bb02df890..b7243d707 100644 --- a/content/activism/toolbox/tip-dont-stop-at-individual-solutions.md +++ b/content/activism/toolbox/tip-dont-stop-at-individual-solutions.md @@ -12,7 +12,7 @@ Here's what to keep in mind to **expand your perspective on data privacy** beyon While it might feel easier to focus on our own needs, nobody lives in a vacuum. Even if you were able to somehow protect all the data you have custody of, there is a lot of data about you that isn't under your control, and a lot of data about *others* that impact you. -Moreover, it's important to consider others in different situations. For example, even if everyone who has access to a [VPN](../../tools/services/vpn/_index.md) service can stay protected from a particular issue, what about all the others? It's neither practical nor realistic to expect that *everyone* would be able to circumvent a problem by using a VPN. +Moreover, it's important to consider others in different situations. For example, even if everyone who has access to a [VPN](../../tools/services/vpn/index.md) service can stay protected from a particular issue, what about all the others? It's neither practical nor realistic to expect that *everyone* would be able to circumvent a problem by using a VPN. While in some cases we might want to discuss immediate individual solutions in order to mitigate some harm, we must also attack the root cause of the problem. diff --git a/content/activism/toolbox/tip-engage-boosts-and-contribute.md b/content/activism/toolbox/tip-engage-boosts-and-contribute.md index a9300869d..7e0c79af4 100644 --- a/content/activism/toolbox/tip-engage-boosts-and-contribute.md +++ b/content/activism/toolbox/tip-engage-boosts-and-contribute.md @@ -4,7 +4,7 @@ description: Once you have the knowledge, motivation, and energy to fight for pr icon: fontawesome/solid/bullhorn cover: activism/banner-toolbox-tip-engage.webp --- -Once you have the knowledge, motivation, and energy, **it's time to act**! Perhaps you've read all the tips here, or have read through our [Knowledge Base](../../wiki/basics/why-privacy-matters/_index.md) already! But you don't need to know that much about privacy to start contributing. +Once you have the knowledge, motivation, and energy, **it's time to act**! Perhaps you've read all the tips here, or have read through our [Knowledge Base](../../wiki/basics/why-privacy-matters/index.md) already! But you don't need to know that much about privacy to start contributing. The most important part is that you care about privacy rights, and want to be part of the movement to defend them. diff --git a/content/activism/toolbox/tip-improve-your-social-media-and-build-resilient-communities.md b/content/activism/toolbox/tip-improve-your-social-media-and-build-resilient-communities.md index 923e2384d..967e58d1c 100644 --- a/content/activism/toolbox/tip-improve-your-social-media-and-build-resilient-communities.md +++ b/content/activism/toolbox/tip-improve-your-social-media-and-build-resilient-communities.md @@ -70,7 +70,7 @@ Here are some resources to help you learn more about this social network, and it - [What is the Fediverse and how it's interconnected (*Stefan Bohacek* project)](https://jointhefediverse.net) -- [Social network recommendations (*Privacy Guides*)](../../tools/software/social-networks/_index.md) +- [Social network recommendations (*Privacy Guides*)](../../tools/software/social-networks/index.md) - [Privacy and security on Mastodon (*Privacy Guides*)](https://www.privacyguides.org/articles/2025/07/15/mastodon-privacy-and-security/) diff --git a/content/activism/toolbox/tip-keep-in-mind-the-whole-landscape.md b/content/activism/toolbox/tip-keep-in-mind-the-whole-landscape.md index f55fe108a..2076b78ed 100644 --- a/content/activism/toolbox/tip-keep-in-mind-the-whole-landscape.md +++ b/content/activism/toolbox/tip-keep-in-mind-the-whole-landscape.md @@ -44,7 +44,7 @@ Here are a few examples: - [**Age Verification**](https://www.privacyguides.org/articles/2025/05/06/age-verification-wants-your-face/) regulations and proposals are growing around the world at a terrifying rate. -- [**Data Brokers**](../../tools/services/data-broker-removals/_index.md) are incessantly exploiting our data due to weak regulations. +- [**Data Brokers**](../../tools/services/data-broker-removals/index.md) are incessantly exploiting our data due to weak regulations. - [**Funding cuts**](https://www.privacyguides.org/articles/2025/02/03/the-future-of-privacy/) from new regulations have frequently impacted negatively the organizations and privacy tools we rely on. diff --git a/content/activism/toolbox/tip-keep-your-posts-and-community-inclusive.md b/content/activism/toolbox/tip-keep-your-posts-and-community-inclusive.md index 9bf0a6a3a..76e713d57 100644 --- a/content/activism/toolbox/tip-keep-your-posts-and-community-inclusive.md +++ b/content/activism/toolbox/tip-keep-your-posts-and-community-inclusive.md @@ -14,7 +14,7 @@ In privacy, **diversity** is an incredible strength, a necessity even. When peop Having a broad perspective is essential to understand the scope and impact of privacy issues, as well as the actionable solutions for diverse situations. -When people with different lived experiences and identities join our group, it expands our understanding of numerous [threat models](../../wiki/basics/threat-modeling/_index.md), and allows us to adapt our message in ways that will be more inclusive. +When people with different lived experiences and identities join our group, it expands our understanding of numerous [threat models](../../wiki/basics/threat-modeling/index.md), and allows us to adapt our message in ways that will be more inclusive. When people from different localities join our group, this helps us to regionalize our content and communication to make it accessible to people all around the world, and expand our network. And when people with different mentalities join our group, it helps us to reach out to people with different ways of thinking more easily. diff --git a/content/activism/toolbox/tip-know-your-privacy-laws.md b/content/activism/toolbox/tip-know-your-privacy-laws.md index 56ff28a63..c20695f75 100644 --- a/content/activism/toolbox/tip-know-your-privacy-laws.md +++ b/content/activism/toolbox/tip-know-your-privacy-laws.md @@ -37,7 +37,7 @@ If your jurisdiction is protected by one or more privacy laws, it should be rela To start your research, you can look at [Privacy Guides' DPA Directory](../legal/dpa-directory.md) and check if your region is listed there. If it is, you will see what is the main consumer privacy law for this region, and you can click on the link to learn more about it. -If your region isn't listed in our DPA Directory, or if you are looking for another more specific privacy-related law, you should be able to find this information online simply using a [trustworthy search engine](../../tools/services/search-engines/_index.md). Look for keywords with your location (be specific about country + states/provinces/region) and "privacy laws" or "data protection regulations." +If your region isn't listed in our DPA Directory, or if you are looking for another more specific privacy-related law, you should be able to find this information online simply using a [trustworthy search engine](../../tools/services/search-engines/index.md). Look for keywords with your location (be specific about country + states/provinces/region) and "privacy laws" or "data protection regulations." Always make sure to find a result that is from an official government source. diff --git a/content/activism/toolbox/tip-level-up-assemble-and-organize.md b/content/activism/toolbox/tip-level-up-assemble-and-organize.md index ed71dae6d..dbde78978 100644 --- a/content/activism/toolbox/tip-level-up-assemble-and-organize.md +++ b/content/activism/toolbox/tip-level-up-assemble-and-organize.md @@ -117,7 +117,7 @@ Here are a few privacy-focused tools and services that can help you to organize :page_with_curl: Use it as an alternative to Google Docs! -[More info](../../tools/software/document-collaboration/_index.md#cryptpad){ .md-button .md-button--primary } +[More info](../../tools/software/document-collaboration/index.md#cryptpad){ .md-button .md-button--primary } [:octicons-home-16:](https://cryptpad.fr/){ .card-link title="Homepage" } [:octicons-feed-star-16:](https://www.privacyguides.org/articles/2025/02/07/cryptpad-review/){ .card-link title="Our CryptPad review" } @@ -131,7 +131,7 @@ Here are a few privacy-focused tools and services that can help you to organize :speech_balloon: Use it as an [alternative](tip-improve-your-social-media-and-build-resilient-communities.md) to commercial social media such as *X*, *Facebook*, *Instagram*, *Threads*, *TikTok*, or *Bluesky*. -[More info](../../tools/software/social-networks/_index.md#mastodon){ .md-button .md-button--primary } +[More info](../../tools/software/social-networks/index.md#mastodon){ .md-button .md-button--primary } [:octicons-home-16:](https://joinmastodon.org/){ .card-link title="Homepage" } [:octicons-feed-star-16:](https://www.privacyguides.org/articles/2025/07/15/mastodon-privacy-and-security/){ .card-link title="Notes on Mastodon Privacy & Security" } @@ -145,7 +145,7 @@ Here are a few privacy-focused tools and services that can help you to organize :loudspeaker: Use it as a privacy-preserving alternative to *Slack* or *Discord*. -[More info](../../tools/software/social-networks/_index.md#element){ .md-button .md-button--primary } +[More info](../../tools/software/social-networks/index.md#element){ .md-button .md-button--primary } [:octicons-home-16:](https://element.io/){ .card-link title="Homepage" } @@ -158,7 +158,7 @@ Here are a few privacy-focused tools and services that can help you to organize :video_camera: Use it to share videos with your community free from *YouTube*'s control. -[:octicons-home-16: Homepage](../../tools/software/social-networks/_index.md#peertube){ .md-button .md-button--primary } +[:octicons-home-16: Homepage](../../tools/software/social-networks/index.md#peertube){ .md-button .md-button--primary } @@ -177,10 +177,10 @@ Here are a few privacy-focused tools and services that can help you to organize
More Alternatives  đź“— -- **Maps & Navigation:** [Organic Maps](../../tools/software/maps/_index.md#organic-maps) or [OsmAnd](../../tools/software/maps/_index.md#osmand) -- **Calendar Sync:** [Tuta](../../tools/services/calendar/_index.md#tuta) or [Proton](../../tools/services/calendar/_index.md#proton-calendar) -- **Cloud Storage:** [Proton Drive](../../tools/services/cloud/_index.md#proton-drive), [Tresorit](../../tools/services/cloud/_index.md#tresorit), or [Peergos](../../tools/services/cloud/_index.md#peergos) -- **File Sharing:** [OnionShare](../../tools/software/file-sharing/_index.md#onionshare), [Send](../../tools/software/file-sharing/_index.md#send), or [Syncthing](../../tools/software/file-sharing/_index.md#syncthing-p2p) +- **Maps & Navigation:** [Organic Maps](../../tools/software/maps/index.md#organic-maps) or [OsmAnd](../../tools/software/maps/index.md#osmand) +- **Calendar Sync:** [Tuta](../../tools/services/calendar/index.md#tuta) or [Proton](../../tools/services/calendar/index.md#proton-calendar) +- **Cloud Storage:** [Proton Drive](../../tools/services/cloud/index.md#proton-drive), [Tresorit](../../tools/services/cloud/index.md#tresorit), or [Peergos](../../tools/services/cloud/index.md#peergos) +- **File Sharing:** [OnionShare](../../tools/software/file-sharing/index.md#onionshare), [Send](../../tools/software/file-sharing/index.md#send), or [Syncthing](../../tools/software/file-sharing/index.md#syncthing-p2p) More tools for community organization could include [LAUTI](https://lauti.org/) for community calendars, and [Mobilizon](https://mobilizon.org/) for events and groups. For more on better alternatives to use, you can check this [tip on why and how to migrate away from Big Tech](tip-migrate-outside-the-surveillance-ecosystem.md) for your privacy advocacy work. diff --git a/content/activism/toolbox/tip-migrate-outside-the-surveillance-ecosystem.md b/content/activism/toolbox/tip-migrate-outside-the-surveillance-ecosystem.md index 467c796e5..b8390483f 100644 --- a/content/activism/toolbox/tip-migrate-outside-the-surveillance-ecosystem.md +++ b/content/activism/toolbox/tip-migrate-outside-the-surveillance-ecosystem.md @@ -24,7 +24,7 @@ While using the most popular mainstream tools and platforms for our work might s
-1. The first drawback is that by using products that are antithetical to our values, we are directly participating in sustaining anti-privacy corporations and contributing to [surveillance capitalism](../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model). +1. The first drawback is that by using products that are antithetical to our values, we are directly participating in sustaining anti-privacy corporations and contributing to [surveillance capitalism](../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model). 2. The second drawback is that simply by using Big Tech tools, we are indirectly promoting the usage of services that are horrible for everyone's privacy. @@ -47,7 +47,7 @@ While using the most popular mainstream tools and platforms for our work might s

What is the best tool?

-For each proposed alternative, you should always first consider your own [threat model](../../wiki/basics/threat-modeling/_index.md). One tool might be ideal for one person or organization, but another tool might be better for another. Make sure to understand well your threat model in order to choose the tools that are the best for your unique situation. +For each proposed alternative, you should always first consider your own [threat model](../../wiki/basics/threat-modeling/index.md). One tool might be ideal for one person or organization, but another tool might be better for another. Make sure to understand well your threat model in order to choose the tools that are the best for your unique situation.
@@ -73,11 +73,11 @@ Here's a list of alternative solutions you can start adopting to improve data pr
-- **[Messaging communication](../../tools/services/messengers/_index.md):** Move your text message communication, audio calls, and video calls to a secure messenger like Signal. Enable features like Signal's username option, and disappearing messages. +- **[Messaging communication](../../tools/services/messengers/index.md):** Move your text message communication, audio calls, and video calls to a secure messenger like Signal. Enable features like Signal's username option, and disappearing messages. -- **Sensitive messaging communication:** If your threat model requires a peer-to-peer solution that doesn't need a phone number and transits over the [Tor network](https://www.privacyguides.org/articles/2025/04/30/in-praise-of-tor/), you might want to use an application such as [Cwtch](https://docs.cwtch.im/) or [Briar](../../tools/services/messengers/_index.md#briar). +- **Sensitive messaging communication:** If your threat model requires a peer-to-peer solution that doesn't need a phone number and transits over the [Tor network](https://www.privacyguides.org/articles/2025/04/30/in-praise-of-tor/), you might want to use an application such as [Cwtch](https://docs.cwtch.im/) or [Briar](../../tools/services/messengers/index.md#briar). -- **[Email communication](../../tools/services/email/_index.md):** Migrate to a privacy-respectful email service that offers end-to-end encryption, such as Proton Mail or Tuta. Make sure to inform yourself about the limitations of email privacy when using email for sensitive communication. +- **[Email communication](../../tools/services/email/index.md):** Migrate to a privacy-respectful email service that offers end-to-end encryption, such as Proton Mail or Tuta. Make sure to inform yourself about the limitations of email privacy when using email for sensitive communication.

Service providers disclosure and compatibility

@@ -90,13 +90,13 @@ Here's a list of alternative solutions you can start adopting to improve data pr
-- **[Document storing and sharing](../../tools/software/document-collaboration/_index.md):** Move away from privacy-invasive Google products to store and share documents. Instead, use an end-to-end encrypted solution such as [CryptPad](https://www.privacyguides.org/articles/2025/02/07/cryptpad-review/) for your collaborative documents and forms. Proton Drive also offers collaborative documents with *Proton Docs* and *Sheets*. +- **[Document storing and sharing](../../tools/software/document-collaboration/index.md):** Move away from privacy-invasive Google products to store and share documents. Instead, use an end-to-end encrypted solution such as [CryptPad](https://www.privacyguides.org/articles/2025/02/07/cryptpad-review/) for your collaborative documents and forms. Proton Drive also offers collaborative documents with *Proton Docs* and *Sheets*. -- **[Storing files](../../tools/services/cloud/_index.md):** Choose an end-to-end encrypted cloud solution to store and share files. Always keep in mind that if a cloud service provider doesn't offer solid end-to-end encryption, then it can potentially access any of your stored files. +- **[Storing files](../../tools/services/cloud/index.md):** Choose an end-to-end encrypted cloud solution to store and share files. Always keep in mind that if a cloud service provider doesn't offer solid end-to-end encryption, then it can potentially access any of your stored files. - **Surveys:** Stop using products such as Google Forms to poll your community. Instead, choose a privacy-focused alternative such as [CryptPad Form](https://www.privacyguides.org/articles/2025/02/07/cryptpad-review/#form) or [Framaforms](https://framaforms.org/abc/en/). -- **[Online calendar](../../tools/services/calendar/_index.md):** Your online calendar can be an important source of sensitive data. Moreover, you might store other's people data in it, or use it to share event links with collaborators. It's essential to make sure to use a privacy-protecting solution for online and collaborative calendars. +- **[Online calendar](../../tools/services/calendar/index.md):** Your online calendar can be an important source of sensitive data. Moreover, you might store other's people data in it, or use it to share event links with collaborators. It's essential to make sure to use a privacy-protecting solution for online and collaborative calendars. - **Groups and events:** When organizing groups or events, be careful to choose platforms that are privacy-respectful and don't require participants to register personal information. Keep in mind that if you only use Facebook groups, you are contributing to people staying on a privacy-invasive platform. If you only use a closed Meetup group, you are demanding people create an account and share their sensitive data in order to join. Instead, use privacy-respectful platforms such as [Mobilizon](https://mobilizon.org/) or [LAUTI](https://lauti.org/) for groups and events, [Discourse](https://www.discourse.org/) for forums, or simply use your own website to advertise in-person events. @@ -110,7 +110,7 @@ Here's a list of alternative solutions you can start adopting to improve data pr - **Availability:** Make sure you or your organization is reachable outside the Big Tech ecosystem. If your organization only has a Facebook page, then people without a Facebook account cannot reach out to you. The same is true for other commercial social media. Instead, try to rely on a website you control yourself, or a social network page you can host yourself. -- **[Social media](../../tools/software/social-networks/_index.md):** Move away from commercial social media platforms. Mainstream platforms are almost all abusing their users' data. By keeping an account there, you are indirectly encouraging your followers to stay there as well, perpetuating the platform's abuse. +- **[Social media](../../tools/software/social-networks/index.md):** Move away from commercial social media platforms. Mainstream platforms are almost all abusing their users' data. By keeping an account there, you are indirectly encouraging your followers to stay there as well, perpetuating the platform's abuse. While you may want to keep a minimal presence to advertise that you have now moved your activity to a more privacy-respectful platform, you should keep your engagement there to a minimum. diff --git a/content/activism/toolbox/tip-refuse-to-participate.md b/content/activism/toolbox/tip-refuse-to-participate.md index ddb22af1e..02168a699 100644 --- a/content/activism/toolbox/tip-refuse-to-participate.md +++ b/content/activism/toolbox/tip-refuse-to-participate.md @@ -56,7 +56,7 @@ There are many ways to refuse to participate in privacy-invasive practices and p - Inform yourself in advance about potential legal options to opt out of privacy-invasive technologies such as airport facial scanner. -- Refuse to provide an official piece of ID online for purposes that aren't strictly necessary, such as government requests. Do not comply with intrusive [age-verification](https://www.privacyguides.org/articles/2025/05/06/age-verification-wants-your-face/) processes. Leave your account abandoned instead, or [delete it](../../wiki/basics/account-deletion/_index.md) if you still can. Additionally, consider contacting your government representatives and the platform's complaint email to voice your privacy concerns about such practice. +- Refuse to provide an official piece of ID online for purposes that aren't strictly necessary, such as government requests. Do not comply with intrusive [age-verification](https://www.privacyguides.org/articles/2025/05/06/age-verification-wants-your-face/) processes. Leave your account abandoned instead, or [delete it](../../wiki/basics/account-deletion/index.md) if you still can. Additionally, consider contacting your government representatives and the platform's complaint email to voice your privacy concerns about such practice. - [Report privacy violations](tip-report-privacy-violations.md) of your local privacy laws whenever you can. diff --git a/content/activism/toolbox/tip-start-alliances-not-wars.md b/content/activism/toolbox/tip-start-alliances-not-wars.md index d185413de..38b3acc8b 100644 --- a/content/activism/toolbox/tip-start-alliances-not-wars.md +++ b/content/activism/toolbox/tip-start-alliances-not-wars.md @@ -46,7 +46,7 @@ Newcomers get confused when they receive competing new information. Confusion le Here are a few ideas to start building alliances within the privacy community: -- **Keep a list** of organizations and other privacy activists sharing your values. Mastodon's [list feature](https://fedi.tips/how-to-use-the-lists-feature-on-mastodon/) can be very helpful to build a social network feed for this. Using an [RSS feed reader](../../tools/software/news-aggregators/_index.md) is another great way to do this. +- **Keep a list** of organizations and other privacy activists sharing your values. Mastodon's [list feature](https://fedi.tips/how-to-use-the-lists-feature-on-mastodon/) can be very helpful to build a social network feed for this. Using an [RSS feed reader](../../tools/software/news-aggregators/index.md) is another great way to do this. - **Get familiar** with what your allies are working on. Think about ways their mission might be compatible with yours. diff --git a/content/activism/toolbox/tip-welcome-beginners.md b/content/activism/toolbox/tip-welcome-beginners.md index 14ce94753..73fb1abbb 100644 --- a/content/activism/toolbox/tip-welcome-beginners.md +++ b/content/activism/toolbox/tip-welcome-beginners.md @@ -36,7 +36,7 @@ Kindness, patience, and compassion are the first steps to attract and retain new - **Start with the basics:** Depending on the context, do not neglect to discuss the most basic privacy concepts before jumping in the juicy tech. Fundamental ideas such as consent, data collection, data storage, or encryption are important to master in order to understand the benefits and dangers related to data privacy. Specific tech and services come and go, but *fundamental* ideas remain. Anyone who comprehends these core concepts will have a much easier time understanding all that follows. -- **No stupid questions:** There are no stupid questions, only impatient answerers. Whenever a beginner asks a question that seems obvious to you, refrain from replying with something dry or snarky such as "Google it," or its privacy-equivalent "DuckDuckGo it." This only has the effect of chasing people away from our community. If you don't feel like helping, just reply nothing. But if you do want to help, try to find an answer for them. If you are in a rush, something like "Hey! Sorry I don't have the answer, but maybe this [resource](../../wiki/basics/why-privacy-matters/_index.md) might be helpful to you!" or "Sorry I'm not sure, but perhaps asking on this [forum](https://discuss.privacyguides.net/) might get you an answer." +- **No stupid questions:** There are no stupid questions, only impatient answerers. Whenever a beginner asks a question that seems obvious to you, refrain from replying with something dry or snarky such as "Google it," or its privacy-equivalent "DuckDuckGo it." This only has the effect of chasing people away from our community. If you don't feel like helping, just reply nothing. But if you do want to help, try to find an answer for them. If you are in a rush, something like "Hey! Sorry I don't have the answer, but maybe this [resource](../../wiki/basics/why-privacy-matters/index.md) might be helpful to you!" or "Sorry I'm not sure, but perhaps asking on this [forum](https://discuss.privacyguides.net/) might get you an answer." - **Stay patient and compassionate:** Always stay patient with beginners and newcomers (and everyone else, actually). To keep people fighting with us and grow our movement, we cannot afford to lose anyone just because we felt angry that day. Develop your [empathy skills](tip-support-your-privacy-comrades.md) to provide support and reply with compassion. People stay where they feel safe and welcomed. ==Make them feel safe and welcomed.== diff --git a/content/tools/_index.md b/content/tools/_index.md index 7e8426421..ddf094b32 100644 --- a/content/tools/_index.md +++ b/content/tools/_index.md @@ -12,7 +12,7 @@ If you're looking for a specific solution to something, these are the hardware a If you want assistance figuring out the best privacy tools and alternative programs for your needs, start a discussion on our [forum](https://discuss.privacyguides.net)! -For more details about each project, why they were chosen, and additional tips or tricks we recommend, click the "Learn more" link in each section, or click on the recommendation itself to be taken to that specific section of the page. **Want a list of every tool we recommend? Check out our [all tools](./all/_index.md) cheatsheet!** +For more details about each project, why they were chosen, and additional tips or tricks we recommend, click the "Learn more" link in each section, or click on the recommendation itself to be taken to that specific section of the page. **Want a list of every tool we recommend? Check out our [all tools](./all/index.md) cheatsheet!**
{{< cards >}} diff --git a/content/tools/advanced/_index.md b/content/tools/advanced/_index.md index c5f4a18db..7060424f9 100644 --- a/content/tools/advanced/_index.md +++ b/content/tools/advanced/_index.md @@ -8,10 +8,10 @@ weight: 70
{{< cards >}} - {{< card link="alternative-networks/_index.md#tor" title="Tor" image="alternative-networks/tor.svg" subtitle="The Tor network is a group of volunteer-operated servers that allows you to connect for free and improve your privacy and security on the Internet. Individuals and organizations can also share information over the Tor network with “.onion hidden services” without compromising their privacy." >}} - {{< card link="alternative-networks/_index.md#orbot" title="Orbot" image="alternative-networks/orbot.svg" subtitle="Orbot is a mobile application which routes traffic from any app on your device through the Tor network." >}} - {{< card link="alternative-networks/_index.md#snowflake" title="Snowflake" image="alternative-networks/snowflake.svg" subtitle="Snowflake allows you to donate bandwidth to the Tor Project by operating a “Snowflake proxy” within your browser." >}} - {{< card link="alternative-networks/_index.md#i2p-the-invisible-internet-project" title="I2P" image="alternative-networks/i2p.svg" subtitle="I2P is a network layer which encrypts your connections and routes them via a network of computers distributed around the world. It is mainly focused on creating an alternative, privacy-protecting network rather than making regular internet connections anonymous." >}} + {{< card link="alternative-networks/index.md#tor" title="Tor" image="alternative-networks/tor.svg" subtitle="The Tor network is a group of volunteer-operated servers that allows you to connect for free and improve your privacy and security on the Internet. Individuals and organizations can also share information over the Tor network with “.onion hidden services” without compromising their privacy." >}} + {{< card link="alternative-networks/index.md#orbot" title="Orbot" image="alternative-networks/orbot.svg" subtitle="Orbot is a mobile application which routes traffic from any app on your device through the Tor network." >}} + {{< card link="alternative-networks/index.md#snowflake" title="Snowflake" image="alternative-networks/snowflake.svg" subtitle="Snowflake allows you to donate bandwidth to the Tor Project by operating a “Snowflake proxy” within your browser." >}} + {{< card link="alternative-networks/index.md#i2p-the-invisible-internet-project" title="I2P" image="alternative-networks/i2p.svg" subtitle="I2P is a network layer which encrypts your connections and routes them via a network of computers distributed around the world. It is mainly focused on creating an alternative, privacy-protecting network rather than making regular internet connections anonymous." >}} {{< /cards >}}
@@ -19,8 +19,8 @@ weight: 70
{{< cards >}} - {{< card link="device-integrity/_index.md#mobile-verification-toolkit" title="MVT" image="device-integrity/mvt.webp" subtitle="Mobile Verification Toolkit (MVT) is a collection of utilities which simplifies and automates the process of scanning mobile devices for potential traces of targeting or infection by known spyware campaigns. MVT was developed by Amnesty International and released in 2021 in the context of the Pegasus Project." >}} - {{< card link="device-integrity/_index.md#imazing-ios" title="iMazing" image="device-integrity/imazing.png" subtitle="iMazing provides a free spyware analyzer tool for iOS devices which acts as a GUI-wrapper for MVT. This can be much easier to run compared to MVT itself, which is a command-line tool designed for technologists and forensic investigators." >}} - {{< card link="device-integrity/_index.md#auditor-android" title="Auditor" image="device-integrity/auditor.svg" subtitle="Auditor is an app which leverages hardware security features to provide device integrity monitoring by actively validating the identity of a device and the integrity of its operating system. Currently, it only works with GrapheneOS or the stock operating system for supported devices." >}} + {{< card link="device-integrity/index.md#mobile-verification-toolkit" title="MVT" image="device-integrity/mvt.webp" subtitle="Mobile Verification Toolkit (MVT) is a collection of utilities which simplifies and automates the process of scanning mobile devices for potential traces of targeting or infection by known spyware campaigns. MVT was developed by Amnesty International and released in 2021 in the context of the Pegasus Project." >}} + {{< card link="device-integrity/index.md#imazing-ios" title="iMazing" image="device-integrity/imazing.png" subtitle="iMazing provides a free spyware analyzer tool for iOS devices which acts as a GUI-wrapper for MVT. This can be much easier to run compared to MVT itself, which is a command-line tool designed for technologists and forensic investigators." >}} + {{< card link="device-integrity/index.md#auditor-android" title="Auditor" image="device-integrity/auditor.svg" subtitle="Auditor is an app which leverages hardware security features to provide device integrity monitoring by actively validating the identity of a device and the integrity of its operating system. Currently, it only works with GrapheneOS or the stock operating system for supported devices." >}} {{< /cards >}}
diff --git a/content/tools/advanced/alternative-networks/_index.md b/content/tools/advanced/alternative-networks/index.md similarity index 89% rename from content/tools/advanced/alternative-networks/_index.md rename to content/tools/advanced/alternative-networks/index.md index afc717e98..a5a6993de 100644 --- a/content/tools/advanced/alternative-networks/_index.md +++ b/content/tools/advanced/alternative-networks/index.md @@ -3,13 +3,13 @@ title: "Alternative Networks" description: These tools allow you to access networks other than the World Wide Web. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) -[{{< badge content="Mass Surveillance" color="blue" >}}](../../../wiki/basics/common-threats/_index.md#mass-surveillance-programs) -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) +[{{< badge content="Mass Surveillance" color="blue" >}}](../../../wiki/basics/common-threats/index.md#mass-surveillance-programs) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) ## Anonymizing Networks -When it comes to anonymizing networks, we want to specially note that [Tor](../../../wiki/advanced/tor-overview/_index.md) is our top choice. It is by far the most utilized, robustly studied, and actively developed anonymous network. Using other networks could be more likely to endanger your [:material-incognito: Anonymity](../../../wiki/basics/common-threats/_index.md#anonymity-vs-privacy){ .pg-purple }, unless you know what you're doing. +When it comes to anonymizing networks, we want to specially note that [Tor](../../../wiki/advanced/tor-overview/index.md) is our top choice. It is by far the most utilized, robustly studied, and actively developed anonymous network. Using other networks could be more likely to endanger your [:material-incognito: Anonymity](../../../wiki/basics/common-threats/index.md#anonymity-vs-privacy){ .pg-purple }, unless you know what you're doing.
{{< cards >}} @@ -22,7 +22,7 @@ When it comes to anonymizing networks, we want to specially note that [Tor](../. ### Tor -The **Tor** network is a group of volunteer-operated servers that allows you to connect for free and improve your privacy and security on the Internet. Individuals and organizations can also share information over the Tor network with ".onion hidden services" without compromising their privacy. Because Tor traffic is difficult to block and trace, Tor is an effective [:material-close-outline: Censorship](../../../wiki/basics/common-threats/_index.md#avoiding-censorship){ .pg-blue-gray } circumvention tool. +The **Tor** network is a group of volunteer-operated servers that allows you to connect for free and improve your privacy and security on the Internet. Individuals and organizations can also share information over the Tor network with ".onion hidden services" without compromising their privacy. Because Tor traffic is difficult to block and trace, Tor is an effective [:material-close-outline: Censorship](../../../wiki/basics/common-threats/index.md#avoiding-censorship){ .pg-blue-gray } circumvention tool. {{< cards >}} {{< card link="https://torproject.org" title="Homepage" icon="home" >}} @@ -31,9 +31,9 @@ The **Tor** network is a group of volunteer-operated servers that allows you to The recommended way to access the Tor network is via the official Tor Browser, which we have covered in more detail on a dedicated page: -[Tor Browser Info :material-arrow-right-drop-circle:](../../software/tor/_index.md){ .md-button .md-button--primary } +[Tor Browser Info :material-arrow-right-drop-circle:](../../software/tor/index.md){ .md-button .md-button--primary } -[Detailed Tor Overview :material-arrow-right-drop-circle:](../../../wiki/advanced/tor-overview/_index.md){ .md-button } +[Detailed Tor Overview :material-arrow-right-drop-circle:](../../../wiki/advanced/tor-overview/index.md){ .md-button } You can access the Tor network using other tools; making this determination comes down to your threat model. If you are a casual Tor user who is not worried about your ISP collecting evidence against you, using apps like [Orbot](#orbot) or mobile browser apps to access the Tor network is probably fine. Increasing the number of people who use Tor on an everyday basis helps reduce the bad stigma of Tor, and lowers the quality of "lists of Tor users" that ISPs and governments may compile. @@ -104,7 +104,7 @@ Unlike Tor, all I2P traffic is internal to the I2P network, which means regular Also, unlike Tor, every I2P node will relay traffic for other users by default, instead of relying on dedicated relay volunteers to run nodes. There are approximately [10,000](https://metrics.torproject.org/networksize.html) relays and bridges on the Tor network compared to ~50,000 on I2P, meaning there is potentially more ways for your traffic to be routed to maximize anonymity. I2P also tends to be more performant than Tor, although this is likely a side effect of Tor being more focused on regular "clearnet" internet traffic and thus using more bottle necked exit nodes. Hidden service performance is generally considered to be much better on I2P compared to Tor. While running P2P applications like BitTorrent is challenging on Tor (and can massively impact Tor network performance), it is very easy and performant on I2P. -There are downsides to I2P's approach, however. Tor relying on dedicated exit nodes means more people in less safe environments can use it, and the relays that do exist on Tor are likely to be more performant and stable, as they generally aren't run on residential connections. Tor is also far more focused on **browser privacy** (i.e. anti-fingerprinting), with a dedicated [Tor Browser](../../software/tor/_index.md) to make browsing activity as anonymous as possible. I2P is used via your [regular web browser](../../software/desktop-browsers/_index.md), and while you can configure your browser to be more privacy-protecting, you probably still won't have the same browser fingerprint as other I2P users (there's no "crowd" to blend in with in that regard). +There are downsides to I2P's approach, however. Tor relying on dedicated exit nodes means more people in less safe environments can use it, and the relays that do exist on Tor are likely to be more performant and stable, as they generally aren't run on residential connections. Tor is also far more focused on **browser privacy** (i.e. anti-fingerprinting), with a dedicated [Tor Browser](../../software/tor/index.md) to make browsing activity as anonymous as possible. I2P is used via your [regular web browser](../../software/desktop-browsers/index.md), and while you can configure your browser to be more privacy-protecting, you probably still won't have the same browser fingerprint as other I2P users (there's no "crowd" to blend in with in that regard). Tor is likely to be more resistant to censorship, due to their robust network of bridges and varying [pluggable transports](https://tb-manual.torproject.org/circumvention). On the other hand, I2P uses directory servers for the initial connection which are varying/untrusted and run by volunteers, compared to the hard-coded/trusted ones Tor uses which are likely easier to block. diff --git a/content/tools/advanced/device-integrity/_index.md b/content/tools/advanced/device-integrity/index.md similarity index 95% rename from content/tools/advanced/device-integrity/_index.md rename to content/tools/advanced/device-integrity/index.md index 54871823b..912a6934f 100644 --- a/content/tools/advanced/device-integrity/_index.md +++ b/content/tools/advanced/device-integrity/index.md @@ -48,7 +48,7 @@ These tools provide analysis based on the information they have the ability to a ## External Verification Tools Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) External verification tools run on your computer and scan your mobile device for forensic traces, which are helpful to identify potential compromise. @@ -107,8 +107,8 @@ iMazing automates and interactively guides you through the process of using [MVT ## On-Device Verification Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) These are apps you can install which check your device and operating system for signs of tampering, and validate the identity of your device. @@ -131,7 +131,7 @@ These are apps you can install which check your device and operating system for Auditor is not a scanning/analysis tool like some other tools on this page. Rather, it uses your device's hardware-backed keystore to allow you to verify the identity of your device and gain assurance that the operating system itself hasn't been tampered with or downgraded via verified boot. This provides a very robust integrity check of your device itself, but doesn't necessarily check whether the user-level apps running on your device are malicious. -Auditor performs attestation and intrusion detection with **two** devices, an *auditee* (the device being verified) and an *auditor* (the device performing the verification). The auditor can be any Android 10+ device (or a remote web service operated by [GrapheneOS](../../os/android/distributions.md#grapheneos)), while the auditee must be a specifically [supported device](https://attestation.app/about#device-support). Auditor works by: +Auditor performs attestation and intrusion detection with **two** devices, an *auditee* (the device being verified) and an *auditor* (the device performing the verification). The auditor can be any Android 10+ device (or a remote web service operated by [GrapheneOS](../../os/android/distributions/index.md#grapheneos)), while the auditee must be a specifically [supported device](https://attestation.app/about#device-support). Auditor works by: - Using a [Trust On First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) model between an *auditor* and *auditee*, the pair establish a private key in the [hardware-backed keystore](https://source.android.com/security/keystore) of the *Auditor*. - The *auditor* can either be another instance of the Auditor app or the [Remote Attestation Service](https://attestation.app). @@ -143,4 +143,4 @@ It is important to note that Auditor can only effectively detect changes **after No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. -If your [threat model](../../../wiki/basics/threat-modeling/_index.md) requires hiding your IP address from the attestation service, you could consider using [Orbot](../alternative-networks/_index.md#orbot) or a [VPN](../../services/vpn/_index.md). +If your [threat model](../../../wiki/basics/threat-modeling/index.md) requires hiding your IP address from the attestation service, you could consider using [Orbot](../alternative-networks/index.md#orbot) or a [VPN](../../services/vpn/index.md). diff --git a/content/tools/all/_index.md b/content/tools/all/index.md similarity index 99% rename from content/tools/all/_index.md rename to content/tools/all/index.md index 2fd21317e..14ec4e360 100644 --- a/content/tools/all/_index.md +++ b/content/tools/all/index.md @@ -39,7 +39,7 @@ If you're looking for a specific solution to something, these are the hardware a #### DNS Providers -We [**recommend**](../services/dns/_index.md#recommended-providers) a number of encrypted DNS servers based on a variety of criteria, such as [Mullvad](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) and [Quad9](https://quad9.net) amongst others. We recommend for you to read our pages on DNS before choosing a provider. In many cases, using an alternative DNS provider is not recommended. +We [**recommend**](../services/dns/index.md#recommended-providers) a number of encrypted DNS servers based on a variety of criteria, such as [Mullvad](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) and [Quad9](https://quad9.net) amongst others. We recommend for you to read our pages on DNS before choosing a provider. In many cases, using an alternative DNS provider is not recommended. #### Encrypted DNS and filtering clients diff --git a/content/tools/hardware/_index.md b/content/tools/hardware/_index.md index baed548d3..139f88820 100644 --- a/content/tools/hardware/_index.md +++ b/content/tools/hardware/_index.md @@ -8,7 +8,7 @@ weight: 40
{{< cards >}} - {{< card link="mobile-phones/_index.md#google-pixel" title="Google Pixel" image="mobile-phones/google-pixel.png" subtitle="Google Pixel phones are the only devices we recommend for purchase. Pixel phones have stronger hardware security than any other Android devices currently on the market, due to proper AVB support for third-party operating systems and Google’s custom Titan security chips acting as the Secure Element." >}} + {{< card link="mobile-phones/index.md#google-pixel" title="Google Pixel" image="mobile-phones/google-pixel.png" subtitle="Google Pixel phones are the only devices we recommend for purchase. Pixel phones have stronger hardware security than any other Android devices currently on the market, due to proper AVB support for third-party operating systems and Google’s custom Titan security chips acting as the Secure Element." >}} {{< /cards >}}
@@ -16,8 +16,8 @@ weight: 40
{{< cards >}} - {{< card link="security-keys/_index.md#yubico-security-key" title="Yubico Security Key" image="security-keys/yubico-security-key.webp" subtitle="The Yubico Security Key series is the most cost-effective hardware security key with FIDO Level 2 certification. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers." >}} - {{< card link="security-keys/_index.md#yubikey" title="YubiKey" image="security-keys/yubikey.png" subtitle="The YubiKey series from Yubico are among the most popular security keys with FIDO Level 2 Certification. The YubiKey 5 Series has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, TOTP and HOTP authentication, Personal Identity Verification (PIV), and OpenPGP." >}} - {{< card link="security-keys/_index.md#nitrokey" title="Nitrokey" image="security-keys/nitrokey-square.svg" subtitle="Nitrokey has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the Nitrokey Passkey. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the Nitrokey 3. Currently, only the Nitrokey 3A Mini has FIDO Level 1 Certification." >}} + {{< card link="security-keys/index.md#yubico-security-key" title="Yubico Security Key" image="security-keys/yubico-security-key.webp" subtitle="The Yubico Security Key series is the most cost-effective hardware security key with FIDO Level 2 certification. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers." >}} + {{< card link="security-keys/index.md#yubikey" title="YubiKey" image="security-keys/yubikey.png" subtitle="The YubiKey series from Yubico are among the most popular security keys with FIDO Level 2 Certification. The YubiKey 5 Series has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, TOTP and HOTP authentication, Personal Identity Verification (PIV), and OpenPGP." >}} + {{< card link="security-keys/index.md#nitrokey" title="Nitrokey" image="security-keys/nitrokey-square.svg" subtitle="Nitrokey has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the Nitrokey Passkey. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the Nitrokey 3. Currently, only the Nitrokey 3A Mini has FIDO Level 1 Certification." >}} {{< /cards >}}
diff --git a/content/tools/hardware/mobile-phones/_index.md b/content/tools/hardware/mobile-phones/index.md similarity index 95% rename from content/tools/hardware/mobile-phones/_index.md rename to content/tools/hardware/mobile-phones/index.md index a63bce1a1..9378765f8 100644 --- a/content/tools/hardware/mobile-phones/_index.md +++ b/content/tools/hardware/mobile-phones/index.md @@ -3,8 +3,8 @@ title: Mobile Phones description: These mobile devices provide the best hardware security support for custom Android operating systems. --- Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) Most **mobile phones** receive short or limited windows of security updates from OEMs; after these devices reach the end of their support period, they **cannot** be considered secure as they no longer receive firmware or driver security updates. @@ -16,7 +16,7 @@ The mobile devices listed here provide a long lifespan of guaranteed security up {{< /cards >}}
-[Recommended Android Distributions :material-arrow-right-drop-circle:](../../os/android/distributions.md) +[Recommended Android Distributions :material-arrow-right-drop-circle:](../../os/android/distributions/index.md) { .md-button .md-button--primary } [Details about Android Security :material-arrow-right-drop-circle:](../../os/android/_index.md#security-protections) @@ -59,7 +59,7 @@ Secure Elements like the Titan M2 are more limited than the processor's Trusted Google Pixel phones use a TEE OS called Trusty which is [open source](https://source.android.com/security/trusty#whyTrusty), unlike many other phones. -The Pixel 8 series and later supports ARM's Memory Tagging Extension ([MTE](https://developer.arm.com/documentation/108035/0100/Introduction-to-the-Memory-Tagging-Extension)), a hardware security enhancement that drastically lowers the probability of exploits occurring through memory corruption bugs. The stock Pixel OS allows you to enable MTE for supported apps through Google's Advanced Protection Program or via a developer option, but its usability is quite limited. [GrapheneOS](../../os/android/distributions.md#grapheneos), an alternative Android OS we recommend, greatly improves the usability and coverage of MTE in its implementation of the feature. +The Pixel 8 series and later supports ARM's Memory Tagging Extension ([MTE](https://developer.arm.com/documentation/108035/0100/Introduction-to-the-Memory-Tagging-Extension)), a hardware security enhancement that drastically lowers the probability of exploits occurring through memory corruption bugs. The stock Pixel OS allows you to enable MTE for supported apps through Google's Advanced Protection Program or via a developer option, but its usability is quite limited. [GrapheneOS](../../os/android/distributions/index.md#grapheneos), an alternative Android OS we recommend, greatly improves the usability and coverage of MTE in its implementation of the feature. ### Buying a Google Pixel diff --git a/content/tools/hardware/security-keys/_index.md b/content/tools/hardware/security-keys/index.md similarity index 92% rename from content/tools/hardware/security-keys/_index.md rename to content/tools/hardware/security-keys/index.md index 24626bacf..3f0fea8cf 100644 --- a/content/tools/hardware/security-keys/_index.md +++ b/content/tools/hardware/security-keys/index.md @@ -3,10 +3,10 @@ title: Security Keys description: These security keys provide a form of phishing-immune authentication for accounts that support it. --- Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) -A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](../../software/multi-factor-authentication/_index.md), the [FIDO2](../../../wiki/basics/multi-factor-authentication/_index.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication. +A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](../../software/multi-factor-authentication/index.md), the [FIDO2](../../../wiki/basics/multi-factor-authentication/index.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
{{< cards >}} diff --git a/content/tools/os/_index.md b/content/tools/os/_index.md index d831d035f..e35f91dc8 100644 --- a/content/tools/os/_index.md +++ b/content/tools/os/_index.md @@ -8,7 +8,7 @@ weight: 50
{{< cards >}} - {{< card link="android/distributions/_index.md#grapheneos" title="GrapheneOS" image="android/distributions/grapheneos.svg" subtitle="GrapheneOS hardens the Android stack on supported Pixels with verified boot, firmware updates, and sandboxed Play." >}} + {{< card link="android/distributions/index.md#grapheneos" title="GrapheneOS" image="android/distributions/grapheneos.svg" subtitle="GrapheneOS hardens the Android stack on supported Pixels with verified boot, firmware updates, and sandboxed Play." >}} {{< /cards >}}
@@ -16,9 +16,9 @@ weight: 50
{{< cards >}} - {{< card link="android/general-apps/_index.md#shelter" title="Shelter" image="android/general-apps/shelter.svg" subtitle="Shelter uses a managed work profile to isolate or duplicate apps with optional cross-profile controls." >}} - {{< card link="android/general-apps/_index.md#secure-camera" title="Secure Camera" image="android/general-apps/secure_camera.svg" subtitle="Secure Camera captures media with minimal metadata and modern Android storage APIs." >}} - {{< card link="android/general-apps/_index.md#secure-pdf-viewer" title="Secure PDF Viewer" image="android/general-apps/secure_pdf_viewer.svg" subtitle="Secure PDF Viewer renders PDFs in a sandboxed WebView without broad file permissions." >}} + {{< card link="android/general-apps/index.md#shelter" title="Shelter" image="android/general-apps/shelter.svg" subtitle="Shelter uses a managed work profile to isolate or duplicate apps with optional cross-profile controls." >}} + {{< card link="android/general-apps/index.md#secure-camera" title="Secure Camera" image="android/general-apps/secure_camera.svg" subtitle="Secure Camera captures media with minimal metadata and modern Android storage APIs." >}} + {{< card link="android/general-apps/index.md#secure-pdf-viewer" title="Secure PDF Viewer" image="android/general-apps/secure_pdf_viewer.svg" subtitle="Secure PDF Viewer renders PDFs in a sandboxed WebView without broad file permissions." >}} {{< /cards >}}
@@ -26,10 +26,10 @@ weight: 50
{{< cards >}} - {{< card link="android/obtaining-apps/_index.md#obtainium" title="Obtainium" image="android/obtaining-apps/obtainium.svg" subtitle="Obtainium is an app manager which allows you to install and update apps directly from the developer’s own releases page (i.e. GitHub, GitLab, the developer’s website, etc.), rather than a centralized app store/repository." >}} - {{< card link="android/obtaining-apps/_index.md#grapheneos-app-store" title="GrapheneOS App Store" subtitle="GrapheneOS’s app store is available on GitHub. It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the Auditor, Camera, and PDF Viewer." >}} - {{< card link="android/obtaining-apps/_index.md#aurora-store" title="Aurora Store" image="android/obtaining-apps/aurora-store.webp" subtitle="Aurora Store is a Google Play Store client which does not require a Google account, Google Play Services, or microG to download apps." >}} - {{< card link="android/obtaining-apps/_index.md#f-droid" title="F-Droid" image="android/obtaining-apps/f-droid.svg" subtitle="We only recommend F-Droid as a way to obtain apps which cannot be obtained via the means above. F-Droid is often recommended as an alternative to Google Play, particularly within the privacy community. The option to add third-party repositories and not be confined to Google’s walled garden has led to its popularity." >}} + {{< card link="android/obtaining-apps/index.md#obtainium" title="Obtainium" image="android/obtaining-apps/obtainium.svg" subtitle="Obtainium is an app manager which allows you to install and update apps directly from the developer’s own releases page (i.e. GitHub, GitLab, the developer’s website, etc.), rather than a centralized app store/repository." >}} + {{< card link="android/obtaining-apps/index.md#grapheneos-app-store" title="GrapheneOS App Store" subtitle="GrapheneOS’s app store is available on GitHub. It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the Auditor, Camera, and PDF Viewer." >}} + {{< card link="android/obtaining-apps/index.md#aurora-store" title="Aurora Store" image="android/obtaining-apps/aurora-store.webp" subtitle="Aurora Store is a Google Play Store client which does not require a Google account, Google Play Services, or microG to download apps." >}} + {{< card link="android/obtaining-apps/index.md#f-droid" title="F-Droid" image="android/obtaining-apps/f-droid.svg" subtitle="We only recommend F-Droid as a way to obtain apps which cannot be obtained via the means above. F-Droid is often recommended as an alternative to Google Play, particularly within the privacy community. The option to add third-party repositories and not be confined to Google’s walled garden has led to its popularity." >}} {{< /cards >}}
@@ -37,16 +37,16 @@ weight: 50
{{< cards >}} - {{< card link="desktop/_index.md#fedora-linux" title="Fedora Linux" image="desktop/fedora.svg" subtitle="Fedora Linux is our recommended desktop distribution for people new to Linux. Fedora generally adopts newer technologies (e.g., Wayland and PipeWire) before other distributions. These new technologies often come with improvements in security, privacy, and usability in general." >}} - {{< card link="desktop/_index.md#opensuse-tumbleweed" title="openSUSE Tumbleweed" image="desktop/opensuse-tumbleweed.svg" subtitle="openSUSE Tumbleweed is a stable rolling release distribution. openSUSE Tumbleweed uses Btrfs and Snapper to ensure that snapshots can be rolled back should there be a problem." >}} - {{< card link="desktop/_index.md#arch-linux" title="Arch Linux" image="desktop/archlinux.svg" subtitle="Arch Linux is a lightweight, do-it-yourself (DIY) distribution, meaning that you only get what you install. For more information see their FAQ." >}} - {{< card link="desktop/_index.md#fedora-atomic-desktops" title="Fedora Atomic Desktops" image="desktop/fedora.svg" subtitle="Fedora Atomic Desktops are variants of Fedora which use the rpm-ostree package manager and have a strong focus on containerized workflows and Flatpak for desktop applications. All of these variants follow the same release schedule as Fedora Workstation, benefiting from the same fast updates and staying very close to upstream." >}} - {{< card link="desktop/_index.md#nixos" title="NixOS" image="desktop/nixos.svg" subtitle="NixOS is an independent distribution based on the Nix package manager with a focus on reproducibility and reliability." >}} - {{< card link="desktop/_index.md#whonix" title="Whonix" image="desktop/whonix.svg" subtitle="Whonix is based on Kicksecure, a security-focused fork of Debian. It aims to provide privacy, security, and anonymity on the internet. Whonix is best used in conjunction with Qubes OS." >}} - {{< card link="desktop/_index.md#tails" title="Tails" image="desktop/tails.svg" subtitle="Tails is a live operating system based on Debian that routes all communications through Tor, which can boot on on almost any computer from a DVD, USB stick, or SD card installation. It uses Tor to preserve privacy and anonymity while circumventing censorship, and it leaves no trace of itself on the computer it is used on after it is powered off." >}} - {{< card link="desktop/_index.md#qubes-os" title="Qubes OS" image="desktop/qubes_os.svg" subtitle="Qubes OS is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or “qubes”). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers." >}} - {{< card link="desktop/_index.md#secureblue" title="Secureblue" image="desktop/secureblue.svg" subtitle="Secureblue is a security-focused operating system based on Fedora Atomic Desktops. It includes a number of security features intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with Trivalent, their hardened, Chromium-based web browser." >}} - {{< card link="desktop/_index.md#kicksecure" title="Kicksecure" image="desktop/kicksecure.svg" subtitle="Kicksecure—in oversimplified terms—is a set of scripts, configurations, and packages that substantially reduce the attack surface of Debian. It covers a lot of privacy and hardening recommendations by default. It also serves as the base OS for Whonix." >}} + {{< card link="desktop/index.md#fedora-linux" title="Fedora Linux" image="desktop/fedora.svg" subtitle="Fedora Linux is our recommended desktop distribution for people new to Linux. Fedora generally adopts newer technologies (e.g., Wayland and PipeWire) before other distributions. These new technologies often come with improvements in security, privacy, and usability in general." >}} + {{< card link="desktop/index.md#opensuse-tumbleweed" title="openSUSE Tumbleweed" image="desktop/opensuse-tumbleweed.svg" subtitle="openSUSE Tumbleweed is a stable rolling release distribution. openSUSE Tumbleweed uses Btrfs and Snapper to ensure that snapshots can be rolled back should there be a problem." >}} + {{< card link="desktop/index.md#arch-linux" title="Arch Linux" image="desktop/archlinux.svg" subtitle="Arch Linux is a lightweight, do-it-yourself (DIY) distribution, meaning that you only get what you install. For more information see their FAQ." >}} + {{< card link="desktop/index.md#fedora-atomic-desktops" title="Fedora Atomic Desktops" image="desktop/fedora.svg" subtitle="Fedora Atomic Desktops are variants of Fedora which use the rpm-ostree package manager and have a strong focus on containerized workflows and Flatpak for desktop applications. All of these variants follow the same release schedule as Fedora Workstation, benefiting from the same fast updates and staying very close to upstream." >}} + {{< card link="desktop/index.md#nixos" title="NixOS" image="desktop/nixos.svg" subtitle="NixOS is an independent distribution based on the Nix package manager with a focus on reproducibility and reliability." >}} + {{< card link="desktop/index.md#whonix" title="Whonix" image="desktop/whonix.svg" subtitle="Whonix is based on Kicksecure, a security-focused fork of Debian. It aims to provide privacy, security, and anonymity on the internet. Whonix is best used in conjunction with Qubes OS." >}} + {{< card link="desktop/index.md#tails" title="Tails" image="desktop/tails.svg" subtitle="Tails is a live operating system based on Debian that routes all communications through Tor, which can boot on on almost any computer from a DVD, USB stick, or SD card installation. It uses Tor to preserve privacy and anonymity while circumventing censorship, and it leaves no trace of itself on the computer it is used on after it is powered off." >}} + {{< card link="desktop/index.md#qubes-os" title="Qubes OS" image="desktop/qubes_os.svg" subtitle="Qubes OS is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or “qubes”). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers." >}} + {{< card link="desktop/index.md#secureblue" title="Secureblue" image="desktop/secureblue.svg" subtitle="Secureblue is a security-focused operating system based on Fedora Atomic Desktops. It includes a number of security features intended to proactively defend against the exploitation of both known and unknown vulnerabilities, and ships with Trivalent, their hardened, Chromium-based web browser." >}} + {{< card link="desktop/index.md#kicksecure" title="Kicksecure" image="desktop/kicksecure.svg" subtitle="Kicksecure—in oversimplified terms—is a set of scripts, configurations, and packages that substantially reduce the attack surface of Debian. It covers a lot of privacy and hardening recommendations by default. It also serves as the base OS for Whonix." >}} {{< /cards >}}
@@ -54,7 +54,7 @@ weight: 50
{{< cards >}} - {{< card link="router-firmware/_index.md#openwrt" title="OpenWrt" image="router-firmware/openwrt.svg" subtitle="OpenWrt is a Linux-based operating system; it’s primarily used on embedded devices to route network traffic. It includes util-linux, uClibc, and BusyBox. All the components have been optimized for home routers." >}} - {{< card link="router-firmware/_index.md#opnsense" title="OPNsense" image="router-firmware/opnsense.svg" subtitle="OPNsense is an open-source, FreeBSD-based firewall and routing platform which incorporates many advanced features such as traffic shaping, load balancing, and VPN capabilities, with many more features available in the form of plugins." >}} + {{< card link="router-firmware/index.md#openwrt" title="OpenWrt" image="router-firmware/openwrt.svg" subtitle="OpenWrt is a Linux-based operating system; it’s primarily used on embedded devices to route network traffic. It includes util-linux, uClibc, and BusyBox. All the components have been optimized for home routers." >}} + {{< card link="router-firmware/index.md#opnsense" title="OPNsense" image="router-firmware/opnsense.svg" subtitle="OPNsense is an open-source, FreeBSD-based firewall and routing platform which incorporates many advanced features such as traffic shaping, load balancing, and VPN capabilities, with many more features available in the form of plugins." >}} {{< /cards >}}
diff --git a/content/tools/os/android/_index.md b/content/tools/os/android/_index.md index 98c316d4c..1cd7b9865 100644 --- a/content/tools/os/android/_index.md +++ b/content/tools/os/android/_index.md @@ -13,7 +13,7 @@ description: Our advice for replacing privacy-invasive default Android features The **Android Open Source Project** (AOSP) is an open-source mobile operating system led by Google which powers the majority of the world's mobile devices. Most phones sold with Android are modified to include invasive integrations and apps such as Google Play Services, so you can significantly improve your privacy on your mobile device by replacing your phone's default installation with a version of Android without these invasive features. -[General Android Overview](../../../wiki/os/android/_index.md) +[General Android Overview](../../../wiki/os/android/index.md) { .md-button .md-button--primary } ## Our Advice @@ -22,12 +22,12 @@ The **Android Open Source Project** (AOSP) is an open-source mobile operating sy There are many methods of obtaining apps on Android while avoiding Google Play. Whenever possible, try using one of these methods before getting your apps from non-private sources: -[Obtaining Applications](./obtaining-apps/_index.md) +[Obtaining Applications](./obtaining-apps/index.md) { .md-button } There are also many private alternatives to the apps that come pre-installed on your phone, such as the camera app. Besides the Android apps we recommend throughout this site in general, we've created a list of system utilities specific to Android which you might find useful. -[General App Recommendations](./general-apps/_index.md) +[General App Recommendations](./general-apps/index.md) { .md-button } ### Install a Custom Distribution @@ -38,14 +38,14 @@ This problem could be solved by using an alternative Android distribution, commo Ideally, when choosing a custom Android distribution, you should make sure that it upholds the Android security model. At the very least, the distribution should have production builds, support for AVB, rollback protection, timely firmware and operating system updates, and SELinux in [enforcing mode](https://source.android.com/security/selinux/concepts#enforcement_levels). All of our recommended Android distributions satisfy these criteria: -[Recommended Distributions](distributions/_index.md) +[Recommended Distributions](distributions/index.md) { .md-button } ### Avoid Root [Rooting](https://en.wikipedia.org/wiki/Rooting_(Android)) Android phones can decrease security significantly as it weakens the complete [Android security model](https://en.wikipedia.org/wiki/Android_(operating_system)#Security_and_privacy). This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful Verified Boot. Apps that require root will also modify the system partition, meaning that Verified Boot would have to remain disabled. Having root exposed directly in the user interface also increases the attack surface of your device and may assist in [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation) vulnerabilities and SELinux policy bypasses. -Content blockers which modify the [hosts file](https://en.wikipedia.org/wiki/Hosts_(file)) (like AdAway) and firewalls which require root access persistently (like AFWall+) are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For content blocking, we suggest encrypted [DNS](../../services/dns/_index.md) or content blocking functionality provided by a VPN instead. TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN), preventing you from using privacy-enhancing services such as [Orbot](../../advanced/alternative-networks/_index.md#orbot) or a [real VPN provider](../../services/vpn/_index.md). +Content blockers which modify the [hosts file](https://en.wikipedia.org/wiki/Hosts_(file)) (like AdAway) and firewalls which require root access persistently (like AFWall+) are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For content blocking, we suggest encrypted [DNS](../../services/dns/index.md) or content blocking functionality provided by a VPN instead. TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN), preventing you from using privacy-enhancing services such as [Orbot](../../advanced/alternative-networks/index.md#orbot) or a [real VPN provider](../../services/vpn/index.md). AFWall+ works based on the [packet filtering](https://en.wikipedia.org/wiki/Firewall_(computing)#Packet_filter) approach and may be bypassable in some situations. diff --git a/content/tools/os/android/distributions/_index.md b/content/tools/os/android/distributions/index.md similarity index 74% rename from content/tools/os/android/distributions/_index.md rename to content/tools/os/android/distributions/index.md index 398123ffd..40bb43b7d 100644 --- a/content/tools/os/android/distributions/_index.md +++ b/content/tools/os/android/distributions/index.md @@ -3,8 +3,8 @@ title: Alternative Distributions description: You can replace the operating system on your Android phone with these secure and privacy-respecting alternatives. --- Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) -[{{< badge content="Passive Attacks" color="amber" >}}](../../../../wiki/basics/common-threats/_index.md#security-and-privacy) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../../wiki/basics/common-threats/index.md#security-and-privacy) A **custom Android-based operating system** (sometimes referred to as a **custom ROM**) can be a way to achieve a higher level of privacy and security on your device. This is in contrast to the "stock" version of Android which comes with your phone from the factory, and is often deeply integrated with Google Play Services as well as other vendor software. @@ -33,15 +33,15 @@ GrapheneOS provides additional [security hardening](https://en.wikipedia.org/wik GrapheneOS supports [sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), which runs Google Play Services fully sandboxed like any other regular app. This means you can take advantage of most Google Play Services, such as push notifications, while giving you full control over their permissions and access, and while containing them to a specific [work profile](../_index.md#work-profile) or [user profile](../_index.md#user-profiles) of your choice. -[Google Pixel phones](../../../hardware/mobile-phones/_index.md#google-pixel) are the only devices that currently meet GrapheneOS's [hardware security requirements](https://grapheneos.org/faq#future-devices). The Pixel 8 and later support ARM's Memory Tagging Extension (MTE), a hardware security enhancement that drastically lowers the probability of exploits occurring through memory corruption bugs. GrapheneOS greatly expands the coverage of MTE on supported devices. Whereas the stock OS only allows you to opt in to a limited implementation of MTE via a developer option or Google's Advanced Protection Program, GrapheneOS features a more robust implementation of MTE by default in the system kernel, default system components, and their Vanadium web browser and its WebView. +[Google Pixel phones](../../../hardware/mobile-phones/index.md#google-pixel) are the only devices that currently meet GrapheneOS's [hardware security requirements](https://grapheneos.org/faq#future-devices). The Pixel 8 and later support ARM's Memory Tagging Extension (MTE), a hardware security enhancement that drastically lowers the probability of exploits occurring through memory corruption bugs. GrapheneOS greatly expands the coverage of MTE on supported devices. Whereas the stock OS only allows you to opt in to a limited implementation of MTE via a developer option or Google's Advanced Protection Program, GrapheneOS features a more robust implementation of MTE by default in the system kernel, default system components, and their Vanadium web browser and its WebView. GrapheneOS also provides a global toggle for enabling MTE on all user-installed apps at :gear: **Settings** → **Security & privacy** → **Exploit protection** → **Memory tagging** → **Enable by default**. The OS also features per-app toggles to opt out of MTE for apps which may crash due to compatibility issues. ### Connectivity Checks -By default, Android makes many network connections to Google to perform DNS connectivity checks, to sync with current network time, to check your network connectivity, and for many other background tasks. GrapheneOS replaces these with connections to servers operated by GrapheneOS and subject to their privacy policy. This hides information like your IP address [from Google](../../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers), but means it is trivial for an admin on your network or ISP to see you are making connections to `grapheneos.network`, `grapheneos.org`, etc. and deduce what operating system you are using. +By default, Android makes many network connections to Google to perform DNS connectivity checks, to sync with current network time, to check your network connectivity, and for many other background tasks. GrapheneOS replaces these with connections to servers operated by GrapheneOS and subject to their privacy policy. This hides information like your IP address [from Google](../../../../wiki/basics/common-threats/index.md#privacy-from-service-providers), but means it is trivial for an admin on your network or ISP to see you are making connections to `grapheneos.network`, `grapheneos.org`, etc. and deduce what operating system you are using. -If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../../../services/vpn/_index.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. +If you want to hide information like this from an adversary on your network or ISP, you **must** use a [trusted VPN](../../../services/vpn/index.md) in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google's servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. ## Criteria diff --git a/content/tools/os/android/general-apps/_index.md b/content/tools/os/android/general-apps/index.md similarity index 95% rename from content/tools/os/android/general-apps/_index.md rename to content/tools/os/android/general-apps/index.md index fc7ef50c1..63832aa98 100644 --- a/content/tools/os/android/general-apps/_index.md +++ b/content/tools/os/android/general-apps/index.md @@ -3,7 +3,7 @@ title: "General Apps" description: The apps listed here are Android-exclusive and specifically enhance or replace key system functionality. --- Protects against the following threat(s): -[{{< badge content="Passive Attacks" color="amber" >}}](../../../../wiki/basics/common-threats/_index.md#security-and-privacy) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../../wiki/basics/common-threats/index.md#security-and-privacy) We recommend a wide variety of Android apps throughout this site. The apps listed here are Android-exclusive and specifically enhance or replace key system functionality. @@ -37,7 +37,7 @@ Shelter is recommended over [Insular](https://secure-system.gitlab.io/Insular) a ## Secure Camera Protects against the following threat(s): -[{{< badge content="Public Exposure" color="green" >}}](../../../../wiki/basics/common-threats/_index.md#limiting-public-information) +[{{< badge content="Public Exposure" color="green" >}}](../../../../wiki/basics/common-threats/index.md#limiting-public-information) **Secure Camera** is a camera app focused on privacy and security which can capture images, videos, and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices. @@ -59,13 +59,13 @@ Main privacy features include: > [!NOTE] > Metadata is not currently deleted from video files, but that is planned. > -> The image orientation metadata is not deleted. If you enable location (in Secure Camera) that **won't** be deleted either. If you want to delete that later you will need to use an external app such as [ExifEraser](../../../software/data-redaction/_index.md#exiferaser-android). +> The image orientation metadata is not deleted. If you enable location (in Secure Camera) that **won't** be deleted either. If you want to delete that later you will need to use an external app such as [ExifEraser](../../../software/data-redaction/index.md#exiferaser-android). ## Secure PDF Viewer Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) **Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [WebView](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files. diff --git a/content/tools/os/android/obtaining-apps/_index.md b/content/tools/os/android/obtaining-apps/index.md similarity index 89% rename from content/tools/os/android/obtaining-apps/_index.md rename to content/tools/os/android/obtaining-apps/index.md index 3bd82fc41..67b11753d 100644 --- a/content/tools/os/android/obtaining-apps/_index.md +++ b/content/tools/os/android/obtaining-apps/index.md @@ -28,7 +28,7 @@ Obtainium allows you to download APK installer files from a wide variety of sour ## GrapheneOS App Store -GrapheneOS's app store is available on [GitHub](https://github.com/GrapheneOS/Apps/releases). It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the [Auditor](../../../advanced/device-integrity/_index.md#auditor-android), [Camera](../general-apps/_index.md#secure-camera), and [PDF Viewer](../general-apps/_index.md#secure-pdf-viewer). If you are looking for these applications, we highly recommend that you get them from GrapheneOS's app store instead of the Play Store, as the apps on their store are signed by the GrapheneOS's project own signature that Google does not have access to. +GrapheneOS's app store is available on [GitHub](https://github.com/GrapheneOS/Apps/releases). It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the [Auditor](../../../advanced/device-integrity/index.md#auditor-android), [Camera](../general-apps/index.md#secure-camera), and [PDF Viewer](../general-apps/index.md#secure-pdf-viewer). If you are looking for these applications, we highly recommend that you get them from GrapheneOS's app store instead of the Play Store, as the apps on their store are signed by the GrapheneOS's project own signature that Google does not have access to. ## Aurora Store @@ -47,13 +47,13 @@ Aurora Store does not allow you to download paid apps with their anonymous accou ## Manually with RSS Notifications -For apps that are released on platforms like GitHub and GitLab, you may be able to add an RSS feed to your [news aggregator](../../../software/news-aggregators/_index.md) that will help you keep track of new releases. +For apps that are released on platforms like GitHub and GitLab, you may be able to add an RSS feed to your [news aggregator](../../../software/news-aggregators/index.md) that will help you keep track of new releases. ![RSS APK](./rss-apk-light.png#only-light) ![RSS APK](./rss-apk-dark.png#only-dark) ![APK Changes](./rss-changes-light.png#only-light) ![APK Changes](./rss-changes-dark.png#only-dark) ### GitHub -On GitHub, using [Secure Camera](../general-apps/_index.md#secure-camera) as an example, you would navigate to its [releases page](https://github.com/GrapheneOS/Camera/releases) and append `.atom` to the URL: +On GitHub, using [Secure Camera](../general-apps/index.md#secure-camera) as an example, you would navigate to its [releases page](https://github.com/GrapheneOS/Camera/releases) and append `.atom` to the URL: `https://github.com/GrapheneOS/Camera/releases.atom` @@ -107,4 +107,4 @@ Other popular third-party repositories for F-Droid such as [IzzyOnDroid](https:/ The [F-Droid](https://f-droid.org/en/packages) and [IzzyOnDroid](https://apt.izzysoft.de/fdroid) repositories are home to countless apps, so they can be useful places to search for and discover open-source apps that you can then download through other means such as the Play Store, Aurora Store, or by getting the APK directly from the developer. You should use your best judgment when looking for new apps via this method, and keep an eye on how frequently the app is updated. Outdated apps may rely on unsupported libraries, among other things, posing a potential security risk. > [!NOTE] -> In some rare cases, the developer of an app will only distribute it through F-Droid ([Gadgetbridge](../../../software/health-and-wellness/_index.md#gadgetbridge) is one example of this). If you really need an app like that, we recommend using the newer [F-Droid Basic](https://f-droid.org/en/packages/org.fdroid.basic) client instead of the original F-Droid app to obtain it. F-Droid Basic supports automatic background updates without privileged extension or root, and has a reduced feature set (limiting attack surface). +> In some rare cases, the developer of an app will only distribute it through F-Droid ([Gadgetbridge](../../../software/health-and-wellness/index.md#gadgetbridge) is one example of this). If you really need an app like that, we recommend using the newer [F-Droid Basic](https://f-droid.org/en/packages/org.fdroid.basic) client instead of the original F-Droid app to obtain it. F-Droid Basic supports automatic background updates without privileged extension or root, and has a reduced feature set (limiting attack surface). diff --git a/content/tools/os/desktop/_index.md b/content/tools/os/desktop/index.md similarity index 88% rename from content/tools/os/desktop/_index.md rename to content/tools/os/desktop/index.md index ef7af44a9..d9e58f0d8 100644 --- a/content/tools/os/desktop/_index.md +++ b/content/tools/os/desktop/index.md @@ -3,11 +3,11 @@ title: "Desktop/PC" description: Linux distributions are commonly recommended for privacy protection and software freedom. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) Linux distributions are commonly recommended for privacy protection and software freedom. If you don't already use Linux, below are some distributions we suggest trying out, as well as some general privacy and security improvement tips that are applicable to many Linux distributions. -- [General Linux Overview](../../../wiki/os/linux/_index.md) +- [General Linux Overview](../../../wiki/os/linux/index.md)
{{< cards >}} @@ -63,13 +63,13 @@ Tumbleweed follows a rolling release model where each update is released as a sn Arch Linux has a rolling release cycle. There is no fixed release schedule and packages are updated very frequently. -Being a DIY distribution, you are [expected to set up and maintain](../../../wiki/os/linux/_index.md#arch-based-distributions) your system on your own. Arch has an [official installer](https://wiki.archlinux.org/title/Archinstall) to make the installation process a little easier. +Being a DIY distribution, you are [expected to set up and maintain](../../../wiki/os/linux/index.md#arch-based-distributions) your system on your own. Arch has an [official installer](https://wiki.archlinux.org/title/Archinstall) to make the installation process a little easier. A large portion of [Arch Linux’s packages](https://reproducible.archlinux.org) are [reproducible](https://reproducible-builds.org)[^1]. ## Atomic Distributions -**Atomic distributions** (sometimes also referred to as **immutable distributions**) are operating systems which handle package installation and updates by layering changes atop your core system image, rather than by directly modifying the system. Advantages of atomic distros include increased stability and the ability to easily roll back updates. See [*Traditional vs. Atomic Updates*](../../../wiki/os/linux/_index.md#traditional-vs-atomic-updates) for more info. +**Atomic distributions** (sometimes also referred to as **immutable distributions**) are operating systems which handle package installation and updates by layering changes atop your core system image, rather than by directly modifying the system. Advantages of atomic distros include increased stability and the ability to easily roll back updates. See [*Traditional vs. Atomic Updates*](../../../wiki/os/linux/index.md#traditional-vs-atomic-updates) for more info. ### Fedora Atomic Desktops @@ -113,7 +113,7 @@ Nix is a source-based package manager; if there’s no pre-built available in th ### Whonix -**Whonix** is based on [Kicksecure](#kicksecure), a security-focused fork of Debian. It aims to provide privacy, security, and [anonymity](../../../wiki/basics/common-threats/_index.md#anonymity-vs-privacy) on the internet. Whonix is best used in conjunction with [Qubes OS](#qubes-os). +**Whonix** is based on [Kicksecure](#kicksecure), a security-focused fork of Debian. It aims to provide privacy, security, and [anonymity](../../../wiki/basics/common-threats/index.md#anonymity-vs-privacy) on the internet. Whonix is best used in conjunction with [Qubes OS](#qubes-os). {{< cards >}} {{< card link="https://whonix.org" title="Homepage" icon="home" >}} @@ -124,11 +124,11 @@ Whonix is meant to run as two virtual machines: a “Workstation” and a Tor Some of its features include Tor Stream Isolation, [keystroke anonymization](https://whonix.org/wiki/Keystroke_Deanonymization#Kloak), [encrypted swap](https://github.com/Whonix/swap-file-creator), and a hardened memory allocator. Future versions of Whonix will likely include [full system AppArmor policies](https://github.com/roddhjav/apparmor.d) and a [sandboxed app launcher](https://whonix.org/wiki/Sandbox-app-launcher) to fully confine all processes on the system. -Whonix is best used [in conjunction with Qubes](https://whonix.org/wiki/Qubes/Why_use_Qubes_over_other_Virtualizers). We have a [recommended guide](../../../wiki/os/qubes/_index.md#connecting-to-tor-via-a-vpn) on configuring Whonix in conjunction with a VPN ProxyVM in Qubes to hide your Tor activities from your ISP. +Whonix is best used [in conjunction with Qubes](https://whonix.org/wiki/Qubes/Why_use_Qubes_over_other_Virtualizers). We have a [recommended guide](../../../wiki/os/qubes/index.md#connecting-to-tor-via-a-vpn) on configuring Whonix in conjunction with a VPN ProxyVM in Qubes to hide your Tor activities from your ISP. ### Tails -**Tails** is a live operating system based on Debian that routes all communications through Tor, which can boot on on almost any computer from a DVD, USB stick, or SD card installation. It uses [Tor](../../software/tor/_index.md) to preserve privacy and [anonymity](../../../wiki/basics/common-threats/_index.md#anonymity-vs-privacy) while circumventing censorship, and it leaves no trace of itself on the computer it is used on after it is powered off. +**Tails** is a live operating system based on Debian that routes all communications through Tor, which can boot on on almost any computer from a DVD, USB stick, or SD card installation. It uses [Tor](../../software/tor/index.md) to preserve privacy and [anonymity](../../../wiki/basics/common-threats/index.md#anonymity-vs-privacy) while circumventing censorship, and it leaves no trace of itself on the computer it is used on after it is powered off. {{< cards >}} {{< card link="https://tails.net" title="Homepage" icon="home" >}} @@ -141,14 +141,14 @@ Whonix is best used [in conjunction with Qubes](https://whonix.org/wiki/Qubes/Wh Tails is great for counter forensics due to amnesia (meaning nothing is written to the disk); however, it is not a hardened distribution like Whonix. It lacks many anonymity and security features that Whonix has and gets updated much less often (only once every six weeks). A Tails system that is compromised by malware may potentially bypass the transparent proxy, allowing for the user to be deanonymized. -Tails includes [uBlock Origin](../../software/browser-extensions/_index.md#ublock-origin) in Tor Browser by default, which may potentially make it easier for adversaries to fingerprint Tails users. [Whonix](#whonix) virtual machines may be more leak-proof, however they are not amnesic, meaning data may be recovered from your storage device. +Tails includes [uBlock Origin](../../software/browser-extensions/index.md#ublock-origin) in Tor Browser by default, which may potentially make it easier for adversaries to fingerprint Tails users. [Whonix](#whonix) virtual machines may be more leak-proof, however they are not amnesic, meaning data may be recovered from your storage device. By design, Tails is meant to completely reset itself after each reboot. Encrypted [persistent storage](https://tails.net/doc/persistent_storage/index.en.html) can be configured to store some data between reboots. ## Security-focused Distributions Protects against the following threat(s): -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) ### Qubes OS @@ -159,9 +159,9 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte {{< card link="https://qubes-os.org/privacy" title="Privacy Policy" icon="eye" >}} {{< /cards >}} -Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised via an exploit in a [targeted attack](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals), the extra isolation is likely to protect the rest of the *qubes* and the core system. +Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised via an exploit in a [targeted attack](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals), the extra isolation is likely to protect the rest of the *qubes* and the core system. -For further information about how Qubes works, read our full [Qubes OS overview](../../../wiki/os/qubes/_index.md) page. +For further information about how Qubes works, read our full [Qubes OS overview](../../../wiki/os/qubes/index.md) page. ### Secureblue @@ -172,13 +172,13 @@ For further information about how Qubes works, read our full [Qubes OS overview] {{< card link="https://secureblue.dev/install" title="Documentation" icon="document-text" >}} {{< /cards >}} -**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](../android/distributions.md#grapheneos)'s Vanadium browser. +**Trivalent** is Secureblue's hardened Chromium for desktop Linux inspired by [GrapheneOS](../android/distributions/index.md#grapheneos)'s Vanadium browser. Secureblue also provides GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) and enables it globally (including for Flatpaks). ### Kicksecure -While we [recommend against](../../../wiki/os/linux/_index.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install. +While we [recommend against](../../../wiki/os/linux/index.md#release-cycle) "perpetually outdated" distributions like Debian for desktop use in most cases, Kicksecure is a Debian-based operating system which has been hardened to be much more than a typical Linux install. **Kicksecure**—in oversimplified terms—is a set of scripts, configurations, and packages that substantially reduce the attack surface of Debian. It covers a lot of privacy and hardening recommendations by default. It also serves as the base OS for [Whonix](#whonix). @@ -189,7 +189,7 @@ While we [recommend against](../../../wiki/os/linux/_index.md#release-cycle) "pe ## Criteria -Choosing a Linux distro that is right for you will come down to a huge variety of personal preferences, and this page is **not** meant to be an exhaustive list of every viable distribution. Our Linux overview page has some advice on [choosing a distro](../../../wiki/os/linux/_index.md#choosing-your-distribution) in more detail. The distros on *this* page do all generally follow the guidelines we covered there, and all meet these standards: +Choosing a Linux distro that is right for you will come down to a huge variety of personal preferences, and this page is **not** meant to be an exhaustive list of every viable distribution. Our Linux overview page has some advice on [choosing a distro](../../../wiki/os/linux/index.md#choosing-your-distribution) in more detail. The distros on *this* page do all generally follow the guidelines we covered there, and all meet these standards: - Free and open source. - Receives regular software and kernel updates. @@ -197,11 +197,11 @@ Choosing a Linux distro that is right for you will come down to a huge variety o - The notable exception here is Qubes, but the [isolation issues](https://blog.invisiblethings.org/2011/04/23/linux-security-circus-on-gui-isolation) which X11 typically has are avoided by virtualization. This isolation only applies to apps *running in different qubes* (virtual machines); apps running in the *same* qube are not protected from each other. - Supports full-disk encryption during installation. - Doesn't freeze regular releases for more than 1 year. - - We [recommend against](../../../wiki/os/linux/_index.md#release-cycle) "Long Term Support" or "stable" distro releases for desktop usage. + - We [recommend against](../../../wiki/os/linux/index.md#release-cycle) "Long Term Support" or "stable" distro releases for desktop usage. - Supports a wide variety of hardware. - Preference towards larger projects. - Maintaining an operating system is a major challenge, and smaller projects have a tendency to make more avoidable mistakes, or delay critical updates (or worse, disappear entirely). We lean towards projects which will likely be around 10 years from now (whether that's due to corporate backing or very significant community support), and away from projects which are hand-built or have a small number of maintainers. In addition, [our standard criteria](../../../about/criteria.md) for recommended projects still applies. **Please note we are not affiliated with any of the projects we recommend.** -[^1]: Reproducibility entails the ability to verify that packages and binaries made available to the end user match the source code, which can be useful against potential [:material-package-variant-closed-remove: Supply Chain Attacks](../../../wiki/basics/common-threats/_index.md#attacks-against-certain-organizations){ .pg-viridian }. +[^1]: Reproducibility entails the ability to verify that packages and binaries made available to the end user match the source code, which can be useful against potential [:material-package-variant-closed-remove: Supply Chain Attacks](../../../wiki/basics/common-threats/index.md#attacks-against-certain-organizations){ .pg-viridian }. diff --git a/content/tools/os/router-firmware/_index.md b/content/tools/os/router-firmware/index.md similarity index 95% rename from content/tools/os/router-firmware/_index.md rename to content/tools/os/router-firmware/index.md index a37d58094..208faf3e0 100644 --- a/content/tools/os/router-firmware/_index.md +++ b/content/tools/os/router-firmware/index.md @@ -3,8 +3,8 @@ title: "Router Firmware" description: Alternative operating systems for securing your router or Wi-Fi access point. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) Below are a few alternative operating systems that can be used on routers, Wi-Fi access points, etc. diff --git a/content/tools/self-hosting/_index.md b/content/tools/self-hosting/_index.md index 9f5bc9299..771626204 100644 --- a/content/tools/self-hosting/_index.md +++ b/content/tools/self-hosting/_index.md @@ -4,7 +4,7 @@ description: For our more technical readers, self-hosting software and services weight: 60 --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../wiki/basics/common-threats/index.md#privacy-from-service-providers) **Self-hosting** software and services can be a way to achieve a higher level of privacy through digital sovereignty, particularly independence from cloud servers controlled by product developers or vendors. By self-hosting, we mean hosting applications and data on your own hardware. @@ -14,8 +14,8 @@ Self-hosting your own solutions requires advanced technical knowledge and a deep
{{< cards >}} - {{< card link="dns-filtering/_index.md#adguard-home" title="AdGuard Home" image="dns-filtering/adguard-home.svg" subtitle="AdGuard Home is an open-source DNS sinkhole which features a polished web interface to view insights and manage blocked content." >}} - {{< card link="dns-filtering/_index.md#pi-hole" title="Pi-hole" image="dns-filtering/pi-hole.svg" subtitle="Pi-hole is an open-source DNS sinkhole which features a friendly web interface to view insights and manage blocked content. Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware." >}} + {{< card link="dns-filtering/index.md#adguard-home" title="AdGuard Home" image="dns-filtering/adguard-home.svg" subtitle="AdGuard Home is an open-source DNS sinkhole which features a polished web interface to view insights and manage blocked content." >}} + {{< card link="dns-filtering/index.md#pi-hole" title="Pi-hole" image="dns-filtering/pi-hole.svg" subtitle="Pi-hole is an open-source DNS sinkhole which features a friendly web interface to view insights and manage blocked content. Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware." >}} {{< /cards >}}
@@ -23,9 +23,9 @@ Self-hosting your own solutions requires advanced technical knowledge and a deep
{{< cards >}} - {{< card link="email-servers/_index.md#stalwart" title="Stalwart" image="email-servers/stalwart.svg" subtitle="Stalwart is a newer mail server written in Rust which supports JMAP in addition to the standard IMAP, POP3, and SMTP. It has a wide variety of configuration options, but also defaults to very reasonable settings in terms of both security and features, making it easy to use immediately." >}} - {{< card link="email-servers/_index.md#mailcow" title="Mailcow" image="email-servers/mailcow.svg" subtitle="Mailcow is an advanced mail server perfect for those with Linux experience. It has everything you need in a Docker container: a mail server with DKIM support, antivirus and spam monitoring, webmail and ActiveSync with SOGo, and web-based administration with 2FA support." >}} - {{< card link="email-servers/_index.md#mail-in-a-box" title="Mail-in-a-Box" image="email-servers/mail-in-a-box.svg" subtitle="Mail-in-a-Box is an automated setup script for deploying a mail server on Ubuntu. Its goal is to make it easier for people to set up their own mail server." >}} + {{< card link="email-servers/index.md#stalwart" title="Stalwart" image="email-servers/stalwart.svg" subtitle="Stalwart is a newer mail server written in Rust which supports JMAP in addition to the standard IMAP, POP3, and SMTP. It has a wide variety of configuration options, but also defaults to very reasonable settings in terms of both security and features, making it easy to use immediately." >}} + {{< card link="email-servers/index.md#mailcow" title="Mailcow" image="email-servers/mailcow.svg" subtitle="Mailcow is an advanced mail server perfect for those with Linux experience. It has everything you need in a Docker container: a mail server with DKIM support, antivirus and spam monitoring, webmail and ActiveSync with SOGo, and web-based administration with 2FA support." >}} + {{< card link="email-servers/index.md#mail-in-a-box" title="Mail-in-a-Box" image="email-servers/mail-in-a-box.svg" subtitle="Mail-in-a-Box is an automated setup script for deploying a mail server on Ubuntu. Its goal is to make it easier for people to set up their own mail server." >}} {{< /cards >}}
@@ -33,9 +33,9 @@ Self-hosting your own solutions requires advanced technical knowledge and a deep
{{< cards >}} - {{< card link="file-management/_index.md#photoprism" title="PhotoPrism" image="file-management/photoprism.svg" subtitle="PhotoPrism is a platform for managing photos. It supports album syncing and sharing as well as a variety of other features. It does not include end-to-end encryption, so it’s best hosted on a server that you trust and is under your control." >}} - {{< card link="file-management/_index.md#freedombox" title="FreedomBox" image="file-management/freedombox.svg" subtitle="FreedomBox is an operating system designed to be run on a single-board computer (SBC). The purpose is to make it easy to set up server applications for use cases like sharing files." >}} - {{< card link="file-management/_index.md#nextcloud" title="Nextcloud" image="file-management/nextcloud.svg" subtitle="Nextcloud is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control." >}} + {{< card link="file-management/index.md#photoprism" title="PhotoPrism" image="file-management/photoprism.svg" subtitle="PhotoPrism is a platform for managing photos. It supports album syncing and sharing as well as a variety of other features. It does not include end-to-end encryption, so it’s best hosted on a server that you trust and is under your control." >}} + {{< card link="file-management/index.md#freedombox" title="FreedomBox" image="file-management/freedombox.svg" subtitle="FreedomBox is an operating system designed to be run on a single-board computer (SBC). The purpose is to make it easy to set up server applications for use cases like sharing files." >}} + {{< card link="file-management/index.md#nextcloud" title="Nextcloud" image="file-management/nextcloud.svg" subtitle="Nextcloud is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control." >}} {{< /cards >}}
@@ -43,7 +43,7 @@ Self-hosting your own solutions requires advanced technical knowledge and a deep
{{< cards >}} - {{< card link="passwords/_index.md#vaultwarden" title="Vaultwarden" image="passwords/vaultwarden.svg" subtitle="Vaultwarden is an alternative implementation of Bitwarden's sync server written in Rust and compatible with official Bitwarden clients, perfect for self-hosted deployment where running the resource-heavy, official service might not be ideal." >}} + {{< card link="passwords/index.md#vaultwarden" title="Vaultwarden" image="passwords/vaultwarden.svg" subtitle="Vaultwarden is an alternative implementation of Bitwarden's sync server written in Rust and compatible with official Bitwarden clients, perfect for self-hosted deployment where running the resource-heavy, official service might not be ideal." >}} {{< /cards >}}
@@ -53,23 +53,23 @@ These recommendations live in other tools categories (software and services) but
{{< cards >}} - {{< card link="../services/cloud/_index.md#peergos" title="Peergos" image="../services/cloud/peergos.svg" subtitle="Peergos is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view, and edit their photos, videos, documents, etc." >}} - {{< card link="../services/email-aliasing/_index.md#addyio" title="Addy.io" image="../services/email-aliasing/addy.svg" subtitle="Addy.io lets you create 10 domain aliases on a shared domain for free, or unlimited standard aliases. The number of shared aliases (which end in a shared domain like @addy.io) that you can create depends on the plan you are subscribed to." >}} - {{< card link="../services/email-aliasing/_index.md#simplelogin" title="SimpleLogin" image="../services/email-aliasing/simplelogin.svg" subtitle="SimpleLogin is a free service which provides email aliases on a variety of shared domain names, and optionally provides paid features like unlimited aliases and custom domains." >}} - {{< card link="../services/messengers/_index.md#simplex-chat" title="SimpleX Chat" image="../services/messengers/simplex.svg" subtitle="SimpleX Chat is an instant messenger that doesn't depend on any unique identifiers such as phone numbers or usernames. Its decentralized network makes SimpleX Chat an effective tool against censorship." >}} - {{< card link="../services/photo-backups/_index.md#ente-photos" title="Ente Photos" image="../services/photo-backups/ente.svg" subtitle="Ente Photos is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open source, both on the client side and on the server side." >}} - {{< card link="../software/document-collaboration/_index.md#cryptpad" title="CryptPad" image="../software/document-collaboration/cryptpad.svg" subtitle="CryptPad is a private-by-design alternative to popular, full-fledged office suites. All content on this web service is E2EE and can be shared with other users easily." >}} - {{< card link="../software/file-sharing/_index.md#send" title="Send" image="../software/file-sharing/send.svg" subtitle="Send is a fork of Mozilla's discontinued Firefox Send service which allows you to send files to others with a link. Files are encrypted on your device so that they cannot be read by the server, and they can be optionally password-protected as well." >}} - {{< card link="../software/frontends/_index.md#invidious" title="Invidious" image="../software/frontends/invidious.svg" subtitle="Invidious is a free and open-source frontend for YouTube that is also self-hostable." >}} - {{< card link="../software/frontends/_index.md#piped" title="Piped" image="../software/frontends/piped.svg" subtitle="Piped is a free and open-source frontend for YouTube that is also self-hostable." >}} - {{< card link="../software/frontends/_index.md#proxitok" title="ProxiTok" image="../software/frontends/proxitok.svg" subtitle="ProxiTok is an open-source frontend to the TikTok website that is also self-hostable." >}} - {{< card link="../software/frontends/_index.md#redlib" title="Redlib" image="../software/frontends/redlib.svg" subtitle="Redlib is an open-source frontend to the Reddit website that is also self-hostable. You can access Redlib through a number of public instances." >}} - {{< card link="../software/language-tools/_index.md#libretranslate" title="LibreTranslate" image="../software/language-tools/libretranslate.png" subtitle="LibreTranslate is a free and open-source machine translation web interface and API server. It uses Argos Translate models on the backend for translations." >}} - {{< card link="../software/news-aggregators/_index.md#miniflux" title="Miniflux" image="../software/news-aggregators/miniflux.svg" subtitle="Miniflux is a web-based news aggregator that you can self-host." >}} - {{< card link="../software/notebooks/_index.md#standard-notes" title="Standard Notes" image="../software/notebooks/standard-notes.svg" subtitle="Standard Notes is a simple and private notes app that features cross-platform sync for seamless use. It features E2EE on every platform, and a powerful desktop experience with themes and custom editors." >}} - {{< card link="../software/pastebins/_index.md#paaster" title="Paaster" image="../software/pastebins/paaster.svg" subtitle="Paaster is a secure and user-friendly pastebin application that prioritizes privacy and simplicity. With end-to-end encryption and paste history, Paaster ensures that your pasted code remains confidential and accessible." >}} - {{< card link="../software/pastebins/_index.md#privatebin" title="PrivateBin" image="../software/pastebins/privatebin.svg" subtitle="PrivateBin is a minimalist, open-source, online pastebin where the server cannot decrypt and read any pasted data you submit. Data is encrypted/decrypted in the browser using 256-bit AES." >}} - {{< card link="../software/social-networks/_index.md#element" title="Element" image="../software/social-networks/element.svg" subtitle="Element is the flagship client for the Matrix protocol, an open standard that enables decentralized communication by way of federated chat rooms. Users can exist on different homeservers but still communicate with each other." >}} - {{< card link="../software/social-networks/_index.md#mastodon" title="Mastodon" image="../software/social-networks/mastodon.svg" subtitle="Mastodon is a social network based on open web protocols and free, open-source software. It uses the ActivityPub protocol, which is decentralized like email: Users can exist on different servers or even different platforms but still communicate with each other." >}} + {{< card link="../services/cloud/index.md#peergos" title="Peergos" image="../services/cloud/peergos.svg" subtitle="Peergos is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view, and edit their photos, videos, documents, etc." >}} + {{< card link="../services/email-aliasing/index.md#addyio" title="Addy.io" image="../services/email-aliasing/addy.svg" subtitle="Addy.io lets you create 10 domain aliases on a shared domain for free, or unlimited standard aliases. The number of shared aliases (which end in a shared domain like @addy.io) that you can create depends on the plan you are subscribed to." >}} + {{< card link="../services/email-aliasing/index.md#simplelogin" title="SimpleLogin" image="../services/email-aliasing/simplelogin.svg" subtitle="SimpleLogin is a free service which provides email aliases on a variety of shared domain names, and optionally provides paid features like unlimited aliases and custom domains." >}} + {{< card link="../services/messengers/index.md#simplex-chat" title="SimpleX Chat" image="../services/messengers/simplex.svg" subtitle="SimpleX Chat is an instant messenger that doesn't depend on any unique identifiers such as phone numbers or usernames. Its decentralized network makes SimpleX Chat an effective tool against censorship." >}} + {{< card link="../services/photo-backups/index.md#ente-photos" title="Ente Photos" image="../services/photo-backups/ente.svg" subtitle="Ente Photos is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open source, both on the client side and on the server side." >}} + {{< card link="../software/document-collaboration/index.md#cryptpad" title="CryptPad" image="../software/document-collaboration/cryptpad.svg" subtitle="CryptPad is a private-by-design alternative to popular, full-fledged office suites. All content on this web service is E2EE and can be shared with other users easily." >}} + {{< card link="../software/file-sharing/index.md#send" title="Send" image="../software/file-sharing/send.svg" subtitle="Send is a fork of Mozilla's discontinued Firefox Send service which allows you to send files to others with a link. Files are encrypted on your device so that they cannot be read by the server, and they can be optionally password-protected as well." >}} + {{< card link="../software/frontends/index.md#invidious" title="Invidious" image="../software/frontends/invidious.svg" subtitle="Invidious is a free and open-source frontend for YouTube that is also self-hostable." >}} + {{< card link="../software/frontends/index.md#piped" title="Piped" image="../software/frontends/piped.svg" subtitle="Piped is a free and open-source frontend for YouTube that is also self-hostable." >}} + {{< card link="../software/frontends/index.md#proxitok" title="ProxiTok" image="../software/frontends/proxitok.svg" subtitle="ProxiTok is an open-source frontend to the TikTok website that is also self-hostable." >}} + {{< card link="../software/frontends/index.md#redlib" title="Redlib" image="../software/frontends/redlib.svg" subtitle="Redlib is an open-source frontend to the Reddit website that is also self-hostable. You can access Redlib through a number of public instances." >}} + {{< card link="../software/language-tools/index.md#libretranslate" title="LibreTranslate" image="../software/language-tools/libretranslate.png" subtitle="LibreTranslate is a free and open-source machine translation web interface and API server. It uses Argos Translate models on the backend for translations." >}} + {{< card link="../software/news-aggregators/index.md#miniflux" title="Miniflux" image="../software/news-aggregators/miniflux.svg" subtitle="Miniflux is a web-based news aggregator that you can self-host." >}} + {{< card link="../software/notebooks/index.md#standard-notes" title="Standard Notes" image="../software/notebooks/standard-notes.svg" subtitle="Standard Notes is a simple and private notes app that features cross-platform sync for seamless use. It features E2EE on every platform, and a powerful desktop experience with themes and custom editors." >}} + {{< card link="../software/pastebins/index.md#paaster" title="Paaster" image="../software/pastebins/paaster.svg" subtitle="Paaster is a secure and user-friendly pastebin application that prioritizes privacy and simplicity. With end-to-end encryption and paste history, Paaster ensures that your pasted code remains confidential and accessible." >}} + {{< card link="../software/pastebins/index.md#privatebin" title="PrivateBin" image="../software/pastebins/privatebin.svg" subtitle="PrivateBin is a minimalist, open-source, online pastebin where the server cannot decrypt and read any pasted data you submit. Data is encrypted/decrypted in the browser using 256-bit AES." >}} + {{< card link="../software/social-networks/index.md#element" title="Element" image="../software/social-networks/element.svg" subtitle="Element is the flagship client for the Matrix protocol, an open standard that enables decentralized communication by way of federated chat rooms. Users can exist on different homeservers but still communicate with each other." >}} + {{< card link="../software/social-networks/index.md#mastodon" title="Mastodon" image="../software/social-networks/mastodon.svg" subtitle="Mastodon is a social network based on open web protocols and free, open-source software. It uses the ActivityPub protocol, which is decentralized like email: Users can exist on different servers or even different platforms but still communicate with each other." >}} {{< /cards >}}
diff --git a/content/tools/self-hosting/dns-filtering/_index.md b/content/tools/self-hosting/dns-filtering/index.md similarity index 93% rename from content/tools/self-hosting/dns-filtering/_index.md rename to content/tools/self-hosting/dns-filtering/index.md index 464f7ff05..8e97384f5 100644 --- a/content/tools/self-hosting/dns-filtering/_index.md +++ b/content/tools/self-hosting/dns-filtering/index.md @@ -3,8 +3,8 @@ title: DNS Filtering description: For our more technical readers, self-hosting a DNS solution can provide filtering for devices not covered by cloud-based DNS solutions. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) **Self-hosting DNS** is useful for providing [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) on controlled platforms, such as smart TVs and other IoT devices, as no client-side software is needed. Keep in mind that the DNS solutions below are typically restricted to your home or local network unless you set up a more advanced configuration. diff --git a/content/tools/self-hosting/email-servers/_index.md b/content/tools/self-hosting/email-servers/index.md similarity index 94% rename from content/tools/self-hosting/email-servers/_index.md rename to content/tools/self-hosting/email-servers/index.md index b68cfae23..09582a022 100644 --- a/content/tools/self-hosting/email-servers/_index.md +++ b/content/tools/self-hosting/email-servers/index.md @@ -3,7 +3,7 @@ title: Email Servers description: For our more technical readers, self-hosting your own email can provide additional privacy assurances by having maximum control over your data. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) Advanced system administrators may consider setting up their own **email server**. Mail servers require attention and continuous maintenance in order to keep things secure and mail delivery reliable. In addition to the "all-in-one" solutions below, we've picked out a few articles that cover a more manual approach: @@ -27,9 +27,9 @@ Advanced system administrators may consider setting up their own **email server* {{< card link="https://stalw.art/docs/get-started" title="Documentation" icon="document-text" >}} {{< /cards >}} -Stalwart's [PGP implementation](https://stalw.art/docs/encryption/overview) is unique among our self-hosted recommendations and allows you to operate your own mail server with encrypted message storage, lessening the risk of unauthorized access to your emails. If you additionally configure Web Key Directory (WKD) on your domain, and if you use an email client which supports PGP and WKD for outgoing mail (like Thunderbird), then this is the easiest way to get self-hosted E2EE compatibility with all [Proton Mail](../../services/email/_index.md#proton-mail) users. +Stalwart's [PGP implementation](https://stalw.art/docs/encryption/overview) is unique among our self-hosted recommendations and allows you to operate your own mail server with encrypted message storage, lessening the risk of unauthorized access to your emails. If you additionally configure Web Key Directory (WKD) on your domain, and if you use an email client which supports PGP and WKD for outgoing mail (like Thunderbird), then this is the easiest way to get self-hosted E2EE compatibility with all [Proton Mail](../../services/email/index.md#proton-mail) users. -Stalwart does **not** have an integrated webmail, so you will need to use it with a [dedicated email client](../../software/email-clients/_index.md) or find an open-source webmail to self-host, like Nextcloud's Mail app. +Stalwart does **not** have an integrated webmail, so you will need to use it with a [dedicated email client](../../software/email-clients/index.md) or find an open-source webmail to self-host, like Nextcloud's Mail app. We use Stalwart for our own internal email at *Privacy Guides*. diff --git a/content/tools/self-hosting/file-management/_index.md b/content/tools/self-hosting/file-management/index.md similarity index 97% rename from content/tools/self-hosting/file-management/_index.md rename to content/tools/self-hosting/file-management/index.md index 03480f206..0cd2f8eeb 100644 --- a/content/tools/self-hosting/file-management/_index.md +++ b/content/tools/self-hosting/file-management/index.md @@ -3,7 +3,7 @@ title: File Management description: For our more technical readers, self-hosting file management tools can provide additional privacy assurances by having maximum control over your data. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) Self-hosting your own **file management** tools may be a good idea to reduce the risk of encryption flaws in a cloud provider's native clients. diff --git a/content/tools/self-hosting/passwords/_index.md b/content/tools/self-hosting/passwords/index.md similarity index 100% rename from content/tools/self-hosting/passwords/_index.md rename to content/tools/self-hosting/passwords/index.md diff --git a/content/tools/services/_index.md b/content/tools/services/_index.md index 96b2dcc87..cb5b15b07 100644 --- a/content/tools/services/_index.md +++ b/content/tools/services/_index.md @@ -8,8 +8,8 @@ weight: 20
{{< cards >}} - {{< card link="calendar/_index.md#tuta" title="Tuta" image="email/tuta.svg" subtitle="Tuta offers a free and encrypted calendar across their supported platforms. Features include automatic E2EE of all data, sharing features, import/export functionality, multifactor authentication, and more." >}} - {{< card link="calendar/_index.md#proton-calendar" title="Proton Calendar" image="calendar/proton-calendar.svg" subtitle="Proton Calendar is an encrypted calendar service available to Proton members via its web or mobile clients. Features include automatic E2EE of all data, sharing features, import/export functionality, and more." >}} + {{< card link="calendar/index.md#tuta" title="Tuta" image="email/tuta.svg" subtitle="Tuta offers a free and encrypted calendar across their supported platforms. Features include automatic E2EE of all data, sharing features, import/export functionality, multifactor authentication, and more." >}} + {{< card link="calendar/index.md#proton-calendar" title="Proton Calendar" image="calendar/proton-calendar.svg" subtitle="Proton Calendar is an encrypted calendar service available to Proton members via its web or mobile clients. Features include automatic E2EE of all data, sharing features, import/export functionality, and more." >}} {{< /cards >}}
@@ -17,9 +17,9 @@ weight: 20
{{< cards >}} - {{< card link="cloud/_index.md#proton-drive" title="Proton Drive" image="cloud/protondrive.svg" subtitle="Proton Drive is an encrypted cloud storage provider from the popular encrypted email provider Proton Mail. The initial free storage is limited to 2 GB, but with the completion of certain steps, additional storage can be obtained up to 5 GB." >}} - {{< card link="cloud/_index.md#tresorit" title="Tresorit" image="cloud/tresorit.svg" subtitle="Tresorit is a Swiss-Hungarian encrypted cloud storage provider founded in 2011. Tresorit is owned by the Swiss Post, the national postal service of Switzerland." >}} - {{< card link="cloud/_index.md#peergos" title="Peergos" image="cloud/peergos.svg" subtitle="Peergos is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view, and edit their photos, videos, documents, etc." >}} + {{< card link="cloud/index.md#proton-drive" title="Proton Drive" image="cloud/protondrive.svg" subtitle="Proton Drive is an encrypted cloud storage provider from the popular encrypted email provider Proton Mail. The initial free storage is limited to 2 GB, but with the completion of certain steps, additional storage can be obtained up to 5 GB." >}} + {{< card link="cloud/index.md#tresorit" title="Tresorit" image="cloud/tresorit.svg" subtitle="Tresorit is a Swiss-Hungarian encrypted cloud storage provider founded in 2011. Tresorit is owned by the Swiss Post, the national postal service of Switzerland." >}} + {{< card link="cloud/index.md#peergos" title="Peergos" image="cloud/peergos.svg" subtitle="Peergos is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view, and edit their photos, videos, documents, etc." >}} {{< /cards >}}
@@ -27,8 +27,8 @@ weight: 20
{{< cards >}} - {{< card link="data-broker-removals/_index.md#easyoptouts-paid" title="EasyOptOuts" image="data-broker-removals/easyoptouts.svg" subtitle="EasyOptOuts is a $20/year service which will search a number of different data broker sites and automatically submit opt-out requests on your behalf. They will perform the first search and removal process immediately, and then re-run the process every 4 months in case your data shows up on new sites over time." >}} - {{< card link="data-broker-removals/_index.md#google-results-about-you-free" title="Google Results about you" image="data-broker-removals/google.svg" subtitle="Results about you is a free tool which helps you discover whether your personal contact information, including your home address, phone number, and email address, appears in Google search results. If any personal information is found, you can request its removal." >}} + {{< card link="data-broker-removals/index.md#easyoptouts-paid" title="EasyOptOuts" image="data-broker-removals/easyoptouts.svg" subtitle="EasyOptOuts is a $20/year service which will search a number of different data broker sites and automatically submit opt-out requests on your behalf. They will perform the first search and removal process immediately, and then re-run the process every 4 months in case your data shows up on new sites over time." >}} + {{< card link="data-broker-removals/index.md#google-results-about-you-free" title="Google Results about you" image="data-broker-removals/google.svg" subtitle="Results about you is a free tool which helps you discover whether your personal contact information, including your home address, phone number, and email address, appears in Google search results. If any personal information is found, you can request its removal." >}} {{< /cards >}}
@@ -36,10 +36,10 @@ weight: 20
{{< cards >}} - {{< card link="dns/_index.md#control-d" title="Control D" image="dns/control-d.svg" subtitle="Control D is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free." >}} - {{< card link="dns/_index.md#nextdns" title="NextDNS" image="dns/nextdns.svg" subtitle="NextDNS is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use." >}} - {{< card link="dns/_index.md#rethinkdns" title="RethinkDNS" image="dns/rethinkdns.svg" subtitle="RethinkDNS is an open-source Android client that supports DoH, DoT, DNSCrypt and DNS Proxy. It also provides additional functionality such as caching DNS responses, locally logging DNS queries, and using the app as a firewall." >}} - {{< card link="dns/_index.md#dnscrypt-proxy" title="DNSCrypt-Proxy" image="dns/dnscrypt-proxy.svg" subtitle="DNSCrypt-Proxy is a DNS proxy with support for DNSCrypt, DoH, and Anonymized DNS." >}} + {{< card link="dns/index.md#control-d" title="Control D" image="dns/control-d.svg" subtitle="Control D is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free." >}} + {{< card link="dns/index.md#nextdns" title="NextDNS" image="dns/nextdns.svg" subtitle="NextDNS is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use." >}} + {{< card link="dns/index.md#rethinkdns" title="RethinkDNS" image="dns/rethinkdns.svg" subtitle="RethinkDNS is an open-source Android client that supports DoH, DoT, DNSCrypt and DNS Proxy. It also provides additional functionality such as caching DNS responses, locally logging DNS queries, and using the app as a firewall." >}} + {{< card link="dns/index.md#dnscrypt-proxy" title="DNSCrypt-Proxy" image="dns/dnscrypt-proxy.svg" subtitle="DNSCrypt-Proxy is a DNS proxy with support for DNSCrypt, DoH, and Anonymized DNS." >}} {{< /cards >}}
@@ -47,9 +47,9 @@ weight: 20
{{< cards >}} - {{< card link="email/_index.md#proton-mail" title="Proton Mail" image="email/protonmail.svg" subtitle="Proton Mail is an email service with a focus on privacy, encryption, security, and ease of use. They have been in operation since 2013. Proton AG is based in Geneva, Switzerland." >}} - {{< card link="email/_index.md#mailbox-mail" title="Mailbox Mail" image="email/mailbox-mail.svg" subtitle="Mailbox Mail (formerly Mailbox.org) is an email service with a focus on being secure, ad-free, and powered by 100% eco-friendly energy. They have been in operation since 2014. Mailbox Mail is based in Berlin, Germany." >}} - {{< card link="email/_index.md#tuta" title="Tuta" image="email/tuta.svg" subtitle="Tuta (formerly Tutanota) is an email service with a focus on security and privacy through the use of encryption. Tuta has been in operation since 2011 and is based in Hanover, Germany." >}} + {{< card link="email/index.md#proton-mail" title="Proton Mail" image="email/protonmail.svg" subtitle="Proton Mail is an email service with a focus on privacy, encryption, security, and ease of use. They have been in operation since 2013. Proton AG is based in Geneva, Switzerland." >}} + {{< card link="email/index.md#mailbox-mail" title="Mailbox Mail" image="email/mailbox-mail.svg" subtitle="Mailbox Mail (formerly Mailbox.org) is an email service with a focus on being secure, ad-free, and powered by 100% eco-friendly energy. They have been in operation since 2014. Mailbox Mail is based in Berlin, Germany." >}} + {{< card link="email/index.md#tuta" title="Tuta" image="email/tuta.svg" subtitle="Tuta (formerly Tutanota) is an email service with a focus on security and privacy through the use of encryption. Tuta has been in operation since 2011 and is based in Hanover, Germany." >}} {{< /cards >}}
@@ -57,8 +57,8 @@ weight: 20
{{< cards >}} - {{< card link="email-aliasing/_index.md#addyio" title="Addy.io" image="email-aliasing/addy.svg" subtitle="Addy.io lets you create 10 domain aliases on a shared domain for free, or unlimited standard aliases. The number of shared aliases (which end in a shared domain like @addy.io) that you can create depends on the plan you are subscribed to." >}} - {{< card link="email-aliasing/_index.md#simplelogin" title="SimpleLogin" image="email-aliasing/simplelogin.svg" subtitle="SimpleLogin is a free service which provides email aliases on a variety of shared domain names, and optionally provides paid features like unlimited aliases and custom domains." >}} + {{< card link="email-aliasing/index.md#addyio" title="Addy.io" image="email-aliasing/addy.svg" subtitle="Addy.io lets you create 10 domain aliases on a shared domain for free, or unlimited standard aliases. The number of shared aliases (which end in a shared domain like @addy.io) that you can create depends on the plan you are subscribed to." >}} + {{< card link="email-aliasing/index.md#simplelogin" title="SimpleLogin" image="email-aliasing/simplelogin.svg" subtitle="SimpleLogin is a free service which provides email aliases on a variety of shared domain names, and optionally provides paid features like unlimited aliases and custom domains." >}} {{< /cards >}}
@@ -66,9 +66,9 @@ weight: 20
{{< cards >}} - {{< card link="financial-services/_index.md#privacycom-us" title="Privacy.com (US)" image="financial-services/privacy_com.svg" subtitle="Privacy.com's free plan allows you to create up to 12 virtual cards per month, set spend limits on those cards, and shut off cards instantly. Their paid plans provide higher limits on the number of cards that can be created each month." >}} - {{< card link="financial-services/_index.md#mysudo-us-paid" title="MySudo (US, Paid)" image="financial-services/mysudo.svg" subtitle="MySudo provides up to 9 virtual cards depending on the plan you purchase. Their paid plans additionally include functionality which may be useful for making purchases privately, such as virtual phone numbers and email addresses, although we typically recommend other email aliasing providers for extensive email aliasing use." >}} - {{< card link="financial-services/_index.md#coincards" title="Coincards" image="financial-services/coincards.svg" subtitle="Coincards allows you to purchase gift cards for a large variety of merchants. Their homepage has a complete listing of the various countries where their service is available." >}} + {{< card link="financial-services/index.md#privacycom-us" title="Privacy.com (US)" image="financial-services/privacy_com.svg" subtitle="Privacy.com's free plan allows you to create up to 12 virtual cards per month, set spend limits on those cards, and shut off cards instantly. Their paid plans provide higher limits on the number of cards that can be created each month." >}} + {{< card link="financial-services/index.md#mysudo-us-paid" title="MySudo (US, Paid)" image="financial-services/mysudo.svg" subtitle="MySudo provides up to 9 virtual cards depending on the plan you purchase. Their paid plans additionally include functionality which may be useful for making purchases privately, such as virtual phone numbers and email addresses, although we typically recommend other email aliasing providers for extensive email aliasing use." >}} + {{< card link="financial-services/index.md#coincards" title="Coincards" image="financial-services/coincards.svg" subtitle="Coincards allows you to purchase gift cards for a large variety of merchants. Their homepage has a complete listing of the various countries where their service is available." >}} {{< /cards >}}
@@ -76,10 +76,10 @@ weight: 20
{{< cards >}} - {{< card link="messengers/_index.md#signal" title="Signal" image="messengers/signal.svg" subtitle="Signal is a mobile app developed by Signal Messenger LLC. The app provides instant messaging and calls secured with the Signal protocol, an extremely secure encryption protocol which supports forward secrecy and post-compromise security." >}} - {{< card link="messengers/_index.md#molly-android" title="Molly (Android)" image="messengers/molly.svg" subtitle="If you use Android and your threat model requires protecting against targeted attacks you may consider using this alternative app, which features a number of security and usability improvements, to access the Signal network. Molly is an alternative Signal client for Android which allows you to encrypt the local database with a passphrase at rest, to have unused RAM data securely shredded, to route your connection via Tor, and more." >}} - {{< card link="messengers/_index.md#simplex-chat" title="SimpleX Chat" image="messengers/simplex.svg" subtitle="SimpleX Chat is an instant messenger that doesn't depend on any unique identifiers such as phone numbers or usernames. Its decentralized network makes SimpleX Chat an effective tool against censorship." >}} - {{< card link="messengers/_index.md#briar" title="Briar" image="messengers/briar.svg" subtitle="Briar is an encrypted instant messenger that connects to other clients using the Tor network, making it an effective tool at circumventing censorship. Briar can also connect via Wi-Fi or Bluetooth when in local proximity." >}} + {{< card link="messengers/index.md#signal" title="Signal" image="messengers/signal.svg" subtitle="Signal is a mobile app developed by Signal Messenger LLC. The app provides instant messaging and calls secured with the Signal protocol, an extremely secure encryption protocol which supports forward secrecy and post-compromise security." >}} + {{< card link="messengers/index.md#molly-android" title="Molly (Android)" image="messengers/molly.svg" subtitle="If you use Android and your threat model requires protecting against targeted attacks you may consider using this alternative app, which features a number of security and usability improvements, to access the Signal network. Molly is an alternative Signal client for Android which allows you to encrypt the local database with a passphrase at rest, to have unused RAM data securely shredded, to route your connection via Tor, and more." >}} + {{< card link="messengers/index.md#simplex-chat" title="SimpleX Chat" image="messengers/simplex.svg" subtitle="SimpleX Chat is an instant messenger that doesn't depend on any unique identifiers such as phone numbers or usernames. Its decentralized network makes SimpleX Chat an effective tool against censorship." >}} + {{< card link="messengers/index.md#briar" title="Briar" image="messengers/briar.svg" subtitle="Briar is an encrypted instant messenger that connects to other clients using the Tor network, making it an effective tool at circumventing censorship. Briar can also connect via Wi-Fi or Bluetooth when in local proximity." >}} {{< /cards >}}
@@ -87,10 +87,10 @@ weight: 20
{{< cards >}} - {{< card link="passwords/_index.md#bitwarden" title="Bitwarden" image="passwords/bitwarden.svg" subtitle="Bitwarden is a free and open-source password and passkey manager. It aims to solve password management problems for individuals, teams, and business organizations." >}} - {{< card link="passwords/_index.md#proton-pass" title="Proton Pass" image="passwords/protonpass.svg" subtitle="Proton Pass is an open-source, end-to-end encrypted password manager developed by Proton, the team behind Proton Mail. It securely stores your login credentials, generates unique email aliases, and supports and stores passkeys." >}} - {{< card link="passwords/_index.md#1password" title="1Password" image="passwords/1password.svg" subtitle="1Password is a password manager with a strong focus on security and ease-of-use that allows you to store passwords, passkeys, credit cards, software licenses, and any other sensitive information in a secure digital vault. Your vault is hosted on 1Password's servers for a monthly fee." >}} - {{< card link="passwords/_index.md#psono" title="Psono" image="passwords/psono.svg" subtitle="Psono is a free and open-source password manager from Germany, with a focus on password management for teams. Psono supports secure sharing of passwords, files, bookmarks, and emails." >}} + {{< card link="passwords/index.md#bitwarden" title="Bitwarden" image="passwords/bitwarden.svg" subtitle="Bitwarden is a free and open-source password and passkey manager. It aims to solve password management problems for individuals, teams, and business organizations." >}} + {{< card link="passwords/index.md#proton-pass" title="Proton Pass" image="passwords/protonpass.svg" subtitle="Proton Pass is an open-source, end-to-end encrypted password manager developed by Proton, the team behind Proton Mail. It securely stores your login credentials, generates unique email aliases, and supports and stores passkeys." >}} + {{< card link="passwords/index.md#1password" title="1Password" image="passwords/1password.svg" subtitle="1Password is a password manager with a strong focus on security and ease-of-use that allows you to store passwords, passkeys, credit cards, software licenses, and any other sensitive information in a secure digital vault. Your vault is hosted on 1Password's servers for a monthly fee." >}} + {{< card link="passwords/index.md#psono" title="Psono" image="passwords/psono.svg" subtitle="Psono is a free and open-source password manager from Germany, with a focus on password management for teams. Psono supports secure sharing of passwords, files, bookmarks, and emails." >}} {{< /cards >}}
@@ -98,7 +98,7 @@ weight: 20
{{< cards >}} - {{< card link="photo-backups/_index.md#ente-photos" title="Ente Photos" image="photo-backups/ente.svg" subtitle="Ente Photos is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open source, both on the client side and on the server side." >}} + {{< card link="photo-backups/index.md#ente-photos" title="Ente Photos" image="photo-backups/ente.svg" subtitle="Ente Photos is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open source, both on the client side and on the server side." >}} {{< /cards >}}
@@ -106,10 +106,10 @@ weight: 20
{{< cards >}} - {{< card link="search-engines/_index.md#brave-search" title="Brave Search" image="search-engines/brave-search.svg" subtitle="Brave Search is a search engine developed by Brave. It includes unique features such as Discussions, which highlights conversation-focused results such as forum posts." >}} - {{< card link="search-engines/_index.md#duckduckgo" title="DuckDuckGo" image="search-engines/duckduckgo.svg" subtitle="DuckDuckGo is one of the more mainstream private search engine options. Notable DuckDuckGo search features include bangs and a variety of instant answers." >}} - {{< card link="search-engines/_index.md#startpage" title="Startpage" image="search-engines/startpage.svg" subtitle="Startpage is a private search engine. One of Startpage's unique features is the Anonymous View, which puts forth efforts to standardize user activity to make it more difficult to be uniquely identified." >}} - {{< card link="search-engines/_index.md#searxng" title="SearXNG" image="search-engines/searxng.svg" subtitle="SearXNG is an open-source, self-hostable, metasearch engine. It is an actively maintained fork of SearX." >}} + {{< card link="search-engines/index.md#brave-search" title="Brave Search" image="search-engines/brave-search.svg" subtitle="Brave Search is a search engine developed by Brave. It includes unique features such as Discussions, which highlights conversation-focused results such as forum posts." >}} + {{< card link="search-engines/index.md#duckduckgo" title="DuckDuckGo" image="search-engines/duckduckgo.svg" subtitle="DuckDuckGo is one of the more mainstream private search engine options. Notable DuckDuckGo search features include bangs and a variety of instant answers." >}} + {{< card link="search-engines/index.md#startpage" title="Startpage" image="search-engines/startpage.svg" subtitle="Startpage is a private search engine. One of Startpage's unique features is the Anonymous View, which puts forth efforts to standardize user activity to make it more difficult to be uniquely identified." >}} + {{< card link="search-engines/index.md#searxng" title="SearXNG" image="search-engines/searxng.svg" subtitle="SearXNG is an open-source, self-hostable, metasearch engine. It is an actively maintained fork of SearX." >}} {{< /cards >}}
@@ -117,8 +117,8 @@ weight: 20
{{< cards >}} - {{< card link="vpn/_index.md#proton-vpn" title="Proton VPN" image="vpn/protonvpn.svg" subtitle="Proton VPN is a strong contender in the VPN space, and they have been in operation since 2016. Proton AG is based in Switzerland and offers a limited free tier, as well as a more featured premium option." >}} - {{< card link="vpn/_index.md#ivpn" title="IVPN" image="vpn/ivpn.svg" subtitle="IVPN is another premium VPN provider, and they have been in operation since 2009. IVPN is based in Gibraltar and does not offer a free trial." >}} - {{< card link="vpn/_index.md#mullvad" title="Mullvad" image="vpn/mullvad.svg" subtitle="Mullvad is a fast and inexpensive VPN with a serious focus on transparency and security. They have been in operation since 2009. Mullvad is based in Sweden and offers a 14-day money-back guarantee for payment methods that allow it." >}} + {{< card link="vpn/index.md#proton-vpn" title="Proton VPN" image="vpn/protonvpn.svg" subtitle="Proton VPN is a strong contender in the VPN space, and they have been in operation since 2016. Proton AG is based in Switzerland and offers a limited free tier, as well as a more featured premium option." >}} + {{< card link="vpn/index.md#ivpn" title="IVPN" image="vpn/ivpn.svg" subtitle="IVPN is another premium VPN provider, and they have been in operation since 2009. IVPN is based in Gibraltar and does not offer a free trial." >}} + {{< card link="vpn/index.md#mullvad" title="Mullvad" image="vpn/mullvad.svg" subtitle="Mullvad is a fast and inexpensive VPN with a serious focus on transparency and security. They have been in operation since 2009. Mullvad is based in Sweden and offers a 14-day money-back guarantee for payment methods that allow it." >}} {{< /cards >}}
diff --git a/content/tools/services/calendar/_index.md b/content/tools/services/calendar/index.md similarity index 97% rename from content/tools/services/calendar/_index.md rename to content/tools/services/calendar/index.md index 05068ffa1..7d0fbd615 100644 --- a/content/tools/services/calendar/_index.md +++ b/content/tools/services/calendar/index.md @@ -4,8 +4,8 @@ description: Calendars contain some of your most sensitive data; use products th --- Protects against the following threat(s): -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers)
{{< cards >}} diff --git a/content/tools/services/cloud/_index.md b/content/tools/services/cloud/index.md similarity index 90% rename from content/tools/services/cloud/_index.md rename to content/tools/services/cloud/index.md index 7e84e33d0..718739084 100644 --- a/content/tools/services/cloud/_index.md +++ b/content/tools/services/cloud/index.md @@ -3,8 +3,8 @@ title: Cloud Storage description: Many cloud storage providers require your trust that they will not look at your files. These are private alternatives! --- Protects against the following threat(s): -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers)
{{< cards >}} @@ -16,14 +16,14 @@ description: Many cloud storage providers require your trust that they will not Many **cloud storage providers** require your full trust that they will not look at your files. The alternatives listed below eliminate the need for trust by implementing secure end-to-end encryption. -If these alternatives do not fit your needs, we suggest you look into using encryption software like [Cryptomator](../../software/encryption/_index.md#cryptomator-cloud) with another cloud provider. Using Cryptomator in conjunction with **any** cloud provider (including these) may be a good idea to reduce the risk of encryption flaws in a provider's native clients. +If these alternatives do not fit your needs, we suggest you look into using encryption software like [Cryptomator](../../software/encryption/index.md#cryptomator-cloud) with another cloud provider. Using Cryptomator in conjunction with **any** cloud provider (including these) may be a good idea to reduce the risk of encryption flaws in a provider's native clients. > [!NOTE] -> For more technical readers, Nextcloud is [still a recommended tool](../../self-hosting/file-management/_index.md#nextcloud) for self-hosting a file management suite, however we do not recommend third-party Nextcloud storage providers at the moment, because we do [not recommend](https://discuss.privacyguides.net/t/dont-recommend-nextcloud-e2ee/10352/29) Nextcloud's built-in E2EE functionality for home users. +> For more technical readers, Nextcloud is [still a recommended tool](../../self-hosting/file-management/index.md#nextcloud) for self-hosting a file management suite, however we do not recommend third-party Nextcloud storage providers at the moment, because we do [not recommend](https://discuss.privacyguides.net/t/dont-recommend-nextcloud-e2ee/10352/29) Nextcloud's built-in E2EE functionality for home users. ## Proton Drive -**Proton Drive** is an encrypted cloud storage provider from the popular encrypted email provider [Proton Mail](../email/_index.md#proton-mail). +**Proton Drive** is an encrypted cloud storage provider from the popular encrypted email provider [Proton Mail](../email/index.md#proton-mail). The initial free storage is limited to 2 GB, but with the completion of [certain steps](https://proton.me/support/more-free-storage-existing-users), additional storage can be obtained up to 5 GB. @@ -87,7 +87,7 @@ Peergos secures your files with quantum-resistant E2EE and ensures all data abou [{{< badge content="GitHub" >}}](https://github.com/Peergos/web-ui/releases) [{{< badge content="Web" >}}](https://peergos.net) -Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [Censorship](../../../wiki/basics/common-threats/_index.md#avoiding-censorship). +Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [Censorship](../../../wiki/basics/common-threats/index.md#avoiding-censorship). The client, server, and command line interface for Peergos all run from the same binary. Additionally, Peergos includes a [sync engine](https://book.peergos.org/features/sync) (accessible via the native apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a [webdav bridge](https://book.peergos.org/features/webdav) to allow other applications to access your Peergos storage. You can refer to Peergos's documentation for a full overview of their numerous features. diff --git a/content/tools/services/data-broker-removals/_index.md b/content/tools/services/data-broker-removals/index.md similarity index 95% rename from content/tools/services/data-broker-removals/_index.md rename to content/tools/services/data-broker-removals/index.md index 0b572aa0f..70c950ae4 100644 --- a/content/tools/services/data-broker-removals/_index.md +++ b/content/tools/services/data-broker-removals/index.md @@ -4,7 +4,7 @@ description: Our recommended methods for removing your personal information from --- Protects against the following threat(s): -[{{< badge content="Public Exposure" color="green" >}}](../../../wiki/basics/common-misconceptions/_index.md) +[{{< badge content="Public Exposure" color="green" >}}](../../../wiki/basics/common-misconceptions/index.md)
{{< cards >}} @@ -20,7 +20,7 @@ description: Our recommended methods for removing your personal information from Counterintuitively, removing your personal data on these sites from the internet generally requires *providing* these companies with your personal data for them to comply with the request. Unfortunately, in most cases it is still worth doing so to minimize the amount of personal data about you which is publicly accessible. > [!TIP] -> Use your favorite [search engine](../search-engines/_index.md) to see if your data is trivially exposed by searching for your name in quotes, plus your general location. For example, search for `"Jane Smith" Chicago IL`. In many cases, you may find your personal information makes up many of the first results. Even if results about you aren't readily available though, you may still be affected. The list of data brokers linked below will provide more places to check whether your data is in any public databases. +> Use your favorite [search engine](../search-engines/index.md) to see if your data is trivially exposed by searching for your name in quotes, plus your general location. For example, search for `"Jane Smith" Chicago IL`. In many cases, you may find your personal information makes up many of the first results. Even if results about you aren't readily available though, you may still be affected. The list of data brokers linked below will provide more places to check whether your data is in any public databases. ## Manual Opt-Outs Free diff --git a/content/tools/services/dns/_index.md b/content/tools/services/dns/index.md similarity index 88% rename from content/tools/services/dns/_index.md rename to content/tools/services/dns/index.md index dad067d4d..0ca396396 100644 --- a/content/tools/services/dns/_index.md +++ b/content/tools/services/dns/index.md @@ -3,7 +3,7 @@ title: DNS Resolvers description: We recommend choosing these encrypted DNS providers to replace your ISP's default configuration. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model)
{{< cards >}} @@ -16,13 +16,13 @@ description: We recommend choosing these encrypted DNS providers to replace your Encrypted **DNS** with third-party servers should only be used to get around basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences. Encrypted DNS will not help you hide any of your browsing activity. -[Learn more about DNS](../../../wiki/advanced/dns-overview/_index.md) +[Learn more about DNS](../../../wiki/advanced/dns-overview/index.md) ## Recommended Providers These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked, you should use a dedicated DNS filtering product instead. -| DNS Provider | Protocols | Logging / Privacy Policy | [ECS](../../../wiki/advanced/dns-overview/_index.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | +| DNS Provider | Protocols | Logging / Privacy Policy | [ECS](../../../wiki/advanced/dns-overview/index.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | |---|---|---|---|---|---| | [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardSDNSFilter) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext
DoH/3
DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | @@ -100,11 +100,11 @@ NextDNS also offers a public DoH service at `https://dns.nextdns.io` and DNS-ove ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](../../../wiki/advanced/dns-overview/_index.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](../../../wiki/advanced/dns-overview/_index.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](../../../wiki/advanced/dns-overview/index.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](../../../wiki/advanced/dns-overview/index.md#what-is-encrypted-dns). ### RethinkDNS -**RethinkDNS** is an open-source Android client that supports [DoH](../../../wiki/advanced/dns-overview/_index.md#dns-over-https-doh), [DoT](../../../wiki/advanced/dns-overview/_index.md#dns-over-tls-dot), [DNSCrypt](../../../wiki/advanced/dns-overview/_index.md#dnscrypt) and DNS Proxy. It also provides additional functionality such as caching DNS responses, locally logging DNS queries, and using the app as a firewall. +**RethinkDNS** is an open-source Android client that supports [DoH](../../../wiki/advanced/dns-overview/index.md#dns-over-https-doh), [DoT](../../../wiki/advanced/dns-overview/index.md#dns-over-tls-dot), [DNSCrypt](../../../wiki/advanced/dns-overview/index.md#dnscrypt) and DNS Proxy. It also provides additional functionality such as caching DNS responses, locally logging DNS queries, and using the app as a firewall. {{< cards >}} {{< card link="https://rethinkdns.com" title="Homepage" icon="home" >}} @@ -118,7 +118,7 @@ While RethinkDNS takes up the Android VPN slot, you can still use a VPN or Orbot ### DNSCrypt-Proxy -**DNSCrypt-Proxy** is a DNS proxy with support for [DNSCrypt](../../../wiki/advanced/dns-overview/_index.md#dnscrypt), [DoH](../../../wiki/advanced/dns-overview/_index.md#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS). +**DNSCrypt-Proxy** is a DNS proxy with support for [DNSCrypt](../../../wiki/advanced/dns-overview/index.md#dnscrypt), [DoH](../../../wiki/advanced/dns-overview/index.md#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS). {{< cards >}} {{< card link="https://github.com/DNSCrypt/dnscrypt-proxy" title="Source Code Repository" icon="code" >}} @@ -130,7 +130,7 @@ While RethinkDNS takes up the Android VPN slot, you can still use a VPN or Orbot [{{< badge content="Windows" color="red" >}}](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Installation-Windows) > [!WARNING] -> The anonymized DNS feature does [not](../../../wiki/advanced/dns-overview/_index.md#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic. +> The anonymized DNS feature does [not](../../../wiki/advanced/dns-overview/index.md#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic. ## Criteria @@ -139,9 +139,9 @@ While RethinkDNS takes up the Android VPN slot, you can still use a VPN or Orbot All DNS products... -- Must support [DNSSEC](../../../wiki/advanced/dns-overview/_index.md#what-is-dnssec). -- Must support [QNAME Minimization](../../../wiki/advanced/dns-overview/_index.md#what-is-qname-minimization). -- Must anonymize [ECS](../../../wiki/advanced/dns-overview/_index.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Must support [DNSSEC](../../../wiki/advanced/dns-overview/index.md#what-is-dnssec). +- Must support [QNAME Minimization](../../../wiki/advanced/dns-overview/index.md#what-is-qname-minimization). +- Must anonymize [ECS](../../../wiki/advanced/dns-overview/index.md#what-is-edns-client-subnet-ecs) or disable it by default. Additionally, all public providers... diff --git a/content/tools/services/email-aliasing/_index.md b/content/tools/services/email-aliasing/index.md similarity index 94% rename from content/tools/services/email-aliasing/_index.md rename to content/tools/services/email-aliasing/index.md index 161eb38ec..3d96452bf 100644 --- a/content/tools/services/email-aliasing/_index.md +++ b/content/tools/services/email-aliasing/index.md @@ -4,8 +4,8 @@ description: An email aliasing service allows you to easily generate a new email --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) -[{{< badge content="Public Exposure" color="green" >}}](../../../wiki/basics/common-threats/_index.md#limiting-public-information) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) +[{{< badge content="Public Exposure" color="green" >}}](../../../wiki/basics/common-threats/index.md#limiting-public-information)
{{< cards >}} @@ -14,7 +14,7 @@ description: An email aliasing service allows you to easily generate a new email {{< /cards >}}
-An **email aliasing service** allows you to easily generate a new email address for every website you register for. The email aliases you generate are then forwarded to an email address of your choosing, hiding both your "main" email address and the identity of your [email provider](../email/_index.md). +An **email aliasing service** allows you to easily generate a new email address for every website you register for. The email aliases you generate are then forwarded to an email address of your choosing, hiding both your "main" email address and the identity of your [email provider](../email/index.md). Email aliasing can also act as a safeguard in case your email provider ever ceases operation. In that scenario, you can easily re-route your aliases to a new email address. In turn, however, you are placing trust in the aliasing service to continue functioning. @@ -111,6 +111,6 @@ When your subscription ends, all aliases you created will still be able to recei ## Criteria -**Please note we are not affiliated with any of the providers we recommend.** In addition to [our standard criteria](../../../about/criteria.md), we evaluate email aliasing providers to the same standard as our regular [email provider criteria](../email/_index.md#criteria) where applicable. We suggest you familiarize yourself with this list before choosing an email aliasing service, and conduct your own research to ensure the provider you choose is the right choice for you. +**Please note we are not affiliated with any of the providers we recommend.** In addition to [our standard criteria](../../../about/criteria.md), we evaluate email aliasing providers to the same standard as our regular [email provider criteria](../email/index.md#criteria) where applicable. We suggest you familiarize yourself with this list before choosing an email aliasing service, and conduct your own research to ensure the provider you choose is the right choice for you. [^1]: Automatic PGP encryption allows you to encrypt non-encrypted incoming emails before they are forwarded to your mailbox, making sure your primary mailbox provider never sees unencrypted email content. diff --git a/content/tools/services/email/_index.md b/content/tools/services/email/index.md similarity index 89% rename from content/tools/services/email/_index.md rename to content/tools/services/email/index.md index 49cfa4498..708701463 100644 --- a/content/tools/services/email/_index.md +++ b/content/tools/services/email/index.md @@ -3,7 +3,7 @@ title: Email Services description: These email providers offer a great place to store your emails securely, and many offer interoperable OpenPGP encryption with other providers. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers)
{{< cards >}} @@ -15,7 +15,7 @@ description: These email providers offer a great place to store your emails secu Email is practically a necessity for using any online service, however we do not recommend it for person-to-person conversations. Rather than using email to contact other people, consider using an instant messaging medium that supports forward secrecy. -[Recommended Instant Messengers](../messengers/_index.md) +[Recommended Instant Messengers](../messengers/index.md) ## Recommended Providers @@ -27,13 +27,13 @@ For everything else, we recommend a variety of email providers based on sustaina | [Mailbox Mail](#mailbox-mail) | :material-check:{ .pg-green } | :material-check:{ .pg-green } | :material-information-outline:{ .pg-blue } Mail only | Cash | | [Tuta](#tuta) | :material-alert-outline:{ .pg-orange } | :material-alert-outline:{ .pg-orange } | :material-check:{ .pg-green } | Monero via third party
Cash via third party | -In addition to (or instead of) an email provider recommended here, you may wish to consider a dedicated [email aliasing service](../email-aliasing/_index.md#recommended-providers) to protect your privacy. Among other things, these services can help protect your real inbox from spam, prevent marketers from correlating your accounts, and encrypt all incoming messages with PGP. +In addition to (or instead of) an email provider recommended here, you may wish to consider a dedicated [email aliasing service](../email-aliasing/index.md#recommended-providers) to protect your privacy. Among other things, these services can help protect your real inbox from spam, prevent marketers from correlating your accounts, and encrypt all incoming messages with PGP. -- [More Information :material-arrow-right-drop-circle:](../email-aliasing/_index.md) +- [More Information :material-arrow-right-drop-circle:](../email-aliasing/index.md) ## OpenPGP Compatible Services -These providers natively support OpenPGP encryption/decryption and the [Web Key Directory (WKD) standard](../../../wiki/basics/email-security/_index.md#what-is-the-web-key-directory-standard), allowing for provider-agnostic end-to-end encrypted emails. For example, a Proton Mail user could send an E2EE message to a Mailbox Mail user, or you could receive OpenPGP-encrypted notifications from internet services which support it. +These providers natively support OpenPGP encryption/decryption and the [Web Key Directory (WKD) standard](../../../wiki/basics/email-security/index.md#what-is-the-web-key-directory-standard), allowing for provider-agnostic end-to-end encrypted emails. For example, a Proton Mail user could send an E2EE message to a Mailbox Mail user, or you could receive OpenPGP-encrypted notifications from internet services which support it.
@@ -43,11 +43,11 @@ These providers natively support OpenPGP encryption/decryption and the [Web Key
> [!WARNING] -> When using E2EE technology like OpenPGP your email will still have some metadata that is not encrypted in the header of the email, generally including the subject line! Read more about [email metadata](../../../wiki/basics/email-security/_index.md#email-metadata-overview). +> When using E2EE technology like OpenPGP your email will still have some metadata that is not encrypted in the header of the email, generally including the subject line! Read more about [email metadata](../../../wiki/basics/email-security/index.md#email-metadata-overview). > > OpenPGP also does not support forward secrecy, which means if the private key of either you or the message recipient is ever stolen, all previous messages encrypted with it will be exposed. > -> - [How do I protect my private keys?](../../../wiki/basics/email-security/_index.md#how-do-i-protect-my-private-keys) +> - [How do I protect my private keys?](../../../wiki/basics/email-security/index.md#how-do-i-protect-my-private-keys) ### Proton Mail @@ -69,7 +69,7 @@ The Proton Free plan comes with 500 MB of Mail storage, which you can increase u [{{< badge content="GitHub" >}}](https://github.com/ProtonMail/android-mail/releases) [{{< badge content="Web" >}}](https://mail.proton.me) -Free accounts have some limitations, such as not being able to search body text and not having access to [Proton Mail Bridge](https://proton.me/mail/bridge), which is required to use a [recommended desktop email client](../../software/email-clients/_index.md) such as Thunderbird. Paid accounts include features like Proton Mail Bridge, additional storage, and custom domain support. The Proton Unlimited plan or any multi-user Proton plan includes access to [SimpleLogin](../email-aliasing/_index.md#simplelogin) Premium. +Free accounts have some limitations, such as not being able to search body text and not having access to [Proton Mail Bridge](https://proton.me/mail/bridge), which is required to use a [recommended desktop email client](../../software/email-clients/index.md) such as Thunderbird. Paid accounts include features like Proton Mail Bridge, additional storage, and custom domain support. The Proton Unlimited plan or any multi-user Proton plan includes access to [SimpleLogin](../email-aliasing/index.md#simplelogin) Premium. A [letter of attestation](https://res.cloudinary.com/dbulfrlrz/images/v1714639878/wp-pme/letter-of-attestation-proton-mail-20211109_3138714c61/letter-of-attestation-proton-mail-20211109_3138714c61.pdf) was provided for Proton Mail's apps in November 2021 by [Securitum](https://research.securitum.com). @@ -95,7 +95,7 @@ Paid Proton Mail subscribers can use their own domain with the service or a [cat #### :material-check:{ .pg-green } Private Payment Methods -Proton Mail [accepts](https://proton.me/support/payment-options) **cash** by mail in addition to standard credit/debit card, [Bitcoin](../../../wiki/advanced/payments/_index.md#other-coins-bitcoin-ethereum-etc), and PayPal payments. Additionally, you can use [**Monero**](../../software/cryptocurrency/_index.md#monero) to purchase vouchers for Proton Mail Plus or Proton Unlimited via their [official](https://discuss.privacyguides.net/t/add-monero-as-an-anonymous-payment-method-for-proton-services/31058/15) reseller [ProxyStore](https://dys2p.com/en/2025-09-09-proton.html). +Proton Mail [accepts](https://proton.me/support/payment-options) **cash** by mail in addition to standard credit/debit card, [Bitcoin](../../../wiki/advanced/payments/index.md#other-coins-bitcoin-ethereum-etc), and PayPal payments. Additionally, you can use [**Monero**](../../software/cryptocurrency/index.md#monero) to purchase vouchers for Proton Mail Plus or Proton Unlimited via their [official](https://discuss.privacyguides.net/t/add-monero-as-an-anonymous-payment-method-for-proton-services/31058/15) reseller [ProxyStore](https://dys2p.com/en/2025-09-09-proton.html). #### :material-check:{ .pg-green } Account Security @@ -111,7 +111,7 @@ Certain information stored in [Proton Contacts](https://proton.me/support/proton Proton Mail has [integrated OpenPGP encryption](https://proton.me/support/how-to-use-pgp) in their webmail. Emails to other Proton Mail accounts are encrypted automatically, and encryption to non-Proton Mail addresses with an OpenPGP key can be enabled easily in your account settings. Proton also supports automatic external key discovery with WKD. This means that emails sent to other providers which use WKD will be automatically encrypted with OpenPGP as well, without the need to manually exchange public PGP keys with your contacts. They also allow you to [encrypt messages to non-Proton Mail addresses without OpenPGP](https://proton.me/support/password-protected-emails), without the need for them to sign up for a Proton Mail account. -Proton Mail also publishes the public keys of Proton accounts via HTTP from their WKD. This allows people who don't use Proton Mail to find the OpenPGP keys of Proton Mail accounts easily for cross-provider E2EE. This only applies to email addresses ending in one of Proton's own domains, like `@proton.me`. If you use a custom domain, you must [configure WKD](../../../wiki/basics/email-security/_index.md#what-is-the-web-key-directory-standard) separately. +Proton Mail also publishes the public keys of Proton accounts via HTTP from their WKD. This allows people who don't use Proton Mail to find the OpenPGP keys of Proton Mail accounts easily for cross-provider E2EE. This only applies to email addresses ending in one of Proton's own domains, like `@proton.me`. If you use a custom domain, you must [configure WKD](../../../wiki/basics/email-security/index.md#what-is-the-web-key-directory-standard) separately. #### :material-information-outline:{ .pg-blue } Account Termination @@ -144,19 +144,19 @@ Mailbox Mail doesn't accept any cryptocurrencies as a result of their payment pr #### :material-check:{ .pg-green } Account Security -Mailbox Mail supports [two-factor authentication](https://kb.mailbox.org/en/private/security-and-privacy/how-to-use-two-factor-authentication-2fa/) for their webmail only. You can use either TOTP or a [YubiKey](../../hardware/security-keys/_index.md#yubikey) via the [YubiCloud](https://yubico.com/products/services-software/yubicloud). Web standards such as [WebAuthn](../../../wiki/basics/multi-factor-authentication/_index.md#fido-fast-identity-online) are not yet supported. +Mailbox Mail supports [two-factor authentication](https://kb.mailbox.org/en/private/security-and-privacy/how-to-use-two-factor-authentication-2fa/) for their webmail only. You can use either TOTP or a [YubiKey](../../hardware/security-keys/index.md#yubikey) via the [YubiCloud](https://yubico.com/products/services-software/yubicloud). Web standards such as [WebAuthn](../../../wiki/basics/multi-factor-authentication/index.md#fido-fast-identity-online) are not yet supported. #### :material-information-outline:{ .pg-blue } Data Security Mailbox Mail allows for encryption of incoming mail using their [encrypted mailbox](https://kb.mailbox.org/en/private/encryption/your-encrypted-mailbox/). New messages that you receive will then be immediately encrypted with your public key. -However, [Open-Xchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox Mail, [does not support](https://kb.mailbox.org/en/business/security-privacy-article/encryption-of-calendar-and-address-book/) the encryption of your address book and calendar. A [standalone option](../calendar/_index.md) may be more appropriate for that data. +However, [Open-Xchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox Mail, [does not support](https://kb.mailbox.org/en/business/security-privacy-article/encryption-of-calendar-and-address-book/) the encryption of your address book and calendar. A [standalone option](../calendar/index.md) may be more appropriate for that data. #### :material-check:{ .pg-green } Email Encryption Mailbox Mail has [integrated encryption](https://kb.mailbox.org/en/private/encryption/how-can-e-mails-be-encrypted-with-pgp/) in their webmail, which simplifies sending messages to people with public OpenPGP keys. They also allow [remote recipients to decrypt an email](https://kb.mailbox.org/en/private/encryption/my-recipient-does-not-use-pgp/) on Mailbox Mail's servers. This feature is useful when the remote recipient does not have OpenPGP and cannot decrypt a copy of the email in their own mailbox. -Mailbox Mail also supports the discovery of public keys via HTTP from their WKD. This allows people outside of Mailbox Mail to find the OpenPGP keys of Mailbox Mail accounts easily for cross-provider E2EE. This only applies to email addresses ending in one of Mailbox Mail's own domains, like `@mailbox.org`. If you use a custom domain, you must [configure WKD](../../../wiki/basics/email-security/_index.md#what-is-the-web-key-directory-standard) separately. +Mailbox Mail also supports the discovery of public keys via HTTP from their WKD. This allows people outside of Mailbox Mail to find the OpenPGP keys of Mailbox Mail accounts easily for cross-provider E2EE. This only applies to email addresses ending in one of Mailbox Mail's own domains, like `@mailbox.org`. If you use a custom domain, you must [configure WKD](../../../wiki/basics/email-security/index.md#what-is-the-web-key-directory-standard) separately. #### :material-information-outline:{ .pg-blue } Account Termination @@ -199,7 +199,7 @@ Free accounts start with 1 GB of storage. [{{< badge content="GitHub" >}}](https://github.com/tutao/tutanota/releases) [{{< badge content="Web" >}}](https://app.tuta.com) -Tuta doesn't support the [IMAP protocol](https://tuta.com/support#imap) or the use of third-party [email clients](../../software/email-clients/_index.md), and you also won't be able to add [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) to the Tuta app. [Email import](https://github.com/tutao/tutanota/issues/630) is not currently supported either, though this is [due to be changed](https://tuta.com/blog/kickoff-import). Emails can be exported [individually or by bulk selection](https://tuta.com/support#generalMail) per folder, which may be inconvenient if you have many folders. +Tuta doesn't support the [IMAP protocol](https://tuta.com/support#imap) or the use of third-party [email clients](../../software/email-clients/index.md), and you also won't be able to add [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) to the Tuta app. [Email import](https://github.com/tutao/tutanota/issues/630) is not currently supported either, though this is [due to be changed](https://tuta.com/blog/kickoff-import). Emails can be exported [individually or by bulk selection](https://tuta.com/support#generalMail) per folder, which may be inconvenient if you have many folders. #### :material-check:{ .pg-green } Custom Domains and Aliases @@ -207,7 +207,7 @@ Paid Tuta accounts can use either 15 or 30 aliases depending on their plan and u #### :material-information-outline:{ .pg-blue } Private Payment Methods -Tuta only directly accepts credit cards and PayPal, however you can use [**cryptocurrency**](../../software/cryptocurrency/_index.md) to purchase gift cards via their [partnership](https://tuta.com/support/#cryptocurrency) with ProxyStore. +Tuta only directly accepts credit cards and PayPal, however you can use [**cryptocurrency**](../../software/cryptocurrency/index.md) to purchase gift cards via their [partnership](https://tuta.com/support/#cryptocurrency) with ProxyStore. #### :material-check:{ .pg-green } Account Security @@ -268,7 +268,7 @@ We prefer our recommended providers to collect as little data as possible. **Best Case:** -- Should accept [anonymous payment options](../../../wiki/advanced/payments/_index.md) ([cryptocurrency](../../software/cryptocurrency/_index.md), cash, gift cards, etc.) +- Should accept [anonymous payment options](../../../wiki/advanced/payments/index.md) ([cryptocurrency](../../software/cryptocurrency/index.md), cash, gift cards, etc.) - Should be hosted in a jurisdiction with strong email privacy protection laws. ### Security @@ -277,7 +277,7 @@ Email servers deal with a lot of very sensitive data. We expect that providers w **Minimum to Qualify:** -- Protection of webmail with 2FA, such as [TOTP](../../../wiki/basics/multi-factor-authentication/_index.md#time-based-one-time-password-totp). +- Protection of webmail with 2FA, such as [TOTP](../../../wiki/basics/multi-factor-authentication/index.md#time-based-one-time-password-totp). - Encryption at rest, using asymmetric encryption where the service provider does not have the decryption keys to the data they hold. This prevents a rogue employee leaking data they have access to, or a remote adversary from releasing data they have stolen by gaining unauthorized access to the server. - [DNSSEC](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) support. - No TLS errors or vulnerabilities when being profiled by tools such as [Hardenize](https://hardenize.com), [testssl.sh](https://testssl.sh), or [Qualys SSL Labs](https://ssllabs.com/ssltest); this includes certificate related errors and weak DH parameters, such as those that led to [Logjam](https://en.wikipedia.org/wiki/Logjam_(computer_security)). @@ -295,7 +295,7 @@ Email servers deal with a lot of very sensitive data. We expect that providers w **Best Case:** -- Should support hardware authentication, i.e. U2F and [WebAuthn](../../../wiki/basics/multi-factor-authentication/_index.md#fido-fast-identity-online). +- Should support hardware authentication, i.e. U2F and [WebAuthn](../../../wiki/basics/multi-factor-authentication/index.md#fido-fast-identity-online). - [DNS Certification Authority Authorization (CAA) Resource Record](https://tools.ietf.org/html/rfc6844) in addition to DANE support. - Should implement [Authenticated Received Chain (ARC)](https://en.wikipedia.org/wiki/Authenticated_Received_Chain), which is useful for people who post to mailing lists [RFC8617](https://tools.ietf.org/html/rfc8617). - Published security audits from a reputable, third-party firm. diff --git a/content/tools/services/financial-services/_index.md b/content/tools/services/financial-services/index.md similarity index 90% rename from content/tools/services/financial-services/_index.md rename to content/tools/services/financial-services/index.md index ee0111c7f..323ed9c0a 100644 --- a/content/tools/services/financial-services/_index.md +++ b/content/tools/services/financial-services/index.md @@ -3,16 +3,16 @@ title: Financial Services description: These services can assist you in protecting your privacy from merchants and other trackers, which is one of the biggest challenges to privacy today. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) Making payments online is one of the biggest challenges to privacy. These services can assist you in protecting your privacy from merchants and other trackers, provided you have a strong understanding of how to make private payments effectively. We strongly encourage you first read our payments overview article before making any purchases: -[Making Private Payments](../../../wiki/advanced/payments/_index.md) +[Making Private Payments](../../../wiki/advanced/payments/index.md) ## Payment Masking Services Protects against the following threat(s): -[{{< badge content="Public Exposure" color="green" >}}](../../../wiki/basics/common-threats/_index.md#limiting-public-information) +[{{< badge content="Public Exposure" color="green" >}}](../../../wiki/basics/common-threats/index.md#limiting-public-information)
{{< cards >}} @@ -39,7 +39,7 @@ Privacy.com gives information about the merchants you purchase from to your bank ### MySudo (US, Paid) -**MySudo** provides up to 9 virtual cards depending on the plan you purchase. Their paid plans additionally include functionality which may be useful for making purchases privately, such as virtual phone numbers and email addresses, although we typically recommend other [email aliasing providers](../email-aliasing/_index.md) for extensive email aliasing use. +**MySudo** provides up to 9 virtual cards depending on the plan you purchase. Their paid plans additionally include functionality which may be useful for making purchases privately, such as virtual phone numbers and email addresses, although we typically recommend other [email aliasing providers](../email-aliasing/index.md) for extensive email aliasing use. {{< cards >}} {{< card link="https://mysudo.com" title="Homepage" icon="home" >}} @@ -58,7 +58,7 @@ MySudo's virtual cards are currently only available via their iOS app. ## Gift Card Marketplaces Protects against the following threat(s): -[{{< badge content="Mass Surveillance" color="blue" >}}](../../../wiki/basics/common-threats/_index.md#mass-surveillance-programs) +[{{< badge content="Mass Surveillance" color="blue" >}}](../../../wiki/basics/common-threats/index.md#mass-surveillance-programs)
{{< cards >}} @@ -66,7 +66,7 @@ MySudo's virtual cards are currently only available via their iOS app. {{< /cards >}}
-These services allow you to purchase gift cards for a variety of merchants online with [cryptocurrency](../../software/cryptocurrency/_index.md). Some of these services offer ID verification options for higher limits, but they also allow accounts with just an email address. Basic limits typically start at $5,000-10,000 a day for basic accounts, with significantly higher limits for ID verified accounts (if offered). +These services allow you to purchase gift cards for a variety of merchants online with [cryptocurrency](../../software/cryptocurrency/index.md). Some of these services offer ID verification options for higher limits, but they also allow accounts with just an email address. Basic limits typically start at $5,000-10,000 a day for basic accounts, with significantly higher limits for ID verified accounts (if offered). ### Coincards @@ -81,7 +81,7 @@ These services allow you to purchase gift cards for a variety of merchants onlin **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../../../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -- Accepts payment in [a recommended cryptocurrency](../../software/cryptocurrency/_index.md). +- Accepts payment in [a recommended cryptocurrency](../../software/cryptocurrency/index.md). - No ID requirement. > [!NOTE] diff --git a/content/tools/services/messengers/_index.md b/content/tools/services/messengers/index.md similarity index 92% rename from content/tools/services/messengers/_index.md rename to content/tools/services/messengers/index.md index f1d2e678c..a3ffd754c 100644 --- a/content/tools/services/messengers/_index.md +++ b/content/tools/services/messengers/index.md @@ -3,10 +3,10 @@ title: Instant Messengers description: Encrypted messengers like Signal and SimpleX keep your sensitive communications secure from prying eyes. --- Protects against the following threat(s): -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) -[{{< badge content="Mass Surveillance" color="blue" >}}](../../../wiki/basics/common-threats/_index.md#mass-surveillance-programs) -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) +[{{< badge content="Mass Surveillance" color="blue" >}}](../../../wiki/basics/common-threats/index.md#mass-surveillance-programs) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model)
{{< cards >}} @@ -17,7 +17,7 @@ description: Encrypted messengers like Signal and SimpleX keep your sensitive co {{< /cards >}}
-These recommendations for encrypted **real-time communication** are great for securing your sensitive communications. These instant messengers come in the form of many [types of communication networks](../../../wiki/advanced/communication-networks/_index.md). +These recommendations for encrypted **real-time communication** are great for securing your sensitive communications. These instant messengers come in the form of many [types of communication networks](../../../wiki/advanced/communication-networks/index.md). [Video: It's time to stop using SMS](https://www.privacyguides.org/videos/2025/01/24/its-time-to-stop-using-sms-heres-why) @@ -60,7 +60,7 @@ The protocol was independently [audited](https://eprint.iacr.org/2016/1013.pdf) ### Molly (Android) -If you use Android and your threat model requires protecting against [:material-target-account: Targeted Attacks](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals){ .pg-red } you may consider using this alternative app, which features a number of security and usability improvements, to access the Signal network. +If you use Android and your threat model requires protecting against [:material-target-account: Targeted Attacks](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals){ .pg-red } you may consider using this alternative app, which features a number of security and usability improvements, to access the Signal network. **Molly** is an alternative Signal client for Android which allows you to encrypt the local database with a passphrase at rest, to have unused RAM data securely shredded, to route your connection via Tor, and [more](https://blog.privacyguides.org/2022/07/07/signal-configuration-and-hardening#privacy-and-security-features). It also has usability improvements including scheduled backups, automatic locking, and the ability to use your Android phone as a linked device instead of the primary device for a Signal account. @@ -83,7 +83,7 @@ Both versions of Molly provide the same security improvements and support [repro ## SimpleX Chat -**SimpleX Chat** is an instant messenger that doesn't depend on any unique identifiers such as phone numbers or usernames. Its decentralized network makes SimpleX Chat an effective tool against [:material-close-outline: Censorship](../../../wiki/basics/common-threats/_index.md#avoiding-censorship){ .pg-blue-gray }. +**SimpleX Chat** is an instant messenger that doesn't depend on any unique identifiers such as phone numbers or usernames. Its decentralized network makes SimpleX Chat an effective tool against [:material-close-outline: Censorship](../../../wiki/basics/common-threats/index.md#avoiding-censorship){ .pg-blue-gray }. {{< cards >}} {{< card link="https://simplex.chat" title="Homepage" icon="home" >}} @@ -108,7 +108,7 @@ SimpleX Chat was independently audited in [July 2024](https://simplex.chat/blog/ ## Briar -**Briar** is an encrypted instant messenger that [connects](https://briarproject.org/how-it-works) to other clients using the [Tor network](../../advanced/alternative-networks/_index.md#tor), making it an effective tool at circumventing [:material-close-outline: Censorship](../../../wiki/basics/common-threats/_index.md#avoiding-censorship){ .pg-blue-gray }. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar’s local mesh mode can be useful when internet availability is a problem. +**Briar** is an encrypted instant messenger that [connects](https://briarproject.org/how-it-works) to other clients using the [Tor network](../../advanced/alternative-networks/index.md#tor), making it an effective tool at circumventing [:material-close-outline: Censorship](../../../wiki/basics/common-threats/index.md#avoiding-censorship){ .pg-blue-gray }. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar’s local mesh mode can be useful when internet availability is a problem. {{< cards >}} {{< card link="https://briarproject.org" title="Homepage" icon="home" >}} @@ -145,7 +145,7 @@ Our best-case criteria represents what we would like to see from the perfect pro - Should support future secrecy (post-compromise security)[^2] - Should have open-source servers. -- Should use a decentralized network, i.e. [federated or P2P](../../../wiki/advanced/communication-networks/_index.md). +- Should use a decentralized network, i.e. [federated or P2P](../../../wiki/advanced/communication-networks/index.md). - Should use E2EE for all messages by default. - Should support Linux, macOS, Windows, Android, and iOS. diff --git a/content/tools/services/passwords/_index.md b/content/tools/services/passwords/index.md similarity index 96% rename from content/tools/services/passwords/_index.md rename to content/tools/services/passwords/index.md index 7469d1590..2e61046e6 100644 --- a/content/tools/services/passwords/_index.md +++ b/content/tools/services/passwords/index.md @@ -3,9 +3,9 @@ title: Password Managers description: Password managers allow you to securely store and manage passwords and other credentials. --- Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers)
{{< cards >}} @@ -18,7 +18,7 @@ description: Password managers allow you to securely store and manage passwords **Password managers** allow you to securely store and manage passwords and other credentials with the use of a master password. -[Introduction to Passwords](../../../wiki/basics/passwords-overview/_index.md) +[Introduction to Passwords](../../../wiki/basics/passwords-overview/index.md) > [!IMPORTANT] > Built-in password managers in software like browsers and operating systems are sometimes not as good as dedicated password manager software. The advantage of a built-in password manager is good integration with the software, but it can often be very simple and lack privacy and security features that standalone offerings have. @@ -59,7 +59,7 @@ Bitwarden's server-side code is [open source](https://github.com/bitwarden/serve ### Proton Pass -**Proton Pass** is an open-source, end-to-end encrypted password manager developed by Proton, the team behind [Proton Mail](../email/_index.md#proton-mail). It securely stores your login credentials, generates unique email aliases, and supports and stores passkeys. +**Proton Pass** is an open-source, end-to-end encrypted password manager developed by Proton, the team behind [Proton Mail](../email/index.md#proton-mail). It securely stores your login credentials, generates unique email aliases, and supports and stores passkeys. {{< cards >}} {{< card link="https://proton.me/pass" title="Homepage" icon="home" >}} diff --git a/content/tools/services/photo-backups/_index.md b/content/tools/services/photo-backups/index.md similarity index 96% rename from content/tools/services/photo-backups/_index.md rename to content/tools/services/photo-backups/index.md index e15bbf2aa..a92502a14 100644 --- a/content/tools/services/photo-backups/_index.md +++ b/content/tools/services/photo-backups/index.md @@ -4,8 +4,8 @@ description: These photo backup tools keep your personal photos safe from the pr --- Protects against the following threat(s): -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers)
{{< cards >}} diff --git a/content/tools/services/search-engines/_index.md b/content/tools/services/search-engines/index.md similarity index 91% rename from content/tools/services/search-engines/_index.md rename to content/tools/services/search-engines/index.md index b11f613b8..77aa19270 100644 --- a/content/tools/services/search-engines/_index.md +++ b/content/tools/services/search-engines/index.md @@ -4,7 +4,7 @@ description: Use privacy-respecting search engines which don't build an advertis --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model)
{{< cards >}} @@ -21,7 +21,7 @@ Use a **search engine** that doesn't build an advertising profile based on your The recommendations here do not collect personally identifying information (PII) based on each service's privacy policy. There is **no guarantee** that these privacy policies are honored. -Consider using a [VPN](../vpn/_index.md) or [Tor](../../software/tor/_index.md) if your threat model requires hiding your IP address from the search provider. +Consider using a [VPN](../vpn/index.md) or [Tor](../../software/tor/index.md) if your threat model requires hiding your IP address from the search provider. | Provider | Search Index | Tor Hidden Service | Logging / Privacy Policy | Country of Operation | |---|---|---|---|---| @@ -46,7 +46,7 @@ Consider using a [VPN](../vpn/_index.md) or [Tor](../../software/tor/_index.md) **Brave Search** is a search engine developed by Brave. It includes unique features such as [Discussions](https://search.brave.com/help/discussions), which highlights conversation-focused results such as forum posts. -Brave Search is the default search engine for the [Brave Browser](../../software/desktop-browsers/_index.md#brave). +Brave Search is the default search engine for the [Brave Browser](../../software/desktop-browsers/index.md#brave). {{< cards >}} {{< card link="https://search.brave.com" title="Homepage" icon="home" >}} @@ -59,7 +59,7 @@ We recommend you disable [Anonymous usage metrics](https://search.brave.com/help **DuckDuckGo** is one of the more mainstream private search engine options. Notable DuckDuckGo search features include [bangs](https://duckduckgo.com/bang) and a variety of [instant answers](https://help.duckduckgo.com/duckduckgo-help-pages/features/instant-answers-and-other-features). The search engine uses numerous [sources](https://help.duckduckgo.com/results/sources) other than Bing for instant answers and other non-primary results. -DuckDuckGo is the default search engine for the [Tor Browser](../../software/tor/_index.md#tor-browser) and is one of the few available options on Apple’s [Safari](../../software/mobile-browsers/_index.md#safari-ios) browser. +DuckDuckGo is the default search engine for the [Tor Browser](../../software/tor/index.md#tor-browser) and is one of the few available options on Apple’s [Safari](../../software/mobile-browsers/index.md#safari-ios) browser. {{< cards >}} {{< card link="https://duckduckgo.com" title="Homepage" icon="home" >}} @@ -70,7 +70,7 @@ DuckDuckGo offers two [other versions](https://help.duckduckgo.com/features/non- ### Startpage -**Startpage** is a private search engine. One of Startpage's unique features is the [Anonymous View](https://startpage.com/en/anonymous-view), which puts forth efforts to standardize user activity to make it more difficult to be uniquely identified. The feature can be useful for hiding [some](https://support.startpage.com/hc/articles/4455540212116-The-Anonymous-View-Proxy-technical-details) network and browser properties. Unlike the name suggests, the feature should not be relied upon for anonymity. If you are looking for anonymity, use the [Tor Browser](../../software/tor/_index.md#tor-browser) instead. +**Startpage** is a private search engine. One of Startpage's unique features is the [Anonymous View](https://startpage.com/en/anonymous-view), which puts forth efforts to standardize user activity to make it more difficult to be uniquely identified. The feature can be useful for hiding [some](https://support.startpage.com/hc/articles/4455540212116-The-Anonymous-View-Proxy-technical-details) network and browser properties. Unlike the name suggests, the feature should not be relied upon for anonymity. If you are looking for anonymity, use the [Tor Browser](../../software/tor/index.md#tor-browser) instead. {{< cards >}} {{< card link="https://startpage.com" title="Homepage" icon="home" >}} @@ -79,7 +79,7 @@ DuckDuckGo offers two [other versions](https://help.duckduckgo.com/features/non- Startpage's majority shareholder is System1 who is an adtech company. We don't believe that to be an issue as they have a distinctly separate [privacy policy](https://system1.com/terms/privacy-policy). The Privacy Guides team reached out to Startpage [back in 2020](https://blog.privacyguides.org/2020/05/03/relisting-startpage) to clear up any concerns with System1's sizeable investment into the service, and we were satisfied with the answers we received. -Startpage previously placed limitations on VPN and [Tor](../../software/tor/_index.md) users, but they recently created an [official](https://support.startpage.com/hc/en-us/articles/24786602537364-Startpage-s-Tor-onion-service) Tor hidden service, and as of April 2024 we have no longer noticed extra roadblocks for Tor or [VPN](../vpn/_index.md) users. +Startpage previously placed limitations on VPN and [Tor](../../software/tor/index.md) users, but they recently created an [official](https://support.startpage.com/hc/en-us/articles/24786602537364-Startpage-s-Tor-onion-service) Tor hidden service, and as of April 2024 we have no longer noticed extra roadblocks for Tor or [VPN](../vpn/index.md) users. ## Metasearch Engines diff --git a/content/tools/services/vpn/_index.md b/content/tools/services/vpn/index.md similarity index 96% rename from content/tools/services/vpn/_index.md rename to content/tools/services/vpn/index.md index 279437cb4..26d40be1a 100644 --- a/content/tools/services/vpn/_index.md +++ b/content/tools/services/vpn/index.md @@ -3,7 +3,7 @@ title: VPN Services description: The best VPN services for protecting your privacy and security online. Find a provider here that isn't out to spy on you. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model)
{{< cards >}} @@ -20,9 +20,9 @@ If you're looking for additional *privacy* from your ISP, on a public Wi-Fi netw > > If you are looking for **anonymity**, you should use the Tor Browser. If you're looking for added **security**, you should always ensure you're connecting to websites using HTTPS. A VPN is not a replacement for good security practices. > -> [Introduction to the Tor Browser](../../software/tor/_index.md#tor-browser) · [Tor Myths & FAQ](../../../wiki/advanced/tor-overview/_index.md) +> [Introduction to the Tor Browser](../../software/tor/index.md#tor-browser) · [Tor Myths & FAQ](../../../wiki/advanced/tor-overview/index.md) -[Detailed VPN Overview](../../../wiki/basics/vpn-overview/_index.md) +[Detailed VPN Overview](../../../wiki/basics/vpn-overview/index.md) ## Recommended Providers @@ -72,7 +72,7 @@ Proton VPN provides the source code for their desktop and mobile clients in thei #### :material-check:{ .pg-green } Accepts Cash -Proton VPN, in addition to accepting credit/debit cards, PayPal, and [Bitcoin](../../../wiki/advanced/payments/_index.md#other-coins-bitcoin-ethereum-etc), also accepts **cash/local currency** as an anonymous form of payment. +Proton VPN, in addition to accepting credit/debit cards, PayPal, and [Bitcoin](../../../wiki/advanced/payments/index.md#other-coins-bitcoin-ethereum-etc), also accepts **cash/local currency** as an anonymous form of payment. #### :material-check:{ .pg-green } WireGuard Support @@ -103,7 +103,7 @@ Proton VPN has published [App Store](https://apps.apple.com/app/id1437005085) an #### :material-alert-outline:{ .pg-orange } Additional Notes -Proton VPN clients support two-factor authentication on all platforms. Proton VPN has their own servers and datacenters in Switzerland, Iceland and Sweden. They offer content blocking and known-malware blocking with their DNS service. Additionally, Proton VPN also offers "Tor" servers allowing you to easily connect to onion sites, but we still strongly recommend using [the official Tor Browser](../../software/tor/_index.md#tor-browser) for this purpose. +Proton VPN clients support two-factor authentication on all platforms. Proton VPN has their own servers and datacenters in Switzerland, Iceland and Sweden. They offer content blocking and known-malware blocking with their DNS service. Additionally, Proton VPN also offers "Tor" servers allowing you to easily connect to onion sites, but we still strongly recommend using [the official Tor Browser](../../software/tor/index.md#tor-browser) for this purpose. ##### Kill switch feature provides poor protections on macOS @@ -259,7 +259,7 @@ We require our recommended providers to support modern technologies currently av - Must provide standard configuration files which can be used in a generic, open-source client such as the WireGuard apps. - Support for strong protocols such as WireGuard. -- Functional kill switch built in to service-provided clients on our recommended [desktop](../../os/desktop/_index.md) and [mobile](../../os/android/distributions.md) platforms. This kill switch should be able to block all internet traffic when the VPN connection drops unexpectedly. +- Functional kill switch built in to service-provided clients on our recommended [desktop](../../os/desktop/index.md) and [mobile](../../os/android/distributions/index.md) platforms. This kill switch should be able to block all internet traffic when the VPN connection drops unexpectedly. - Multi-hop support. Multi-hopping is important to keep data private in case of a single node compromise. - If VPN clients are provided, they should be [open source](https://en.wikipedia.org/wiki/Open_source), like the VPN software they generally have built into them. We believe that [source code](https://en.wikipedia.org/wiki/Source_code) availability provides greater transparency about what the program is actually doing. - Censorship resistance features designed to bypass firewalls without DPI. @@ -278,12 +278,12 @@ We prefer our recommended providers to collect as little data as possible. Not c **Minimum to Qualify:** -- [Anonymous cryptocurrency](../../software/cryptocurrency/_index.md) **or** cash payment option. +- [Anonymous cryptocurrency](../../software/cryptocurrency/index.md) **or** cash payment option. - No personal information required to register: Only username, password, and email at most. **Best Case:** -- Accepts multiple [anonymous payment options](../../../wiki/advanced/payments/_index.md). +- Accepts multiple [anonymous payment options](../../../wiki/advanced/payments/index.md). - No personal information accepted (auto-generated username, no email required, etc.). ### Security @@ -339,7 +339,7 @@ Must not have any marketing which is irresponsible: Responsible marketing that is both educational and useful to the consumer could include: -- An accurate comparison to when [Tor](../../software/tor/_index.md) should be used instead. +- An accurate comparison to when [Tor](../../software/tor/index.md) should be used instead. - Availability of the VPN provider's website over a [.onion service](https://en.wikipedia.org/wiki/.onion) ### Additional Functionality diff --git a/content/tools/software/_index.md b/content/tools/software/_index.md index 8e6440b42..9a75f9a31 100644 --- a/content/tools/software/_index.md +++ b/content/tools/software/_index.md @@ -8,9 +8,9 @@ weight: 30
{{< cards >}} - {{< card link="ai-chat/_index.md#koboldcpp" title="Kobold.cpp" image="ai-chat/kobold.png" subtitle="Kobold.cpp is an AI client that runs locally on your Windows, Mac, or Linux computer. It's an excellent choice if you are looking for heavy customization and tweaking, such as for role-playing purposes." >}} - {{< card link="ai-chat/_index.md#ollama-cli" title="Ollama" image="ai-chat/ollama.png" subtitle="Ollama is a command-line AI assistant that is available on macOS, Linux, and Windows. Ollama is a great choice if you're looking for an AI client that's easy-to-use, widely compatible, and fast due to its use of inference and other techniques." >}} - {{< card link="ai-chat/_index.md#llamafile" title="Llamafile" image="ai-chat/llamafile.webp" subtitle="Llamafile is a lightweight, single-file executable that allows users to run LLMs locally on their own computers without any setup involved. It is backed by Mozilla and available on Linux, macOS, and Windows." >}} + {{< card link="ai-chat/index.md#koboldcpp" title="Kobold.cpp" image="ai-chat/kobold.png" subtitle="Kobold.cpp is an AI client that runs locally on your Windows, Mac, or Linux computer. It's an excellent choice if you are looking for heavy customization and tweaking, such as for role-playing purposes." >}} + {{< card link="ai-chat/index.md#ollama-cli" title="Ollama" image="ai-chat/ollama.png" subtitle="Ollama is a command-line AI assistant that is available on macOS, Linux, and Windows. Ollama is a great choice if you're looking for an AI client that's easy-to-use, widely compatible, and fast due to its use of inference and other techniques." >}} + {{< card link="ai-chat/index.md#llamafile" title="Llamafile" image="ai-chat/llamafile.webp" subtitle="Llamafile is a lightweight, single-file executable that allows users to run LLMs locally on their own computers without any setup involved. It is backed by Mozilla and available on Linux, macOS, and Windows." >}} {{< /cards >}}
@@ -18,9 +18,9 @@ weight: 30
{{< cards >}} - {{< card link="browser-extensions/_index.md#ublock-origin" title="uBlock Origin" image="browser-extensions/ublock_origin.svg" subtitle="uBlock Origin is a popular content blocker that could help you block ads, trackers, and fingerprinting scripts." >}} - {{< card link="browser-extensions/_index.md#ublock-origin-lite" title="uBlock Origin Lite" image="browser-extensions/ublock_origin_lite.svg" subtitle="uBlock Origin Lite is a Manifest V3 compatible content blocker. Compared to the original uBlock Origin, this extension does not require broad read/modify data permissions to function, which lowers the risk of Passive Attacks on your browser if a malicious rule is added to a filter list." >}} - {{< card link="browser-extensions/_index.md#adguard" title="AdGuard for iOS" image="browser-extensions/adguard.svg" subtitle="AdGuard for iOS is a free and open-source content-blocking extension for Safari that uses the native Content Blocker API." >}} + {{< card link="browser-extensions/index.md#ublock-origin" title="uBlock Origin" image="browser-extensions/ublock_origin.svg" subtitle="uBlock Origin is a popular content blocker that could help you block ads, trackers, and fingerprinting scripts." >}} + {{< card link="browser-extensions/index.md#ublock-origin-lite" title="uBlock Origin Lite" image="browser-extensions/ublock_origin_lite.svg" subtitle="uBlock Origin Lite is a Manifest V3 compatible content blocker. Compared to the original uBlock Origin, this extension does not require broad read/modify data permissions to function, which lowers the risk of Passive Attacks on your browser if a malicious rule is added to a filter list." >}} + {{< card link="browser-extensions/index.md#adguard" title="AdGuard for iOS" image="browser-extensions/adguard.svg" subtitle="AdGuard for iOS is a free and open-source content-blocking extension for Safari that uses the native Content Blocker API." >}} {{< /cards >}}
@@ -28,7 +28,7 @@ weight: 30
{{< cards >}} - {{< card link="cryptocurrency/_index.md#monero" title="Monero" image="cryptocurrency/monero.svg" subtitle="Monero uses a blockchain with privacy-enhancing technologies that obfuscate transactions to achieve Anonymity. Every Monero transaction hides the transaction amount, sending and receiving addresses, and source of funds without any hoops to jump through, making it an ideal choice for cryptocurrency novices." >}} + {{< card link="cryptocurrency/index.md#monero" title="Monero" image="cryptocurrency/monero.svg" subtitle="Monero uses a blockchain with privacy-enhancing technologies that obfuscate transactions to achieve Anonymity. Every Monero transaction hides the transaction amount, sending and receiving addresses, and source of funds without any hoops to jump through, making it an ideal choice for cryptocurrency novices." >}} {{< /cards >}}
@@ -36,9 +36,9 @@ weight: 30
{{< cards >}} - {{< card link="data-redaction/_index.md#mat2" title="MAT2" image="data-redaction/mat2.svg" subtitle="MAT2 is free, cross-platform software which allows you to remove metadata from image, audio, torrent, and document file types. It provides both a command line tool and a graphical user interface via an extension for Dolphin, the default file manager of KDE." >}} - {{< card link="data-redaction/_index.md#exiferaser-android" title="ExifEraser" image="data-redaction/exiferaser.svg" subtitle="ExifEraser is a modern, permissionless image metadata erasing application for Android." >}} - {{< card link="data-redaction/_index.md#exiftool-cli" title="ExifTool" image="data-redaction/exiftool.png" subtitle="ExifTool is the original Perl library and command-line application for reading, writing, and editing meta information (Exif, IPTC, XMP, and more) in a wide variety of file formats (JPEG, TIFF, PNG, PDF, RAW, and more)." >}} + {{< card link="data-redaction/index.md#mat2" title="MAT2" image="data-redaction/mat2.svg" subtitle="MAT2 is free, cross-platform software which allows you to remove metadata from image, audio, torrent, and document file types. It provides both a command line tool and a graphical user interface via an extension for Dolphin, the default file manager of KDE." >}} + {{< card link="data-redaction/index.md#exiferaser-android" title="ExifEraser" image="data-redaction/exiferaser.svg" subtitle="ExifEraser is a modern, permissionless image metadata erasing application for Android." >}} + {{< card link="data-redaction/index.md#exiftool-cli" title="ExifTool" image="data-redaction/exiftool.png" subtitle="ExifTool is the original Perl library and command-line application for reading, writing, and editing meta information (Exif, IPTC, XMP, and more) in a wide variety of file formats (JPEG, TIFF, PNG, PDF, RAW, and more)." >}} {{< /cards >}}
@@ -46,9 +46,9 @@ weight: 30
{{< cards >}} - {{< card link="desktop-browsers/_index.md#mullvad-browser" title="Mullvad Browser" image="desktop-browsers/mullvad_browser.svg" subtitle="Mullvad Browser is a version of Tor Browser with Tor network integrations removed. It aims to provide to VPN users Tor Browser's anti-fingerprinting browser technologies, which are key protections against Mass Surveillance." >}} - {{< card link="desktop-browsers/_index.md#firefox" title="Firefox" image="desktop-browsers/firefox.svg" subtitle="Firefox provides strong privacy settings such as Enhanced Tracking Protection, which can help block various types of tracking." >}} - {{< card link="desktop-browsers/_index.md#brave" title="Brave" image="desktop-browsers/brave.svg" subtitle="Brave Browser includes a built-in content blocker and privacy features, many of which are enabled by default. Brave is built upon the Chromium web browser project, so it should feel familiar and have minimal website compatibility issues." >}} + {{< card link="desktop-browsers/index.md#mullvad-browser" title="Mullvad Browser" image="desktop-browsers/mullvad_browser.svg" subtitle="Mullvad Browser is a version of Tor Browser with Tor network integrations removed. It aims to provide to VPN users Tor Browser's anti-fingerprinting browser technologies, which are key protections against Mass Surveillance." >}} + {{< card link="desktop-browsers/index.md#firefox" title="Firefox" image="desktop-browsers/firefox.svg" subtitle="Firefox provides strong privacy settings such as Enhanced Tracking Protection, which can help block various types of tracking." >}} + {{< card link="desktop-browsers/index.md#brave" title="Brave" image="desktop-browsers/brave.svg" subtitle="Brave Browser includes a built-in content blocker and privacy features, many of which are enabled by default. Brave is built upon the Chromium web browser project, so it should feel familiar and have minimal website compatibility issues." >}} {{< /cards >}}
@@ -56,7 +56,7 @@ weight: 30
{{< cards >}} - {{< card link="document-collaboration/_index.md#cryptpad" title="CryptPad" image="document-collaboration/cryptpad.svg" subtitle="CryptPad is a private-by-design alternative to popular, full-fledged office suites. All content on this web service is E2EE and can be shared with other users easily." >}} + {{< card link="document-collaboration/index.md#cryptpad" title="CryptPad" image="document-collaboration/cryptpad.svg" subtitle="CryptPad is a private-by-design alternative to popular, full-fledged office suites. All content on this web service is E2EE and can be shared with other users easily." >}} {{< /cards >}}
@@ -64,13 +64,13 @@ weight: 30
{{< cards >}} - {{< card link="email-clients/_index.md#thunderbird" title="Thunderbird" image="email-clients/thunderbird.svg" subtitle="Thunderbird is a free, open-source, cross-platform email, newsgroup, news feed, and chat (XMPP, IRC, Matrix) client developed by the Thunderbird community, and previously by the Mozilla Foundation." >}} - {{< card link="email-clients/_index.md#apple-mail-macos" title="Apple Mail" image="email-clients/applemail.png" subtitle="Apple Mail is included in macOS and can be extended to have OpenPGP support with GPG Suite, which adds the ability to send PGP-encrypted email." >}} - {{< card link="email-clients/_index.md#fairemail-android" title="FairEmail" image="email-clients/fairemail.svg" subtitle="FairEmail is a minimal, open-source email app which uses open standards (IMAP, SMTP, OpenPGP) and minimizes data and battery usage." >}} - {{< card link="email-clients/_index.md#gnome-evolution-gnome" title="GNOME Evolution" image="email-clients/evolution.svg" subtitle="Evolution is a personal information management application that provides integrated mail, calendaring, and address book functionality. Evolution has extensive documentation to help you get started." >}} - {{< card link="email-clients/_index.md#kontact-kde" title="Kontact" image="email-clients/kontact.svg" subtitle="Kontact is a personal information manager (PIM) application from the KDE project. It provides a mail client, address book, RSS client, and an organizer." >}} - {{< card link="email-clients/_index.md#mailvelope-browser" title="Mailvelope" image="email-clients/mailvelope.svg" subtitle="Mailvelope is a browser extension that enables the exchange of encrypted emails following the OpenPGP encryption standard." >}} - {{< card link="email-clients/_index.md#neomutt-cli" title="NeoMutt" image="email-clients/mutt.svg" subtitle="NeoMutt is an open-source command line email reader for Linux and BSD. It's a fork of Mutt) with added features." >}} + {{< card link="email-clients/index.md#thunderbird" title="Thunderbird" image="email-clients/thunderbird.svg" subtitle="Thunderbird is a free, open-source, cross-platform email, newsgroup, news feed, and chat (XMPP, IRC, Matrix) client developed by the Thunderbird community, and previously by the Mozilla Foundation." >}} + {{< card link="email-clients/index.md#apple-mail-macos" title="Apple Mail" image="email-clients/applemail.png" subtitle="Apple Mail is included in macOS and can be extended to have OpenPGP support with GPG Suite, which adds the ability to send PGP-encrypted email." >}} + {{< card link="email-clients/index.md#fairemail-android" title="FairEmail" image="email-clients/fairemail.svg" subtitle="FairEmail is a minimal, open-source email app which uses open standards (IMAP, SMTP, OpenPGP) and minimizes data and battery usage." >}} + {{< card link="email-clients/index.md#gnome-evolution-gnome" title="GNOME Evolution" image="email-clients/evolution.svg" subtitle="Evolution is a personal information management application that provides integrated mail, calendaring, and address book functionality. Evolution has extensive documentation to help you get started." >}} + {{< card link="email-clients/index.md#kontact-kde" title="Kontact" image="email-clients/kontact.svg" subtitle="Kontact is a personal information manager (PIM) application from the KDE project. It provides a mail client, address book, RSS client, and an organizer." >}} + {{< card link="email-clients/index.md#mailvelope-browser" title="Mailvelope" image="email-clients/mailvelope.svg" subtitle="Mailvelope is a browser extension that enables the exchange of encrypted emails following the OpenPGP encryption standard." >}} + {{< card link="email-clients/index.md#neomutt-cli" title="NeoMutt" image="email-clients/mutt.svg" subtitle="NeoMutt is an open-source command line email reader for Linux and BSD. It's a fork of Mutt) with added features." >}} {{< /cards >}}
@@ -78,17 +78,17 @@ weight: 30
{{< cards >}} - {{< card link="encryption/_index.md#cryptomator-cloud" title="Cryptomator" image="encryption/cryptomator.svg" subtitle="Cryptomator is an encryption solution designed for privately saving files to any cloud Service Provider, eliminating the need to trust that they won't access your files. It allows you to create vaults that are stored on a virtual drive, the contents of which are encrypted and synced with your cloud storage provider." >}} - {{< card link="encryption/_index.md#veracrypt-disk" title="VeraCrypt" image="encryption/veracrypt.svg" subtitle="VeraCrypt is a source-available freeware utility used for on-the-fly encryption. It can create a virtual encrypted disk within a file, encrypt a partition, or encrypt the entire storage device with pre-boot authentication." >}} - {{< card link="encryption/_index.md#bitlocker" title="BitLocker" image="encryption/bitlocker.png" subtitle="BitLocker is the full volume encryption solution bundled with Microsoft Windows that uses the Trusted Platform Module (TPM) for hardware-based security." >}} - {{< card link="encryption/_index.md#filevault" title="FileVault" image="encryption/filevault.png" subtitle="FileVault is the on-the-fly volume encryption solution built into macOS. FileVault takes advantage of the hardware security capabilities present on an Apple Silicon SoC or T2 Security Chip." >}} - {{< card link="encryption/_index.md#linux-unified-key-setup" title="LUKS" image="encryption/luks.png" subtitle="LUKS is the default FDE method for Linux. It can be used to encrypt full volumes, partitions, or create encrypted containers." >}} - {{< card link="encryption/_index.md#kryptor" title="Kryptor" image="encryption/kryptor.png" subtitle="Kryptor is a free and open-source file encryption and signing tool that makes use of modern and secure cryptographic algorithms. It aims to be a better version of age and Minisign to provide a simple, easier alternative to GPG." >}} - {{< card link="encryption/_index.md#tomb" title="Tomb" image="encryption/tomb.png" subtitle="Tomb is a command-line shell wrapper for LUKS. It supports steganography via third-party tools." >}} - {{< card link="encryption/_index.md#gnu-privacy-guard" title="GnuPG" image="encryption/gnupg.svg" subtitle="GnuPG is a GPL-licensed alternative to the PGP suite of cryptographic software. GnuPG is compliant with RFC 4880, which is the current IETF specification of OpenPGP." >}} - {{< card link="encryption/_index.md#gpg4win" title="GPG4win" image="encryption/gpg4win.svg" subtitle="GPG4win is a package for Windows from Intevation and g10 Code. It includes various tools that can assist you in using GPG on Microsoft Windows." >}} - {{< card link="encryption/_index.md#gpg-suite" title="GPG Suite" image="encryption/gpgsuite.png" subtitle="GPG Suite provides OpenPGP support for Apple Mail and other email clients on macOS." >}} - {{< card link="encryption/_index.md#openkeychain" title="OpenKeychain" image="encryption/openkeychain.svg" subtitle="OpenKeychain is an implementation of GnuPG for Android. It's commonly required by mail clients such as Thunderbird, FairEmail, and other Android apps to provide encryption support." >}} + {{< card link="encryption/index.md#cryptomator-cloud" title="Cryptomator" image="encryption/cryptomator.svg" subtitle="Cryptomator is an encryption solution designed for privately saving files to any cloud Service Provider, eliminating the need to trust that they won't access your files. It allows you to create vaults that are stored on a virtual drive, the contents of which are encrypted and synced with your cloud storage provider." >}} + {{< card link="encryption/index.md#veracrypt-disk" title="VeraCrypt" image="encryption/veracrypt.svg" subtitle="VeraCrypt is a source-available freeware utility used for on-the-fly encryption. It can create a virtual encrypted disk within a file, encrypt a partition, or encrypt the entire storage device with pre-boot authentication." >}} + {{< card link="encryption/index.md#bitlocker" title="BitLocker" image="encryption/bitlocker.png" subtitle="BitLocker is the full volume encryption solution bundled with Microsoft Windows that uses the Trusted Platform Module (TPM) for hardware-based security." >}} + {{< card link="encryption/index.md#filevault" title="FileVault" image="encryption/filevault.png" subtitle="FileVault is the on-the-fly volume encryption solution built into macOS. FileVault takes advantage of the hardware security capabilities present on an Apple Silicon SoC or T2 Security Chip." >}} + {{< card link="encryption/index.md#linux-unified-key-setup" title="LUKS" image="encryption/luks.png" subtitle="LUKS is the default FDE method for Linux. It can be used to encrypt full volumes, partitions, or create encrypted containers." >}} + {{< card link="encryption/index.md#kryptor" title="Kryptor" image="encryption/kryptor.png" subtitle="Kryptor is a free and open-source file encryption and signing tool that makes use of modern and secure cryptographic algorithms. It aims to be a better version of age and Minisign to provide a simple, easier alternative to GPG." >}} + {{< card link="encryption/index.md#tomb" title="Tomb" image="encryption/tomb.png" subtitle="Tomb is a command-line shell wrapper for LUKS. It supports steganography via third-party tools." >}} + {{< card link="encryption/index.md#gnu-privacy-guard" title="GnuPG" image="encryption/gnupg.svg" subtitle="GnuPG is a GPL-licensed alternative to the PGP suite of cryptographic software. GnuPG is compliant with RFC 4880, which is the current IETF specification of OpenPGP." >}} + {{< card link="encryption/index.md#gpg4win" title="GPG4win" image="encryption/gpg4win.svg" subtitle="GPG4win is a package for Windows from Intevation and g10 Code. It includes various tools that can assist you in using GPG on Microsoft Windows." >}} + {{< card link="encryption/index.md#gpg-suite" title="GPG Suite" image="encryption/gpgsuite.png" subtitle="GPG Suite provides OpenPGP support for Apple Mail and other email clients on macOS." >}} + {{< card link="encryption/index.md#openkeychain" title="OpenKeychain" image="encryption/openkeychain.svg" subtitle="OpenKeychain is an implementation of GnuPG for Android. It's commonly required by mail clients such as Thunderbird, FairEmail, and other Android apps to provide encryption support." >}} {{< /cards >}}
@@ -96,9 +96,9 @@ weight: 30
{{< cards >}} - {{< card link="file-sharing/_index.md#send" title="Send" image="file-sharing/send.svg" subtitle="Send is a fork of Mozilla's discontinued Firefox Send service which allows you to send files to others with a link. Files are encrypted on your device so that they cannot be read by the server, and they can be optionally password-protected as well." >}} - {{< card link="file-sharing/_index.md#onionshare" title="OnionShare" image="file-sharing/onionshare.svg" subtitle="OnionShare is an open-source tool that lets you securely and anonymously share a file of any size. It works by starting a web server accessible as a Tor onion service, with an unguessable URL that you can share with the recipients to download or send files." >}} - {{< card link="file-sharing/_index.md#syncthing-p2p" title="Syncthing" image="file-sharing/syncthing.svg" subtitle="Syncthing is an open-source peer-to-peer continuous file synchronization utility. It is used to synchronize files between two or more devices over the local network or the internet." >}} + {{< card link="file-sharing/index.md#send" title="Send" image="file-sharing/send.svg" subtitle="Send is a fork of Mozilla's discontinued Firefox Send service which allows you to send files to others with a link. Files are encrypted on your device so that they cannot be read by the server, and they can be optionally password-protected as well." >}} + {{< card link="file-sharing/index.md#onionshare" title="OnionShare" image="file-sharing/onionshare.svg" subtitle="OnionShare is an open-source tool that lets you securely and anonymously share a file of any size. It works by starting a web server accessible as a Tor onion service, with an unguessable URL that you can share with the recipients to download or send files." >}} + {{< card link="file-sharing/index.md#syncthing-p2p" title="Syncthing" image="file-sharing/syncthing.svg" subtitle="Syncthing is an open-source peer-to-peer continuous file synchronization utility. It is used to synchronize files between two or more devices over the local network or the internet." >}} {{< /cards >}}
@@ -106,13 +106,13 @@ weight: 30
{{< cards >}} - {{< card link="frontends/_index.md#redlib" title="Redlib" image="frontends/redlib.svg" subtitle="Redlib is an open-source frontend to the Reddit website that is also self-hostable. You can access Redlib through a number of public instances." >}} - {{< card link="frontends/_index.md#proxitok" title="ProxiTok" image="frontends/proxitok.svg" subtitle="ProxiTok is an open-source frontend to the TikTok website that is also self-hostable." >}} - {{< card link="frontends/_index.md#invidious" title="Invidious" image="frontends/invidious.svg" subtitle="Invidious is a free and open-source frontend for YouTube that is also self-hostable." >}} - {{< card link="frontends/_index.md#piped" title="Piped" image="frontends/piped.svg" subtitle="Piped is a free and open-source frontend for YouTube that is also self-hostable." >}} - {{< card link="frontends/_index.md#freetube" title="FreeTube" image="frontends/freetube.svg" subtitle="FreeTube is a free and open-source desktop application for YouTube. FreeTube extracts data from YouTube using its built-in API based on YouTube.js or the Invidious API." >}} - {{< card link="frontends/_index.md#libretube-android" title="LibreTube" image="frontends/libretube.svg" subtitle="LibreTube is a free and open-source Android application for YouTube which uses the Piped API." >}} - {{< card link="frontends/_index.md#newpipe-android" title="NewPipe" image="frontends/newpipe.svg" subtitle="NewPipe is a free and open-source Android application for YouTube, SoundCloud, media.ccc.de, Bandcamp, and PeerTube (1)." >}} + {{< card link="frontends/index.md#redlib" title="Redlib" image="frontends/redlib.svg" subtitle="Redlib is an open-source frontend to the Reddit website that is also self-hostable. You can access Redlib through a number of public instances." >}} + {{< card link="frontends/index.md#proxitok" title="ProxiTok" image="frontends/proxitok.svg" subtitle="ProxiTok is an open-source frontend to the TikTok website that is also self-hostable." >}} + {{< card link="frontends/index.md#invidious" title="Invidious" image="frontends/invidious.svg" subtitle="Invidious is a free and open-source frontend for YouTube that is also self-hostable." >}} + {{< card link="frontends/index.md#piped" title="Piped" image="frontends/piped.svg" subtitle="Piped is a free and open-source frontend for YouTube that is also self-hostable." >}} + {{< card link="frontends/index.md#freetube" title="FreeTube" image="frontends/freetube.svg" subtitle="FreeTube is a free and open-source desktop application for YouTube. FreeTube extracts data from YouTube using its built-in API based on YouTube.js or the Invidious API." >}} + {{< card link="frontends/index.md#libretube-android" title="LibreTube" image="frontends/libretube.svg" subtitle="LibreTube is a free and open-source Android application for YouTube which uses the Piped API." >}} + {{< card link="frontends/index.md#newpipe-android" title="NewPipe" image="frontends/newpipe.svg" subtitle="NewPipe is a free and open-source Android application for YouTube, SoundCloud, media.ccc.de, Bandcamp, and PeerTube (1)." >}} {{< /cards >}}
@@ -120,13 +120,13 @@ weight: 30
{{< cards >}} - {{< card link="health-and-wellness/_index.md#drip" title="Drip" image="health-and-wellness/drip.png" subtitle="Drip is a gender-inclusive and open source menstrual cycle tracker available on all mobile platforms. It relies on the 'sympto-thermal method' to predict ovulation." >}} - {{< card link="health-and-wellness/_index.md#euki" title="Euki" image="health-and-wellness/euki.svg" subtitle="Euki is a nonprofit-backed menstrual cycle tracker that also doubles as a medication tracker and sexual wellness knowledge base. It allows you to schedule the automatic deletion of your personal data in the app." >}} - {{< card link="health-and-wellness/_index.md#apple-health" title="Apple Health" image="health-and-wellness/apple-health.webp" subtitle="Apple Health is one of the default apps installed on iOS devices. It includes many health and wellness features (see Health Records), including menstrual cycle tracking." >}} - {{< card link="health-and-wellness/_index.md#apple-fitness" title="Apple Fitness" image="health-and-wellness/apple-fitness.webp" subtitle="Apple Fitness is the default fitness app for iOS. Apple Fitness always uses end-to-end encryption when syncing across multiple devices." >}} - {{< card link="health-and-wellness/_index.md#gadgetbridge" title="Gadgetbridge" image="health-and-wellness/gadgetbridge.svg" subtitle="Gadgetbridge is an open-source Android application which allows you to pair and manage your Bluetooth device without relying on the vendor’s application. When paired with a compatible smartwatch, it can mimic the health and wellness functionality of these watches without third-party data collection." >}} - {{< card link="health-and-wellness/_index.md#apple-health-records" title="Apple Health Records" image="health-and-wellness/apple-health.webp" subtitle="Apple Health Records is a built-in feature within Apple Health that allows you to view, store, and share your health records." >}} - {{< card link="health-and-wellness/_index.md#commonhealth" title="CommonHealth" image="health-and-wellness/commonhealth.png" subtitle="CommonHealth is a privacy-respecting Android app that allows people to access their electronic health records and securely share it to providers. All health data is stored on your device and can be protected with a passcode or biometric authentication." >}} + {{< card link="health-and-wellness/index.md#drip" title="Drip" image="health-and-wellness/drip.png" subtitle="Drip is a gender-inclusive and open source menstrual cycle tracker available on all mobile platforms. It relies on the 'sympto-thermal method' to predict ovulation." >}} + {{< card link="health-and-wellness/index.md#euki" title="Euki" image="health-and-wellness/euki.svg" subtitle="Euki is a nonprofit-backed menstrual cycle tracker that also doubles as a medication tracker and sexual wellness knowledge base. It allows you to schedule the automatic deletion of your personal data in the app." >}} + {{< card link="health-and-wellness/index.md#apple-health" title="Apple Health" image="health-and-wellness/apple-health.webp" subtitle="Apple Health is one of the default apps installed on iOS devices. It includes many health and wellness features (see Health Records), including menstrual cycle tracking." >}} + {{< card link="health-and-wellness/index.md#apple-fitness" title="Apple Fitness" image="health-and-wellness/apple-fitness.webp" subtitle="Apple Fitness is the default fitness app for iOS. Apple Fitness always uses end-to-end encryption when syncing across multiple devices." >}} + {{< card link="health-and-wellness/index.md#gadgetbridge" title="Gadgetbridge" image="health-and-wellness/gadgetbridge.svg" subtitle="Gadgetbridge is an open-source Android application which allows you to pair and manage your Bluetooth device without relying on the vendor’s application. When paired with a compatible smartwatch, it can mimic the health and wellness functionality of these watches without third-party data collection." >}} + {{< card link="health-and-wellness/index.md#apple-health-records" title="Apple Health Records" image="health-and-wellness/apple-health.webp" subtitle="Apple Health Records is a built-in feature within Apple Health that allows you to view, store, and share your health records." >}} + {{< card link="health-and-wellness/index.md#commonhealth" title="CommonHealth" image="health-and-wellness/commonhealth.png" subtitle="CommonHealth is a privacy-respecting Android app that allows people to access their electronic health records and securely share it to providers. All health data is stored on your device and can be protected with a passcode or biometric authentication." >}} {{< /cards >}}
@@ -134,8 +134,8 @@ weight: 30
{{< cards >}} - {{< card link="language-tools/_index.md#languagetool" title="LanguageTool" image="language-tools/languagetool.svg" subtitle="LanguageTool is a multilingual grammar, style, and spell checker that supports more than 20 languages. According to their privacy policy, they do not store any content sent to their service for review, but for higher assurance the software is self-hostable." >}} - {{< card link="language-tools/_index.md#libretranslate" title="LibreTranslate" image="language-tools/libretranslate.png" subtitle="LibreTranslate is a free and open-source machine translation web interface and API server. It uses Argos Translate models on the backend for translations." >}} + {{< card link="language-tools/index.md#languagetool" title="LanguageTool" image="language-tools/languagetool.svg" subtitle="LanguageTool is a multilingual grammar, style, and spell checker that supports more than 20 languages. According to their privacy policy, they do not store any content sent to their service for review, but for higher assurance the software is self-hostable." >}} + {{< card link="language-tools/index.md#libretranslate" title="LibreTranslate" image="language-tools/libretranslate.png" subtitle="LibreTranslate is a free and open-source machine translation web interface and API server. It uses Argos Translate models on the backend for translations." >}} {{< /cards >}}
@@ -143,8 +143,8 @@ weight: 30
{{< cards >}} - {{< card link="maps/_index.md#organic-maps" title="Organic Maps" image="maps/organic-maps.svg" subtitle="Organic Maps is an open-source, community-developed map display and satnav-style navigation app for walkers, drivers, and cyclists. The app offers worldwide, offline maps based on OpenStreetMap data, and navigation with privacy — no location tracking, no data collection, and no ads." >}} - {{< card link="maps/_index.md#osmand" title="OsmAnd" image="maps/osmand.svg" subtitle="OsmAnd is an open-source, offline map and navigation application based on OpenStreetMap that offers turn-by-turn navigation for walking, cycling, driving, as well as public transport. You can find a detailed overview of OsmAnd's supported features on the OpenStreet Map Wiki." >}} + {{< card link="maps/index.md#organic-maps" title="Organic Maps" image="maps/organic-maps.svg" subtitle="Organic Maps is an open-source, community-developed map display and satnav-style navigation app for walkers, drivers, and cyclists. The app offers worldwide, offline maps based on OpenStreetMap data, and navigation with privacy — no location tracking, no data collection, and no ads." >}} + {{< card link="maps/index.md#osmand" title="OsmAnd" image="maps/osmand.svg" subtitle="OsmAnd is an open-source, offline map and navigation application based on OpenStreetMap that offers turn-by-turn navigation for walking, cycling, driving, as well as public transport. You can find a detailed overview of OsmAnd's supported features on the OpenStreet Map Wiki." >}} {{< /cards >}}
@@ -152,9 +152,9 @@ weight: 30
{{< cards >}} - {{< card link="mobile-browsers/_index.md#brave" title="Brave" image="mobile-browsers/brave.svg" subtitle="Brave Browser includes a built-in content blocker and privacy features, many of which are enabled by default. Brave is built upon the Chromium web browser project, so it should feel familiar and have minimal website compatibility issues." >}} - {{< card link="mobile-browsers/_index.md#cromite-android" title="Cromite" image="mobile-browsers/cromite.svg" subtitle="Cromite is a Chromium-based browser with built-in ad blocking, fingerprinting protections, and other privacy and security enhancements. It is a fork of the discontinued Bromite browser." >}} - {{< card link="mobile-browsers/_index.md#safari-ios" title="Safari (iOS)" image="mobile-browsers/safari.svg" subtitle="On iOS, any app that can browse the web is restricted to using an Apple-provided WebKit framework, so a browser like Brave does not use the Blink engine (the core component of Chromium) like its counterparts on other operating systems. Safari is the default browser in iOS." >}} + {{< card link="mobile-browsers/index.md#brave" title="Brave" image="mobile-browsers/brave.svg" subtitle="Brave Browser includes a built-in content blocker and privacy features, many of which are enabled by default. Brave is built upon the Chromium web browser project, so it should feel familiar and have minimal website compatibility issues." >}} + {{< card link="mobile-browsers/index.md#cromite-android" title="Cromite" image="mobile-browsers/cromite.svg" subtitle="Cromite is a Chromium-based browser with built-in ad blocking, fingerprinting protections, and other privacy and security enhancements. It is a fork of the discontinued Bromite browser." >}} + {{< card link="mobile-browsers/index.md#safari-ios" title="Safari (iOS)" image="mobile-browsers/safari.svg" subtitle="On iOS, any app that can browse the web is restricted to using an Apple-provided WebKit framework, so a browser like Brave does not use the Blink engine (the core component of Chromium) like its counterparts on other operating systems. Safari is the default browser in iOS." >}} {{< /cards >}}
@@ -162,8 +162,8 @@ weight: 30
{{< cards >}} - {{< card link="multi-factor-authentication/_index.md#ente-auth" title="Ente Auth" image="multi-factor-authentication/ente-auth.svg" subtitle="Ente Auth is a free and open-source app which stores and generates TOTP tokens. It can be used with an online account to back up and sync your tokens across your devices (and access them via a web interface) in a secure, end-to-end encrypted fashion." >}} - {{< card link="multi-factor-authentication/_index.md#aegis-authenticator-android" title="Aegis Authenticator" image="multi-factor-authentication/aegis.png" subtitle="Aegis Authenticator is a free and open-source app for Android to manage your 2-step verification tokens for your online services. Aegis Authenticator operates completely offline/locally, but includes the option to export your tokens for backup unlike many alternatives." >}} + {{< card link="multi-factor-authentication/index.md#ente-auth" title="Ente Auth" image="multi-factor-authentication/ente-auth.svg" subtitle="Ente Auth is a free and open-source app which stores and generates TOTP tokens. It can be used with an online account to back up and sync your tokens across your devices (and access them via a web interface) in a secure, end-to-end encrypted fashion." >}} + {{< card link="multi-factor-authentication/index.md#aegis-authenticator-android" title="Aegis Authenticator" image="multi-factor-authentication/aegis.png" subtitle="Aegis Authenticator is a free and open-source app for Android to manage your 2-step verification tokens for your online services. Aegis Authenticator operates completely offline/locally, but includes the option to export your tokens for backup unlike many alternatives." >}} {{< /cards >}}
@@ -171,12 +171,12 @@ weight: 30
{{< cards >}} - {{< card link="news-aggregators/_index.md#akregator" title="Akregator" image="news-aggregators/akregator.svg" subtitle="Akregator is a news feed reader that is a part of the KDE project. It comes with a fast search, advanced archiving functionality, and an internal browser for easy news reading." >}} - {{< card link="news-aggregators/_index.md#newsflash" title="NewsFlash" image="news-aggregators/newsflash.png" subtitle="NewsFlash is an open-source, modern, and easy-to-use news feed reader for Linux. It can be used offline or with services like Inoreader or Nextcloud News." >}} - {{< card link="news-aggregators/_index.md#feeder" title="Feeder" image="news-aggregators/feeder.png" subtitle="Feeder is a modern RSS client for Android that has many features and works well with folders of RSS feeds." >}} - {{< card link="news-aggregators/_index.md#miniflux" title="Miniflux" image="news-aggregators/miniflux.svg" subtitle="Miniflux is a web-based news aggregator that you can self-host." >}} - {{< card link="news-aggregators/_index.md#netnewswire" title="NetNewsWire" image="news-aggregators/netnewswire.png" subtitle="NetNewsWire is a free and open-source feed reader for macOS and iOS with a focus on a native design and feature set." >}} - {{< card link="news-aggregators/_index.md#newsboat" title="Newsboat" image="news-aggregators/newsboat.svg" subtitle="Newsboat is an RSS/Atom feed reader for the text console. It's an actively maintained fork of Newsbeuter." >}} + {{< card link="news-aggregators/index.md#akregator" title="Akregator" image="news-aggregators/akregator.svg" subtitle="Akregator is a news feed reader that is a part of the KDE project. It comes with a fast search, advanced archiving functionality, and an internal browser for easy news reading." >}} + {{< card link="news-aggregators/index.md#newsflash" title="NewsFlash" image="news-aggregators/newsflash.png" subtitle="NewsFlash is an open-source, modern, and easy-to-use news feed reader for Linux. It can be used offline or with services like Inoreader or Nextcloud News." >}} + {{< card link="news-aggregators/index.md#feeder" title="Feeder" image="news-aggregators/feeder.png" subtitle="Feeder is a modern RSS client for Android that has many features and works well with folders of RSS feeds." >}} + {{< card link="news-aggregators/index.md#miniflux" title="Miniflux" image="news-aggregators/miniflux.svg" subtitle="Miniflux is a web-based news aggregator that you can self-host." >}} + {{< card link="news-aggregators/index.md#netnewswire" title="NetNewsWire" image="news-aggregators/netnewswire.png" subtitle="NetNewsWire is a free and open-source feed reader for macOS and iOS with a focus on a native design and feature set." >}} + {{< card link="news-aggregators/index.md#newsboat" title="Newsboat" image="news-aggregators/newsboat.svg" subtitle="Newsboat is an RSS/Atom feed reader for the text console. It's an actively maintained fork of Newsbeuter." >}} {{< /cards >}}
@@ -184,11 +184,11 @@ weight: 30
{{< cards >}} - {{< card link="notebooks/_index.md#standard-notes" title="Standard Notes" image="notebooks/standard-notes.svg" subtitle="Standard Notes is a simple and private notes app that features cross-platform sync for seamless use. It features E2EE on every platform, and a powerful desktop experience with themes and custom editors." >}} - {{< card link="notebooks/_index.md#notesnook" title="Notesnook" image="notebooks/notesnook.svg" subtitle="Notesnook is a free (as in speech), open-source, and easy-to-use E2EE note-taking app focused on user privacy." >}} - {{< card link="notebooks/_index.md#joplin" title="Joplin" image="notebooks/joplin.svg" subtitle="Joplin is a free, open-source, and fully-featured E2EE note-taking and to-do application which can handle numerous Markdown notes organized into notebooks and tags." >}} - {{< card link="notebooks/_index.md#cryptee" title="Cryptee" image="notebooks/cryptee.svg" subtitle="Cryptee is an open-source, web-based E2EE document editor and photo storage application." >}} - {{< card link="notebooks/_index.md#org-mode" title="Org-mode" image="notebooks/org-mode.svg" subtitle="Org-mode is a major mode for GNU Emacs. Org-mode is for keeping notes, maintaining to-do lists, planning projects, and authoring documents with a fast and effective plain-text system." >}} + {{< card link="notebooks/index.md#standard-notes" title="Standard Notes" image="notebooks/standard-notes.svg" subtitle="Standard Notes is a simple and private notes app that features cross-platform sync for seamless use. It features E2EE on every platform, and a powerful desktop experience with themes and custom editors." >}} + {{< card link="notebooks/index.md#notesnook" title="Notesnook" image="notebooks/notesnook.svg" subtitle="Notesnook is a free (as in speech), open-source, and easy-to-use E2EE note-taking app focused on user privacy." >}} + {{< card link="notebooks/index.md#joplin" title="Joplin" image="notebooks/joplin.svg" subtitle="Joplin is a free, open-source, and fully-featured E2EE note-taking and to-do application which can handle numerous Markdown notes organized into notebooks and tags." >}} + {{< card link="notebooks/index.md#cryptee" title="Cryptee" image="notebooks/cryptee.svg" subtitle="Cryptee is an open-source, web-based E2EE document editor and photo storage application." >}} + {{< card link="notebooks/index.md#org-mode" title="Org-mode" image="notebooks/org-mode.svg" subtitle="Org-mode is a major mode for GNU Emacs. Org-mode is for keeping notes, maintaining to-do lists, planning projects, and authoring documents with a fast and effective plain-text system." >}} {{< /cards >}}
@@ -196,8 +196,8 @@ weight: 30
{{< cards >}} - {{< card link="office-suites/_index.md#libreoffice" title="LibreOffice" image="office-suites/libreoffice.svg" subtitle="LibreOffice is a free and open-source office suite with extensive functionality." >}} - {{< card link="office-suites/_index.md#onlyoffice" title="OnlyOffice" image="office-suites/onlyoffice.svg" subtitle="OnlyOffice is a cloud-based free and open-source office suite with extensive functionality, including integration with Nextcloud." >}} + {{< card link="office-suites/index.md#libreoffice" title="LibreOffice" image="office-suites/libreoffice.svg" subtitle="LibreOffice is a free and open-source office suite with extensive functionality." >}} + {{< card link="office-suites/index.md#onlyoffice" title="OnlyOffice" image="office-suites/onlyoffice.svg" subtitle="OnlyOffice is a cloud-based free and open-source office suite with extensive functionality, including integration with Nextcloud." >}} {{< /cards >}}
@@ -205,10 +205,10 @@ weight: 30
{{< cards >}} - {{< card link="passwords/_index.md#keepassxc" title="KeePassXC" image="passwords/keepassxc.svg" subtitle="KeePassXC is a community fork of KeePassX, a native cross-platform port of KeePass Password Safe, with the goal of extending and improving it with new features and bug fixes to provide a feature-rich, cross-platform, and modern open-source password manager." >}} - {{< card link="passwords/_index.md#keepassdx-android" title="KeePassDX" image="passwords/keepassdx.svg" subtitle="KeePassDX is a lightweight password manager for Android; it allows for editing encrypted data in a single file in KeePass format and can fill in forms securely." >}} - {{< card link="passwords/_index.md#keepassium-ios-macos" title="KeePassium" image="passwords/keepassium.svg" subtitle="KeePassium is a commercial, open-source password manager made by KeePassium Labs that's compatible with other KeePass applications. It provides autofill support, passkey management, automatic two-way synchronization through most cloud storage providers, and more." >}} - {{< card link="passwords/_index.md#gopass-cli" title="Gopass" image="passwords/gopass.svg" subtitle="Gopass is a minimal password manager for the command line written in Go. It can be used within scripting applications and works on all major desktop and server operating systems." >}} + {{< card link="passwords/index.md#keepassxc" title="KeePassXC" image="passwords/keepassxc.svg" subtitle="KeePassXC is a community fork of KeePassX, a native cross-platform port of KeePass Password Safe, with the goal of extending and improving it with new features and bug fixes to provide a feature-rich, cross-platform, and modern open-source password manager." >}} + {{< card link="passwords/index.md#keepassdx-android" title="KeePassDX" image="passwords/keepassdx.svg" subtitle="KeePassDX is a lightweight password manager for Android; it allows for editing encrypted data in a single file in KeePass format and can fill in forms securely." >}} + {{< card link="passwords/index.md#keepassium-ios-macos" title="KeePassium" image="passwords/keepassium.svg" subtitle="KeePassium is a commercial, open-source password manager made by KeePassium Labs that's compatible with other KeePass applications. It provides autofill support, passkey management, automatic two-way synchronization through most cloud storage providers, and more." >}} + {{< card link="passwords/index.md#gopass-cli" title="Gopass" image="passwords/gopass.svg" subtitle="Gopass is a minimal password manager for the command line written in Go. It can be used within scripting applications and works on all major desktop and server operating systems." >}} {{< /cards >}}
@@ -216,8 +216,8 @@ weight: 30
{{< cards >}} - {{< card link="pastebins/_index.md#privatebin" title="PrivateBin" image="pastebins/privatebin.svg" subtitle="PrivateBin is a minimalist, open-source, online pastebin where the server cannot decrypt and read any pasted data you submit. Data is encrypted/decrypted in the browser using 256-bit AES." >}} - {{< card link="pastebins/_index.md#paaster" title="Paaster" image="pastebins/paaster.svg" subtitle="Paaster is a secure and user-friendly pastebin application that prioritizes privacy and simplicity. With end-to-end encryption and paste history, Paaster ensures that your pasted code remains confidential and accessible." >}} + {{< card link="pastebins/index.md#privatebin" title="PrivateBin" image="pastebins/privatebin.svg" subtitle="PrivateBin is a minimalist, open-source, online pastebin where the server cannot decrypt and read any pasted data you submit. Data is encrypted/decrypted in the browser using 256-bit AES." >}} + {{< card link="pastebins/index.md#paaster" title="Paaster" image="pastebins/paaster.svg" subtitle="Paaster is a secure and user-friendly pastebin application that prioritizes privacy and simplicity. With end-to-end encryption and paste history, Paaster ensures that your pasted code remains confidential and accessible." >}} {{< /cards >}}
@@ -225,8 +225,8 @@ weight: 30
{{< cards >}} - {{< card link="social-networks/_index.md#mastodon" title="Mastodon" image="social-networks/mastodon.svg" subtitle="Mastodon is a social network based on open web protocols and free, open-source software. It uses the ActivityPub protocol, which is decentralized like email: Users can exist on different servers or even different platforms but still communicate with each other." >}} - {{< card link="social-networks/_index.md#element" title="Element" image="social-networks/element.svg" subtitle="Element is the flagship client for the Matrix protocol, an open standard that enables decentralized communication by way of federated chat rooms. Users can exist on different homeservers but still communicate with each other." >}} + {{< card link="social-networks/index.md#mastodon" title="Mastodon" image="social-networks/mastodon.svg" subtitle="Mastodon is a social network based on open web protocols and free, open-source software. It uses the ActivityPub protocol, which is decentralized like email: Users can exist on different servers or even different platforms but still communicate with each other." >}} + {{< card link="social-networks/index.md#element" title="Element" image="social-networks/element.svg" subtitle="Element is the flagship client for the Matrix protocol, an open standard that enables decentralized communication by way of federated chat rooms. Users can exist on different homeservers but still communicate with each other." >}} {{< /cards >}}
@@ -234,7 +234,7 @@ weight: 30
{{< cards >}} - {{< card link="tor/_index.md#tor-browser" title="Tor Browser" image="tor/tor.svg" subtitle="Tor Browser is the top choice if you need anonymity, as it provides you with access to the Tor network and bridges, and it includes default settings and extensions that are automatically configured by the default security levels: *Standard*, *Safer* and *Safest*." >}} - {{< card link="tor/_index.md#onion-browser-ios" title="Onion Browser" image="tor/onion_browser.svg" subtitle="Onion Browser is an open-source browser that lets you browse the web anonymously over the Tor network on iOS devices and is endorsed by the Tor Project." >}} + {{< card link="tor/index.md#tor-browser" title="Tor Browser" image="tor/tor.svg" subtitle="Tor Browser is the top choice if you need anonymity, as it provides you with access to the Tor network and bridges, and it includes default settings and extensions that are automatically configured by the default security levels: *Standard*, *Safer* and *Safest*." >}} + {{< card link="tor/index.md#onion-browser-ios" title="Onion Browser" image="tor/onion_browser.svg" subtitle="Onion Browser is an open-source browser that lets you browse the web anonymously over the Tor network on iOS devices and is endorsed by the Tor Project." >}} {{< /cards >}}
diff --git a/content/tools/software/ai-chat/_index.md b/content/tools/software/ai-chat/index.md similarity index 98% rename from content/tools/software/ai-chat/_index.md rename to content/tools/software/ai-chat/index.md index 7599830e2..ed341bdf0 100755 --- a/content/tools/software/ai-chat/_index.md +++ b/content/tools/software/ai-chat/index.md @@ -3,9 +3,9 @@ title: "AI Chat" description: Unlike OpenAI's ChatGPT and its Big Tech competitors, these AI tools run locally so your data never leaves your desktop device. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) -[{{< badge content="Censorship" >}}](../../../wiki/basics/common-threats/_index.md#avoiding-censorship) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) +[{{< badge content="Censorship" >}}](../../../wiki/basics/common-threats/index.md#avoiding-censorship) The use of **AI chat**, also known as Large Language Models (LLMs), has become increasingly common since the release of ChatGPT in 2022. LLMs can help us write better, understand unfamiliar subjects, or answer a wide range of questions. They work by statistically predicting the next word in their responses based on a vast amount of data scraped from the web. diff --git a/content/tools/software/browser-extensions/_index.md b/content/tools/software/browser-extensions/index.md similarity index 92% rename from content/tools/software/browser-extensions/_index.md rename to content/tools/software/browser-extensions/index.md index 907f853ce..c361c0c6c 100644 --- a/content/tools/software/browser-extensions/_index.md +++ b/content/tools/software/browser-extensions/index.md @@ -3,13 +3,13 @@ title: Browser Extensions description: These browser extensions can enhance your browsing experience and protect your privacy. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) In general, we recommend keeping your browser extensions to a minimum to decrease your attack surface. They have privileged access within your browser, require you to trust the developer, can make you [stand out](https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint), and [weaken](https://groups.google.com/a/chromium.org/g/chromium-extensions/c/0ei-UCHNm34/m/lDaXwQhzBAAJ) site isolation. -However, some provide functionality which can outweigh these downsides in certain situations, particularly when it comes to [content blocking](../../../wiki/basics/common-threats/_index.md#mass-surveillance-programs). +However, some provide functionality which can outweigh these downsides in certain situations, particularly when it comes to [content blocking](../../../wiki/basics/common-threats/index.md#mass-surveillance-programs). -Don't install extensions which you don't immediately have a need for, or ones that duplicate the functionality of your browser. For example, [Brave](../desktop-browsers/_index.md#brave) users don't need to install uBlock Origin, because Brave Shields already provides the same functionality. +Don't install extensions which you don't immediately have a need for, or ones that duplicate the functionality of your browser. For example, [Brave](../desktop-browsers/index.md#brave) users don't need to install uBlock Origin, because Brave Shields already provides the same functionality.
{{< cards >}} @@ -49,7 +49,7 @@ uBlock Origin also has a "Lite" version of their extension, which offers a limit - ...you want a more resource (memory/CPU) efficient content blocker[^1] - ...your browser only supports Manifest V3 extensions. This is the case for Chrome [^2] , Edge and most Chromium browsers. -**uBlock Origin Lite** is a Manifest V3 compatible content blocker. Compared to the original *uBlock Origin*, this extension does not require broad "read/modify data" permissions to function, which lowers the risk of [:material-bug-outline: Passive Attacks](../../../wiki/basics/common-threats/_index.md#security-and-privacy){ .pg-orange } on your browser if a malicious rule is added to a filter list. +**uBlock Origin Lite** is a Manifest V3 compatible content blocker. Compared to the original *uBlock Origin*, this extension does not require broad "read/modify data" permissions to function, which lowers the risk of [:material-bug-outline: Passive Attacks](../../../wiki/basics/common-threats/index.md#security-and-privacy){ .pg-orange } on your browser if a malicious rule is added to a filter list. {{< cards >}} {{< card link="https://github.com/uBlockOrigin/uBOL-home#readme" title="Repository" icon="code" >}} @@ -70,7 +70,7 @@ uBlock Origin Lite only receives block list updates whenever the extension is up ### AdGuard -We recommend [Safari](../mobile-browsers/_index.md#safari-ios) for iOS users, which unfortunately is only supported by uBlock Origin **Lite**. Luckily, AdGuard provides an adequate alternative: +We recommend [Safari](../mobile-browsers/index.md#safari-ios) for iOS users, which unfortunately is only supported by uBlock Origin **Lite**. Luckily, AdGuard provides an adequate alternative: **AdGuard for iOS** is a free and open-source content-blocking extension for Safari that uses the native [Content Blocker API](https://developer.apple.com/documentation/safariservices/creating_a_content_blocker). diff --git a/content/tools/software/cryptocurrency/_index.md b/content/tools/software/cryptocurrency/index.md similarity index 92% rename from content/tools/software/cryptocurrency/_index.md rename to content/tools/software/cryptocurrency/index.md index 22061f39a..dc4ed155d 100644 --- a/content/tools/software/cryptocurrency/_index.md +++ b/content/tools/software/cryptocurrency/index.md @@ -3,8 +3,8 @@ description: Unlike most cryptocurrencies, these ones provide transaction privac title: Cryptocurrency --- Protects against the following threat(s): -[{{< badge content="Mass Surveillance" color="blue" >}}](../../../wiki/basics/common-threats/_index.md#mass-surveillance-programs) -[{{< badge content="Censorship" >}}](../../../wiki/basics/common-threats/_index.md#avoiding-censorship) +[{{< badge content="Mass Surveillance" color="blue" >}}](../../../wiki/basics/common-threats/index.md#mass-surveillance-programs) +[{{< badge content="Censorship" >}}](../../../wiki/basics/common-threats/index.md#avoiding-censorship)
{{< cards >}} @@ -14,7 +14,7 @@ title: Cryptocurrency Making payments online is one of the biggest challenges to privacy. These cryptocurrencies provide transaction privacy by default (something which is **not** guaranteed by the majority of cryptocurrencies), provided you have a strong understanding of how to make private payments effectively. We strongly encourage you first read our payments overview article before making any purchases: -[Making Private Payments](../../../wiki/advanced/payments/_index.md) +[Making Private Payments](../../../wiki/advanced/payments/index.md) { .md-button } > [!CAUTION] @@ -22,7 +22,7 @@ Making payments online is one of the biggest challenges to privacy. These crypto ## Monero -**Monero** uses a blockchain with privacy-enhancing technologies that obfuscate transactions to achieve [:material-incognito: Anonymity](../../../wiki/basics/common-threats/_index.md#anonymity-vs-privacy){ .pg-purple }. Every Monero transaction hides the transaction amount, sending and receiving addresses, and source of funds without any hoops to jump through, making it an ideal choice for cryptocurrency novices. +**Monero** uses a blockchain with privacy-enhancing technologies that obfuscate transactions to achieve [:material-incognito: Anonymity](../../../wiki/basics/common-threats/index.md#anonymity-vs-privacy){ .pg-purple }. Every Monero transaction hides the transaction amount, sending and receiving addresses, and source of funds without any hoops to jump through, making it an ideal choice for cryptocurrency novices. {{< cards >}} {{< card link="https://getmonero.org" title="Homepage" icon="home" >}} @@ -54,11 +54,11 @@ For optimal privacy, make sure to use a self-custody wallet where the [view key] ### Monero nodes -For maximum privacy (even with a self-custody wallet), you should run your own Monero node called the [Monero daemon](https://docs.getmonero.org/interacting/monerod-reference), which is included in the [CLI wallet](https://getmonero.org/downloads/#cli). Using another person’s node will expose some information to them, such as the IP address that you connect to it from, the timestamps that you sync your wallet, and the transactions that you send from your wallet (though no other details about those transactions). Alternatively, you can connect to someone else’s Monero node over [Tor](../../advanced/alternative-networks/_index.md#tor), [I2P](../../advanced/alternative-networks/_index.md#i2p-the-invisible-internet-project), or a [VPN](../../services/vpn/_index.md). +For maximum privacy (even with a self-custody wallet), you should run your own Monero node called the [Monero daemon](https://docs.getmonero.org/interacting/monerod-reference), which is included in the [CLI wallet](https://getmonero.org/downloads/#cli). Using another person’s node will expose some information to them, such as the IP address that you connect to it from, the timestamps that you sync your wallet, and the transactions that you send from your wallet (though no other details about those transactions). Alternatively, you can connect to someone else’s Monero node over [Tor](../../advanced/alternative-networks/index.md#tor), [I2P](../../advanced/alternative-networks/index.md#i2p-the-invisible-internet-project), or a [VPN](../../services/vpn/index.md). ### Buying Monero -[General tips for acquiring Monero](../../../wiki/advanced/payments/_index.md#acquisition) +[General tips for acquiring Monero](../../../wiki/advanced/payments/index.md#acquisition) { .md-button } There are numerous centralized exchanges (CEX) as well as P2P marketplaces where you can buy and sell Monero. Some of them require identifying yourself (KYC) to comply with anti-money laundering regulations. However, due to Monero's privacy features, the only thing known to the seller is *that* you bought Monero, but not how much you own or where you spend it (after it leaves the exchange). Some reputable places to buy Monero include: diff --git a/content/tools/software/data-redaction/_index.md b/content/tools/software/data-redaction/index.md similarity index 99% rename from content/tools/software/data-redaction/_index.md rename to content/tools/software/data-redaction/index.md index b7d763f72..6416ef26c 100644 --- a/content/tools/software/data-redaction/_index.md +++ b/content/tools/software/data-redaction/index.md @@ -3,7 +3,7 @@ title: "Data and Metadata Redaction" description: Use these tools to remove metadata like GPS location and other identifying information from photos and files you share. --- Protects against the following threat(s): -[{{< badge content="Public Exposure" color="green" >}}](../../../wiki/basics/common-threats/_index.md#limiting-public-information) +[{{< badge content="Public Exposure" color="green" >}}](../../../wiki/basics/common-threats/index.md#limiting-public-information) When sharing files, be sure to remove associated metadata. Image files commonly include [Exif](https://en.wikipedia.org/wiki/Exif) data. Photos sometimes even include GPS coordinates in the file metadata. diff --git a/content/tools/software/desktop-browsers/_index.md b/content/tools/software/desktop-browsers/index.md similarity index 89% rename from content/tools/software/desktop-browsers/_index.md rename to content/tools/software/desktop-browsers/index.md index bf5ea6676..6b4d271de 100644 --- a/content/tools/software/desktop-browsers/_index.md +++ b/content/tools/software/desktop-browsers/index.md @@ -3,7 +3,7 @@ title: Desktop Browsers description: These privacy-protecting browsers are what we currently recommend for standard/non-anonymous internet browsing on desktop systems. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) These are our currently recommended **desktop web browsers** and configurations for standard/non-anonymous browsing. We recommend [Mullvad Browser](#mullvad-browser) if you are focused on strong privacy protections and anti-fingerprinting out of the box, [Firefox](#firefox) for casual internet browsers looking for a good alternative to Google Chrome, and [Brave](#brave) if you need Chromium browser compatibility. @@ -15,11 +15,11 @@ These are our currently recommended **desktop web browsers** and configurations {{< /cards >}}
-If you need to browse the internet anonymously, you should use [Tor](../tor/_index.md) instead. We make some configuration recommendations on this page, but all browsers other than Tor Browser will be traceable by *somebody* in some manner or another. +If you need to browse the internet anonymously, you should use [Tor](../tor/index.md) instead. We make some configuration recommendations on this page, but all browsers other than Tor Browser will be traceable by *somebody* in some manner or another. ## Mullvad Browser -**Mullvad Browser** is a version of [Tor Browser](../tor/_index.md#tor-browser) with Tor network integrations removed. It aims to provide to VPN users Tor Browser's anti-fingerprinting browser technologies, which are key protections against [:material-eye-outline: Mass Surveillance](../../../wiki/basics/common-threats/_index.md#mass-surveillance-programs){ .pg-blue }. It is developed by the Tor Project and distributed by [Mullvad](../../services/vpn/_index.md#mullvad), and does **not** require the use of Mullvad's VPN. +**Mullvad Browser** is a version of [Tor Browser](../tor/index.md#tor-browser) with Tor network integrations removed. It aims to provide to VPN users Tor Browser's anti-fingerprinting browser technologies, which are key protections against [:material-eye-outline: Mass Surveillance](../../../wiki/basics/common-threats/index.md#mass-surveillance-programs){ .pg-blue }. It is developed by the Tor Project and distributed by [Mullvad](../../services/vpn/index.md#mullvad), and does **not** require the use of Mullvad's VPN. {{< cards >}} {{< card link="https://mullvad.net/en/browser" title="Homepage" icon="home" >}} @@ -30,7 +30,7 @@ If you need to browse the internet anonymously, you should use [Tor](../tor/_ind [{{< badge content="macOS" color="indigo" >}}](https://mullvad.net/en/download/browser/macos) [{{< badge content="Windows" color="red" >}}](https://mullvad.net/en/download/browser/windows) -Like [Tor Browser](../tor/_index.md), Mullvad Browser is designed to prevent fingerprinting by making your browser fingerprint identical to all other Mullvad Browser users, and it includes default settings and extensions that are automatically configured by the default security levels: *Standard*, *Safer* and *Safest*. +Like [Tor Browser](../tor/index.md), Mullvad Browser is designed to prevent fingerprinting by making your browser fingerprint identical to all other Mullvad Browser users, and it includes default settings and extensions that are automatically configured by the default security levels: *Standard*, *Safer* and *Safest*. Therefore, it is imperative that you do not modify the browser at all outside adjusting the default [security levels](https://tb-manual.torproject.org/security-settings). When adjusting the security level, you **must** always restart the browser before continuing to use it. Otherwise, [the security settings may not be fully applied](https://www.privacyguides.org/articles/2025/05/02/tor-security-slider-flaw), putting you at a higher risk of fingerprinting and exploits than you may expect based on the setting chosen. @@ -38,13 +38,13 @@ Modifications other than adjusting this setting would make your fingerprint uniq ### Anti-Fingerprinting -**Without** using a [VPN](../../services/vpn/_index.md), Mullvad Browser provides protections against [naive fingerprinting scripts](https://github.com/arkenfox/user.js/wiki/3.3-Overrides-%5BTo-RFP-or-Not%5D#-fingerprinting) similar to other private browsers like Firefox+[Arkenfox](#arkenfox-advanced) or [Brave](#brave). Mullvad Browser provides these protections out of the box, at the expense of some flexibility and convenience that other private browsers can provide. +**Without** using a [VPN](../../services/vpn/index.md), Mullvad Browser provides protections against [naive fingerprinting scripts](https://github.com/arkenfox/user.js/wiki/3.3-Overrides-%5BTo-RFP-or-Not%5D#-fingerprinting) similar to other private browsers like Firefox+[Arkenfox](#arkenfox-advanced) or [Brave](#brave). Mullvad Browser provides these protections out of the box, at the expense of some flexibility and convenience that other private browsers can provide. ==For the strongest anti-fingerprinting protection, we recommend using Mullvad Browser in conjunction **with** a VPN==, whether that is Mullvad or another recommended VPN provider. When using a VPN with Mullvad Browser, you will share a fingerprint and a pool of IP addresses with many other users, giving you a "crowd" to blend in with. This strategy is the only way to thwart advanced tracking scripts, and is the same anti-fingerprinting technique used by Tor Browser. Note that while you can use Mullvad Browser with any VPN provider, other people on that VPN must also be using Mullvad Browser for this "crowd" to exist, something which is more likely on Mullvad VPN compared to other providers. Mullvad Browser does not have built-in VPN connectivity, nor does it check whether you are using a VPN before browsing; your VPN connection has to be configured and managed separately. -Mullvad Browser comes with the *uBlock Origin* and *NoScript* browser extensions pre-installed. While we typically discourage adding *additional* [browser extensions](../browser-extensions/_index.md), these extensions that come pre-installed with the browser should **not** be removed or configured outside their default values, because doing so would noticeably make your browser fingerprint distinct from other Mullvad Browser users. It also comes pre-installed with the Mullvad Browser Extension, which *can* be safely removed without impacting your browser fingerprint if you would like, but is also safe to keep even if you don't use Mullvad VPN. +Mullvad Browser comes with the *uBlock Origin* and *NoScript* browser extensions pre-installed. While we typically discourage adding *additional* [browser extensions](../browser-extensions/index.md), these extensions that come pre-installed with the browser should **not** be removed or configured outside their default values, because doing so would noticeably make your browser fingerprint distinct from other Mullvad Browser users. It also comes pre-installed with the Mullvad Browser Extension, which *can* be safely removed without impacting your browser fingerprint if you would like, but is also safe to keep even if you don't use Mullvad VPN. ### Private Browsing Mode @@ -136,7 +136,7 @@ This prevents you from unintentionally connecting to a website in plain-text HTT ##### DNS over HTTPS -If you use a [DNS over HTTPS provider](../../services/dns/_index.md): +If you use a [DNS over HTTPS provider](../../services/dns/index.md): - [x] Select **Max Protection** and choose a suitable provider @@ -227,7 +227,7 @@ Brave allows you to select additional content filters within the internal `brave ##### Tor windows -[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](../tor/_index.md#tor-browser). +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser is, and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](../tor/index.md#tor-browser). ##### Data Collection @@ -268,7 +268,7 @@ We recommend disabling search suggestions in Brave for the same reason we recomm #### Brave Rewards and Wallet -**Brave Rewards** lets you receive Basic Attention Token (BAT) cryptocurrency for performing certain actions within Brave. It relies on a custodial account and KYC from a select number of providers. We do not recommend BAT as a [private cryptocurrency](../cryptocurrency/_index.md), nor do we recommend using a [custodial wallet](../../../wiki/advanced/payments/_index.md#wallet-custody), so we would discourage using this feature. +**Brave Rewards** lets you receive Basic Attention Token (BAT) cryptocurrency for performing certain actions within Brave. It relies on a custodial account and KYC from a select number of providers. We do not recommend BAT as a [private cryptocurrency](../cryptocurrency/index.md), nor do we recommend using a [custodial wallet](../../../wiki/advanced/payments/index.md#wallet-custody), so we would discourage using this feature. **Brave Wallet** operates locally on your computer, but does not support any private cryptocurrencies, so we would discourage using this feature as well. @@ -296,6 +296,6 @@ Our best-case criteria represents what we would like to see from the perfect pro - Should not include add-on functionality (bloatware) that does not impact user privacy. - Should not collect telemetry by default. - Should provide an open-source sync server implementation. -- Should default to a [private search engine](../../services/search-engines/_index.md). +- Should default to a [private search engine](../../services/search-engines/index.md). [^1]: Brave's implementation is detailed at [Brave Privacy Updates: Partitioning network-state for privacy](https://brave.com/privacy-updates/14-partitioning-network-state). diff --git a/content/tools/software/document-collaboration/_index.md b/content/tools/software/document-collaboration/index.md similarity index 97% rename from content/tools/software/document-collaboration/_index.md rename to content/tools/software/document-collaboration/index.md index c2cb38c67..a60f3d255 100644 --- a/content/tools/software/document-collaboration/_index.md +++ b/content/tools/software/document-collaboration/index.md @@ -3,7 +3,7 @@ title: Document Collaboration description: Most online office suites do not support end-to-end encryption, meaning the cloud provider has access to everything you do. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers)
{{< cards >}} diff --git a/content/tools/software/email-clients/_index.md b/content/tools/software/email-clients/index.md similarity index 91% rename from content/tools/software/email-clients/_index.md rename to content/tools/software/email-clients/index.md index ab0016040..6a7a5097a 100644 --- a/content/tools/software/email-clients/_index.md +++ b/content/tools/software/email-clients/index.md @@ -3,19 +3,19 @@ title: "Email Clients" description: These email clients are privacy-respecting and support OpenPGP email encryption. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) -The **email clients** we recommend support both [OpenPGP](../encryption/_index.md#openpgp) and strong authentication such as [Open Authorization (OAuth)](../../../wiki/basics/account-creation/_index.md#sign-in-with-oauth). OAuth allows you to use [Multi-Factor Authentication](../../../wiki/basics/multi-factor-authentication/_index.md) to prevent account theft. +The **email clients** we recommend support both [OpenPGP](../encryption/index.md#openpgp) and strong authentication such as [Open Authorization (OAuth)](../../../wiki/basics/account-creation/index.md#sign-in-with-oauth). OAuth allows you to use [Multi-Factor Authentication](../../../wiki/basics/multi-factor-authentication/index.md) to prevent account theft.
Email does not provide forward secrecy -When using end-to-end encryption (E2EE) technology like OpenPGP, email will still have [some metadata](../../../wiki/basics/email-security/_index.md#email-metadata-overview) that is not encrypted in the header of the email. +When using end-to-end encryption (E2EE) technology like OpenPGP, email will still have [some metadata](../../../wiki/basics/email-security/index.md#email-metadata-overview) that is not encrypted in the header of the email. -OpenPGP also does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed: [How do I protect my private keys?](../../../wiki/basics/email-security/_index.md#how-do-i-protect-my-private-keys) Consider using a medium that provides forward secrecy: +OpenPGP also does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed: [How do I protect my private keys?](../../../wiki/basics/email-security/index.md#how-do-i-protect-my-private-keys) Consider using a medium that provides forward secrecy: -[Real-time Communication](../../services/messengers/_index.md) +[Real-time Communication](../../services/messengers/index.md) { .md-button }
@@ -77,13 +77,13 @@ These options can be found in :material-menu: → **Settings** → **Privacy & S #### Thunderbird-user.js (advanced) -[`thunderbird-user.js`](https://github.com/HorlogeSkynet/thunderbird-user.js) is a set of configuration options that aims to disable as many of the web-browsing features within Thunderbird Desktop as possible in order to reduce attack surface and maintain privacy. Some of the changes are backported from the [Arkenfox project](../desktop-browsers/_index.md#arkenfox-advanced). +[`thunderbird-user.js`](https://github.com/HorlogeSkynet/thunderbird-user.js) is a set of configuration options that aims to disable as many of the web-browsing features within Thunderbird Desktop as possible in order to reduce attack surface and maintain privacy. Some of the changes are backported from the [Arkenfox project](../desktop-browsers/index.md#arkenfox-advanced). ## Platform Specific ### Apple Mail (macOS) -**Apple Mail** is included in macOS and can be extended to have OpenPGP support with [GPG Suite](../encryption/_index.md#gpg-suite), which adds the ability to send PGP-encrypted email. +**Apple Mail** is included in macOS and can be extended to have OpenPGP support with [GPG Suite](../encryption/index.md#gpg-suite), which adds the ability to send PGP-encrypted email. {{< cards >}} {{< card link="https://support.apple.com/guide/mail/welcome/mac" title="Homepage" icon="home" >}} diff --git a/content/tools/software/encryption/_index.md b/content/tools/software/encryption/index.md similarity index 91% rename from content/tools/software/encryption/_index.md rename to content/tools/software/encryption/index.md index 409545c10..b383879bc 100644 --- a/content/tools/software/encryption/_index.md +++ b/content/tools/software/encryption/index.md @@ -27,9 +27,9 @@ The options listed here are available on multiple platforms and great for creati ### Cryptomator (Cloud) Protects against the following threat(s): -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) -**Cryptomator** is an encryption solution designed for privately saving files to any cloud [:material-server-network: Service Provider](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers){ .pg-teal }, eliminating the need to trust that they won't access your files. It allows you to create vaults that are stored on a virtual drive, the contents of which are encrypted and synced with your cloud storage provider. +**Cryptomator** is an encryption solution designed for privately saving files to any cloud [:material-server-network: Service Provider](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers){ .pg-teal }, eliminating the need to trust that they won't access your files. It allows you to create vaults that are stored on a virtual drive, the contents of which are encrypted and synced with your cloud storage provider. {{< cards >}} {{< card link="https://cryptomator.org" title="Homepage" icon="home" >}} @@ -55,7 +55,7 @@ Cryptomator's documentation details its intended [security target](https://docs. ### VeraCrypt (Disk) Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) **VeraCrypt** is a source-available freeware utility used for on-the-fly encryption. It can create a virtual encrypted disk within a file, encrypt a partition, or encrypt the entire storage device with pre-boot authentication. @@ -77,9 +77,9 @@ TrueCrypt has been [audited a number of times](https://en.wikipedia.org/wiki/Tru ## Operating System Encryption Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) -Built-in OS encryption solutions generally leverage hardware security features such as a [secure cryptoprocessor](../../../wiki/basics/hardware/_index.md#tpmsecure-cryptoprocessor). Therefore, we recommend using the built-in encryption solutions for your operating system. For cross-platform encryption, we still recommend [cross-platform tools](#multi-platform) for additional flexibility and to avoid vendor lock-in. +Built-in OS encryption solutions generally leverage hardware security features such as a [secure cryptoprocessor](../../../wiki/basics/hardware/index.md#tpmsecure-cryptoprocessor). Therefore, we recommend using the built-in encryption solutions for your operating system. For cross-platform encryption, we still recommend [cross-platform tools](#multi-platform) for additional flexibility and to avoid vendor lock-in.
@@ -100,11 +100,11 @@ Powering off your devices when they’re not in use provides the highest level o BitLocker is [officially supported](https://support.microsoft.com/en-us/windows/bitlocker-overview-44c0c61c-989d-4a69-8822-b95cd49b1bbf) on the Pro, Enterprise, and Education editions of Windows. The Home edition only supports automatic [Device Encryption](https://support.microsoft.com/en-us/windows/device-encryption-in-windows-cf7e2b6f-3e70-4882-9532-18633605b7df) and must meet specific hardware requirements. If you’re using the Home edition, we recommend [upgrading to Pro](https://support.microsoft.com/en-us/windows/upgrade-windows-home-to-windows-pro-ef34d520-e73f-3198-c525-d1a218cc2818), which can be done without reinstalling Windows or losing your files. -Pro and higher editions also support the more secure pre-boot [TPM+PIN](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/faq#what-is-the-difference-between-a-tpm-owner-password--recovery-password--recovery-key--pin--enhanced-pin--and-startup-key) feature, configured through the appropriate [group policy](../../../wiki/os/windows/group-policies/_index.md#bitlocker-drive-encryption) settings. The PIN is rate limited and the TPM will panic and lock access to the encryption key either permanently or for a period of time if someone attempts to brute force access. +Pro and higher editions also support the more secure pre-boot [TPM+PIN](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/faq#what-is-the-difference-between-a-tpm-owner-password--recovery-password--recovery-key--pin--enhanced-pin--and-startup-key) feature, configured through the appropriate [group policy](../../../wiki/os/windows/group-policies/index.md#bitlocker-drive-encryption) settings. The PIN is rate limited and the TPM will panic and lock access to the encryption key either permanently or for a period of time if someone attempts to brute force access. ### FileVault -**FileVault** is the on-the-fly volume encryption solution built into macOS. FileVault takes advantage of the [hardware security capabilities](../../../wiki/os/macos/_index.md#hardware-security) present on an Apple Silicon SoC or T2 Security Chip. +**FileVault** is the on-the-fly volume encryption solution built into macOS. FileVault takes advantage of the [hardware security capabilities](../../../wiki/os/macos/index.md#hardware-security) present on an Apple Silicon SoC or T2 Security Chip. {{< cards >}} {{< card link="https://support.apple.com/guide/mac-help/encrypt-mac-data-with-filevault-mh11785/mac" title="Documentation" icon="document-text" >}} @@ -151,7 +151,7 @@ udisksctl unlock -b /dev/loop0 ## Command-line Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) Tools with command-line interfaces are useful for integrating [shell scripts](https://en.wikipedia.org/wiki/Shell_script). @@ -180,9 +180,9 @@ Tools with command-line interfaces are useful for integrating [shell scripts](ht ## OpenPGP Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) -[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/_index.md#security-and-privacy) -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) +[{{< badge content="Passive Attacks" color="amber" >}}](../../../wiki/basics/common-threats/index.md#security-and-privacy) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) OpenPGP is sometimes needed for specific tasks such as digitally signing and encrypting email. PGP has many features and is [complex](https://latacora.micro.blog/2019/07/16/the-pgp-problem.html) as it has been around a long time. For tasks such as signing or encrypting files, we suggest the above options. @@ -221,7 +221,7 @@ When encrypting with PGP, you have the option to configure different options in ### GPG Suite -**GPG Suite** provides OpenPGP support for [Apple Mail](../email-clients/_index.md#apple-mail-macos) and other email clients on macOS. +**GPG Suite** provides OpenPGP support for [Apple Mail](../email-clients/index.md#apple-mail-macos) and other email clients on macOS. We recommend taking a look at their [First steps](https://gpgtools.tenderapp.com/kb/how-to/first-steps-where-do-i-start-where-do-i-begin-setup-gpgtools-create-a-new-key-your-first-encrypted-email) and [Knowledge Base](https://gpgtools.tenderapp.com/kb) for support. @@ -236,7 +236,7 @@ Currently, GPG Suite does [not yet](https://gpgtools.com/sequoia) have a stable ### OpenKeychain -**OpenKeychain** is an implementation of GnuPG for Android. It's commonly required by mail clients such as [Thunderbird](../email-clients/_index.md#thunderbird), [FairEmail](../email-clients/_index.md#fairemail-android), and other Android apps to provide encryption support. +**OpenKeychain** is an implementation of GnuPG for Android. It's commonly required by mail clients such as [Thunderbird](../email-clients/index.md#thunderbird), [FairEmail](../email-clients/index.md#fairemail-android), and other Android apps to provide encryption support. {{< cards >}} {{< card link="https://openkeychain.org" title="Homepage" icon="home" >}} diff --git a/content/tools/software/file-sharing/_index.md b/content/tools/software/file-sharing/index.md similarity index 89% rename from content/tools/software/file-sharing/_index.md rename to content/tools/software/file-sharing/index.md index 546746a63..5f1c2fe97 100644 --- a/content/tools/software/file-sharing/_index.md +++ b/content/tools/software/file-sharing/index.md @@ -3,7 +3,7 @@ title: File Sharing and Sync description: Discover how to privately share your files between your devices, with your friends and family, or anonymously online. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) Discover how to privately share your files between your devices, with your friends and family, or anonymously online. @@ -17,7 +17,7 @@ Discover how to privately share your files between your devices, with your frien ## File Sharing -If you already use [Proton Drive](../../services/cloud/_index.md#proton-drive)[^1] or have a [Bitwarden](../../services/passwords/_index.md#bitwarden) Premium[^2] subscription, consider using the file sharing capabilities that they each offer, both of which use end-to-end encryption. Otherwise, the standalone options listed here ensure that the files you share are not read by a remote server. +If you already use [Proton Drive](../../services/cloud/index.md#proton-drive)[^1] or have a [Bitwarden](../../services/passwords/index.md#bitwarden) Premium[^2] subscription, consider using the file sharing capabilities that they each offer, both of which use end-to-end encryption. Otherwise, the standalone options listed here ensure that the files you share are not read by a remote server. ### Send @@ -36,7 +36,7 @@ ffsend upload --host https://send.vis.ee/ FILE ### OnionShare -**OnionShare** is an open-source tool that lets you securely and [:material-incognito: anonymously](../../../wiki/basics/common-threats/_index.md#anonymity-vs-privacy){ .pg-purple } share a file of any size. It works by starting a web server accessible as a Tor onion service, with an unguessable URL that you can share with the recipients to download or send files. +**OnionShare** is an open-source tool that lets you securely and [:material-incognito: anonymously](../../../wiki/basics/common-threats/index.md#anonymity-vs-privacy){ .pg-purple } share a file of any size. It works by starting a web server accessible as a Tor onion service, with an unguessable URL that you can share with the recipients to download or send files. {{< cards >}} {{< card link="https://onionshare.org" title="Homepage" icon="home" >}} @@ -48,7 +48,7 @@ ffsend upload --host https://send.vis.ee/ FILE [{{< badge content="Windows" color="red" >}}](https://onionshare.org/#download) [{{< badge content="Flathub" >}}](https://flathub.org/apps/org.onionshare.OnionShare) -OnionShare provides the option to connect via [Tor bridges](https://docs.onionshare.org/2.6.2/en/tor.html#automatic-censorship-circumvention) to circumvent [:material-close-outline: Censorship](../../../wiki/basics/common-threats/_index.md#avoiding-censorship){ .pg-blue-gray }. +OnionShare provides the option to connect via [Tor bridges](https://docs.onionshare.org/2.6.2/en/tor.html#automatic-censorship-circumvention) to circumvent [:material-close-outline: Censorship](../../../wiki/basics/common-threats/index.md#avoiding-censorship){ .pg-blue-gray }. ### Criteria diff --git a/content/tools/software/frontends/_index.md b/content/tools/software/frontends/index.md similarity index 83% rename from content/tools/software/frontends/_index.md rename to content/tools/software/frontends/index.md index 182b2b4e2..491ab3c1f 100644 --- a/content/tools/software/frontends/_index.md +++ b/content/tools/software/frontends/index.md @@ -3,13 +3,13 @@ title: "Frontends" description: These open-source frontends for various internet services allow you to access content without JavaScript or other annoyances. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) Sometimes services will try to force you to sign up for an account by blocking access to content with annoying popups. They might also break without JavaScript enabled. These frontends can allow you to circumvent these restrictions. If you choose to self-host these frontends, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting, as other peoples' usage will be linked to your hosting. -When you are using an instance run by someone else, make sure to read the privacy policy of that specific instance (if available). They can be modified by their owners and therefore may not reflect the default policy. Some instances have [Tor](../tor/_index.md) .onion addresses, which may grant some privacy as long as your search queries don't contain personally identifiable information. +When you are using an instance run by someone else, make sure to read the privacy policy of that specific instance (if available). They can be modified by their owners and therefore may not reflect the default policy. Some instances have [Tor](../tor/index.md) .onion addresses, which may grant some privacy as long as your search queries don't contain personally identifiable information.
{{< cards >}} @@ -35,11 +35,11 @@ When you are using an instance run by someone else, make sure to read the privac {{< /cards >}} > [!NOTE] -> The [Old Reddit](https://old.reddit.com) website doesn't require as much JavaScript as the new Reddit website does, but it has recently blocked access to IP addresses reserved for public VPNs. You can use Old Reddit in conjunction with the [Tor](../tor/_index.md) Onion that was [launched in October 2022](https://forum.torproject.org/t/reddit-onion-service-launch/5305) at [https://old.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion](https://old.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion). +> The [Old Reddit](https://old.reddit.com) website doesn't require as much JavaScript as the new Reddit website does, but it has recently blocked access to IP addresses reserved for public VPNs. You can use Old Reddit in conjunction with the [Tor](../tor/index.md) Onion that was [launched in October 2022](https://forum.torproject.org/t/reddit-onion-service-launch/5305) at [https://old.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion](https://old.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion). > [!TIP] -> Redlib is useful if you want to disable JavaScript in your browser, such as [Tor Browser](../tor/_index.md#tor-browser) on the Safest security level. +> Redlib is useful if you want to disable JavaScript in your browser, such as [Tor Browser](../tor/index.md#tor-browser) on the Safest security level. ## TikTok @@ -48,7 +48,7 @@ When you are using an instance run by someone else, make sure to read the privac **ProxiTok** is an open-source frontend to the [TikTok](https://tiktok.com) website that is also self-hostable. -There are a number of public instances, with some that offer a [Tor](../tor/_index.md) onion service or an [I2P](../../advanced/alternative-networks/_index.md#i2p-the-invisible-internet-project) eepsite. +There are a number of public instances, with some that offer a [Tor](../tor/index.md) onion service or an [I2P](../../advanced/alternative-networks/index.md#i2p-the-invisible-internet-project) eepsite. {{< cards >}} {{< card link="https://github.com/pablouser1/ProxiTok#readme" title="Repository" icon="code" >}} @@ -56,7 +56,7 @@ There are a number of public instances, with some that offer a [Tor](../tor/_ind {{< /cards >}} > [!TIP] -> ProxiTok is useful if you want to disable JavaScript in your browser, such as [Tor Browser](../tor/_index.md#tor-browser) on the Safest security level. +> ProxiTok is useful if you want to disable JavaScript in your browser, such as [Tor Browser](../tor/index.md#tor-browser) on the Safest security level. ## YouTube @@ -67,7 +67,7 @@ There are a number of public instances, with some that offer a [Tor](../tor/_ind **Invidious** is a free and open-source frontend for [YouTube](https://youtube.com) that is also self-hostable. -There are a number of public instances, with some that offer a [Tor](../tor/_index.md) onion service or an [I2P](../../advanced/alternative-networks/_index.md#i2p-the-invisible-internet-project) eepsite. +There are a number of public instances, with some that offer a [Tor](../tor/index.md) onion service or an [I2P](../../advanced/alternative-networks/index.md#i2p-the-invisible-internet-project) eepsite. {{< cards >}} {{< card link="https://invidious.io" title="Homepage" icon="home" >}} @@ -79,7 +79,7 @@ There are a number of public instances, with some that offer a [Tor](../tor/_ind > [!TIP] -> Invidious is useful if you want to disable JavaScript in your browser, such as [Tor Browser](../tor/_index.md#tor-browser) on the Safest security level. It does not provide privacy by itself, and we don’t recommend logging into any accounts. +> Invidious is useful if you want to disable JavaScript in your browser, such as [Tor Browser](../tor/index.md#tor-browser) on the Safest security level. It does not provide privacy by itself, and we don’t recommend logging into any accounts. ### Piped @@ -114,7 +114,7 @@ When using FreeTube, your subscription list, playlists, watch history and search [{{< badge content="Flathub" >}}](https://flathub.org/apps/details/io.freetubeapp.FreeTube) > [!WARNING] -> When using FreeTube, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io), or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](../../services/vpn/_index.md) or [Tor](../tor/_index.md) if your [threat model](../../../wiki/basics/threat-modeling/_index.md) requires hiding your IP address. +> When using FreeTube, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io), or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](../../services/vpn/index.md) or [Tor](../tor/index.md) if your [threat model](../../../wiki/basics/threat-modeling/index.md) requires hiding your IP address. By default, FreeTube blocks all YouTube advertisements. In addition, FreeTube optionally integrates with [SponsorBlock](https://sponsor.ajay.app) to help you skip sponsored video segments. @@ -133,7 +133,7 @@ Your subscription list and playlists are saved locally on your Android device. [{{< badge content="GitHub" >}}](https://github.com/libre-tube/LibreTube/releases) > [!WARNING] -> When using LibreTube, your IP address will be visible to YouTube, [Piped](https://github.com/TeamPiped/Piped/wiki/Instances), or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](../../services/vpn/_index.md) or [Tor](../tor/_index.md) if your [threat model](../../../wiki/basics/threat-modeling/_index.md) requires hiding your IP address. +> When using LibreTube, your IP address will be visible to YouTube, [Piped](https://github.com/TeamPiped/Piped/wiki/Instances), or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](../../services/vpn/index.md) or [Tor](../tor/index.md) if your [threat model](../../../wiki/basics/threat-modeling/index.md) requires hiding your IP address. By default, LibreTube blocks all YouTube advertisements. Additionally, LibreTube uses [SponsorBlock](https://sponsor.ajay.app) to help you skip sponsored video segments. You are able to fully configure the types of segments that SponsorBlock will skip, or disable it completely. There is also a button on the video player itself to disable it for a specific video if desired. @@ -154,7 +154,7 @@ Your subscription list and playlists are saved locally on your Android device. 1. The default instance is [FramaTube](https://framatube.org), however more can be added via **Settings** → **Content** → **PeerTube instances**. > [!WARNING] -> When using NewPipe, your IP address will be visible to the video providers used. Consider using a [VPN](../../services/vpn/_index.md) or [Tor](../tor/_index.md) if your [threat model](../../../wiki/basics/threat-modeling/_index.md) requires hiding your IP address. +> When using NewPipe, your IP address will be visible to the video providers used. Consider using a [VPN](../../services/vpn/index.md) or [Tor](../tor/index.md) if your [threat model](../../../wiki/basics/threat-modeling/index.md) requires hiding your IP address. ## Criteria @@ -165,7 +165,7 @@ We only consider frontends if one of the following is true for a platform: - Normally only accessible with JavaScript enabled. - Normally only accessible with an account. -- Blocks access from commercial [VPNs](../../services/vpn/_index.md). +- Blocks access from commercial [VPNs](../../services/vpn/index.md). Recommended frontends... diff --git a/content/tools/software/health-and-wellness/_index.md b/content/tools/software/health-and-wellness/index.md similarity index 99% rename from content/tools/software/health-and-wellness/_index.md rename to content/tools/software/health-and-wellness/index.md index 1c282a4db..3f94ea0fd 100644 --- a/content/tools/software/health-and-wellness/_index.md +++ b/content/tools/software/health-and-wellness/index.md @@ -3,7 +3,7 @@ title: "Health and Wellness" description: These applications are what we currently recommend for all health- and fitness-related activites on your phone. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) Keep track of your health and fitness-related goals with these apps. Unlike their mainstream alternatives, your personal health information will be kept private. diff --git a/content/tools/software/language-tools/_index.md b/content/tools/software/language-tools/index.md similarity index 90% rename from content/tools/software/language-tools/_index.md rename to content/tools/software/language-tools/index.md index 23b2cbf0b..a10622960 100644 --- a/content/tools/software/language-tools/_index.md +++ b/content/tools/software/language-tools/index.md @@ -3,8 +3,8 @@ title: "Language Tools" description: These language tools do not send your input text to a server and can be used offline and self-hosted. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model)
{{< cards >}} @@ -46,7 +46,7 @@ LanguageTool offers integration with a variety of [office suites](https://langua {{< card link="https://github.com/LibreTranslate/LibreTranslate#mirrors" title="Public Instances" icon="server" >}} {{< /cards >}} -You can use LibreTranslate through a number of public instances, with some that offer a [Tor](../tor/_index.md) onion service or an [I2P](../../advanced/alternative-networks/_index.md#i2p-the-invisible-internet-project) eepsite. You can also host the software yourself for maximum control over the text submitted for translation. +You can use LibreTranslate through a number of public instances, with some that offer a [Tor](../tor/index.md) onion service or an [I2P](../../advanced/alternative-networks/index.md#i2p-the-invisible-internet-project) eepsite. You can also host the software yourself for maximum control over the text submitted for translation. We use a self-hosted instance of LibreTranslate to automatically translate posts on our [forum](https://discuss.privacyguides.net) to multiple languages. diff --git a/content/tools/software/maps/_index.md b/content/tools/software/maps/index.md similarity index 98% rename from content/tools/software/maps/_index.md rename to content/tools/software/maps/index.md index 1063fe981..2c6a9aea2 100644 --- a/content/tools/software/maps/_index.md +++ b/content/tools/software/maps/index.md @@ -3,7 +3,7 @@ title: Maps and Navigation description: Privacy-respecting map providers and navigation apps which don't build an advertising profile based on your searches and locations. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model)
{{< cards >}} diff --git a/content/tools/software/mobile-browsers/_index.md b/content/tools/software/mobile-browsers/index.md similarity index 98% rename from content/tools/software/mobile-browsers/_index.md rename to content/tools/software/mobile-browsers/index.md index 66ecbdd36..21202869e 100644 --- a/content/tools/software/mobile-browsers/_index.md +++ b/content/tools/software/mobile-browsers/index.md @@ -3,7 +3,7 @@ title: Mobile Browsers description: These browsers are what we currently recommend for standard/non-anonymous internet browsing on your phone. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model)
{{< cards >}} @@ -13,7 +13,7 @@ description: These browsers are what we currently recommend for standard/non-ano {{< /cards >}}
-These are our currently recommended **mobile web browsers** and configurations for standard/non-anonymous internet browsing. If you need to browse the internet anonymously, you should use [Tor](../tor/_index.md) instead. +These are our currently recommended **mobile web browsers** and configurations for standard/non-anonymous internet browsing. If you need to browse the internet anonymously, you should use [Tor](../tor/index.md) instead. ## Brave @@ -33,7 +33,7 @@ Brave is built upon the Chromium web browser project, so it should feel familiar ### Recommended Brave Configuration -Tor Browser is the only way to truly browse the internet anonymously. When you use Brave, we recommend changing the following settings to protect your privacy from certain parties, but all browsers other than the [Tor Browser](../tor/_index.md#tor-browser) will be traceable by *somebody* in some regard or another. +Tor Browser is the only way to truly browse the internet anonymously. When you use Brave, we recommend changing the following settings to protect your privacy from certain parties, but all browsers other than the [Tor Browser](../tor/index.md#tor-browser) will be traceable by *somebody* in some regard or another. === "Android" diff --git a/content/tools/software/multi-factor-authentication/_index.md b/content/tools/software/multi-factor-authentication/index.md similarity index 97% rename from content/tools/software/multi-factor-authentication/_index.md rename to content/tools/software/multi-factor-authentication/index.md index a4e302d64..5ec655d8e 100644 --- a/content/tools/software/multi-factor-authentication/_index.md +++ b/content/tools/software/multi-factor-authentication/index.md @@ -3,10 +3,10 @@ title: Multifactor Authentication description: These tools assist you with securing your internet accounts with multifactor authentication without sending your secrets to a third party. --- Protects against the following threat(s): -[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/_index.md#attacks-against-specific-individuals) +[{{< badge content="Targeted Attacks" color="red" >}}](../../../wiki/basics/common-threats/index.md#attacks-against-specific-individuals) > [!NOTE] -> [Hardware security key recommendations](../../hardware/security-keys/_index.md) have been moved to their own category. +> [Hardware security key recommendations](../../hardware/security-keys/index.md) have been moved to their own category. **Multifactor authentication apps** implement a security standard adopted by the Internet Engineering Task Force (IETF) called **Time-based One-time Passwords**, or **TOTP**. This is a method where websites share a secret with you which is used by your authenticator app to generate a six (usually) digit code based on the current time, which you enter while logging in for the website to check. Typically, these codes are regenerated every 30 seconds, and once a new code is generated the old one becomes useless. Even if a hacker gets one six-digit code, there is no way for them to reverse that code to get the original secret or otherwise be able to predict what any future codes might be. diff --git a/content/tools/software/news-aggregators/_index.md b/content/tools/software/news-aggregators/index.md similarity index 98% rename from content/tools/software/news-aggregators/_index.md rename to content/tools/software/news-aggregators/index.md index b2051ffe6..987e51a88 100644 --- a/content/tools/software/news-aggregators/_index.md +++ b/content/tools/software/news-aggregators/index.md @@ -3,7 +3,7 @@ title: "News Aggregators" description: These news aggregator clients let you keep up with your favorite blogs and news sites using internet standards like RSS. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) A **news aggregator** is software which aggregates digital content from online newspapers, blogs, podcasts, and other resources to one location for easy viewing. Using one can be a great way to keep up with your favorite content. diff --git a/content/tools/software/notebooks/_index.md b/content/tools/software/notebooks/index.md similarity index 98% rename from content/tools/software/notebooks/_index.md rename to content/tools/software/notebooks/index.md index 71ba554ed..c799f5548 100644 --- a/content/tools/software/notebooks/_index.md +++ b/content/tools/software/notebooks/index.md @@ -3,7 +3,7 @@ title: "Notebooks" description: These encrypted note-taking apps let you keep track of your notes without giving them to a third party. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers) Keep track of your notes and journals without giving them to a third party. @@ -105,7 +105,7 @@ Cryptee is a PWA, which means that it works seamlessly across all modern devices ### Org-mode -**Org-mode** is a [major mode](https://gnu.org/software/emacs/manual/html_node/elisp/Major-Modes.html) for GNU Emacs. Org-mode is for keeping notes, maintaining to-do lists, planning projects, and authoring documents with a fast and effective plain-text system. File synchronization is possible with tools like [Syncthing](../file-sharing/_index.md#syncthing-p2p). +**Org-mode** is a [major mode](https://gnu.org/software/emacs/manual/html_node/elisp/Major-Modes.html) for GNU Emacs. Org-mode is for keeping notes, maintaining to-do lists, planning projects, and authoring documents with a fast and effective plain-text system. File synchronization is possible with tools like [Syncthing](../file-sharing/index.md#syncthing-p2p). {{< cards >}} {{< card link="https://orgmode.org" title="Homepage" icon="home" >}} diff --git a/content/tools/software/office-suites/_index.md b/content/tools/software/office-suites/index.md similarity index 97% rename from content/tools/software/office-suites/_index.md rename to content/tools/software/office-suites/index.md index 68db2bc13..fff9aaa6a 100644 --- a/content/tools/software/office-suites/_index.md +++ b/content/tools/software/office-suites/index.md @@ -3,7 +3,7 @@ title: "Office Suites" description: These office suites offer their full functionality without an account and can be used offline. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers)
{{< cards >}} diff --git a/content/tools/software/passwords/_index.md b/content/tools/software/passwords/index.md similarity index 100% rename from content/tools/software/passwords/_index.md rename to content/tools/software/passwords/index.md diff --git a/content/tools/software/pastebins/_index.md b/content/tools/software/pastebins/index.md similarity index 97% rename from content/tools/software/pastebins/_index.md rename to content/tools/software/pastebins/index.md index 989e7fdce..6d1c1933c 100644 --- a/content/tools/software/pastebins/_index.md +++ b/content/tools/software/pastebins/index.md @@ -3,7 +3,7 @@ title: "Pastebins" description: These tools allow you to have full control of any pasted data you share to other parties. --- Protects against the following threat(s): -[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/_index.md#privacy-from-service-providers) +[{{< badge content="Service Providers" color="indigo" >}}](../../../wiki/basics/common-threats/index.md#privacy-from-service-providers)
{{< cards >}} diff --git a/content/tools/software/social-networks/_index.md b/content/tools/software/social-networks/index.md similarity index 98% rename from content/tools/software/social-networks/_index.md rename to content/tools/software/social-networks/index.md index 5317a9d46..716e5ec06 100644 --- a/content/tools/software/social-networks/_index.md +++ b/content/tools/software/social-networks/index.md @@ -3,8 +3,8 @@ title: Social Networks description: Find a new social network that doesn’t pry into your data or monetize your profile. --- Protects against the following threat(s): -[{{< badge content="Censorship" >}}](../../../wiki/basics/common-threats/_index.md#avoiding-censorship) -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) +[{{< badge content="Censorship" >}}](../../../wiki/basics/common-threats/index.md#avoiding-censorship) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model)
{{< cards >}} @@ -19,7 +19,7 @@ A growing problem among social media platforms is censorship in two different fo The social networks we recommend solve the issue of censorship by operating atop an open and decentralized social networking protocol. They also don't require an account merely to view publicly available content. -You should note that **no** social networks are appropriate for private or sensitive communications. For chatting directly with others, you should use a recommended [instant messenger](../../services/messengers/_index.md) with strong end-to-end encryption, and only use direct messages on social media in order to establish a more private and secure chat platform with your contacts. +You should note that **no** social networks are appropriate for private or sensitive communications. For chatting directly with others, you should use a recommended [instant messenger](../../services/messengers/index.md) with strong end-to-end encryption, and only use direct messages on social media in order to establish a more private and secure chat platform with your contacts. ## Decentralization @@ -183,8 +183,8 @@ With this setting enabled, unverified users (i.e., those who have not used the * - Must be free and open-source software. - Must use a federated protocol to communicate with other instances of the social networking software. - Must not have non-technical restrictions on who can be federated with. -- Must be usable within a standard [web browser](../desktop-browsers/_index.md). +- Must be usable within a standard [web browser](../desktop-browsers/index.md). - Must make public content accessible to visitors without an account. - Must allow you to limit who can follow your profile. - Must allow you to post content visible only to your followers. -- Must support modern web application security standards/features (including [multifactor authentication](../multi-factor-authentication/_index.md)). +- Must support modern web application security standards/features (including [multifactor authentication](../multi-factor-authentication/index.md)). diff --git a/content/tools/software/tor/_index.md b/content/tools/software/tor/index.md similarity index 83% rename from content/tools/software/tor/_index.md rename to content/tools/software/tor/index.md index 56b78a14d..c2201f493 100644 --- a/content/tools/software/tor/_index.md +++ b/content/tools/software/tor/index.md @@ -3,26 +3,26 @@ title: "Tor Browser" description: Protect your internet browsing from prying eyes by using the Tor network, a secure network which circumvents censorship. --- Protects against the following threat(s): -[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/_index.md#surveillance-as-a-business-model) -[{{< badge content="Mass Surveillance" color="blue" >}}](../../../wiki/basics/common-threats/_index.md#mass-surveillance-programs) -[{{< badge content="Censorship" >}}](../../../wiki/basics/common-threats/_index.md#avoiding-censorship) +[{{< badge content="Surveillance Capitalism" color="purple" >}}](../../../wiki/basics/common-threats/index.md#surveillance-as-a-business-model) +[{{< badge content="Mass Surveillance" color="blue" >}}](../../../wiki/basics/common-threats/index.md#mass-surveillance-programs) +[{{< badge content="Censorship" >}}](../../../wiki/basics/common-threats/index.md#avoiding-censorship) **Tor** is a group of volunteer-operated servers that allows you to connect for free and improve your privacy and security on the Internet. Individuals and organizations can also share information over the Tor network with ".onion hidden services" without compromising their privacy. Because Tor traffic is difficult to block and trace, Tor is an effective censorship circumvention tool. -[Detailed Tor Overview :material-arrow-right-drop-circle:](../../../wiki/advanced/tor-overview/_index.md) +[Detailed Tor Overview :material-arrow-right-drop-circle:](../../../wiki/advanced/tor-overview/index.md) { .md-button .md-button--primary } [:material-movie-open-play-outline: Video: Why You Need Tor](https://www.privacyguides.org/videos/2025/03/02/why-you-need-tor) { .md-button } > [!TIP] -> Before connecting to Tor, please ensure you've read our [overview](../../../wiki/advanced/tor-overview/_index.md) on what Tor is and how to connect to it safely. We often recommend connecting to Tor through a trusted [VPN provider](../../services/vpn/_index.md), but you have to do so **properly** to avoid decreasing your anonymity. +> Before connecting to Tor, please ensure you've read our [overview](../../../wiki/advanced/tor-overview/index.md) on what Tor is and how to connect to it safely. We often recommend connecting to Tor through a trusted [VPN provider](../../services/vpn/index.md), but you have to do so **properly** to avoid decreasing your anonymity. -There are a variety of ways to connect to the Tor network from your device, the most commonly used being the **Tor Browser**, a fork of Firefox designed for [:material-incognito: anonymous](../../../wiki/basics/common-threats/_index.md#anonymity-vs-privacy){ .pg-purple } browsing for desktop computers and Android. +There are a variety of ways to connect to the Tor network from your device, the most commonly used being the **Tor Browser**, a fork of Firefox designed for [:material-incognito: anonymous](../../../wiki/basics/common-threats/index.md#anonymity-vs-privacy){ .pg-purple } browsing for desktop computers and Android. Some of these apps are better than others; making a determination comes down to your threat model. If you are a casual Tor user who is not worried about your ISP collecting evidence against you, using mobile browser apps like [Onion Browser](#onion-browser-ios) to access the Tor network is probably fine. Increasing the number of people who use Tor on an everyday basis helps reduce the bad stigma of Tor, and lowers the quality of "lists of Tor users" that ISPs and governments may compile. -If more complete anonymity is paramount to your situation, you should **only** be using the desktop Tor Browser client, ideally in a [Whonix](../../os/desktop/_index.md#whonix) + [Qubes](../../os/desktop/_index.md#qubes-os) configuration. Mobile browsers are less common on Tor (and more fingerprintable as a result), and other configurations are not as rigorously tested against deanonymization. +If more complete anonymity is paramount to your situation, you should **only** be using the desktop Tor Browser client, ideally in a [Whonix](../../os/desktop/index.md#whonix) + [Qubes](../../os/desktop/index.md#qubes-os) configuration. Mobile browsers are less common on Tor (and more fingerprintable as a result), and other configurations are not as rigorously tested against deanonymization.
{{< cards >}} @@ -51,7 +51,7 @@ If more complete anonymity is paramount to your situation, you should **only** b The Tor Browser is designed to prevent fingerprinting, or identifying you based on your browser configuration. Therefore, it is imperative that you do **not** modify the browser beyond the default [security levels](https://tb-manual.torproject.org/security-settings). When modifying the security level setting, you **must** always restart the browser before continuing to use it. Otherwise, [the security settings may not be fully applied](https://www.privacyguides.org/articles/2025/05/02/tor-security-slider-flaw), putting you at a higher risk of fingerprinting and exploits than you may expect based on the setting chosen. -In addition to installing Tor Browser on your computer directly, there are also operating systems designed specifically to connect to the Tor network such as [Whonix](../../os/desktop/_index.md#whonix) on [Qubes OS](../../os/desktop/_index.md#qubes-os), which provide even greater security and protections than the standard Tor Browser alone. +In addition to installing Tor Browser on your computer directly, there are also operating systems designed specifically to connect to the Tor network such as [Whonix](../../os/desktop/index.md#whonix) on [Qubes OS](../../os/desktop/index.md#qubes-os), which provide even greater security and protections than the standard Tor Browser alone. ## Onion Browser (iOS) @@ -68,4 +68,4 @@ In addition to installing Tor Browser on your computer directly, there are also Onion Browser does not provide the same levels of privacy protections as Tor Browser does on desktop platforms. For casual use it is a perfectly fine way to access hidden services, but if you're concerned about being traced or monitored by advanced adversaries you should not rely on this as an anonymity tool. -[Notably](https://github.com/privacyguides/privacyguides.org/issues/2929), Onion Browser does not *guarantee* all requests go through Tor. When using the built-in version of Tor, [your real IP **will** be leaked via WebRTC and audio/video streams](https://onionbrowser.com/faqs) due to limitations of WebKit. It is *safer* to use Onion Browser alongside [Orbot](../../advanced/alternative-networks/_index.md#orbot), but this still comes with some limitations on iOS. +[Notably](https://github.com/privacyguides/privacyguides.org/issues/2929), Onion Browser does not *guarantee* all requests go through Tor. When using the built-in version of Tor, [your real IP **will** be leaked via WebRTC and audio/video streams](https://onionbrowser.com/faqs) due to limitations of WebKit. It is *safer* to use Onion Browser alongside [Orbot](../../advanced/alternative-networks/index.md#orbot), but this still comes with some limitations on iOS. diff --git a/content/wiki/_index.md b/content/wiki/_index.md index fd49103a5..a937159e8 100644 --- a/content/wiki/_index.md +++ b/content/wiki/_index.md @@ -11,7 +11,7 @@ Welcome to our **Privacy Wiki**! Here, the Privacy Guides community is building *the* comprehensive resource for understanding digital privacy, the threats we face, and the tools we can use to protect ourselves. This wiki is a living document, and we encourage you to contribute if you have something to add. -This is a selection of featured pages, but you can browse the sidebar for more topics, or use the search bar to find something specific. If you're looking for somewhere to start, start [here](basics/why-privacy-matters/_index.md) to learn about why privacy is important, and then check out our [threat modeling guide](basics/threat-modeling/_index.md) to learn how to make informed decisions about the software and services you use. +This is a selection of featured pages, but you can browse the sidebar for more topics, or use the search bar to find something specific. If you're looking for somewhere to start, start [here](basics/why-privacy-matters/index.md) to learn about why privacy is important, and then check out our [threat modeling guide](basics/threat-modeling/index.md) to learn how to make informed decisions about the software and services you use. ## Getting Started diff --git a/content/wiki/advanced/communication-networks/_index.md b/content/wiki/advanced/communication-networks/index.md similarity index 89% rename from content/wiki/advanced/communication-networks/_index.md rename to content/wiki/advanced/communication-networks/index.md index 4c86f8bd7..e770b7c7d 100644 --- a/content/wiki/advanced/communication-networks/_index.md +++ b/content/wiki/advanced/communication-networks/index.md @@ -4,9 +4,9 @@ weight: 40 description: An overview of several network architectures commonly used by instant messaging applications. --- -There are several network architectures commonly used to relay messages between people. These networks can provide different privacy guarantees, which is why it's worth considering your [threat model](../../basics/threat-modeling/_index.md) when deciding which app to use. +There are several network architectures commonly used to relay messages between people. These networks can provide different privacy guarantees, which is why it's worth considering your [threat model](../../basics/threat-modeling/index.md) when deciding which app to use. -- [Recommended Instant Messengers](../../../tools/services/messengers/_index.md) +- [Recommended Instant Messengers](../../../tools/services/messengers/index.md) - [Video: It's time to stop using SMS](https://www.privacyguides.org/videos/2025/01/24/its-time-to-stop-using-sms-heres-why) ## Centralized Networks @@ -78,7 +78,7 @@ P2P networks do not use servers, as peers communicate directly between each othe - Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online. - Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network to learn about who is online. - Some common messenger features may not be implemented or incompletely, such as message deletion. -- Your IP address and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a [VPN](../../../tools/services/vpn/_index.md) or [Tor](../../../tools/software/tor/_index.md). Many countries have some form of mass surveillance and/or metadata retention. +- Your IP address and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a [VPN](../../../tools/services/vpn/index.md) or [Tor](../../../tools/software/tor/index.md). Many countries have some form of mass surveillance and/or metadata retention. ## Anonymous Routing @@ -86,7 +86,7 @@ P2P networks do not use servers, as peers communicate directly between each othe A messenger using [anonymous routing](https://doi.org/10.1007/978-1-4419-5906-5_628) hides either the identity of the sender, the receiver, or evidence that they have been communicating. Ideally, a messenger should hide all three. -There are [many](https://doi.org/10.1145/3182658) ways to implement anonymous routing. One of the most famous is [onion routing](https://en.wikipedia.org/wiki/Onion_routing) (i.e. [Tor](../tor-overview/_index.md)), which communicates encrypted messages through a virtual [overlay network](https://en.wikipedia.org/wiki/Overlay_network) that hides the location of each node as well as the recipient and sender of each message. The sender and recipient never interact directly and only meet through a secret rendezvous node so that there is no leak of IP addresses nor physical location. Nodes cannot decrypt messages, nor the final destination; only the recipient can. Each intermediary node can only decrypt a part that indicates where to send the still encrypted message next, until it arrives at the recipient who can fully decrypt it, hence the "onion layers." +There are [many](https://doi.org/10.1145/3182658) ways to implement anonymous routing. One of the most famous is [onion routing](https://en.wikipedia.org/wiki/Onion_routing) (i.e. [Tor](../tor-overview/index.md)), which communicates encrypted messages through a virtual [overlay network](https://en.wikipedia.org/wiki/Overlay_network) that hides the location of each node as well as the recipient and sender of each message. The sender and recipient never interact directly and only meet through a secret rendezvous node so that there is no leak of IP addresses nor physical location. Nodes cannot decrypt messages, nor the final destination; only the recipient can. Each intermediary node can only decrypt a part that indicates where to send the still encrypted message next, until it arrives at the recipient who can fully decrypt it, hence the "onion layers." Self-hosting a node in an anonymous routing network does not provide the host with additional privacy benefits, but rather contributes to the whole network's resilience against identification attacks for everyone's benefit. diff --git a/content/wiki/advanced/dns-overview/_index.md b/content/wiki/advanced/dns-overview/index.md similarity index 97% rename from content/wiki/advanced/dns-overview/_index.md rename to content/wiki/advanced/dns-overview/index.md index d1d19f44d..f5f1117d8 100644 --- a/content/wiki/advanced/dns-overview/_index.md +++ b/content/wiki/advanced/dns-overview/index.md @@ -83,7 +83,7 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be [**DNS over HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS), as defined in [RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484), packages queries in the [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) protocol and provides security with HTTPS. Support was first added in web browsers such as Firefox 60 and Chrome 83. -Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../../../tools/services/dns/_index.md#encrypted-dns-proxies). +Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../../../tools/services/dns/index.md#encrypted-dns-proxies). ### Native Operating System Support @@ -101,7 +101,7 @@ Apple does not provide a native interface for creating encrypted DNS profiles. [ #### Linux -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](../../../tools/services/dns/_index.md#dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](../../../tools/services/dns/index.md#dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. ## What can an outside party see? @@ -131,7 +131,7 @@ We can see the [connection establishment](https://en.wikipedia.org/wiki/Transmis ## Why **shouldn't** I use encrypted DNS? -In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](../../basics/threat-modeling/_index.md). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](../tor-overview/_index.md) or a [VPN](../../../tools/services/vpn/_index.md) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity. +In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](../../basics/threat-modeling/index.md). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](../tor-overview/index.md) or a [VPN](../../../tools/services/vpn/index.md) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity. When we do a DNS lookup, it's generally because we want to access a resource. Below, we will discuss some of the methods that may disclose your browsing activities even when using encrypted DNS: @@ -299,7 +299,7 @@ graph TB Encrypted DNS with a third party should only be used to get around redirects and basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences, or you're interested in a provider that does some rudimentary filtering. -[List of recommended DNS servers](../../../tools/services/dns/_index.md){ .md-button } +[List of recommended DNS servers](../../../tools/services/dns/index.md){ .md-button } ## What is DNSSEC? diff --git a/content/wiki/advanced/payments/_index.md b/content/wiki/advanced/payments/index.md similarity index 86% rename from content/wiki/advanced/payments/_index.md rename to content/wiki/advanced/payments/index.md index 6b66f2fc5..bb4c4fd94 100644 --- a/content/wiki/advanced/payments/_index.md +++ b/content/wiki/advanced/payments/index.md @@ -27,17 +27,17 @@ Cash remains the best option for in-person purchases for most people. Gift cards ### Online Marketplaces -If you have [cryptocurrency](../../../tools/software/cryptocurrency/_index.md), you can purchase gift cards with an online gift card marketplace. Some of these services offer high limits (with ID verification), but they usually allow basic, low-limit accounts with just an email address. Expect limits under $10,000 for basic accounts and significantly higher limits for ID verified accounts (if offered). +If you have [cryptocurrency](../../../tools/software/cryptocurrency/index.md), you can purchase gift cards with an online gift card marketplace. Some of these services offer high limits (with ID verification), but they usually allow basic, low-limit accounts with just an email address. Expect limits under $10,000 for basic accounts and significantly higher limits for ID verified accounts (if offered). When buying gift cards online, there is usually a slight discount. Prepaid cards are usually sold online at face value or with a fee. If you buy prepaid cards and gift cards with cryptocurrencies, you should strongly prefer to pay with Monero which provides strong privacy (more on this below). Paying for a gift card with a traceable payment method negates the benefits a gift card can provide when purchased with cash or Monero. -- [Online Gift Card Marketplaces :material-arrow-right-drop-circle:](../../../tools/services/financial-services/_index.md#gift-card-marketplaces) +- [Online Gift Card Marketplaces :material-arrow-right-drop-circle:](../../../tools/services/financial-services/index.md#gift-card-marketplaces) ## Virtual Cards Another way to protect your information from merchants online is to use virtual, single-use cards which mask your actual banking or billing information. This is primarily useful for protecting you from merchant data breaches, less sophisticated tracking or purchase correlation by marketing agencies, and online data theft. They do **not** assist you in making a purchase completely anonymously, nor do they hide any information from the banking institution themselves. Regular financial institutions which offer virtual cards are subject to "Know Your Customer" (KYC) laws, meaning they may require your ID or other identifying information. -- [Recommended Payment Masking Services :material-arrow-right-drop-circle:](../../../tools/services/financial-services/_index.md#payment-masking-services) +- [Recommended Payment Masking Services :material-arrow-right-drop-circle:](../../../tools/services/financial-services/index.md#payment-masking-services) These tend to be good options for recurring/subscription payments online, while prepaid gift cards are preferred for one-time transactions. @@ -59,7 +59,7 @@ Additionally, many if not most cryptocurrencies are scams. Make transactions car There are a number of cryptocurrency projects which purport to provide privacy by making transactions anonymous. We recommend using one which provides transaction anonymity **by default** to avoid operational errors. -- [Recommended Cryptocurrency :material-arrow-right-drop-circle:](../../../tools/software/cryptocurrency/_index.md#monero) +- [Recommended Cryptocurrency :material-arrow-right-drop-circle:](../../../tools/software/cryptocurrency/index.md#monero) Privacy coins have been subject to increasing scrutiny by government agencies. In 2020, [the IRS published a $625,000 bounty](https://forbes.com/sites/kellyphillipserb/2020/09/14/irs-will-pay-up-to-625000-if-you-can-crack-monero-other-privacy-coins/?sh=2e9808a085cc) for tools which can trace (at least to some extent) Bitcoin Lightning Network and/or Monero transactions. They ultimately [paid two companies](https://sam.gov/opp/5ab94eae1a8d422e88945b64181c6018/view) (Chainalysis and Integra Fec) a combined $1.25 million to further develop tools to do so. Due to the secrecy surrounding tools like these, none of these methods of tracing cryptocurrencies have been independently confirmed. However, it is quite likely that tools which assist targeted investigations into private coin transactions exist, and that privacy coins in their current form only succeed in thwarting mass surveillance. @@ -77,9 +77,9 @@ With cryptocurrency there are two forms of wallets: custodial wallets and self-c ### Acquisition -Acquiring [cryptocurrencies](../../../tools/software/cryptocurrency/_index.md) like Monero privately can be difficult. P2P marketplaces (platforms which facilitate trades between people) are one option, though the user experience typically suffers. If using an exchange which requires KYC is acceptable for you as long as subsequent transactions can't be traced, it's much easier to purchase Monero on a centralized exchange or purchase Bitcoin/Litecoin from a KYC exchange which can then be swapped for Monero. Then, you can withdraw the purchased Monero to your own self-custody wallet to use privately from that point forward. +Acquiring [cryptocurrencies](../../../tools/software/cryptocurrency/index.md) like Monero privately can be difficult. P2P marketplaces (platforms which facilitate trades between people) are one option, though the user experience typically suffers. If using an exchange which requires KYC is acceptable for you as long as subsequent transactions can't be traced, it's much easier to purchase Monero on a centralized exchange or purchase Bitcoin/Litecoin from a KYC exchange which can then be swapped for Monero. Then, you can withdraw the purchased Monero to your own self-custody wallet to use privately from that point forward. -[Recommended places to buy Monero](../../../tools/software/cryptocurrency/_index.md#buying-monero){ .md-button } +[Recommended places to buy Monero](../../../tools/software/cryptocurrency/index.md#buying-monero){ .md-button } If you go this route, make sure to purchase Monero at different times and in different amounts than where you will spend it. If you purchase $5000 of Monero at an exchange and make a $5000 purchase in Monero an hour later, those actions could potentially be correlated by an outside observer regardless of which path the Monero took. Staggering purchases and purchasing larger amounts of Monero in advance to later spend on multiple smaller transactions can avoid this pitfall. @@ -87,7 +87,7 @@ If you go this route, make sure to purchase Monero at different times and in dif When you're making a payment in person with cash, make sure to keep your in-person privacy in mind. Security cameras are ubiquitous. Consider wearing non-distinct clothing and a face mask (such as a surgical mask or N95). Don’t sign up for rewards programs or provide any other information about yourself. -When purchasing online, ideally you should do so over [Tor](../tor-overview/_index.md). However, many merchants don’t allow purchases with Tor. You can consider using a [recommended VPN](../../../tools/services/vpn/_index.md) (paid for with cash, gift card, or Monero), or making the purchase from a coffee shop or library with free Wi-Fi. If you are ordering a physical item that needs to be delivered, you will need to provide a delivery address. You should consider using a PO box, private mailbox, or work address. +When purchasing online, ideally you should do so over [Tor](../tor-overview/index.md). However, many merchants don’t allow purchases with Tor. You can consider using a [recommended VPN](../../../tools/services/vpn/index.md) (paid for with cash, gift card, or Monero), or making the purchase from a coffee shop or library with free Wi-Fi. If you are ordering a physical item that needs to be delivered, you will need to provide a delivery address. You should consider using a PO box, private mailbox, or work address.
diff --git a/content/wiki/advanced/tor-overview/_index.md b/content/wiki/advanced/tor-overview/index.md similarity index 94% rename from content/wiki/advanced/tor-overview/_index.md rename to content/wiki/advanced/tor-overview/index.md index 87f65354a..3d4fe4222 100644 --- a/content/wiki/advanced/tor-overview/_index.md +++ b/content/wiki/advanced/tor-overview/index.md @@ -6,7 +6,7 @@ description: Tor is a free to use, decentralized network designed for using the ![Tor logo](tor.svg) -[**Tor**](../../../tools/advanced/alternative-networks/_index.md#tor) is a free to use, decentralized network designed for using the internet with as much privacy as possible. If used properly, the network enables private and anonymous browsing and communications. Because Tor traffic is difficult to block and trace, Tor is an effective censorship circumvention tool. +[**Tor**](../../../tools/advanced/alternative-networks/index.md#tor) is a free to use, decentralized network designed for using the internet with as much privacy as possible. If used properly, the network enables private and anonymous browsing and communications. Because Tor traffic is difficult to block and trace, Tor is an effective censorship circumvention tool. [:material-movie-open-play-outline: Video: Why You Need Tor](https://www.privacyguides.org/videos/2025/03/02/why-you-need-tor) @@ -22,20 +22,20 @@ Tor works by routing your internet traffic through volunteer-operated servers in Before connecting to Tor, you should carefully consider what you're looking to accomplish by using Tor in the first place, and who you're trying to hide your network activity from. -If you live in a free country, are accessing mundane content via Tor, aren't worried about your ISP or local network administrators having the knowledge that you're using Tor, and want to help [destigmatize](https://2019.www.torproject.org/about/torusers.html.en) Tor usage, you can likely connect to Tor directly via standard means like [Tor Browser](../../../tools/software/tor/_index.md) without worry. +If you live in a free country, are accessing mundane content via Tor, aren't worried about your ISP or local network administrators having the knowledge that you're using Tor, and want to help [destigmatize](https://2019.www.torproject.org/about/torusers.html.en) Tor usage, you can likely connect to Tor directly via standard means like [Tor Browser](../../../tools/software/tor/index.md) without worry. If you have the ability to access a trusted VPN provider and **any** of the following are true, you almost certainly should connect to Tor through a VPN: -- You already use a [trusted VPN provider](../../../tools/services/vpn/_index.md) +- You already use a [trusted VPN provider](../../../tools/services/vpn/index.md) - Your threat model includes an adversary which is capable of extracting information from your ISP - Your threat model includes your ISP itself as an adversary - Your threat model includes local network administrators before your ISP as an adversary -Because we already [generally recommend](../../basics/vpn-overview/_index.md) that the vast majority of people use a trusted VPN provider for a variety of reasons, the following recommendation about connecting to Tor via a VPN likely applies to you. There is no need to disable your VPN before connecting to Tor, as some online resources would lead you to believe. +Because we already [generally recommend](../../basics/vpn-overview/index.md) that the vast majority of people use a trusted VPN provider for a variety of reasons, the following recommendation about connecting to Tor via a VPN likely applies to you. There is no need to disable your VPN before connecting to Tor, as some online resources would lead you to believe. Connecting directly to Tor will make your connection stand out to any local network administrators or your ISP. Detecting and correlating this traffic [has been done](https://edition.cnn.com/2013/12/17/justice/massachusetts-harvard-hoax) in the past by network administrators to identify and deanonymize specific Tor users on their network. On the other hand, connecting to a VPN is almost always less suspicious, because commercial VPN providers are used by everyday consumers for a variety of mundane tasks like bypassing geo-restrictions, even in countries with heavy internet restrictions. -Therefore, you should make an effort to hide your IP address **before** connecting to the Tor network. You can do this by simply connecting to a VPN (through a client installed on your computer) and then accessing [Tor](../../../tools/software/tor/_index.md) as normal (e.g., through Tor Browser). This creates a connection chain like so: +Therefore, you should make an effort to hide your IP address **before** connecting to the Tor network. You can do this by simply connecting to a VPN (through a client installed on your computer) and then accessing [Tor](../../../tools/software/tor/index.md) as normal (e.g., through Tor Browser). This creates a connection chain like so: - [x] You → VPN → Tor → Internet @@ -100,13 +100,13 @@ Additionally, Tor Browser is based on Firefox's Extended Support Release builds, 1. Look for new Critical/High vulnerabilities in Firefox nightly or beta builds, then check if they are exploitable in Tor Browser (this vulnerability period can last weeks). 2. Chain *multiple* Medium/Low vulnerabilities together until they get the level of access they're looking for (this vulnerability period can last months or longer). -Those at risk of browser vulnerabilities should consider additional protections to defend against Tor Browser exploits, such as using Whonix in [Qubes](../../os/qubes/_index.md) to contain your Tor browsing in a secure virtual machine and protect against leaks. +Those at risk of browser vulnerabilities should consider additional protections to defend against Tor Browser exploits, such as using Whonix in [Qubes](../../os/qubes/index.md) to contain your Tor browsing in a secure virtual machine and protect against leaks. ## Path Building to Clearnet Services "Clearnet services" are websites which you can access with any browser, like [privacyguides.org](https://www.privacyguides.org). Tor lets you connect to these websites anonymously by routing your traffic through a network comprised of thousands of volunteer-run servers called nodes (or relays). -Every time you [connect to Tor](../../../tools/software/tor/_index.md), it will choose three nodes to build a path to the internet—this path is called a "circuit." +Every time you [connect to Tor](../../../tools/software/tor/index.md), it will choose three nodes to build a path to the internet—this path is called a "circuit."
![Tor path showing your device connecting to an entry node, middle node, and exit node before reaching the destination website](tor-path.svg#only-light) @@ -184,7 +184,7 @@ Though Tor does provide strong privacy guarantees, one must be aware that Tor is If you wish to use Tor for browsing the web, we only recommend the **official** Tor Browser—it is designed to prevent fingerprinting. -- [Tor Browser :material-arrow-right-drop-circle:](../../../tools/software/tor/_index.md#tor-browser) +- [Tor Browser :material-arrow-right-drop-circle:](../../../tools/software/tor/index.md#tor-browser) ### Protections provided by bridges diff --git a/content/wiki/basics/account-creation/_index.md b/content/wiki/basics/account-creation/index.md similarity index 95% rename from content/wiki/basics/account-creation/_index.md rename to content/wiki/basics/account-creation/index.md index 1158ea8f1..36db68c79 100644 --- a/content/wiki/basics/account-creation/_index.md +++ b/content/wiki/basics/account-creation/index.md @@ -9,7 +9,7 @@ Often people sign up for services without thinking. Maybe it's a streaming servi There are risks associated with every new service that you use. Data breaches; disclosure of customer information to third parties; rogue employees accessing data; all are possibilities that must be considered when giving your information out. You need to be confident that you can trust the service, which is why we don't recommend storing valuable data on anything but the most mature and battle-tested products. That usually means services which provide E2EE and have undergone a cryptographic audit. An audit increases assurance that the product was designed without glaring security issues caused by an inexperienced developer. -It can also be difficult to delete the accounts on some services. Sometimes [overwriting data](../account-deletion/_index.md#overwriting-account-information) associated with an account can be possible, but in other cases the service will keep an entire history of changes to the account. +It can also be difficult to delete the accounts on some services. Sometimes [overwriting data](../account-deletion/index.md#overwriting-account-information) associated with an account can be possible, but in other cases the service will keep an entire history of changes to the account. ## Terms of Service & Privacy Policy @@ -27,15 +27,15 @@ There are usually multiple ways to sign up for an account, each with their own b ### Email and password -The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](../passwords-overview/_index.md) regarding passwords. +The most common way to create a new account is by an email address and password. When using this method, you should use a password manager and follow [best practices](../passwords-overview/index.md) regarding passwords. > [!TIP] > You can use your password manager to organize other authentication methods too! Just add the new entry and fill the appropriate fields, you can add notes for things like security questions or a backup key. -You will be responsible for managing your login credentials. For added security, you can set up [MFA](../multi-factor-authentication/_index.md) on your accounts. +You will be responsible for managing your login credentials. For added security, you can set up [MFA](../multi-factor-authentication/index.md) on your accounts. -[Recommended password managers](../../../tools/software/passwords/_index.md){ .md-button } +[Recommended password managers](../../../tools/software/passwords/index.md){ .md-button } #### Email aliases @@ -43,7 +43,7 @@ If you don't want to give your real email address to a service, you have the opt Should a service get hacked, you might start receiving phishing or spam emails to the address you used to sign up. Using unique aliases for each service can assist in identifying exactly what service was hacked. -[Recommended email aliasing services](../../../tools/services/email-aliasing/_index.md){ .md-button } +[Recommended email aliasing services](../../../tools/services/email-aliasing/index.md){ .md-button } ### "Sign in with..." (OAuth) @@ -61,7 +61,7 @@ But there are disadvantages: - **Privacy**: The OAuth provider you log in with will know the services you use. - **Centralization**: If the account you use for OAuth is compromised, or you aren't able to log in to it, all other accounts connected to it are affected. -OAuth can be especially useful in those situations where you could benefit from deeper integration between services. Our recommendation is to limit using OAuth to only where you need it, and always protect the main account with [MFA](../multi-factor-authentication/_index.md). +OAuth can be especially useful in those situations where you could benefit from deeper integration between services. Our recommendation is to limit using OAuth to only where you need it, and always protect the main account with [MFA](../multi-factor-authentication/index.md). All the services that use OAuth will be as secure as your underlying OAuth provider's account. For example, if you want to secure an account with a hardware key, but that service doesn't support hardware keys, you can secure the account you use with OAuth with a hardware key instead, and now you essentially have hardware MFA on all your accounts. It is worth noting though that weak authentication on your OAuth provider account means that any account tied to that login will also be weak. diff --git a/content/wiki/basics/account-deletion/_index.md b/content/wiki/basics/account-deletion/index.md similarity index 93% rename from content/wiki/basics/account-deletion/_index.md rename to content/wiki/basics/account-deletion/index.md index 7d2d8d1d8..b22625b4f 100644 --- a/content/wiki/basics/account-deletion/_index.md +++ b/content/wiki/basics/account-deletion/index.md @@ -43,13 +43,13 @@ Residents of the EEA have additional rights regarding data erasure specified in In some situations where you plan to abandon an account, it may make sense to overwrite the account information with fake data. Once you've made sure you can log in, change all the information in your account to falsified information. The reason for this is that many sites will retain information you previously had even after account deletion. The hope is that they will overwrite the previous information with the newest data you entered. However, there is no guarantee that there won't be backups with the prior information. -For the account email, either create a new alternate email account via your provider of choice or create an alias using an [email aliasing service](../../../tools/services/email-aliasing/_index.md). You can then delete your alternate email address once you are done. We recommend against using temporary email providers, as oftentimes it is possible to reactivate temporary emails. +For the account email, either create a new alternate email account via your provider of choice or create an alias using an [email aliasing service](../../../tools/services/email-aliasing/index.md). You can then delete your alternate email address once you are done. We recommend against using temporary email providers, as oftentimes it is possible to reactivate temporary emails. ### Delete You can check [JustDeleteMe](https://justdeleteme.xyz) for instructions on deleting the account for a specific service. Some sites will graciously have a "Delete Account" option, while others will go as far as to force you to speak with a support agent. The deletion process can vary from site to site, with account deletion being impossible on some. -For services that don't allow account deletion, the best thing to do is falsify all your information as previously mentioned and strengthen account security. To do so, enable [MFA](../multi-factor-authentication/_index.md) and any extra security features offered. As well, change the password to a randomly-generated one that is the maximum allowed size (a [password manager](../../../tools/software/passwords/_index.md) can be useful for this). +For services that don't allow account deletion, the best thing to do is falsify all your information as previously mentioned and strengthen account security. To do so, enable [MFA](../multi-factor-authentication/index.md) and any extra security features offered. As well, change the password to a randomly-generated one that is the maximum allowed size (a [password manager](../../../tools/software/passwords/index.md) can be useful for this). If you're satisfied that all information you care about is removed, you can safely forget about this account. If not, it might be a good idea to keep the credentials stored with your other passwords and occasionally re-login to reset the password. diff --git a/content/wiki/basics/common-misconceptions/_index.md b/content/wiki/basics/common-misconceptions/index.md similarity index 88% rename from content/wiki/basics/common-misconceptions/_index.md rename to content/wiki/basics/common-misconceptions/index.md index 7fc7d73af..1eb4a3e00 100644 --- a/content/wiki/basics/common-misconceptions/_index.md +++ b/content/wiki/basics/common-misconceptions/index.md @@ -8,7 +8,7 @@ description: Privacy isn't a straightforward topic, and it's easy to get caught These myths stem from a number of prejudices, but whether the source code is available and how software is licensed does not inherently affect its security in any way. Open-source software has the *potential* to be more secure than proprietary software, but there is absolutely no guarantee this is the case. When you evaluate software, you should look at the reputation and security of each tool on an individual basis. -Open-source software *can* be audited by third-parties, and is often more transparent about potential vulnerabilities than proprietary counterparts. It also allows you to review the code and disable any suspicious functionality you find yourself. However, *unless you do so*, there is no guarantee that code has ever been evaluated, especially with smaller software projects. The open development process has also sometimes been exploited to introduce new vulnerabilities known as [:material-package-variant-closed-remove: Supply Chain Attacks](../common-threats/_index.md#attacks-against-certain-organizations){ .pg-viridian }, which are discussed further in our [Common Threats](../common-threats/_index.md) page.[^1] +Open-source software *can* be audited by third-parties, and is often more transparent about potential vulnerabilities than proprietary counterparts. It also allows you to review the code and disable any suspicious functionality you find yourself. However, *unless you do so*, there is no guarantee that code has ever been evaluated, especially with smaller software projects. The open development process has also sometimes been exploited to introduce new vulnerabilities known as [:material-package-variant-closed-remove: Supply Chain Attacks](../common-threats/index.md#attacks-against-certain-organizations){ .pg-viridian }, which are discussed further in our [Common Threats](../common-threats/index.md) page.[^1] On the flip side, proprietary software is less transparent, but that doesn't imply that it's not secure. Major proprietary software projects can be audited internally and by third-party agencies, and independent security researchers can still find vulnerabilities with techniques like reverse engineering. @@ -23,7 +23,7 @@ We talk about "shifting trust" a lot when discussing solutions like VPNs (which ## "Privacy-focused solutions are inherently trustworthy" -Focusing solely on the privacy policies and marketing of a tool or provider can blind you to its weaknesses. When you're looking for a more private solution, you should determine what the underlying problem is and find technical solutions to that problem. For example, you may want to avoid Google Drive, which gives Google access to all of your data. The underlying problem in this case is lack of E2EE, so you should make sure that the provider you switch to actually implements E2EE, or use a tool (like [Cryptomator](../../../tools/software/encryption/_index.md#cryptomator-cloud)) which provides E2EE on any cloud provider. Switching to a "privacy-focused" provider (that doesn't implement E2EE) doesn't solve your problem: it just shifts trust from Google to that provider. +Focusing solely on the privacy policies and marketing of a tool or provider can blind you to its weaknesses. When you're looking for a more private solution, you should determine what the underlying problem is and find technical solutions to that problem. For example, you may want to avoid Google Drive, which gives Google access to all of your data. The underlying problem in this case is lack of E2EE, so you should make sure that the provider you switch to actually implements E2EE, or use a tool (like [Cryptomator](../../../tools/software/encryption/index.md#cryptomator-cloud)) which provides E2EE on any cloud provider. Switching to a "privacy-focused" provider (that doesn't implement E2EE) doesn't solve your problem: it just shifts trust from Google to that provider. The privacy policies and business practices of providers you choose are very important, but should be considered secondary to technical guarantees of your privacy: You shouldn't shift trust to another provider when trusting a provider isn't a requirement at all. @@ -50,7 +50,7 @@ One of the clearest threat models is one where people *know who you are* and one 2. **Unknown identity** - An unknown identity could be a stable pseudonym that you regularly use. It is not anonymous because it doesn't change. If you're part of an online community, you may wish to retain a persona that others know. This pseudonym isn't anonymous because—if monitored for long enough—details about the owner can reveal further information, such as the way they write, their general knowledge about topics of interest, etc. - You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](../../../tools/software/cryptocurrency/_index.md#monero). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. + You may wish to use a VPN for this, to mask your IP address. Financial transactions are more difficult to mask: You could consider using anonymous cryptocurrencies, such as [Monero](../../../tools/software/cryptocurrency/index.md#monero). Employing altcoin shifting may also help to disguise where your currency originated. Typically, exchanges require KYC (know your customer) to be completed before they'll allow you to exchange fiat currency into any kind of cryptocurrency. Local meet-up options may also be a solution; however, those are often more expensive and sometimes also require KYC. 3. **Anonymous identity** - Even with experience, anonymous identities are difficult to maintain over long periods of time. They should be short-term and short-lived identities which are rotated regularly. diff --git a/content/wiki/basics/common-threats/_index.md b/content/wiki/basics/common-threats/index.md similarity index 91% rename from content/wiki/basics/common-threats/_index.md rename to content/wiki/basics/common-threats/index.md index 3b9e07796..8718fe2be 100644 --- a/content/wiki/basics/common-threats/_index.md +++ b/content/wiki/basics/common-threats/index.md @@ -4,7 +4,7 @@ weight: 30 description: Your threat model is personal to you, but these are some of the things many visitors to this site care about. --- -Broadly speaking, we categorize our recommendations into the [threats](../threat-modeling/_index.md) or goals that apply to most people. You may be concerned with none, one, a few, or all of these possibilities, and the tools and services you use depend on what your goals are. You may have specific threats outside these categories as well, which is perfectly fine! The important part is developing an understanding of the benefits and shortcomings of the tools you choose to use, because virtually none of them will protect you from every threat. +Broadly speaking, we categorize our recommendations into the [threats](../threat-modeling/index.md) or goals that apply to most people. You may be concerned with none, one, a few, or all of these possibilities, and the tools and services you use depend on what your goals are. You may have specific threats outside these categories as well, which is perfectly fine! The important part is developing an understanding of the benefits and shortcomings of the tools you choose to use, because virtually none of them will protect you from every threat. :material-incognito: **Anonymity** @@ -65,7 +65,7 @@ To minimize the damage that a malicious piece of software *could* do, you should > [!TIP] > Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources. > -> Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../../../tools/os/desktop/_index.md#qubes-os). +> Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../../../tools/os/desktop/index.md#qubes-os). ## Attacks against Specific Individuals @@ -122,7 +122,7 @@ Thankfully, E2EE can alleviate this issue by encrypting communications between y

Note on Web-based Encryption

-In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../../../tools/services/messengers/_index.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). +In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../../../tools/services/messengers/index.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering). On the other hand, web-based E2EE implementations, such as Proton Mail's web app or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt. @@ -130,7 +130,7 @@ Therefore, you should use native applications over web clients whenever possible
-Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as whom you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](../threat-modeling/_index.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. +Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as whom you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](../threat-modeling/index.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all. ## Mass Surveillance Programs @@ -186,7 +186,7 @@ Additionally, even companies outside the *AdTech* or tracking industry can share The best way to keep your data private is simply not making it public in the first place. Deleting unwanted information you find about yourself online is one of the best first steps you can take to regain your privacy. -- [View our guide on account deletion :material-arrow-right-drop-circle:](../account-deletion/_index.md) +- [View our guide on account deletion :material-arrow-right-drop-circle:](../account-deletion/index.md) On sites where you do share information, checking the privacy settings of your account to limit how widely that data is spread is very important. For example, enable "private mode" on your accounts if given the option: This ensures that your account isn't being indexed by search engines, and that it can't be viewed without your permission. @@ -200,12 +200,12 @@ Censorship online can be carried out (to varying degrees) by actors including to Censorship on corporate platforms is increasingly common, as platforms like Twitter and Facebook give in to public demand, market pressures, and pressures from government agencies. Government pressures can be covert requests to businesses, such as the White House [requesting the takedown](https://nytimes.com/2012/09/17/technology/on-the-web-a-fine-line-on-free-speech-across-globe.html) of a provocative YouTube video, or overt, such as the Chinese government requiring companies to adhere to a strict regime of censorship. -People concerned with the threat of censorship can use technologies like [Tor](../../advanced/tor-overview/_index.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../../../tools/software/social-networks/_index.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. +People concerned with the threat of censorship can use technologies like [Tor](../../advanced/tor-overview/index.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../../../tools/software/social-networks/index.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily. > [!TIP] > While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic. > -> You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../../advanced/dns-overview/_index.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). +> You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../../advanced/dns-overview/index.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection). You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught. diff --git a/content/wiki/basics/email-security/_index.md b/content/wiki/basics/email-security/index.md similarity index 80% rename from content/wiki/basics/email-security/_index.md rename to content/wiki/basics/email-security/index.md index 37cf52042..13e6d1dfd 100644 --- a/content/wiki/basics/email-security/_index.md +++ b/content/wiki/basics/email-security/index.md @@ -11,9 +11,9 @@ As a result, email is best used for receiving transactional emails (like notific ## Email Encryption Overview -The standard way to add E2EE to emails between different email providers is by using OpenPGP. There are different implementations of the OpenPGP standard, the most common being [GnuPG](../../../tools/software/encryption/_index.md#gnu-privacy-guard) and [OpenPGP.js](https://openpgpjs.org). +The standard way to add E2EE to emails between different email providers is by using OpenPGP. There are different implementations of the OpenPGP standard, the most common being [GnuPG](../../../tools/software/encryption/index.md#gnu-privacy-guard) and [OpenPGP.js](https://openpgpjs.org). -Even if you use OpenPGP, it does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if the private key of either you or the message recipient is ever stolen, all previous messages encrypted with it will be exposed. This is why we recommend [instant messengers](../../../tools/services/messengers/_index.md) which implement forward secrecy over email for person-to-person communications whenever possible. +Even if you use OpenPGP, it does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if the private key of either you or the message recipient is ever stolen, all previous messages encrypted with it will be exposed. This is why we recommend [instant messengers](../../../tools/services/messengers/index.md) which implement forward secrecy over email for person-to-person communications whenever possible. There is another standard which is popular with business called [S/MIME](https://en.wikipedia.org/wiki/S/MIME), however it requires a certificate issued from a [Certificate Authority](https://en.wikipedia.org/wiki/Certificate_authority) (not all of them issue S/MIME certificates, and often a yearly payment is required). In some cases it is more usable than PGP because it has support in popular/mainstream email applications like Apple Mail, [Google Workplace](https://support.google.com/a/topic/9061730), and [Outlook](https://support.office.com/article/encrypt-messages-by-using-s-mime-in-outlook-on-the-web-878c79fc-7088-4b39-966f-14512658f480). However, S/MIME does not solve the issue of lack of forward secrecy, and isn't particularly more secure than PGP. @@ -21,7 +21,7 @@ There is another standard which is popular with business called [S/MIME](https:/ The [Web Key Directory (WKD)](https://wiki.gnupg.org/WKD) standard allows email clients to discover the OpenPGP key for other mailboxes, even those hosted on a different provider. Email clients which support WKD will ask the recipient's server for a key based on the email address' domain name. For example, if you emailed `jonah@privacyguides.org`, your email client would ask `privacyguides.org` for Jonah's OpenPGP key, and if `privacyguides.org` has a key for that account, your message would be automatically encrypted. -In addition to the [email clients we recommend](../../../tools/software/email-clients/_index.md) which support WKD, some webmail providers also support WKD. Whether *your own* key is published to WKD for others to use depends on your domain configuration. If you use an [email provider](../../../tools/services/email/_index.md#openpgp-compatible-services) which supports WKD, such as Proton Mail or Mailbox Mail, they can publish your OpenPGP key on their domain for you. +In addition to the [email clients we recommend](../../../tools/software/email-clients/index.md) which support WKD, some webmail providers also support WKD. Whether *your own* key is published to WKD for others to use depends on your domain configuration. If you use an [email provider](../../../tools/services/email/index.md#openpgp-compatible-services) which supports WKD, such as Proton Mail or Mailbox Mail, they can publish your OpenPGP key on their domain for you. If you use your own custom domain, you will need to configure WKD separately. If you control your domain name, you can set up WKD regardless of your email provider. One easy way to do this is to use the "[WKD as a Service](https://keys.openpgp.org/about/usage#wkd-as-a-service)" feature from the `keys.openpgp.org` server: Set a CNAME record on the `openpgpkey` subdomain of your domain pointed to `wkd.keys.openpgp.org`, then upload your key to [keys.openpgp.org](https://keys.openpgp.org). Alternatively, you can [self-host WKD on your own web server](https://wiki.gnupg.org/WKDHosting). @@ -29,11 +29,11 @@ If you use a shared domain from a provider which doesn't support WKD, like `@gma ### What Email Clients Support E2EE? -Email providers which allow you to use standard access protocols like IMAP and SMTP can be used with any of the [email clients we recommend](../../../tools/software/email-clients/_index.md). Depending on the authentication method, this may lead to decreased security if either the provider or the email client does not support [OAuth](../account-creation/_index.md#sign-in-with-oauth) or a bridge application as [multifactor authentication](../multi-factor-authentication/_index.md) is not possible with plain password authentication. +Email providers which allow you to use standard access protocols like IMAP and SMTP can be used with any of the [email clients we recommend](../../../tools/software/email-clients/index.md). Depending on the authentication method, this may lead to decreased security if either the provider or the email client does not support [OAuth](../account-creation/index.md#sign-in-with-oauth) or a bridge application as [multifactor authentication](../multi-factor-authentication/index.md) is not possible with plain password authentication. ### How Do I Protect My Private Keys? -A smart card (such as a [YubiKey](https://support.yubico.com/hc/articles/360013790259-Using-Your-YubiKey-with-OpenPGP) or [Nitrokey](../../../tools/hardware/security-keys/_index.md#nitrokey)) works by receiving an encrypted email message from a device (phone, tablet, computer, etc.) running an email/webmail client. The message is then decrypted by the smart card and the decrypted content is sent back to the device. +A smart card (such as a [YubiKey](https://support.yubico.com/hc/articles/360013790259-Using-Your-YubiKey-with-OpenPGP) or [Nitrokey](../../../tools/hardware/security-keys/index.md#nitrokey)) works by receiving an encrypted email message from a device (phone, tablet, computer, etc.) running an email/webmail client. The message is then decrypted by the smart card and the decrypted content is sent back to the device. It is advantageous for the decryption to occur on the smart card to avoid possibly exposing your private key to a compromised device. diff --git a/content/wiki/basics/hardware/_index.md b/content/wiki/basics/hardware/index.md similarity index 92% rename from content/wiki/basics/hardware/_index.md rename to content/wiki/basics/hardware/index.md index 2f5584570..2384ef1a2 100644 --- a/content/wiki/basics/hardware/_index.md +++ b/content/wiki/basics/hardware/index.md @@ -16,7 +16,7 @@ Some devices will have a "hardware security program", which is a collaboration b - [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. - [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. -- macOS running on an Apple SoC takes advantage of [hardware security](../../os/macos/_index.md#hardware-security) which may not be available with third party operating systems. +- macOS running on an Apple SoC takes advantage of [hardware security](../../os/macos/index.md#hardware-security) which may not be available with third party operating systems. - [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. @@ -57,7 +57,7 @@ Android defines three [security classes](https://source.android.com/docs/securit ### Device Encryption -If your device is [encrypted](../../../tools/software/encryption/_index.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. +If your device is [encrypted](../../../tools/software/encryption/index.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. @@ -69,7 +69,7 @@ Some threats can't be protected against by your internal components alone. Many Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. -[Recommended Hardware Keys :material-arrow-right-drop-circle:](../../../tools/hardware/security-keys/_index.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](../multi-factor-authentication/_index.md#hardware-security-keys){ .md-button } +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../../../tools/hardware/security-keys/index.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](../multi-factor-authentication/index.md#hardware-security-keys){ .md-button } ### Camera/Microphone @@ -135,6 +135,6 @@ The most important thing to think about with routers is keeping them up-to-date. If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. -Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../../../tools/os/router-firmware/_index.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../../../tools/os/router-firmware/index.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/content/wiki/basics/multi-factor-authentication/_index.md b/content/wiki/basics/multi-factor-authentication/index.md similarity index 98% rename from content/wiki/basics/multi-factor-authentication/_index.md rename to content/wiki/basics/multi-factor-authentication/index.md index 34551aaee..1bb4a9c01 100644 --- a/content/wiki/basics/multi-factor-authentication/_index.md +++ b/content/wiki/basics/multi-factor-authentication/index.md @@ -35,7 +35,7 @@ Unlike [WebAuthn](#fido-fast-identity-online), TOTP offers no protection against An adversary could set up a website to imitate an official service in an attempt to trick you into giving out your username, password and current TOTP code. If the adversary then uses those recorded credentials they may be able to log into the real service and hijack the account. -Although not perfect, TOTP is secure enough for most people, and when [hardware security keys](../../../tools/hardware/security-keys/_index.md) are not supported [authenticator apps](../../../tools/software/multi-factor-authentication/_index.md) are still a good option. +Although not perfect, TOTP is secure enough for most people, and when [hardware security keys](../../../tools/hardware/security-keys/index.md) are not supported [authenticator apps](../../../tools/software/multi-factor-authentication/index.md) are still a good option. ### Hardware security keys @@ -99,7 +99,7 @@ When configuring your MFA method, keep in mind that it is only as secure as your You should always have backups for your MFA method. Hardware security keys can get lost, stolen or simply stop working over time. It is recommended that you have a pair of hardware security keys with the same access to your accounts instead of just one. -When using TOTP with an authenticator app, be sure to back up your recovery keys or the app itself, or copy the "shared secrets" to another instance of the app on a different phone or to an encrypted container (e.g. [VeraCrypt](../../../tools/software/encryption/_index.md#veracrypt-disk)). +When using TOTP with an authenticator app, be sure to back up your recovery keys or the app itself, or copy the "shared secrets" to another instance of the app on a different phone or to an encrypted container (e.g. [VeraCrypt](../../../tools/software/encryption/index.md#veracrypt-disk)). ### Initial Set Up @@ -111,7 +111,7 @@ If you have to use email for MFA, make sure that the email account itself is sec If you use SMS MFA, use a carrier who will not switch your phone number to a new SIM card without account access, or use a dedicated VoIP number from a provider with similar security to avoid a [SIM swap attack](https://en.wikipedia.org/wiki/SIM_swap_scam). -[MFA tools we recommend](../../../tools/software/multi-factor-authentication/_index.md){ .md-button } +[MFA tools we recommend](../../../tools/software/multi-factor-authentication/index.md){ .md-button } ## More Places to Set Up MFA diff --git a/content/wiki/basics/passwords-overview/_index.md b/content/wiki/basics/passwords-overview/index.md similarity index 90% rename from content/wiki/basics/passwords-overview/_index.md rename to content/wiki/basics/passwords-overview/index.md index 75247f7b0..bc1c33ae5 100644 --- a/content/wiki/basics/passwords-overview/_index.md +++ b/content/wiki/basics/passwords-overview/index.md @@ -18,19 +18,19 @@ This is called [credential stuffing](https://en.wikipedia.org/wiki/Credential_st You should **never** rely on yourself to come up with a good password. We recommend using [randomly generated passwords](#passwords) or [diceware passphrases](#diceware-passphrases) with sufficient entropy to protect your accounts and devices. -All of our [recommended password managers](../../../tools/software/passwords/_index.md) include a built-in password generator that you can use. +All of our [recommended password managers](../../../tools/software/passwords/index.md) include a built-in password generator that you can use. ### Rotating Passwords You should avoid changing passwords that you have to remember (such as your password manager's master password) too often unless you have reason to believe it has been compromised, as changing it too often exposes you to the risk of forgetting it. -When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](../threat-modeling/_index.md) calls for it, we recommend going through important accounts (especially accounts that don't use multifactor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage. +When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](../threat-modeling/index.md) calls for it, we recommend going through important accounts (especially accounts that don't use multifactor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage.

Checking for data breaches

-If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../../../tools/software/news-aggregators/_index.md). +If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../../../tools/software/news-aggregators/index.md).
@@ -158,13 +158,13 @@ The best way to store your passwords is by using a password manager. They allow There are many good options to choose from, both cloud-based and local. Choose one of our recommended password managers and use it to establish strong passwords across all of your accounts. We recommend securing your password manager with a [diceware passphrase](#diceware-passphrases) comprised of at least seven words. -[List of recommended password managers](../../../tools/software/passwords/_index.md){ .md-button } +[List of recommended password managers](../../../tools/software/passwords/index.md){ .md-button }

Don't place your passwords and TOTP tokens inside the same password manager

-When using [TOTP codes as multifactor authentication](../multi-factor-authentication/_index.md#time-based-one-time-password-totp), the best security practice is to keep your TOTP codes in a [separate app](../../../tools/software/multi-factor-authentication/_index.md). +When using [TOTP codes as multifactor authentication](../multi-factor-authentication/index.md#time-based-one-time-password-totp), the best security practice is to keep your TOTP codes in a [separate app](../../../tools/software/multi-factor-authentication/index.md). Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager. @@ -174,4 +174,4 @@ Furthermore, we do not recommend storing single-use recovery codes in your passw ### Backups -You should store an [encrypted](../../../tools/software/encryption/_index.md) backup of your passwords on multiple storage devices or a cloud storage provider. This can help you access your passwords if something happens to your primary device or the service you are using. +You should store an [encrypted](../../../tools/software/encryption/index.md) backup of your passwords on multiple storage devices or a cloud storage provider. This can help you access your passwords if something happens to your primary device or the service you are using. diff --git a/content/wiki/basics/threat-modeling/_index.md b/content/wiki/basics/threat-modeling/index.md similarity index 99% rename from content/wiki/basics/threat-modeling/_index.md rename to content/wiki/basics/threat-modeling/index.md index 98eba4fe7..7c285de23 100644 --- a/content/wiki/basics/threat-modeling/_index.md +++ b/content/wiki/basics/threat-modeling/index.md @@ -99,7 +99,7 @@ Making a security plan will help you to understand the threats that are unique t For people looking to increase their privacy and security online, we've compiled a list of common threats our visitors face or goals our visitors have, to give you some inspiration and demonstrate the basis of our recommendations. -- [Common Goals and Threats :material-arrow-right-drop-circle:](../common-threats/_index.md) +- [Common Goals and Threats :material-arrow-right-drop-circle:](../common-threats/index.md) ## Sources diff --git a/content/wiki/basics/vpn-overview/_index.md b/content/wiki/basics/vpn-overview/index.md similarity index 90% rename from content/wiki/basics/vpn-overview/_index.md rename to content/wiki/basics/vpn-overview/index.md index c40692f62..50aa06a87 100644 --- a/content/wiki/basics/vpn-overview/_index.md +++ b/content/wiki/basics/vpn-overview/index.md @@ -9,12 +9,12 @@ Virtual Private Networks are a way of extending the end of your network to exit [:material-movie-open-play-outline: Video: Do you need a VPN?](https://www.privacyguides.org/videos/2024/12/12/do-you-need-a-vpn){ .md-button } -Normally, an ISP can see the flow of internet traffic entering and exiting your network termination device (i.e. modem). Encryption protocols such as HTTPS are commonly used on the internet, so they may not be able to see exactly what you're posting or reading, but they can get an idea of the [domains you request](../../advanced/dns-overview/_index.md#why-shouldnt-i-use-encrypted-dns). +Normally, an ISP can see the flow of internet traffic entering and exiting your network termination device (i.e. modem). Encryption protocols such as HTTPS are commonly used on the internet, so they may not be able to see exactly what you're posting or reading, but they can get an idea of the [domains you request](../../advanced/dns-overview/index.md#why-shouldnt-i-use-encrypted-dns). Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it. > [!NOTE] -> When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../../../tools/services/vpn/_index.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. +> When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../../../tools/services/vpn/index.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection. ## How does a VPN work? @@ -46,9 +46,9 @@ VPNs cannot encrypt data outside the connection between your device and the VPN ## When isn't a VPN suitable? -Using a VPN in cases where you're using your [real-life or well-known identity](../common-misconceptions/_index.md#complicated-is-better) online is unlikely to be useful. Doing so may trigger spam and fraud detection systems, such as if you were to log into your bank's website. +Using a VPN in cases where you're using your [real-life or well-known identity](../common-misconceptions/index.md#complicated-is-better) online is unlikely to be useful. Doing so may trigger spam and fraud detection systems, such as if you were to log into your bank's website. -It's important to remember that a VPN will not provide you with absolute anonymity because the VPN provider itself will still have access to your real IP address, destination website information, and often a money trail that can be linked directly back to you. "No logging" policies are merely a promise; if you need complete safety from the network itself, consider using [Tor](../../advanced/tor-overview/_index.md) in addition to or instead of a VPN. +It's important to remember that a VPN will not provide you with absolute anonymity because the VPN provider itself will still have access to your real IP address, destination website information, and often a money trail that can be linked directly back to you. "No logging" policies are merely a promise; if you need complete safety from the network itself, consider using [Tor](../../advanced/tor-overview/index.md) in addition to or instead of a VPN. You also should not trust a VPN to secure your connection to an unencrypted, HTTP destination. In order to keep what you actually do on the websites you visit private and secure, you must use HTTPS. This will keep your passwords, session tokens, and queries safe from the VPN provider and other potential adversaries in between the VPN server and your destination. You should enable HTTPS-only mode in your browser (if it's supported) to mitigate attacks which try to downgrade your connection from HTTPS to HTTP. @@ -60,9 +60,9 @@ Another common reason encrypted DNS is recommended is that it prevents DNS spoof ## Should I use Tor *and* a VPN? -Maybe, Tor is not necessarily suitable for everybody in the first place. Consider your [threat model](../threat-modeling/_index.md), because if your adversary is not capable of extracting information from your VPN provider, using a VPN alone may provide enough protection. +Maybe, Tor is not necessarily suitable for everybody in the first place. Consider your [threat model](../threat-modeling/index.md), because if your adversary is not capable of extracting information from your VPN provider, using a VPN alone may provide enough protection. -If you do use Tor then you are *probably* best off connecting to the Tor network via a commercial VPN provider. However, this is a complex subject which we've written more about on our [Tor overview](../../advanced/tor-overview/_index.md) page. +If you do use Tor then you are *probably* best off connecting to the Tor network via a commercial VPN provider. However, this is a complex subject which we've written more about on our [Tor overview](../../advanced/tor-overview/index.md) page. ## Should I access Tor through VPN providers that provide "Tor nodes"? @@ -70,7 +70,7 @@ You should not use that feature: The primary advantage of using Tor is that you Currently, Tor only supports the TCP protocol. UDP (used by [WebRTC](https://en.wikipedia.org/wiki/WebRTC), [HTTP3/QUIC](https://en.wikipedia.org/wiki/HTTP/3), and other protocols), [ICMP](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol), and other packets will be dropped. To compensate for this, VPN providers typically will route all non-TCP packets through their VPN server (your first hop). This is the case with [ProtonVPN](https://protonvpn.com/support/tor-vpn). Additionally, when using this Tor over VPN setup, you do not have control over other important Tor features such as [Isolated Destination Address](https://whonix.org/wiki/Stream_Isolation) (using a different Tor circuit for every domain you visit). -The feature should be viewed as a *convenient* way to access hidden services on Tor, not to stay anonymous. For proper anonymity, use the actual [Tor Browser](../../../tools/software/tor/_index.md). +The feature should be viewed as a *convenient* way to access hidden services on Tor, not to stay anonymous. For proper anonymity, use the actual [Tor Browser](../../../tools/software/tor/index.md). ## Commercial VPN Ownership @@ -78,7 +78,7 @@ Most VPN services are owned by the same [few companies](https://vpnpro.com/blog/ You should also be wary that many VPN review sites are merely advertising vehicles open to the highest bidder. Privacy Guides does not make money from recommending external products, and never uses affiliate programs. -[Our VPN Recommendations](../../../tools/services/vpn/_index.md){ .md-button } +[Our VPN Recommendations](../../../tools/services/vpn/index.md){ .md-button } ## Modern VPN Alternatives diff --git a/content/wiki/basics/why-privacy-matters/_index.md b/content/wiki/basics/why-privacy-matters/index.md similarity index 97% rename from content/wiki/basics/why-privacy-matters/_index.md rename to content/wiki/basics/why-privacy-matters/index.md index b7b641a30..2eac8f934 100644 --- a/content/wiki/basics/why-privacy-matters/_index.md +++ b/content/wiki/basics/why-privacy-matters/index.md @@ -26,13 +26,13 @@ Many people get the concepts of **privacy**, **security**, and **anonymity** con **Anonymity** -: Anonymity is the ability to act without a persistent identifier. You might achieve this online with [Tor](../../../tools/software/tor/_index.md), which allows you to browse the internet with a random IP address and network connection instead of your own. +: Anonymity is the ability to act without a persistent identifier. You might achieve this online with [Tor](../../../tools/software/tor/index.md), which allows you to browse the internet with a random IP address and network connection instead of your own. : **Pseudonymity** is a similar concept, but it allows you to have a persistent identifier without it being tied to your real identity. If everybody knows you as `@GamerGuy12` online, but nobody knows your real name, that is your pseudonym. All of these concepts overlap, but it is possible to have any combination of these. The sweet spot for most people is when all three of these concepts overlap. However, it's trickier to achieve than many initially believe. Sometimes, you have to compromise on some of these, and that's okay too. This is where **threat modeling** comes into play, allowing you to make informed decisions about the [software and services](../../../tools/_index.md) you use. -[:material-book-outline: Learn More About Threat Modeling](../threat-modeling/_index.md){ .md-button } +[:material-book-outline: Learn More About Threat Modeling](../threat-modeling/index.md){ .md-button } ## Privacy vs. Secrecy diff --git a/content/wiki/os/_index.md b/content/wiki/os/_index.md index ae94e8dbf..39baf5f3b 100644 --- a/content/wiki/os/_index.md +++ b/content/wiki/os/_index.md @@ -2,10 +2,10 @@ title: Operating Systems description: An overview of our operating system-related recommendations for all major computing hardware. --- -We publish configuration guides for the major operating systems, because you can generally improve the amount of data that is collected about you on any option, especially if you use privacy tools like our [recommended web browsers](../../tools/software/desktop-browsers/_index.md) in place of native tools where appropriate. However, some operating systems will be more privacy-respecting inherently, and it will be much harder to achieve an equivalent level of privacy on other choices. +We publish configuration guides for the major operating systems, because you can generally improve the amount of data that is collected about you on any option, especially if you use privacy tools like our [recommended web browsers](../../tools/software/desktop-browsers/index.md) in place of native tools where appropriate. However, some operating systems will be more privacy-respecting inherently, and it will be much harder to achieve an equivalent level of privacy on other choices. > [!TIP] -> You may also wish to explore our [recommended linux distros](../../tools/os/desktop/_index.md) and [recommended Android distros](../../tools/os/android/distributions/_index.md). +> You may also wish to explore our [recommended linux distros](../../tools/os/desktop/index.md) and [recommended Android distros](../../tools/os/android/distributions/index.md). ## Mobile Operating Systems diff --git a/content/wiki/os/android/_index.md b/content/wiki/os/android/index.md similarity index 95% rename from content/wiki/os/android/_index.md rename to content/wiki/os/android/index.md index 353b66722..4e8e69b16 100644 --- a/content/wiki/os/android/_index.md +++ b/content/wiki/os/android/index.md @@ -16,7 +16,7 @@ The **Android Open Source Project** is a secure mobile operating system featurin ## Security Protections -Key components of the Android security model include [verified boot](#verified-boot), [firmware updates](#firmware-updates), and a robust [permission system](#android-permissions). These important security features form the baseline of the minimum criteria for our [mobile phone](../../../tools/hardware/mobile-phones/_index.md) and [custom Android OS](../../../tools/os/android/distributions/_index.md) recommendations. +Key components of the Android security model include [verified boot](#verified-boot), [firmware updates](#firmware-updates), and a robust [permission system](#android-permissions). These important security features form the baseline of the minimum criteria for our [mobile phone](../../../tools/hardware/mobile-phones/index.md) and [custom Android OS](../../../tools/os/android/distributions/index.md) recommendations. ### Verified Boot @@ -44,7 +44,7 @@ Fairphone, for example, markets their Fairphone 4 device as receiving 6 years of [**Permissions on Android**](https://developer.android.com/guide/topics/permissions/overview) grant you control over what apps are allowed to access. Google regularly makes [improvements](https://developer.android.com/about/versions/11/privacy/permissions) on the permission system in each successive version. All apps you install are strictly [sandboxed](https://source.android.com/security/app-sandbox), therefore, there is no need to install any antivirus apps. -A smartphone with the latest version of Android will always be more secure than an old smartphone with an antivirus that you have paid for. It's better not to pay for antivirus software and to save money to buy a new smartphone such as a [Google Pixel](../../../tools/hardware/mobile-phones/_index.md#google-pixel). +A smartphone with the latest version of Android will always be more secure than an old smartphone with an antivirus that you have paid for. It's better not to pay for antivirus software and to save money to buy a new smartphone such as a [Google Pixel](../../../tools/hardware/mobile-phones/index.md#google-pixel). Android 10: @@ -93,7 +93,7 @@ With user profiles, you can impose restrictions on a specific profile, such as: [**Work Profiles**](https://support.google.com/work/android/answer/6191949) are another way to isolate individual apps and may be more convenient than separate user profiles. -A **device controller** app such as [Shelter](../../../tools/os/android/general-apps/_index.md#shelter) is required to create a Work Profile without an enterprise MDM, unless you're using a custom Android OS which includes one. +A **device controller** app such as [Shelter](../../../tools/os/android/general-apps/index.md#shelter) is required to create a Work Profile without an enterprise MDM, unless you're using a custom Android OS which includes one. The work profile is dependent on a device controller to function. Features such as *File Shuttle* and *contact search blocking* or any kind of isolation features must be implemented by the controller. You must also fully trust the device controller app, as it has full access to your data inside the work profile. @@ -121,11 +121,11 @@ If you are using a device with Google services—whether with the stock operatin ### Advanced Protection Program -If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection). It is available at no cost to anyone with two or more hardware security keys with [FIDO](../../basics/multi-factor-authentication/_index.md#fido-fast-identity-online) support. Alternatively, you can use [passkeys](https://fidoalliance.org/passkeys). +If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection). It is available at no cost to anyone with two or more hardware security keys with [FIDO](../../basics/multi-factor-authentication/index.md#fido-fast-identity-online) support. Alternatively, you can use [passkeys](https://fidoalliance.org/passkeys). The Advanced Protection Program provides enhanced threat monitoring and enables: -- Stricter two-factor authentication; e.g. that [FIDO](../../basics/multi-factor-authentication/_index.md#fido-fast-identity-online) **must** be used and disallows the use of [SMS OTPs](../../basics/multi-factor-authentication/_index.md#sms-or-email-mfa), [TOTP](../../basics/multi-factor-authentication/_index.md#time-based-one-time-password-totp) and [OAuth](../../basics/account-creation/_index.md#sign-in-with-oauth) +- Stricter two-factor authentication; e.g. that [FIDO](../../basics/multi-factor-authentication/index.md#fido-fast-identity-online) **must** be used and disallows the use of [SMS OTPs](../../basics/multi-factor-authentication/index.md#sms-or-email-mfa), [TOTP](../../basics/multi-factor-authentication/index.md#time-based-one-time-password-totp) and [OAuth](../../basics/account-creation/index.md#sign-in-with-oauth) - Only Google and verified third-party apps can access account data - Scanning of incoming emails on Gmail accounts for [phishing](https://en.wikipedia.org/wiki/Phishing#Email_phishing) attempts - Stricter [safe browser scanning](https://google.com/chrome/privacy/whitepaper.html#malware) with Google Chrome diff --git a/content/wiki/os/ios/_index.md b/content/wiki/os/ios/index.md similarity index 93% rename from content/wiki/os/ios/_index.md rename to content/wiki/os/ios/index.md index c48977f10..4fc407306 100644 --- a/content/wiki/os/ios/_index.md +++ b/content/wiki/os/ios/index.md @@ -9,7 +9,7 @@ description: iOS is a mobile operating system developed by Apple for the iPhone. iOS devices are frequently praised by security experts for their robust data protection and adherence to modern best practices. However, the restrictiveness of Apple's ecosystem—particularly with their mobile devices—does still hamper privacy in a number of ways. -We generally consider iOS to provide better than average privacy and security protections for most people, compared to stock Android devices from any manufacturer. However, you can achieve even higher standards of privacy with a [custom Android operating system](../../../tools/os/android/distributions/_index.md) like GrapheneOS, if you want or need to be completely independent of Apple or Google's cloud services. +We generally consider iOS to provide better than average privacy and security protections for most people, compared to stock Android devices from any manufacturer. However, you can achieve even higher standards of privacy with a [custom Android operating system](../../../tools/os/android/distributions/index.md) like GrapheneOS, if you want or need to be completely independent of Apple or Google's cloud services. ### Activation Lock @@ -41,13 +41,13 @@ The majority of privacy and security concerns with Apple products are related to Therefore, if you do use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple. -The encryption used by Advanced Data Protection, while strong, [is not *quite* as robust](https://discuss.privacyguides.net/t/apple-advances-user-security-with-powerful-new-data-protections/10778/4) as the encryption offered by other [cloud services](../../../tools/services/cloud/_index.md), particularly when it comes to iCloud Drive. While we strongly encourage using Advanced Data Protection if you use iCloud, we would also suggest considering finding an alternative to iCloud from a more [privacy-focused service provider](../../../tools/_index.md), although it is unlikely most people would be impacted by these encryption quirks. +The encryption used by Advanced Data Protection, while strong, [is not *quite* as robust](https://discuss.privacyguides.net/t/apple-advances-user-security-with-powerful-new-data-protections/10778/4) as the encryption offered by other [cloud services](../../../tools/services/cloud/index.md), particularly when it comes to iCloud Drive. While we strongly encourage using Advanced Data Protection if you use iCloud, we would also suggest considering finding an alternative to iCloud from a more [privacy-focused service provider](../../../tools/_index.md), although it is unlikely most people would be impacted by these encryption quirks. You can also protect your data by limiting what you sync to iCloud in the first place. At the top of the **Settings** app, you'll see your name and profile picture if you are signed in to iCloud. Select that, then **iCloud**, and turn off the switches for any services you don't want to sync to iCloud. You may see third-party apps listed under **Show All** if they sync to iCloud, which you can disable here. #### iCloud+ -A paid **iCloud+** subscription (with any iCloud storage plan) comes with some privacy-protecting functionality. While these may provide adequate service for current iCloud customers, we wouldn't recommend purchasing an iCloud+ plan over a [VPN](../../../tools/services/vpn/_index.md) and [standalone email aliasing service](../../../tools/services/email-aliasing/_index.md) just for these features alone. +A paid **iCloud+** subscription (with any iCloud storage plan) comes with some privacy-protecting functionality. While these may provide adequate service for current iCloud customers, we wouldn't recommend purchasing an iCloud+ plan over a [VPN](../../../tools/services/vpn/index.md) and [standalone email aliasing service](../../../tools/services/email-aliasing/index.md) just for these features alone. [**Private Relay**](https://apple.com/legal/privacy/data/en/icloud-relay) is a proxy service which relays all of your Safari traffic, your DNS queries, and unencrypted traffic on your device through two servers: one owned by Apple and one owned by a third-party provider (including Akamai, Cloudflare, and Fastly). In theory this should prevent any single provider in the chain—including Apple—from having full visibility into which websites you visit while connected. Unlike a VPN, Private Relay does not protect traffic that's already encrypted. @@ -136,7 +136,7 @@ If you don't want anyone to be able to control your phone with Siri when it is l Setting a strong password on your phone is the most important step you can take for physical device security. You'll have to make trade-offs here between security and convenience: A longer password will be annoying to type in every time, but a shorter password or PIN will be easier to guess. Setting up Face ID or Touch ID along with a strong password can be a good compromise between usability and security. -Select **Turn Passcode On** or **Change Passcode** → **Passcode Options** → **Custom Alphanumeric Code**. Make sure that you create a [secure password](../../basics/passwords-overview/_index.md). +Select **Turn Passcode On** or **Change Passcode** → **Passcode Options** → **Custom Alphanumeric Code**. Make sure that you create a [secure password](../../basics/passwords-overview/index.md). If you wish to use Face ID or Touch ID, you can go ahead and set it up now. Your phone will use the password you set up earlier as a fallback in case your biometric verification fails. Biometric unlock methods are primarily a convenience, although they do stop surveillance cameras or people over your shoulder from watching you input your passcode. @@ -206,7 +206,7 @@ Set wired accessories to ask for permission when you connect them. Select **Wire ### E2EE Calls -Normal phone calls made with the Phone app through your carrier are not E2EE. Both FaceTime Video and FaceTime Audio calls are E2EE. Alternatively, you can use [another app](../../../tools/services/messengers/_index.md) like Signal for E2EE calls. +Normal phone calls made with the Phone app through your carrier are not E2EE. Both FaceTime Video and FaceTime Audio calls are E2EE. Alternatively, you can use [another app](../../../tools/services/messengers/index.md) like Signal for E2EE calls. ### Encrypted iMessage @@ -232,7 +232,7 @@ Rather than allow an app to access all the photos on your device, you can allow ![Private Access](private-access-light.png#only-light) ![Private Access](private-access-dark.png#only-dark) -Some apps also support **Private Access**, which functions similarly to the **Limited Access** permission. However, photos shared to apps using Private Access include their location by default. We recommend unchecking this setting if you do not [remove photo metadata](../../../tools/software/data-redaction/_index.md) beforehand. +Some apps also support **Private Access**, which functions similarly to the **Limited Access** permission. However, photos shared to apps using Private Access include their location by default. We recommend unchecking this setting if you do not [remove photo metadata](../../../tools/software/data-redaction/index.md) beforehand. ### Contact Permissions @@ -267,7 +267,7 @@ You can use the [Clean Up](https://support.apple.com/en-us/121429) feature on su - Tap the button labeled **Clean Up** - Draw a circle around whatever you want to redact. Faces will be pixelated, and it will attempt to delete anything else. -Our warning [against blurring text](../../../tools/software/data-redaction/_index.md) also applies here, so we recommend to instead add a black shape with 100% opacity over it. In addition to redacting text, you can also black out any face or object using the **Photos** app. +Our warning [against blurring text](../../../tools/software/data-redaction/index.md) also applies here, so we recommend to instead add a black shape with 100% opacity over it. In addition to redacting text, you can also black out any face or object using the **Photos** app.
@@ -294,7 +294,7 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes [:material-target-account: Targeted Attacks](../../basics/common-threats/_index.md#attacks-against-specific-individuals){ .pg-red } that involve forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes [:material-target-account: Targeted Attacks](../../basics/common-threats/index.md#attacks-against-specific-individuals){ .pg-red } that involve forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. iPhones [automatically reboot](https://support.apple.com/guide/security/protecting-user-data-in-the-face-of-attack-secf5549a4f5/1/web/1#:~:text=On%20an%20iPhone%20or%20iPad%20with%20iOS%2018%20and%20iPadOS%2018%20or%20later%2C%20a%20new%20security%20protection%20will%20restart%20devices%20if%20they%20remain%20locked%20for%20a%20prolonged%20period%20of%20time.) if they're not unlocked after a period of time. diff --git a/content/wiki/os/linux/_index.md b/content/wiki/os/linux/index.md similarity index 91% rename from content/wiki/os/linux/_index.md rename to content/wiki/os/linux/index.md index 2406547fa..03257d352 100644 --- a/content/wiki/os/linux/_index.md +++ b/content/wiki/os/linux/index.md @@ -7,7 +7,7 @@ description: Linux is an open-source, privacy-focused desktop operating system a Our website generally uses the term “Linux” to describe **desktop** Linux distributions. Other operating systems which also use the Linux kernel such as ChromeOS, Android, and Qubes OS are not discussed on this page. -[Our Linux Recommendations :material-arrow-right-drop-circle:](../../../tools/os/desktop/_index.md){ .md-button } +[Our Linux Recommendations :material-arrow-right-drop-circle:](../../../tools/os/desktop/index.md){ .md-button } ## Security Notes @@ -15,11 +15,11 @@ There are some notable security concerns with Linux which you should be aware of - Avoid telemetry that often comes with proprietary operating systems - Maintain [software freedom](https://gnu.org/philosophy/free-sw.en.html#four-freedoms) -- Use privacy-focused systems such as [Whonix](../../../tools/os/desktop/_index.md#whonix) or [Tails](../../../tools/os/desktop/_index.md#tails) +- Use privacy-focused systems such as [Whonix](../../../tools/os/desktop/index.md#whonix) or [Tails](../../../tools/os/desktop/index.md#tails) ### Open-Source Security -It is a [common misconception](../../basics/common-misconceptions/_index.md#open-source-software-is-always-secure-or-proprietary-software-is-more-secure) that Linux and other open-source software are inherently secure simply because the source code is available. There is an expectation that community verification occurs regularly, but this isn’t always [the case](https://seirdy.one/posts/2022/02/02/floss-security). +It is a [common misconception](../../basics/common-misconceptions/index.md#open-source-software-is-always-secure-or-proprietary-software-is-more-secure) that Linux and other open-source software are inherently secure simply because the source code is available. There is an expectation that community verification occurs regularly, but this isn’t always [the case](https://seirdy.one/posts/2022/02/02/floss-security). In reality, distro security depends on a number of factors, such as project activity, developer experience, the level of rigor applied to code reviews, and how often attention is given to specific parts of the codebase that may go untouched for years. @@ -35,7 +35,7 @@ Additionally, Linux falls behind in implementing [exploit mitigations](https://m ## Choosing your distribution -Not all Linux distributions are created equal. Our [Linux recommendation page](../../../tools/os/desktop/_index.md) is not meant to be an authoritative source on which distribution you should use, but our recommendations *are* aligned with the following guidelines. These are a few things you should keep in mind when choosing a distribution: +Not all Linux distributions are created equal. Our [Linux recommendation page](../../../tools/os/desktop/index.md) is not meant to be an authoritative source on which distribution you should use, but our recommendations *are* aligned with the following guidelines. These are a few things you should keep in mind when choosing a distribution: ### Release cycle @@ -53,7 +53,7 @@ Traditionally, Linux distributions update by sequentially updating the desired p Distros which use atomic updates, on the other hand, apply updates in full or not at all. On an atomic distribution, if an error occurs while updating (perhaps due to a power failure), nothing is changed on the system. -The atomic update method can achieve reliability with this model and is used for [distributions](../../../tools/os/desktop/_index.md#atomic-distributions) like Silverblue and NixOS. [Adam Šamalík](https://twitter.com/adsamalik) provides a presentation on how `rpm-ostree` works with Silverblue: +The atomic update method can achieve reliability with this model and is used for [distributions](../../../tools/os/desktop/index.md#atomic-distributions) like Silverblue and NixOS. [Adam Šamalík](https://twitter.com/adsamalik) provides a presentation on how `rpm-ostree` works with Silverblue: - [Let's try Fedora Silverblue — an immutable desktop OS! - Adam Šamalík](https://youtu.be/-hpV5l-gJnQ) (YouTube) @@ -67,7 +67,7 @@ Arch and Arch-based distributions are not recommended for those new to Linux (re For a secure system, you are also expected to have sufficient Linux knowledge to properly set up security for their system such as adopting a [mandatory access control](#mandatory-access-control) system, setting up [kernel module](https://en.wikipedia.org/wiki/Loadable_kernel_module#Security) blacklists, hardening boot parameters, manipulating [sysctl](https://en.wikipedia.org/wiki/Sysctl) parameters, and knowing what components they need such as [Polkit](https://en.wikipedia.org/wiki/Polkit). -Anyone using the [Arch User Repository (AUR)](https://wiki.archlinux.org/title/Arch_User_Repository) **must** be comfortable auditing PKGBUILDs that they download from that service. AUR packages are community-produced content and are not vetted in any way, and therefore are vulnerable to software [:material-package-variant-closed-remove: Supply Chain Attacks](../../basics/common-threats/_index.md#attacks-against-certain-organizations){ .pg-viridian }, which has in fact happened [in the past](https://bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository). +Anyone using the [Arch User Repository (AUR)](https://wiki.archlinux.org/title/Arch_User_Repository) **must** be comfortable auditing PKGBUILDs that they download from that service. AUR packages are community-produced content and are not vetted in any way, and therefore are vulnerable to software [:material-package-variant-closed-remove: Supply Chain Attacks](../../basics/common-threats/index.md#attacks-against-certain-organizations){ .pg-viridian }, which has in fact happened [in the past](https://bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository). The AUR should always be used sparingly, and often there is a lot of bad advice on various pages which direct people to blindly use [AUR helpers](https://wiki.archlinux.org/title/AUR_helpers) without sufficient warning. Similar warnings apply to the use of third-party Personal Package Archives (PPAs) on Debian-based distributions or Community Projects (COPR) on Fedora. @@ -92,7 +92,7 @@ SELinux on [Fedora](https://docs.fedoraproject.org/en-US/quick-docs/selinux-gett ### Drive Encryption -Most Linux distributions have an option within its installer for enabling [LUKS](../../../tools/software/encryption/_index.md#linux-unified-key-setup) FDE. If this option isn’t set at installation time, you will have to back up your data and re-install, as encryption is applied after [disk partitioning](https://en.wikipedia.org/wiki/Disk_partitioning), but before [file systems](https://en.wikipedia.org/wiki/File_system) are formatted. We also suggest securely erasing your storage device: +Most Linux distributions have an option within its installer for enabling [LUKS](../../../tools/software/encryption/index.md#linux-unified-key-setup) FDE. If this option isn’t set at installation time, you will have to back up your data and re-install, as encryption is applied after [disk partitioning](https://en.wikipedia.org/wiki/Disk_partitioning), but before [file systems](https://en.wikipedia.org/wiki/File_system) are formatted. We also suggest securely erasing your storage device: - [Secure Data Erasure :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/05/25/secure-data-erasure) @@ -155,7 +155,7 @@ MAC address randomization is primarily beneficial for Wi-Fi connections. For Eth ### Other Identifiers -There are other system identifiers which you may wish to be careful about. You should give this some thought to see if it applies to your [threat model](../../basics/threat-modeling/_index.md): +There are other system identifiers which you may wish to be careful about. You should give this some thought to see if it applies to your [threat model](../../basics/threat-modeling/index.md): - **Hostnames:** Your system's hostname is shared with the networks you connect to. You should avoid including identifying terms like your name or operating system in your hostname, instead sticking to generic terms or random strings. - **Usernames:** Similarly, your username is used in a variety of ways across your system. Consider using generic terms like "user" rather than your actual name. diff --git a/content/wiki/os/macos/_index.md b/content/wiki/os/macos/index.md similarity index 95% rename from content/wiki/os/macos/_index.md rename to content/wiki/os/macos/index.md index d14de872b..70b780091 100644 --- a/content/wiki/os/macos/_index.md +++ b/content/wiki/os/macos/index.md @@ -132,7 +132,7 @@ Decide whether you want personalized ads based on your usage. ##### FileVault -On modern devices with a Secure Enclave (Apple T2 Security Chip, Apple Silicon), your data is always encrypted, but is decrypted automatically by a hardware key if your device doesn't detect it's been tampered with. Enabling [FileVault](../../../tools/software/encryption/_index.md#filevault) additionally requires your password to decrypt your data, greatly improving security, especially when powered off or before the first login after powering on. +On modern devices with a Secure Enclave (Apple T2 Security Chip, Apple Silicon), your data is always encrypted, but is decrypted automatically by a hardware key if your device doesn't detect it's been tampered with. Enabling [FileVault](../../../tools/software/encryption/index.md#filevault) additionally requires your password to decrypt your data, greatly improving security, especially when powered off or before the first login after powering on. On older Intel-based Mac computers, FileVault is the only form of disk encryption available by default, and should always be enabled. @@ -180,10 +180,10 @@ System Integrity Protection makes critical file locations read-only to protect a ##### App Sandbox -On macOS, whether an app is sandboxed is determined by the developer when they sign it. The [App Sandbox](https://developer.apple.com/documentation/xcode/configuring-the-macos-app-sandbox) protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../../basics/common-threats/_index.md#attacks-against-certain-organizations){ .pg-viridian } by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the [App Store](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/1/web/1#:~:text=All%20apps%20from%20the%20App%20Store%20are%20sandboxed%20to%20restrict%20access%20to%20data%20stored%20by%20other%20apps.). +On macOS, whether an app is sandboxed is determined by the developer when they sign it. The [App Sandbox](https://developer.apple.com/documentation/xcode/configuring-the-macos-app-sandbox) protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../../basics/common-threats/index.md#attacks-against-certain-organizations){ .pg-viridian } by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the [App Store](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/1/web/1#:~:text=All%20apps%20from%20the%20App%20Store%20are%20sandboxed%20to%20restrict%20access%20to%20data%20stored%20by%20other%20apps.). > [!WARNING] -> Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../../basics/common-threats/_index.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*. +> Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../../basics/common-threats/index.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*. You can check if an app uses the App Sandbox in a few ways: @@ -208,7 +208,7 @@ If an app is sandboxed, you should see the following output: [Bool] true ``` -If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../../basics/common-threats/_index.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the non-sandboxed app altogether. +If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../../basics/common-threats/index.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the non-sandboxed app altogether. ##### Hardened Runtime diff --git a/content/wiki/os/qubes/_index.md b/content/wiki/os/qubes/index.md similarity index 83% rename from content/wiki/os/qubes/_index.md rename to content/wiki/os/qubes/index.md index 69797e487..d052be1a0 100644 --- a/content/wiki/os/qubes/_index.md +++ b/content/wiki/os/qubes/index.md @@ -3,11 +3,11 @@ title: "Qubes Overview" icon: simple/qubesos description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security. --- -[**Qubes OS**](../../../tools/os/desktop/_index.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://ranum.com/security/computer_security/editorials/dumb). +[**Qubes OS**](../../../tools/os/desktop/index.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://ranum.com/security/computer_security/editorials/dumb). ## How does Qubes OS work? -Qubes uses [compartmentalization](https://qubes-os.org/intro) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../../../tools/os/desktop/_index.md#whonix). Qubes OS also allows you to create once-use [disposable](https://qubes-os.org/doc/how-to-use-disposables) *qubes*. +Qubes uses [compartmentalization](https://qubes-os.org/intro) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../../../tools/os/desktop/index.md#whonix). Qubes OS also allows you to create once-use [disposable](https://qubes-os.org/doc/how-to-use-disposables) *qubes*.
The term qubes is gradually being updated to avoid referring to them as "virtual machines". @@ -26,7 +26,7 @@ Each qube has a [colored border](https://qubes-os.org/screenshots) that can help ## Why Should I use Qubes? -Qubes OS is useful if your [threat model](../../basics/threat-modeling/_index.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system. +Qubes OS is useful if your [threat model](../../basics/threat-modeling/index.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system. Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps. @@ -56,7 +56,7 @@ The [qrexec framework](https://qubes-os.org/doc/qrexec) is a core part of Qubes ## Connecting to Tor via a VPN -We [recommend](../../advanced/tor-overview/_index.md) connecting to the Tor network via a [VPN](../../../tools/services/vpn/_index.md) provider, and luckily Qubes makes this easy to do with a combination of ProxyVMs and Whonix. +We [recommend](../../advanced/tor-overview/index.md) connecting to the Tor network via a [VPN](../../../tools/services/vpn/index.md) provider, and luckily Qubes makes this easy to do with a combination of ProxyVMs and Whonix. After [creating a new ProxyVM](https://forum.qubes-os.org/t/configuring-a-proxyvm-vpn-gateway/19061) which connects to the VPN of your choice, you can chain your Whonix qubes to that ProxyVM **before** they connect to the Tor network, by setting the NetVM of your Whonix **Gateway** (`sys-whonix`) to the newly-created ProxyVM. diff --git a/content/wiki/os/windows/_index.md b/content/wiki/os/windows/_index.md index 1ad4d8646..9e1b59fde 100644 --- a/content/wiki/os/windows/_index.md +++ b/content/wiki/os/windows/_index.md @@ -12,7 +12,7 @@ Unfortunately, this feature was added without too much thought about the privacy You can enhance your privacy and security on Windows without downloading any third-party tools with these guides: - Initial Installation (coming soon) -- [Group Policy Settings](./group-policies/_index.md) +- [Group Policy Settings](./group-policies/index.md) - Privacy Settings (coming soon) - Application Sandboxing (coming soon) - Security Hardening (coming soon) diff --git a/content/wiki/os/windows/group-policies/_index.md b/content/wiki/os/windows/group-policies/index.md similarity index 100% rename from content/wiki/os/windows/group-policies/_index.md rename to content/wiki/os/windows/group-policies/index.md