mirror of
https://github.com/privacyguides/privacyguides.org.git
synced 2025-07-24 12:21:09 +00:00
Compare commits
1 Commits
2024.07.21
...
russian-se
| Author | SHA1 | Date | |
|---|---|---|---|
727a2be2f9
|
463
docs/android.md
Normal file
463
docs/android.md
Normal file
@@ -0,0 +1,463 @@
|
||||
---
|
||||
meta_title: "Android Recommendations: GrapheneOS and DivestOS - Privacy Guides"
|
||||
title: "Android"
|
||||
icon: 'simple/android'
|
||||
description: You can replace the operating system on your Android phone with these secure and privacy-respecting alternatives.
|
||||
cover: android.webp
|
||||
schema:
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
name: Private Android Operating Systems
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: Android
|
||||
image: /assets/img/android/android.svg
|
||||
url: https://source.android.com/
|
||||
sameAs: https://en.wikipedia.org/wiki/Android_(operating_system)
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: GrapheneOS
|
||||
image: /assets/img/android/grapheneos.svg
|
||||
url: https://grapheneos.org/
|
||||
sameAs: https://en.wikipedia.org/wiki/GrapheneOS
|
||||
subjectOf:
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: Divest
|
||||
image: /assets/img/android/divestos.svg
|
||||
url: https://divestos.org/
|
||||
sameAs: https://en.wikipedia.org/wiki/DivestOS
|
||||
subjectOf:
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": Product
|
||||
name: Pixel
|
||||
brand:
|
||||
"@type": Brand
|
||||
name: Google
|
||||
image: /assets/img/android/google-pixel.png
|
||||
sameAs: https://en.wikipedia.org/wiki/Google_Pixel
|
||||
review:
|
||||
"@type": Review
|
||||
author:
|
||||
"@type": Organization
|
||||
name: Privacy Guides
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Shelter
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Auditor
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Secure Camera
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Secure PDF Viewer
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
---
|
||||
|
||||
{ align=right }
|
||||
|
||||
The **Android Open Source Project** is an open-source mobile operating system led by Google which powers the majority of the world's mobile devices. Most phones sold with Android are modified to include invasive integrations and apps such as Google Play Services, so you can significantly improve your privacy on your mobile device by replacing your phone's default installation with a version of Android without these invasive features.
|
||||
|
||||
[:octicons-home-16:](https://source.android.com){ .card-link title=Homepage }
|
||||
[:octicons-info-16:](https://source.android.com/docs){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://cs.android.com/android/platform/superproject){ .card-link title="Source Code" }
|
||||
|
||||
These are the Android operating systems, devices, and apps we recommend to maximize your mobile device's security and privacy. To learn more about Android:
|
||||
|
||||
[General Android Overview :material-arrow-right-drop-circle:](os/android-overview.md){ .md-button }
|
||||
|
||||
## AOSP Derivatives
|
||||
|
||||
We recommend installing one of these custom Android operating systems on your device, listed in order of preference, depending on your device's compatibility with these operating systems.
|
||||
|
||||
<div class="admonition note" markdown>
|
||||
<p class="admonition-title">Note</p>
|
||||
|
||||
End-of-life devices (such as GrapheneOS's or CalyxOS's "extended support" devices) do not have full security patches (firmware updates) due to the OEM discontinuing support. These devices cannot be considered completely secure regardless of installed software.
|
||||
|
||||
</div>
|
||||
|
||||
### GrapheneOS
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**GrapheneOS** is the best choice when it comes to privacy and security.
|
||||
|
||||
GrapheneOS provides additional [security hardening](https://en.wikipedia.org/wiki/Hardening_(computing)) and privacy improvements. It has a [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), network and sensor permissions, and various other [security features](https://grapheneos.org/features). GrapheneOS also comes with full firmware updates and signed builds, so verified boot is fully supported.
|
||||
|
||||
[:octicons-home-16: Homepage](https://grapheneos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://grapheneos.org/faq#privacy-policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://grapheneos.org/faq){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://grapheneos.org/source){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), which runs [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) fully sandboxed like any other regular app. This means you can take advantage of most Google Play Services, such as [push notifications](https://firebase.google.com/docs/cloud-messaging), while giving you full control over their permissions and access, and while containing them to a specific [work profile](os/android-overview.md#work-profile) or [user profile](os/android-overview.md#user-profiles) of your choice.
|
||||
|
||||
Google Pixel phones are the only devices that currently meet GrapheneOS's [hardware security requirements](https://grapheneos.org/faq#future-devices).
|
||||
|
||||
[Why we recommend GrapheneOS over CalyxOS :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos){ .md-button }
|
||||
|
||||
### DivestOS
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org).
|
||||
DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
|
||||
|
||||
[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" }
|
||||
[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates.
|
||||
DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled.
|
||||
|
||||
DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) and SENSORS permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and higher features GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features).
|
||||
|
||||
DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repositories ([DivestOS Official](https://divestos.org/fdroid/official/?fingerprint=E4BE8D6ABFA4D9D4FEEF03CDDA7FF62A73FD64B75566F6DD4E5E577550BE8467) and [DivestOS WebView](https://divestos.org/fdroid/webview/?fingerprint=FB426DA1750A53D7724C8A582B4D34174E64A84B38940E5D5A802E1DFF9A40D2)). We recommend disabling the official F-Droid app and using [F-Droid Basic](https://f-droid.org/en/packages/org.fdroid.basic) **with the DivestOS repositories enabled** to keep those components up to date. For other apps, our recommended methods of obtaining them still apply.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
DivestOS firmware update [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) and quality control varies across the devices it supports. We still recommend GrapheneOS depending on your device's compatibility. For other devices, DivestOS is a good alternative.
|
||||
|
||||
Not all of the supported devices have verified boot, and some perform it better than others.
|
||||
|
||||
</div>
|
||||
|
||||
## Android Devices
|
||||
|
||||
When purchasing a device, we recommend getting one as new as possible. The software and firmware of mobile devices are only supported for a limited time, so buying new extends that lifespan as much as possible.
|
||||
|
||||
Avoid buying phones from mobile network operators. These often have a **locked bootloader** and do not support [OEM unlocking](https://source.android.com/devices/bootloader/locking_unlocking). These phone variants will prevent you from installing any kind of alternative Android distribution.
|
||||
|
||||
Be very **careful** about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen, there's a possibility of it being entered in the [IMEI database](https://gsma.com/get-involved/working-groups/terminal-steering-group/imei-database). There is also a risk involved with you being associated with the activity of the previous owner.
|
||||
|
||||
A few more tips regarding Android devices and operating system compatibility:
|
||||
|
||||
- Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.
|
||||
- Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper [Verified Boot](https://source.android.com/security/verifiedboot) support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
|
||||
- In short, if a device or Android distribution is not listed here, there is probably a good reason. Check out our [forum](https://discuss.privacyguides.net) to find details!
|
||||
|
||||
### Google Pixel
|
||||
|
||||
Google Pixel phones are the **only** devices we recommend for purchase. Pixel phones have stronger hardware security than any other Android devices currently on the market, due to proper AVB support for third-party operating systems and Google's custom [Titan](https://security.googleblog.com/2021/10/pixel-6-setting-new-standard-for-mobile.html) security chips acting as the Secure Element.
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Google Pixel** devices are known to have good security and properly support [Verified Boot](https://source.android.com/security/verifiedboot), even when installing custom operating systems.
|
||||
|
||||
Beginning with the **Pixel 8** and **8 Pro**, Pixel devices receive a minimum of 7 years of guaranteed security updates, ensuring a much longer lifespan compared to the 2-5 years competing OEMs typically offer.
|
||||
|
||||
[:material-shopping: Store](https://store.google.com/category/phones){ .md-button .md-button--primary }
|
||||
|
||||
</div>
|
||||
|
||||
Secure Elements like the Titan M2 are more limited than the processor's Trusted Execution Environment used by most other phones as they are only used for secrets storage, hardware attestation, and rate limiting, not for running "trusted" programs. Phones without a Secure Element have to use the TEE for *all* of those functions, resulting in a larger attack surface.
|
||||
|
||||
Google Pixel phones use a TEE OS called Trusty which is [open source](https://source.android.com/security/trusty#whyTrusty), unlike many other phones.
|
||||
|
||||
The installation of GrapheneOS on a Pixel phone is easy with their [web installer](https://grapheneos.org/install/web). If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the [NitroPhone](https://shop.nitrokey.com/shop) as they come preloaded with GrapheneOS from the reputable [Nitrokey](https://nitrokey.com/about) company.
|
||||
|
||||
A few more tips for purchasing a Google Pixel:
|
||||
|
||||
- If you're after a bargain on a Pixel device, we suggest buying an "**a**" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
|
||||
- Consider price beating options and specials offered at physical stores.
|
||||
- Look at online community bargain sites in your country. These can alert you to good sales.
|
||||
- Google provides a list showing the [support cycle](https://support.google.com/nexus/answer/4457705) for each one of their devices. The price per day for a device can be calculated as:
|
||||
<math xmlns="http://www.w3.org/1998/Math/MathML" display="inline" class="tml-display" style="display:inline math;">
|
||||
<mfrac>
|
||||
<mtext>Cost</mtext>
|
||||
<mrow>
|
||||
<mtext>End of Life Date</mtext>
|
||||
<mo>−</mo>
|
||||
<mtext>Current Date</mtext>
|
||||
</mrow>
|
||||
</mfrac>
|
||||
</math>
|
||||
, meaning that the longer use of the device the lower cost per day.
|
||||
- If the Pixel is unavailable in your region, the [NitroPhone](https://shop.nitrokey.com/shop) can be shipped globally.
|
||||
|
||||
## General Apps
|
||||
|
||||
We recommend a wide variety of Android apps throughout this site. The apps listed here are Android-exclusive and specifically enhance or replace key system functionality.
|
||||
|
||||
### Shelter
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Shelter** is an app that helps you leverage Android's Work Profile functionality to isolate or duplicate apps on your device.
|
||||
|
||||
Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager ([DocumentsUI](https://source.android.com/devices/architecture/modular-system/documentsui)).
|
||||
|
||||
[:octicons-repo-16: Repository](https://gitea.angry.im/PeterCxy/Shelter#shelter){ .md-button .md-button--primary }
|
||||
[:octicons-code-16:](https://gitea.angry.im/PeterCxy/Shelter){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://patreon.com/PeterCxy){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Shelter is recommended over [Insular](https://secure-system.gitlab.io/Insular) and [Island](https://github.com/oasisfeng/island) as it supports [contact search blocking](https://secure-system.gitlab.io/Insular/faq.html).
|
||||
|
||||
When using Shelter, you are placing complete trust in its developer, as Shelter acts as a [Device Admin](https://developer.android.com/guide/topics/admin/device-admin) to create the Work Profile, and it has extensive access to the data stored within the Work Profile.
|
||||
|
||||
</div>
|
||||
|
||||
### Secure Camera
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Secure Camera** is a camera app focused on privacy and security which can capture images, videos and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/GrapheneOS/Camera){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://grapheneos.org/usage#camera){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/GrapheneOS/Camera){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.camera.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/Camera/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Main privacy features include:
|
||||
|
||||
- Auto removal of [Exif](https://en.wikipedia.org/wiki/Exif) metadata (enabled by default)
|
||||
- Use of the new [Media](https://developer.android.com/training/data-storage/shared/media) API, therefore [storage permissions](https://developer.android.com/training/data-storage) are not required
|
||||
- Microphone permission not required unless you want to record sound
|
||||
|
||||
<div class="admonition note" markdown>
|
||||
<p class="admonition-title">Note</p>
|
||||
|
||||
Metadata is not currently deleted from video files but that is planned.
|
||||
|
||||
The image orientation metadata is not deleted. If you enable location (in Secure Camera) that **won't** be deleted either. If you want to delete that later you will need to use an external app such as [ExifEraser](data-redaction.md#exiferaser-android).
|
||||
|
||||
</div>
|
||||
|
||||
### Secure PDF Viewer
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [webview](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files.
|
||||
|
||||
[Content-Security-Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) is used to enforce that the JavaScript and styling properties within the WebView are entirely static content.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/GrapheneOS/PdfViewer){ .md-button .md-button--primary }
|
||||
[:octicons-code-16:](https://github.com/GrapheneOS/PdfViewer){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.pdfviewer.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/PdfViewer/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
## Obtaining Applications
|
||||
|
||||
### Obtainium
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Obtainium** is an app manager which allows you to install and update apps directly from the developer's own releases page (i.e. GitHub, GitLab, the developer's website, etc.), rather than a centralized app store/repository. It supports automatic background updates on Android 12 and higher.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/ImranR98/Obtainium#readme){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://github.com/ImranR98/Obtainium/wiki){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/ImranR98/Obtainium){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://github.com/sponsors/ImranR98){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-github: GitHub](https://github.com/ImranR98/Obtainium/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Obtainium allows you to download APK installer files from a wide variety of sources, and it is up to you to ensure those sources and apps are legitimate. For example, using Obtainium to install Signal from [Signal's APK landing page](https://signal.org/android/apk) should be fine, but installing from third-party APK repositories like Aptoide or APKPure may pose additional risks. The risk of installing a malicious *update* is lower, because Android itself verifies that all app updates are signed by the same developer as the existing app on your phone before installing them.
|
||||
|
||||
### GrapheneOS App Store
|
||||
|
||||
GrapheneOS's app store is available on [GitHub](https://github.com/GrapheneOS/Apps/releases). It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the [Auditor](https://attestation.app), [Camera](https://github.com/GrapheneOS/Camera), and [PDF Viewer](https://github.com/GrapheneOS/PdfViewer). If you are looking for these applications, we highly recommend that you get them from GrapheneOS's app store instead of the Play Store, as the apps on their store are signed by the GrapheneOS's project own signature that Google does not have access to.
|
||||
|
||||
### Aurora Store
|
||||
|
||||
The Google Play Store requires a Google account to login which is not great for privacy. You can get around this by using an alternative client, such as Aurora Store.
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Aurora Store** is a Google Play Store client which does not require a Google Account, Google Play Services, or microG to download apps.
|
||||
|
||||
[:octicons-home-16: Homepage](https://auroraoss.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://gitlab.com/AuroraOSS/AuroraStore/-/blob/master/POLICY.md){ .card-link title="Privacy Policy" }
|
||||
[:octicons-code-16:](https://gitlab.com/AuroraOSS/AuroraStore){ .card-link title="Source Code" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-gitlab: GitLab](https://gitlab.com/AuroraOSS/AuroraStore/-/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Aurora Store does not allow you to download paid apps with their anonymous account feature. You can optionally log in with your Google account with Aurora Store to download apps you have purchased, which does give access to the list of apps you've installed to Google. However, you still benefit from not requiring the full Google Play client and Google Play Services or microG on your device.
|
||||
|
||||
### Manually with RSS Notifications
|
||||
|
||||
For apps that are released on platforms like GitHub and GitLab, you may be able to add an RSS feed to your [news aggregator](news-aggregators.md) that will help you keep track of new releases.
|
||||
|
||||
   
|
||||
|
||||
#### GitHub
|
||||
|
||||
On GitHub, using [Secure Camera](#secure-camera) as an example, you would navigate to its [releases page](https://github.com/GrapheneOS/Camera/releases) and append `.atom` to the URL:
|
||||
|
||||
`https://github.com/GrapheneOS/Camera/releases.atom`
|
||||
|
||||
#### GitLab
|
||||
|
||||
On GitLab, using [Aurora Store](#aurora-store) as an example, you would navigate to its [project repository](https://gitlab.com/AuroraOSS/AuroraStore) and append `/-/tags?format=atom` to the URL:
|
||||
|
||||
`https://gitlab.com/AuroraOSS/AuroraStore/-/tags?format=atom`
|
||||
|
||||
#### Verifying APK Fingerprints
|
||||
|
||||
If you download APK files to install manually, you can verify their signature with the [`apksigner`](https://developer.android.com/studio/command-line/apksigner) tool, which is a part of Android [build-tools](https://developer.android.com/studio/releases/build-tools).
|
||||
|
||||
1. Install [Java JDK](https://oracle.com/java/technologies/downloads).
|
||||
|
||||
2. Download the [Android Studio command line tools](https://developer.android.com/studio#command-tools).
|
||||
|
||||
3. Extract the downloaded archive:
|
||||
|
||||
```bash
|
||||
unzip commandlinetools-*.zip
|
||||
cd cmdline-tools
|
||||
./bin/sdkmanager --sdk_root=./ "build-tools;29.0.3"
|
||||
```
|
||||
|
||||
4. Run the signature verification command:
|
||||
|
||||
```bash
|
||||
./build-tools/29.0.3/apksigner verify --print-certs ../Camera-37.apk
|
||||
```
|
||||
|
||||
5. The resulting hashes can then be compared with another source. Some developers such as Signal [show the fingerprints](https://signal.org/android/apk) on their website.
|
||||
|
||||
```bash
|
||||
Signer #1 certificate DN: CN=GrapheneOS
|
||||
Signer #1 certificate SHA-256 digest: 6436b155b917c2f9a9ed1d15c4993a5968ffabc94947c13f2aeee14b7b27ed59
|
||||
Signer #1 certificate SHA-1 digest: 23e108677a2e1b1d6e6b056f3bb951df7ad5570c
|
||||
Signer #1 certificate MD5 digest: dbbcd0cac71bd6fa2102a0297c6e0dd3
|
||||
```
|
||||
|
||||
### F-Droid
|
||||
|
||||
{ align=right width=120px }
|
||||
|
||||
==We only recommend F-Droid as a way to obtain apps which cannot be obtained via the means above.== F-Droid is often recommended as an alternative to Google Play, particularly in the privacy community. The option to add third-party repositories and not be confined to Google's walled garden has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds) for some applications and is dedicated to free and open-source software. However, there are some security-related downsides to how F-Droid builds, signs, and delivers packages:
|
||||
|
||||
Due to their process of building apps, apps in the official F-Droid repository often fall behind on updates. F-Droid maintainers also reuse package IDs while signing apps with their own keys, which is not ideal as it gives the F-Droid team ultimate trust. Additionally, the requirements for an app to be included in the official F-Droid repo are less strict than other app stores like Google Play, meaning that F-Droid tends to host a lot more apps which are older, unmaintained, or otherwise no longer meet [modern security standards](https://developer.android.com/google/play/requirements/target-sdk).
|
||||
|
||||
Other popular third-party repositories for F-Droid such as [IzzyOnDroid](https://apt.izzysoft.de/fdroid) alleviate some of these concerns. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. However, it is not something that we can fully recommend, as apps are typically [removed](https://github.com/vfsfitvnm/ViMusic/issues/240#issuecomment-1225564446) from that repository if they are later added to the main F-Droid repository. While that makes sense (since the goal of that particular repository is to host apps before they're accepted into the main F-Droid repository), it can leave you with installed apps which no longer receive updates.
|
||||
|
||||
That said, the [F-Droid](https://f-droid.org/en/packages) and [IzzyOnDroid](https://apt.izzysoft.de/fdroid) repositories are home to countless apps, so they can be a useful tool to search for and discover open-source apps that you can then download through other means such as the Play Store, Aurora Store, or by getting the APK directly from the developer. You should use your best judgement when looking for new apps via this method, and keep an eye on how frequently the app is updated. Outdated apps may rely on unsupported libraries, among other things, posing a potential security risk.
|
||||
|
||||
<div class="admonition note" markdown>
|
||||
<p class="admonition-title">F-Droid Basic</p>
|
||||
|
||||
In some rare cases, the developer of an app will only distribute it through F-Droid ([Gadgetbridge](https://gadgetbridge.org) is one example of this). If you really need an app like that, we recommend using the newer [F-Droid Basic](https://f-droid.org/en/packages/org.fdroid.basic) client instead of the original F-Droid app to obtain it. F-Droid Basic supports automatic background updates without privileged extension or root, and has a reduced feature set (limiting attack surface).
|
||||
|
||||
</div>
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
### Operating Systems
|
||||
|
||||
- Must be open-source software.
|
||||
- Must support bootloader locking with custom AVB key support.
|
||||
- Must receive major Android updates within 0-1 months of release.
|
||||
- Must receive Android feature updates (minor version) within 0-14 days of release.
|
||||
- Must receive regular security patches within 0-5 days of release.
|
||||
- Must **not** be "rooted" out of the box.
|
||||
- Must **not** enable Google Play Services by default.
|
||||
- Must **not** require system modification to support Google Play Services.
|
||||
|
||||
### Devices
|
||||
|
||||
- Must support at least one of our recommended custom operating systems.
|
||||
- Must be currently sold new in stores.
|
||||
- Must receive a minimum of 5 years of security updates.
|
||||
- Must have dedicated secure element hardware.
|
||||
|
||||
### Applications
|
||||
|
||||
- Applications on this page must not be applicable to any other software category on the site.
|
||||
- General applications should extend or replace core system functionality.
|
||||
- Applications should receive regular updates and maintenance.
|
||||
@@ -1,108 +0,0 @@
|
||||
---
|
||||
meta_title: "The Best Custom Android OSes (aka Custom ROMs) - Privacy Guides"
|
||||
title: "Alternative Distributions"
|
||||
description: You can replace the operating system on your Android phone with these secure and privacy-respecting alternatives.
|
||||
schema:
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
name: Private Android Operating Systems
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: GrapheneOS
|
||||
image: /assets/img/android/grapheneos.svg
|
||||
url: https://grapheneos.org/
|
||||
sameAs: https://en.wikipedia.org/wiki/GrapheneOS
|
||||
subjectOf:
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: Divest
|
||||
image: /assets/img/android/divestos.svg
|
||||
url: https://divestos.org/
|
||||
sameAs: https://en.wikipedia.org/wiki/DivestOS
|
||||
subjectOf:
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
---
|
||||
A **custom Android-based operating system** (often known as a **custom ROM**) is a popular way to achieve higher levels of privacy and security on your device. This is in contrast to the "stock" version of Android which comes with your phone from the factory, and is often deeply integrated with Google Play Services.
|
||||
|
||||
We recommend installing one of these custom Android operating systems on your device, listed in order of preference, depending on your device's compatibility with these operating systems.
|
||||
|
||||
## AOSP Derivatives
|
||||
|
||||
### GrapheneOS
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**GrapheneOS** is the best choice when it comes to privacy and security.
|
||||
|
||||
GrapheneOS provides additional [security hardening](https://en.wikipedia.org/wiki/Hardening_(computing)) and privacy improvements. It has a [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), network and sensor permissions, and various other [security features](https://grapheneos.org/features). GrapheneOS also comes with full firmware updates and signed builds, so verified boot is fully supported.
|
||||
|
||||
[:octicons-home-16: Homepage](https://grapheneos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://grapheneos.org/faq#privacy-policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://grapheneos.org/faq){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://grapheneos.org/source){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), which runs [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) fully sandboxed like any other regular app. This means you can take advantage of most Google Play Services, such as [push notifications](https://firebase.google.com/docs/cloud-messaging), while giving you full control over their permissions and access, and while containing them to a specific [work profile](../os/android-overview.md#work-profile) or [user profile](../os/android-overview.md#user-profiles) of your choice.
|
||||
|
||||
[Google Pixel phones](../mobile-phones.md#google-pixel) are the only devices that currently meet GrapheneOS's [hardware security requirements](https://grapheneos.org/faq#future-devices).
|
||||
|
||||
### DivestOS
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org).
|
||||
DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
|
||||
|
||||
[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" }
|
||||
[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates.
|
||||
DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled.
|
||||
|
||||
DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) and SENSORS permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and higher features GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, [automatic reboot](https://grapheneos.org/features#auto-reboot), and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction).
|
||||
|
||||
DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repositories ([DivestOS Official](https://divestos.org/fdroid/official/?fingerprint=E4BE8D6ABFA4D9D4FEEF03CDDA7FF62A73FD64B75566F6DD4E5E577550BE8467) and [DivestOS WebView](https://divestos.org/fdroid/webview/?fingerprint=FB426DA1750A53D7724C8A582B4D34174E64A84B38940E5D5A802E1DFF9A40D2)). We recommend disabling the official F-Droid app and using [F-Droid Basic](https://f-droid.org/en/packages/org.fdroid.basic) **with the DivestOS repositories enabled** to keep those components up to date. For other apps, our recommended methods of obtaining them still apply.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
DivestOS firmware update [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) and quality control varies across the devices it supports. We still recommend GrapheneOS depending on your device's compatibility. For other devices, DivestOS is a good alternative.
|
||||
|
||||
Not all of the supported devices have verified boot, and some perform it better than others.
|
||||
|
||||
</div>
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
- Must be open-source software.
|
||||
- Must support bootloader locking with custom AVB key support.
|
||||
- Must receive major Android updates within 0-1 months of release.
|
||||
- Must receive Android feature updates (minor version) within 0-14 days of release.
|
||||
- Must receive regular security patches within 0-5 days of release.
|
||||
- Must **not** be "rooted" out of the box.
|
||||
- Must **not** enable Google Play Services by default.
|
||||
- Must **not** require system modification to support Google Play Services.
|
||||
@@ -1,127 +0,0 @@
|
||||
---
|
||||
title: "General Apps"
|
||||
schema:
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
name: General Android Apps
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Shelter
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Secure Camera
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Secure PDF Viewer
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
---
|
||||
We recommend a wide variety of Android apps throughout this site. The apps listed here are Android-exclusive and specifically enhance or replace key system functionality.
|
||||
|
||||
### Shelter
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Shelter** is an app that helps you leverage Android's Work Profile functionality to isolate or duplicate apps on your device.
|
||||
|
||||
Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager ([DocumentsUI](https://source.android.com/devices/architecture/modular-system/documentsui)).
|
||||
|
||||
[:octicons-repo-16: Repository](https://gitea.angry.im/PeterCxy/Shelter#shelter){ .md-button .md-button--primary }
|
||||
[:octicons-code-16:](https://gitea.angry.im/PeterCxy/Shelter){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://patreon.com/PeterCxy){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Shelter is recommended over [Insular](https://secure-system.gitlab.io/Insular) and [Island](https://github.com/oasisfeng/island) as it supports [contact search blocking](https://secure-system.gitlab.io/Insular/faq.html).
|
||||
|
||||
When using Shelter, you are placing complete trust in its developer, as Shelter acts as a [Device Admin](https://developer.android.com/guide/topics/admin/device-admin) to create the Work Profile, and it has extensive access to the data stored within the Work Profile.
|
||||
|
||||
</div>
|
||||
|
||||
### Secure Camera
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Secure Camera** is a camera app focused on privacy and security which can capture images, videos, and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/GrapheneOS/Camera){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://grapheneos.org/usage#camera){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/GrapheneOS/Camera){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.camera.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/Camera/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Main privacy features include:
|
||||
|
||||
- Auto removal of [Exif](https://en.wikipedia.org/wiki/Exif) metadata (enabled by default)
|
||||
- Use of the new [Media](https://developer.android.com/training/data-storage/shared/media) API, therefore [storage permissions](https://developer.android.com/training/data-storage) are not required
|
||||
- Microphone permission not required unless you want to record sound
|
||||
|
||||
<div class="admonition note" markdown>
|
||||
<p class="admonition-title">Note</p>
|
||||
|
||||
Metadata is not currently deleted from video files but that is planned.
|
||||
|
||||
The image orientation metadata is not deleted. If you enable location (in Secure Camera) that **won't** be deleted either. If you want to delete that later you will need to use an external app such as [ExifEraser](../data-redaction.md#exiferaser-android).
|
||||
|
||||
</div>
|
||||
|
||||
### Secure PDF Viewer
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [WebView](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files.
|
||||
|
||||
[Content-Security-Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) is used to enforce that the JavaScript and styling properties within the WebView are entirely static content.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/GrapheneOS/PdfViewer){ .md-button .md-button--primary }
|
||||
[:octicons-code-16:](https://github.com/GrapheneOS/PdfViewer){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.pdfviewer.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/PdfViewer/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
- Applications on this page must not be applicable to any other software category on the site.
|
||||
- General applications should extend or replace core system functionality.
|
||||
- Applications should receive regular updates and maintenance.
|
||||
@@ -1,36 +0,0 @@
|
||||
---
|
||||
title: "Android"
|
||||
icon: 'simple/android'
|
||||
cover: android.webp
|
||||
schema:
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
name: Android Recommendations
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: Android
|
||||
image: /assets/img/android/android.svg
|
||||
url: https://source.android.com/
|
||||
sameAs: https://en.wikipedia.org/wiki/Android_(operating_system)
|
||||
---
|
||||
|
||||
{ align=right }
|
||||
|
||||
The **Android Open Source Project** (AOSP) is an open-source mobile operating system led by Google which powers the majority of the world's mobile devices. Most phones sold with Android are modified to include invasive integrations and apps such as Google Play Services, so you can significantly improve your privacy on your mobile device by replacing your phone's default installation with a version of Android without these invasive features.
|
||||
|
||||
[:octicons-home-16:](https://source.android.com){ .card-link title=Homepage }
|
||||
[:octicons-info-16:](https://source.android.com/docs){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://cs.android.com/android/platform/superproject/main){ .card-link title="Source Code" }
|
||||
|
||||
We recommend the following Android-specific tools to maximize your mobile device's security and privacy.
|
||||
|
||||
- [Alternative Distributions](distributions.md)
|
||||
- [General Apps](general-apps.md)
|
||||
- [Obtaining Applications](obtaining-apps.md)
|
||||
|
||||
To learn more about Android:
|
||||
|
||||
[General Android Overview :material-arrow-right-drop-circle:](../os/android-overview.md){ .md-button }
|
||||
@@ -1,125 +0,0 @@
|
||||
---
|
||||
title: "Obtaining Applications"
|
||||
---
|
||||
There are many ways to obtain Android apps privately, even from the Play Store, without interacting with Google Play Services. We recommend the following methods of obtaining applications on Android, listed in order of preference.
|
||||
|
||||
## Obtainium
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Obtainium** is an app manager which allows you to install and update apps directly from the developer's own releases page (i.e. GitHub, GitLab, the developer's website, etc.), rather than a centralized app store/repository. It supports automatic background updates on Android 12 and higher.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/ImranR98/Obtainium#readme){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://github.com/ImranR98/Obtainium/wiki){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/ImranR98/Obtainium){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://github.com/sponsors/ImranR98){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-github: GitHub](https://github.com/ImranR98/Obtainium/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Obtainium allows you to download APK installer files from a wide variety of sources, and it is up to you to ensure those sources and apps are legitimate. For example, using Obtainium to install Signal from [Signal's APK landing page](https://signal.org/android/apk) should be fine, but installing from third-party APK repositories like Aptoide or APKPure may pose additional risks. The risk of installing a malicious *update* is lower, because Android itself verifies that all app updates are signed by the same developer as the existing app on your phone before installing them.
|
||||
|
||||
## GrapheneOS App Store
|
||||
|
||||
GrapheneOS's app store is available on [GitHub](https://github.com/GrapheneOS/Apps/releases). It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the [Auditor](../device-integrity.md#auditor-android), [Camera](general-apps.md#secure-camera), and [PDF Viewer](general-apps.md#secure-pdf-viewer). If you are looking for these applications, we highly recommend that you get them from GrapheneOS's app store instead of the Play Store, as the apps on their store are signed by the GrapheneOS's project own signature that Google does not have access to.
|
||||
|
||||
## Aurora Store
|
||||
|
||||
The Google Play Store requires a Google account to log in, which is not great for privacy. You can get around this by using an alternative client, such as Aurora Store.
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Aurora Store** is a Google Play Store client which does not require a Google account, Google Play Services, or microG to download apps.
|
||||
|
||||
[:octicons-home-16: Homepage](https://auroraoss.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://gitlab.com/AuroraOSS/AuroraStore/-/blob/master/POLICY.md){ .card-link title="Privacy Policy" }
|
||||
[:octicons-code-16:](https://gitlab.com/AuroraOSS/AuroraStore){ .card-link title="Source Code" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-gitlab: GitLab](https://gitlab.com/AuroraOSS/AuroraStore/-/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Aurora Store does not allow you to download paid apps with their anonymous account feature. You can optionally log in with your Google account with Aurora Store to download apps you have purchased, which does give access to the list of apps you've installed to Google. However, you still benefit from not requiring the full Google Play client and Google Play Services or microG on your device.
|
||||
|
||||
## Manually with RSS Notifications
|
||||
|
||||
For apps that are released on platforms like GitHub and GitLab, you may be able to add an RSS feed to your [news aggregator](../news-aggregators.md) that will help you keep track of new releases.
|
||||
|
||||
   
|
||||
|
||||
### GitHub
|
||||
|
||||
On GitHub, using [Secure Camera](general-apps.md#secure-camera) as an example, you would navigate to its [releases page](https://github.com/GrapheneOS/Camera/releases) and append `.atom` to the URL:
|
||||
|
||||
`https://github.com/GrapheneOS/Camera/releases.atom`
|
||||
|
||||
### GitLab
|
||||
|
||||
On GitLab, using [Aurora Store](#aurora-store) as an example, you would navigate to its [project repository](https://gitlab.com/AuroraOSS/AuroraStore) and append `/-/tags?format=atom` to the URL:
|
||||
|
||||
`https://gitlab.com/AuroraOSS/AuroraStore/-/tags?format=atom`
|
||||
|
||||
### Verifying APK Fingerprints
|
||||
|
||||
If you download APK files to install manually, you can verify their signature with the [`apksigner`](https://developer.android.com/studio/command-line/apksigner) tool, which is a part of Android [build-tools](https://developer.android.com/studio/releases/build-tools).
|
||||
|
||||
1. Install [Java JDK](https://oracle.com/java/technologies/downloads).
|
||||
|
||||
2. Download the [Android Studio command line tools](https://developer.android.com/studio#command-tools).
|
||||
|
||||
3. Extract the downloaded archive:
|
||||
|
||||
```bash
|
||||
unzip commandlinetools-*.zip
|
||||
cd cmdline-tools
|
||||
./bin/sdkmanager --sdk_root=./ "build-tools;29.0.3"
|
||||
```
|
||||
|
||||
4. Run the signature verification command:
|
||||
|
||||
```bash
|
||||
./build-tools/29.0.3/apksigner verify --print-certs ../Camera-37.apk
|
||||
```
|
||||
|
||||
5. The resulting hashes can then be compared with another source. Some developers such as Signal [show the fingerprints](https://signal.org/android/apk) on their website.
|
||||
|
||||
```bash
|
||||
Signer #1 certificate DN: CN=GrapheneOS
|
||||
Signer #1 certificate SHA-256 digest: 6436b155b917c2f9a9ed1d15c4993a5968ffabc94947c13f2aeee14b7b27ed59
|
||||
Signer #1 certificate SHA-1 digest: 23e108677a2e1b1d6e6b056f3bb951df7ad5570c
|
||||
Signer #1 certificate MD5 digest: dbbcd0cac71bd6fa2102a0297c6e0dd3
|
||||
```
|
||||
|
||||
## F-Droid
|
||||
|
||||
{ align=right width=120px }
|
||||
|
||||
==We only recommend F-Droid as a way to obtain apps which cannot be obtained via the means above.== F-Droid is often recommended as an alternative to Google Play, particularly within the privacy community. The option to add third-party repositories and not be confined to Google's walled garden has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds) for some applications and is dedicated to free and open-source software. However, there are some security-related downsides to how F-Droid builds, signs, and delivers packages:
|
||||
|
||||
Due to their process of building apps, apps in the *official* F-Droid repository often fall behind on updates. F-Droid maintainers also reuse package IDs while signing apps with their own keys, which is not ideal as it gives the F-Droid team ultimate trust. Additionally, the requirements for an app to be included in the official F-Droid repo are less strict than other app stores like Google Play, meaning that F-Droid tends to host a lot more apps which are older, unmaintained, or otherwise no longer meet [modern security standards](https://developer.android.com/google/play/requirements/target-sdk).
|
||||
|
||||
Other popular third-party repositories for F-Droid such as [IzzyOnDroid](https://apt.izzysoft.de/fdroid) alleviate some of these concerns. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. However, it is not something that we can fully recommend, as apps are typically [removed](https://github.com/vfsfitvnm/ViMusic/issues/240#issuecomment-1225564446) from that repository if they are later added to the main F-Droid repository. While that makes sense (since the goal of that particular repository is to host apps before they're accepted into the main F-Droid repository), it can leave you with installed apps which no longer receive updates.
|
||||
|
||||
That said, the [F-Droid](https://f-droid.org/en/packages) and [IzzyOnDroid](https://apt.izzysoft.de/fdroid) repositories are home to countless apps, so they can be a useful tool to search for and discover open-source apps that you can then download through other means such as the Play Store, Aurora Store, or by getting the APK directly from the developer. You should use your best judgement when looking for new apps via this method, and keep an eye on how frequently the app is updated. Outdated apps may rely on unsupported libraries, among other things, posing a potential security risk.
|
||||
|
||||
<div class="admonition note" markdown>
|
||||
<p class="admonition-title">F-Droid Basic</p>
|
||||
|
||||
In some rare cases, the developer of an app will only distribute it through F-Droid ([Gadgetbridge](https://gadgetbridge.org) is one example of this). If you really need an app like that, we recommend using the newer [F-Droid Basic](https://f-droid.org/en/packages/org.fdroid.basic) client instead of the original F-Droid app to obtain it. F-Droid Basic supports automatic background updates without privileged extension or root, and has a reduced feature set (limiting attack surface).
|
||||
|
||||
</div>
|
||||
@@ -38,14 +38,14 @@ With Monero, outside observers cannot decipher addresses trading Monero, transac
|
||||
For optimal privacy, make sure to use a noncustodial wallet where the view key stays on the device. This means that only you will have the ability to spend your funds and see incoming and outgoing transactions. If you use a custodial wallet, the provider can see **everything** you do; if you use a “lightweight” wallet where the provider retains your private view key, the provider can see almost everything you do. Some noncustodial wallets include:
|
||||
|
||||
- [Official Monero client](https://getmonero.org/downloads) (Desktop)
|
||||
- [Cake Wallet](https://cakewallet.com) (iOS, Android, macOS)
|
||||
- Cake Wallet supports multiple cryptocurrencies. A Monero-only version of Cake Wallet for iOS and Android is available at [Monero.com](https://monero.com).
|
||||
- [Cake Wallet](https://cakewallet.com) (iOS, Android, macOS, Linux BETA)
|
||||
- Cake Wallet supports multiple cryptocurrencies. A Monero-only version of Cake Wallet is available at [Monero.com](https://monero.com).
|
||||
- [Feather Wallet](https://featherwallet.org) (Desktop)
|
||||
- [Monerujo](https://monerujo.io) (Android)
|
||||
|
||||
For maximum privacy (even with a noncustodial wallet), you should run your own Monero node. Using another person’s node will expose some information to them, such as the IP address that you connect to it from, the timestamps that you sync your wallet, and the transactions that you send from your wallet (though no other details about those transactions). Alternatively, you can connect to someone else’s Monero node over Tor or [I2P](alternative-networks.md#i2p-the-invisible-internet-project).
|
||||
For maximum privacy (even with a noncustodial wallet), you should run your own Monero node. Using another person’s node will expose some information to them, such as the IP address that you connect to it from, the timestamps that you sync your wallet, and the transactions that you send from your wallet (though no other details about those transactions). Alternatively, you can connect to someone else’s Monero node over Tor or i2p.
|
||||
|
||||
In August 2021, CipherTrace [announced](https://web.archive.org/web/20240223224846/https://ciphertrace.com/enhanced-monero-tracing) enhanced Monero tracing capabilities for government agencies. Public postings show that the US Department of the Treasury's Financial Crimes Enforcement Network [licensed](https://sam.gov/opp/d12cbe9afbb94ca68006d0f006d355ac/view) CipherTrace's "Monero Module" in late 2022.
|
||||
In August 2021, CipherTrace [announced](https://ciphertrace.com/enhanced-monero-tracing) enhanced Monero tracing capabilities for government agencies. Public postings show that the US Department of the Treasury's Financial Crimes Enforcement Network [licensed](https://sam.gov/opp/d12cbe9afbb94ca68006d0f006d355ac/view) CipherTrace's "Monero Module" in late 2022.
|
||||
|
||||
Monero transaction graph privacy is limited by its relatively small ring signatures, especially against targeted attacks. Monero's privacy features have also been [called into question](https://web.archive.org/web/20180331203053/https://wired.com/story/monero-privacy) by some security researchers, and a number of severe vulnerabilities have been found and patched in the past, so the claims made by organizations like CipherTrace are not out of the question. While it's unlikely that Monero mass surveillance tools exist like they do for Bitcoin and others, it's certain that tracing tools assist with targeted investigations.
|
||||
|
||||
|
||||
@@ -253,6 +253,8 @@ Brave is built upon the Chromium web browser project, so it should feel familiar
|
||||
|
||||
</div>
|
||||
|
||||
**macOS users:** The download for Brave Browser from their official website is a `.pkg` installer which requires admin privileges to run (and may run other unnecessary scripts on your machine). As an alternative, you can download the latest `Brave-Browser-universal.dmg` file from their [GitHub releases](https://github.com/brave/brave-browser/releases/latest) page, which provides a traditional "drag to Applications folder" install.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
|
||||
@@ -162,9 +162,9 @@ Using these apps is insufficient to determine that a device is "clean", and not
|
||||
|
||||
</div>
|
||||
|
||||
Auditor is not a scanning/analysis tool like some other tools on this page. Rather, it uses your device's hardware-backed keystore to allow you to verify the identity of your device and gain assurance that the operating system itself hasn't been tampered with or downgraded via verified boot. This provides a very robust integrity check of your device itself, but doesn't necessarily check whether the user-level apps running on your device are malicious.
|
||||
Auditor is not a scanning/analysis tool like some other tools on this page; rather it uses your device's hardware-backed keystore to allow you to verify the identity of your device and gain assurance that the operating system itself hasn't been tampered with or downgraded via verified boot. This provides a very robust integrity check of your device itself, but doesn't necessarily check whether the user-level apps running on your device are malicious.
|
||||
|
||||
Auditor performs attestation and intrusion detection with **two** devices, an *auditee* (the device being verified) and an *auditor* (the device performing the verification). The auditor can be any Android 10+ device (or a remote web service operated by [GrapheneOS](android/distributions.md#grapheneos)), while the auditee must be a specifically [supported device](https://attestation.app/about#device-support). Auditor works by:
|
||||
Auditor performs attestation and intrusion detection with **two** devices, an *auditee* (the device being verified) and an *auditor* (the device performing the verification). The auditor can be any Android 10+ device (or a remote web service operated by [GrapheneOS](android.md#grapheneos)), while the auditee must be a specifically [supported device](https://attestation.app/about#device-support). Auditor works by:
|
||||
|
||||
- Using a [Trust On First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) model between an *auditor* and *auditee*, the pair establish a private key in the [hardware-backed keystore](https://source.android.com/security/keystore) of the *Auditor*.
|
||||
- The *auditor* can either be another instance of the Auditor app or the [Remote Attestation Service](https://attestation.app).
|
||||
@@ -196,7 +196,7 @@ Using these apps is insufficient to determine that a device is "clean", and not
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally).
|
||||
**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud. Scans are performed entirely locally.
|
||||
|
||||
[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" }
|
||||
|
||||
@@ -17,14 +17,12 @@ These are our favorite public DNS resolvers based on their privacy and security
|
||||
|
||||
| DNS Provider | Protocols | Logging / Privacy Policy | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||
|---|---|---|---|---|---|
|
||||
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) |
|
||||
| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:octicons-link-external-24:](https://docs.controld.com/docs/macos-platform) |
|
||||
| [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||
| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice, malware blocking by default. | Yes [:octicons-link-external-24:](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||
|
||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||
[^4]: dns0.eu collects some data for their threat intelligence feeds, to monitor for newly registered/observed/active domains and other bulk data. That data is shared with some [partners](https://docs.dns0.eu/data-feeds/introduction) for e.g. security research. They do not collect any Personally Identifiable Information. [https://dns0.eu/privacy](https://dns0.eu/privacy)
|
||||
|
||||
@@ -15,7 +15,7 @@ There are a number of services which provide "virtual debit cards" which you can
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Check your current bank</p>
|
||||
|
||||
Many banks and credit card providers offer native virtual card functionality. If you use one which provides this option already, you should use it over the following recommendations in most cases. That way, you are not trusting multiple parties with your personal information.
|
||||
Many banks and credit card providers offer native virtual card functionality. If you use one which provides this option already, you should use it over the following recommendations in most cases. That way you are not trusting multiple parties with your personal information.
|
||||
|
||||
</div>
|
||||
|
||||
@@ -26,7 +26,7 @@ Many banks and credit card providers offer native virtual card functionality. If
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Privacy.com**'s free plan allows you to create up to 12 virtual cards per month, set spend limits on those cards, and shut off cards instantly. Their paid plans provide higher limits on the number of cards that can be created each month and the option to hide transaction information from your bank.
|
||||
**Privacy.com**'s free plan allows you to create up to 12 virtual cards per month, set spend limits on those cards, and shut off cards instantly. Their paid plan allows you to create up to 36 cards per month, get 1% cash back on purchases, and hide transaction information from your bank.
|
||||
|
||||
[:octicons-home-16: Homepage](https://privacy.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://privacy.com/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -36,7 +36,7 @@ Many banks and credit card providers offer native virtual card functionality. If
|
||||
|
||||
</div>
|
||||
|
||||
Privacy.com gives information about the merchants you purchase from to your bank by default. Their paid "discreet merchants" feature hides merchant information from your bank, so your bank only sees that a purchase was made with Privacy.com, but not where that money was spent. However, that is not foolproof, and of course, Privacy.com still has knowledge about the merchants you are spending money with.
|
||||
Privacy.com gives information about the merchants you purchase from to your bank by default. Their paid "discreet merchants" feature hides merchant information from your bank, so your bank only sees that a purchase was made with Privacy.com but not where that money was spent, however that is not foolproof, and of course Privacy.com still has knowledge about the merchants you are spending money with.
|
||||
|
||||
### MySudo (US, Paid)
|
||||
|
||||
@@ -66,15 +66,15 @@ MySudo's virtual cards are currently only available via their iOS app.
|
||||
|
||||
## Gift Card Marketplaces
|
||||
|
||||
These services allow you to purchase gift cards for a variety of merchants online with [cryptocurrency](cryptocurrency.md). Some of these services offer ID verification options for higher limits, but they also allow accounts with just an email address. Basic limits typically start at $5,000-10,000 a day for basic accounts, with significantly higher limits for ID verified accounts (if offered).
|
||||
These services allow you to purchase gift cards for a variety of merchants online with [cryptocurrency](cryptocurrency.md). Some of these services offer ID verification options for higher limits, but they also allow accounts with just an email address. Basic limits typically start at $5,000-10,000 a day for basic accounts, and significantly higher limits for ID verified accounts (if offered).
|
||||
|
||||
### Coincards
|
||||
### CoinCards
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Coincards** allows you to purchase gift cards for a large variety of merchants. Their homepage has a complete listing of the various countries where their service is available.
|
||||
**CoinCards** (available in the US and Canada) allows you to purchase gift cards for a large variety of merchants.
|
||||
|
||||
[:octicons-home-16: Homepage](https://coincards.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://coincards.com/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@@ -104,7 +104,7 @@ By default, FreeTube blocks all YouTube advertisements. In addition, FreeTube op
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
When using FreeTube, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io), or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](vpn.md) or [Tor](tor.md) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
|
||||
When using FreeTube, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io) or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](vpn.md) or [Tor](tor.md) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
|
||||
|
||||
</div>
|
||||
|
||||
@@ -114,9 +114,9 @@ When using FreeTube, your IP address may still be known to YouTube, [Invidious](
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Yattee** is a free and open-source privacy oriented video player for iOS, tvOS, and macOS for [YouTube](https://youtube.com). When using Yattee, your subscription list is saved locally on your device.
|
||||
**Yattee** is a free and open-source privacy oriented video player for iOS, tvOS and macOS for [YouTube](https://youtube.com). When using Yattee, your subscription list are saved locally on your device.
|
||||
|
||||
You will need to take a few [extra steps](https://web.archive.org/web/20230330122839/https://gonzoknows.com/posts/Yattee) before you can use Yattee to watch YouTube, due to App Store restrictions.
|
||||
You will need to take a few [extra steps](https://gonzoknows.com/posts/Yattee) before you can use Yattee to watch YouTube, due to App Store restrictions.
|
||||
|
||||
[:octicons-home-16: Homepage](https://github.com/yattee/yattee){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://r.yattee.stream/docs/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -137,7 +137,7 @@ You will need to take a few [extra steps](https://web.archive.org/web/2023033012
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
When using Yattee, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io), [Piped](https://github.com/TeamPiped/Piped/wiki/Instances), or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](vpn.md) or [Tor](tor.md) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
|
||||
When using Yattee, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io), [Piped](https://github.com/TeamPiped/Piped/wiki/Instances) or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](vpn.md) or [Tor](tor.md) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -37,8 +37,6 @@ schema:
|
||||
query-input: required name=search_term_string
|
||||
---
|
||||
<!-- markdownlint-disable -->
|
||||
<div class="grid" markdown>
|
||||
<div markdown>
|
||||
## Why should I care?
|
||||
|
||||
##### “I have nothing to hide. Why should I care about my privacy?”
|
||||
@@ -48,9 +46,7 @@ Much like the right to interracial marriage, woman's suffrage, freedom of speech
|
||||
You shouldn't confuse privacy with secrecy. We know what happens in the bathroom, but you still close the door. That's because you want privacy, not secrecy. **Everyone** has something to protect. Privacy is something that makes us human.
|
||||
|
||||
[:material-book-outline: Why Privacy Matters](basics/why-privacy-matters.md){ class="md-button md-button--primary" }
|
||||
</div>
|
||||
|
||||
<div markdown>
|
||||
## What should I do?
|
||||
|
||||
##### First, you need to make a plan
|
||||
@@ -60,5 +56,3 @@ Trying to protect all your data from everyone all the time is impractical, expen
|
||||
==This process of identifying threats and defining countermeasures is called **threat modeling**==, and it forms the basis of every good security and privacy plan.
|
||||
|
||||
[:material-book-outline: Learn More About Threat Modeling](basics/threat-modeling.md){ class="md-button md-button--primary" }
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -1,102 +0,0 @@
|
||||
---
|
||||
title: "Mobile Phones"
|
||||
icon: material/cellphone-check
|
||||
description: These mobile devices have proper Android Verified Boot support for custom operating systems.
|
||||
cover: android.webp
|
||||
schema:
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
name: Mobile Phone Recommendations
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": Product
|
||||
name: Pixel
|
||||
brand:
|
||||
"@type": Brand
|
||||
name: Google
|
||||
image: /assets/img/android/google-pixel.png
|
||||
sameAs: https://en.wikipedia.org/wiki/Google_Pixel
|
||||
review:
|
||||
"@type": Review
|
||||
author:
|
||||
"@type": Organization
|
||||
name: Privacy Guides
|
||||
---
|
||||
Most **mobile phones** receive short or limited windows of security updates from OEMs; after these devices reach the end of their support period, they **cannot** be considered secure as they no longer receive firmware or driver security updates.
|
||||
|
||||
The mobile devices listed here provide a long lifespan of guaranteed security updates and allow you to install a custom operating system without violating the Android security model.
|
||||
|
||||
[Recommended Custom OSes :material-arrow-right-drop-circle:](android/distributions.md){ .md-button .md-button--primary } [Details about Android Security :material-arrow-right-drop-circle:](os/android-overview.md#security-protections){ .md-button }
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
End-of-life devices (such as GrapheneOS's "extended support" devices) do not have full security patches (firmware updates) due to the OEM discontinuing support. These devices cannot be considered completely secure regardless of installed software.
|
||||
|
||||
</div>
|
||||
|
||||
## Purchasing Advice
|
||||
|
||||
When purchasing a device, we recommend getting one as new as possible. The software and firmware of mobile devices are only supported for a limited time, so buying new extends that lifespan as much as possible.
|
||||
|
||||
Avoid buying phones from mobile network operators. These often have a **locked bootloader** and do not support [OEM unlocking](https://source.android.com/devices/bootloader/locking_unlocking). These phone variants will prevent you from installing any kind of alternative Android distribution.
|
||||
|
||||
Be very **careful** about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen, there's a possibility of it being entered in the [IMEI database](https://gsma.com/get-involved/working-groups/terminal-steering-group/imei-database). There is also a risk involved with you being associated with the activity of the previous owner.
|
||||
|
||||
A few more tips regarding Android devices and operating system compatibility:
|
||||
|
||||
- Do not buy devices that have reached or are near their end-of-life; additional firmware updates must be provided by the manufacturer.
|
||||
- Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper [Verified Boot](https://source.android.com/security/verifiedboot) support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
|
||||
- In short, if a device is not listed here, there is probably a good reason. Check out our [forum](https://discuss.privacyguides.net) to find details!
|
||||
|
||||
## Google Pixel
|
||||
|
||||
Google Pixel phones are the **only** devices we recommend for purchase. Pixel phones have stronger hardware security than any other Android devices currently on the market, due to proper AVB support for third-party operating systems and Google's custom [Titan](https://security.googleblog.com/2021/10/pixel-6-setting-new-standard-for-mobile.html) security chips acting as the Secure Element.
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Google Pixel** devices are known to have good security and properly support [Verified Boot](https://source.android.com/security/verifiedboot), even when installing custom operating systems.
|
||||
|
||||
Beginning with the **Pixel 8** and **8 Pro**, Pixel devices receive a minimum of 7 years of guaranteed security updates, ensuring a much longer lifespan compared to the 2-5 years competing OEMs typically offer.
|
||||
|
||||
[:material-shopping: Store](https://store.google.com/category/phones){ .md-button .md-button--primary }
|
||||
|
||||
</div>
|
||||
|
||||
Secure Elements like the Titan M2 are more limited than the processor's Trusted Execution Environment used by most other phones as they are only used for secrets storage, hardware attestation, and rate limiting, not for running "trusted" programs. Phones without a Secure Element have to use the TEE for *all* of those functions, resulting in a larger attack surface.
|
||||
|
||||
Google Pixel phones use a TEE OS called Trusty which is [open source](https://source.android.com/security/trusty#whyTrusty), unlike many other phones.
|
||||
|
||||
The installation of GrapheneOS on a Pixel phone is easy with their [web installer](https://grapheneos.org/install/web). If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the [NitroPhone](https://shop.nitrokey.com/shop) as they come preloaded with GrapheneOS from the reputable [Nitrokey](https://nitrokey.com/about) company.
|
||||
|
||||
A few more tips for purchasing a Google Pixel:
|
||||
|
||||
- If you're after a bargain on a Pixel device, we suggest buying an "**a**" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
|
||||
- Consider price beating options and specials offered at physical stores.
|
||||
- Look at online community bargain sites in your country. These can alert you to good sales.
|
||||
- Google provides a list showing the [support cycle](https://support.google.com/nexus/answer/4457705) for each one of their devices. The price per day for a device can be calculated as:
|
||||
<math xmlns="http://www.w3.org/1998/Math/MathML" display="inline" class="tml-display" style="display:inline math;">
|
||||
<mfrac>
|
||||
<mtext>Cost</mtext>
|
||||
<mrow>
|
||||
<mtext>End of Life Date</mtext>
|
||||
<mo>−</mo>
|
||||
<mtext>Current Date</mtext>
|
||||
</mrow>
|
||||
</mfrac>
|
||||
</math>
|
||||
, meaning that the longer use of the device the lower cost per day.
|
||||
- If the Pixel is unavailable in your region, the [NitroPhone](https://shop.nitrokey.com/shop) can be shipped globally.
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
- Must support at least one of our recommended custom operating systems.
|
||||
- Must be currently sold new in stores.
|
||||
- Must receive a minimum of 5 years of security updates.
|
||||
- Must have dedicated secure element hardware.
|
||||
@@ -20,7 +20,7 @@ We highly recommend that you use mobile TOTP apps instead of desktop alternative
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Auth** is a free and open-source app which stores and generates TOTP tokens. It can be used with an online account to backup and sync your tokens across your devices (and access them via a web interface) in a secure, end-to-end encrypted fashion. It can also be used offline on a single device with no account necessary.
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ This problem could be solved by using a custom Android distribution that does no
|
||||
|
||||
Ideally, when choosing a custom Android distribution, you should make sure that it upholds the Android security model. At the very least, the distribution should have production builds, support for AVB, rollback protection, timely firmware and operating system updates, and SELinux in [enforcing mode](https://source.android.com/security/selinux/concepts#enforcement_levels). All of our recommended Android distributions satisfy these criteria.
|
||||
|
||||
[Our Android System Recommendations :material-arrow-right-drop-circle:](../android/distributions.md){ .md-button }
|
||||
[Our Android System Recommendations :material-arrow-right-drop-circle:](../android.md){ .md-button }
|
||||
|
||||
### Avoid Rooting
|
||||
|
||||
@@ -124,7 +124,7 @@ With user profiles, you can impose restrictions on a specific profile, such as:
|
||||
|
||||
[Work Profiles](https://support.google.com/work/android/answer/6191949) are another way to isolate individual apps and may be more convenient than separate user profiles.
|
||||
|
||||
A **device controller** app such as [Shelter](../android/general-apps.md#shelter) is required to create a Work Profile without an enterprise MDM, unless you're using a custom Android OS which includes one.
|
||||
A **device controller** app such as [Shelter](../android.md#shelter) is required to create a Work Profile without an enterprise MDM, unless you're using a custom Android OS which includes one.
|
||||
|
||||
The work profile is dependent on a device controller to function. Features such as *File Shuttle* and *contact search blocking* or any kind of isolation features must be implemented by the controller. You must also fully trust the device controller app, as it has full access to your data inside the work profile.
|
||||
|
||||
@@ -144,7 +144,7 @@ If you are using a device with Google services—whether with the stock operatin
|
||||
|
||||
### Advanced Protection Program
|
||||
|
||||
If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection). It is available at no cost to anyone with two or more hardware security keys with [FIDO](../basics/multi-factor-authentication.md#fido-fast-identity-online) support. Alternatively, you can use [passkeys](https://fidoalliance.org/passkeys).
|
||||
If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection). It is available at no cost to anyone with two or more hardware security keys with [FIDO](../basics/multi-factor-authentication.md#fido-fast-identity-online) support.
|
||||
|
||||
The Advanced Protection Program provides enhanced threat monitoring and enables:
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@ title: Operating Systems
|
||||
---
|
||||
We publish configuration guides for the major operating systems, because you can generally improve the amount of data that is collected about you on any option, especially if you use [privacy tools](../tools.md) like our recommended web browsers in place of native tools where appropriate. However, some operating systems will be more privacy-respecting inherently, and it will be much harder to achieve an equivalent level of privacy on other choices.
|
||||
|
||||
If you're starting from scratch, we strongly recommend [Linux](../desktop.md) on desktop and [Android](../android/index.md) on mobile. If you already use something else and aren't interested in switching, we hope you'll find these guides useful.
|
||||
If you're starting from scratch, we strongly recommend [Linux](../desktop.md) on desktop and [Android](../android.md) on mobile. If you already use something else and aren't interested in switching, we hope you'll find these guides useful.
|
||||
|
||||
## Mobile Operating Systems
|
||||
|
||||
|
||||
@@ -9,7 +9,7 @@ description: iOS is a mobile operating system developed by Apple for the iPhone.
|
||||
|
||||
iOS devices are frequently praised by security experts for their robust data protection and adherence to modern best practices. However, the restrictiveness of Apple's ecosystem—particularly with their mobile devices—does still hamper privacy in a number of ways.
|
||||
|
||||
We generally consider iOS to provide better than average privacy and security protections for most people, compared to stock Android devices from any manufacturer. However, you can achieve even higher standards of privacy with a [custom Android operating system](../android/distributions.md#aosp-derivatives) like GrapheneOS, if you want or need to be completely independent of Apple or Google's cloud services.
|
||||
We generally consider iOS to provide better than average privacy and security protections for most people, compared to stock Android devices from any manufacturer. However, you can achieve even higher standards of privacy with a [custom Android operating system](../android.md#aosp-derivatives) like GrapheneOS, if you want or need to be completely independent of Apple or Google's cloud services.
|
||||
|
||||
### Activation Lock
|
||||
|
||||
|
||||
@@ -376,7 +376,7 @@ KeePassXC stores its export data as [CSV](https://en.wikipedia.org/wiki/Comma-se
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Strongbox** is a native password manager for iOS and macOS. Supporting both KeePass and Password Safe formats, Strongbox can be used in tandem with other password managers, like KeePassXC, on non-Apple platforms. By employing a [freemium model](https://strongboxsafe.com/pricing), Strongbox offers most features under its free tier, with more convenience-oriented [features](https://strongboxsafe.com/comparison)—such as biometric authentication—locked behind a subscription or perpetual license.
|
||||
**Strongbox** is a native, open-source password manager for iOS and macOS. Supporting both KeePass and Password Safe formats, Strongbox can be used in tandem with other password managers, like KeePassXC, on non-Apple platforms. By employing a [freemium model](https://strongboxsafe.com/pricing), Strongbox offers most features under its free tier, with more convenience-oriented [features](https://strongboxsafe.com/comparison)—such as biometric authentication—locked behind a subscription or perpetual license.
|
||||
|
||||
[:octicons-home-16: Homepage](https://strongboxsafe.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://strongboxsafe.com/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@@ -1,38 +0,0 @@
|
||||
---
|
||||
title: "Pastebins"
|
||||
icon: material/content-paste
|
||||
description: These tools allow you to have full control of any pasted data you share to other parties.
|
||||
cover: pastebins.webp
|
||||
---
|
||||
[**Pastebins**](https://en.wikipedia.org/wiki/Pastebin) are online services most commonly used to share large blocks of code in a convenient and efficient manner. The pastebins listed here employ client-side encryption and password protection for pasted content; both of these features prevent the website or server operator from reading or accessing the contents of any paste.
|
||||
|
||||
## PrivateBin
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**PrivateBin** is a minimalist, open-source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256-bit AES. It is the improved version of ZeroBin.
|
||||
|
||||
[:octicons-home-16: Homepage](https://privatebin.info){ .md-button .md-button--primary }
|
||||
[:octicons-server-16:](https://privatebin.info/directory){ .card-link title="Public Instances"}
|
||||
[:octicons-info-16:](https://github.com/PrivateBin/PrivateBin/wiki/FAQ){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/PrivateBin/PrivateBin){ .card-link title="Source Code" }
|
||||
|
||||
</div>
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
### Minimum Requirements
|
||||
|
||||
- Must be open source.
|
||||
- Must implement "zero-trust" end-to-end encryption.
|
||||
- Must support password-protected files.
|
||||
|
||||
### Best-Case
|
||||
|
||||
Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page.
|
||||
|
||||
- Should have a published audit from a reputable, independent third-party.
|
||||
@@ -153,6 +153,39 @@ In general, we define office suites as applications which could reasonably act a
|
||||
- Must support editing documents, spreadsheets, and slideshows.
|
||||
- Must export files to standard document formats.
|
||||
|
||||
## Paste services
|
||||
|
||||
### PrivateBin
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**PrivateBin** is a minimalist, open-source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256-bit AES. It is the improved version of ZeroBin.
|
||||
|
||||
[:octicons-home-16: Homepage](https://privatebin.info){ .md-button .md-button--primary }
|
||||
[:octicons-server-16:](https://privatebin.info/directory){ .card-link title="Public Instances"}
|
||||
[:octicons-info-16:](https://github.com/PrivateBin/PrivateBin/wiki/FAQ){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/PrivateBin/PrivateBin){ .card-link title="Source Code" }
|
||||
|
||||
</div>
|
||||
|
||||
### Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
#### Minimum Requirements
|
||||
|
||||
- Must be open source.
|
||||
- Must implement "zero-trust" end-to-end encryption.
|
||||
- Must support password-protected files.
|
||||
|
||||
#### Best-Case
|
||||
|
||||
Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page.
|
||||
|
||||
- Should have a published audit from a reputable, independent third-party.
|
||||
|
||||
## Language services
|
||||
|
||||
### LanguageTool
|
||||
|
||||
@@ -156,7 +156,7 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Coincards](financial-services.md#coincards)
|
||||
- { .twemoji loading=lazy } [CoinCards](financial-services.md#coincards)
|
||||
|
||||
</div>
|
||||
|
||||
@@ -340,7 +340,7 @@ For encrypting your operating system drive, we typically recommend using whichev
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Ente Auth](multi-factor-authentication.md#ente-auth)
|
||||
- { .twemoji loading=lazy } [Ente Auth](multi-factor-authentication.md#ente-auth)
|
||||
- { .twemoji loading=lazy } [Aegis Authenticator (Android)](multi-factor-authentication.md#aegis-authenticator-android)
|
||||
|
||||
</div>
|
||||
@@ -394,16 +394,6 @@ For encrypting your operating system drive, we typically recommend using whichev
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](passwords.md)
|
||||
|
||||
### Pastebins
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [PrivateBin](pastebins.md#privatebin)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](pastebins.md)
|
||||
|
||||
### Productivity Tools
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
@@ -412,6 +402,7 @@ For encrypting your operating system drive, we typically recommend using whichev
|
||||
- { .twemoji loading=lazy } [LibreOffice](productivity.md#libreoffice)
|
||||
- { .twemoji loading=lazy } [OnlyOffice](productivity.md#onlyoffice)
|
||||
- { .twemoji loading=lazy } [CryptPad](productivity.md#cryptpad)
|
||||
- { .twemoji loading=lazy } [PrivateBin (Pastebin)](productivity.md#privatebin)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [LanguageTool](productivity.md#languagetool)
|
||||
|
||||
</div>
|
||||
@@ -446,53 +437,32 @@ For encrypting your operating system drive, we typically recommend using whichev
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](security-keys.md)
|
||||
|
||||
### Mobile Phones
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Google Pixel](mobile-phones.md#google-pixel)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](mobile-phones.md)
|
||||
|
||||
## Operating Systems
|
||||
|
||||
### Mobile
|
||||
|
||||
#### Custom Android Operating Systems
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos)
|
||||
- { .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [GrapheneOS](android.md#grapheneos)
|
||||
- { .twemoji loading=lazy } [DivestOS](android.md#divestos)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](android/distributions.md)
|
||||
[Learn more :material-arrow-right-drop-circle:](android.md)
|
||||
|
||||
#### Android Apps
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Shelter (Work Profiles)](android/general-apps.md#shelter)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [Secure Camera](android/general-apps.md#secure-camera)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [Secure PDF Viewer](android/general-apps.md#secure-pdf-viewer)
|
||||
- { .twemoji loading=lazy } [Obtainium (App Manager)](android.md#obtainium)
|
||||
- { .twemoji loading=lazy } [Aurora Store (Google Play Client)](android.md#aurora-store)
|
||||
- { .twemoji loading=lazy } [Shelter (Work Profiles)](android.md#shelter)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [Secure Camera](android.md#secure-camera)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [Secure PDF Viewer](android.md#secure-pdf-viewer)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](android/general-apps.md)
|
||||
|
||||
#### Ways to Obtain Android Apps
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Obtainium (App Manager)](android/obtaining-apps.md#obtainium)
|
||||
- { .twemoji loading=lazy } [Aurora Store (Google Play Client)](android/obtaining-apps.md#aurora-store)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](android/obtaining-apps.md)
|
||||
[Learn more :material-arrow-right-drop-circle:](android.md#general-apps)
|
||||
|
||||
### Desktop/PC
|
||||
|
||||
|
||||
@@ -17,12 +17,6 @@ HOMEPAGE_RSS_STORIES_LINK="https://share.privacyguides.org/web-stories/feed/"
|
||||
HOMEPAGE_RSS_STORIES_TITLE="Privacy Guides web stories feed"
|
||||
HOMEPAGE_RSS_FORUM_LINK="https://discuss.privacyguides.net/latest.rss"
|
||||
HOMEPAGE_RSS_FORUM_TITLE="Latest Privacy Guides forum topics"
|
||||
HOMEPAGE_HEADER="The collaborative privacy advocacy community."
|
||||
HOMEPAGE_SUBHEADER="Privacy Guides is a not-for-profit, volunteer-run project that hosts online communities and publishes news and recommendations surrounding privacy and security tools, services, and knowledge."
|
||||
HOMEPAGE_BUTTON_GET_STARTED_NAME="Start Your Privacy Journey"
|
||||
HOMEPAGE_BUTTON_GET_STARTED_TITLE="The first step of your privacy journey"
|
||||
HOMEPAGE_BUTTON_TOOLS_NAME="Recommended Tools"
|
||||
HOMEPAGE_BUTTON_TOOLS_TITLE="Recommended privacy tools, services, and knowledge"
|
||||
NAV_ABOUT="About"
|
||||
NAV_ADVANCED="Advanced"
|
||||
NAV_ADVANCED_TOPICS="Advanced Topics"
|
||||
|
||||
@@ -415,18 +415,12 @@ nav:
|
||||
- "news-aggregators.md"
|
||||
- "notebooks.md"
|
||||
- "passwords.md"
|
||||
- "pastebins.md"
|
||||
- "productivity.md"
|
||||
- "real-time-communication.md"
|
||||
- !ENV [NAV_HARDWARE, "Hardware"]:
|
||||
- "mobile-phones.md"
|
||||
- "security-keys.md"
|
||||
- !ENV [NAV_OPERATING_SYSTEMS, "Operating Systems"]:
|
||||
- !ENV [NAV_ANDROID, "Android"]:
|
||||
- "android/index.md"
|
||||
- "android/distributions.md"
|
||||
- "android/general-apps.md"
|
||||
- "android/obtaining-apps.md"
|
||||
- "android.md"
|
||||
- "desktop.md"
|
||||
- "router.md"
|
||||
- !ENV [NAV_ADVANCED, "Advanced"]:
|
||||
|
||||
8
run.sh
8
run.sh
@@ -86,13 +86,11 @@ if [ "$language" != "en" ]; then
|
||||
export BUILD_SITE_DIR="site/$language"
|
||||
export BUILD_SITE_URL="https://privacyguides.org/$language"
|
||||
export BUILD_THEME_LANGUAGE="$language"
|
||||
fi
|
||||
|
||||
# Source per-language strings
|
||||
set -a
|
||||
set -a
|
||||
# shellcheck disable=SC1090
|
||||
source "$PWD/includes/strings.$language.env"
|
||||
set +a
|
||||
set +a
|
||||
fi
|
||||
|
||||
# Set font if hebrew
|
||||
if [ "$language" == "he" ]; then
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 284 KiB |
BIN
theme/assets/img/multi-factor-authentication/ente-auth.png
Normal file
BIN
theme/assets/img/multi-factor-authentication/ente-auth.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 4.6 KiB |
@@ -1,81 +0,0 @@
|
||||
<svg width="1024" height="1024" viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg">
|
||||
<g clip-path="url(#clip0_26133_116870)">
|
||||
<rect width="1024" height="1024" rx="234" fill="url(#paint0_linear_26133_116870)" style=""/>
|
||||
<g opacity="0.8" filter="url(#filter0_dii_26133_116870)">
|
||||
<path d="M512.364 162L226 289.273V480.182C226 656.773 348.182 821.909 512.364 862C676.545 821.909 798.727 656.773 798.727 480.182V289.273L512.364 162ZM512.364 352.909C556.909 352.909 601.455 387.909 601.455 432.455V480.182C620.546 480.182 639.636 499.273 639.636 521.545V632.909C639.636 652 620.545 671.091 598.273 671.091H423.273C404.182 671.091 385.091 652 385.091 629.727V518.364C385.091 499.273 404.182 480.182 423.273 480.182V432.455C423.273 387.909 467.818 352.909 512.364 352.909ZM512.364 391.091C486.909 391.091 464.636 407 464.636 432.455V480.182H560.091V432.455C560.091 407 537.818 391.091 512.364 391.091Z" fill="white" style="fill:white;fill-opacity:1;"/>
|
||||
</g>
|
||||
<g opacity="0.8" filter="url(#filter1_dii_26133_116870)">
|
||||
<path d="M512.364 162L226 289.273V480.182C226 656.773 348.182 821.909 512.364 862C676.545 821.909 798.727 656.773 798.727 480.182V289.273L512.364 162ZM512.364 352.909C556.909 352.909 601.455 387.909 601.455 432.455V480.182C620.546 480.182 639.636 499.273 639.636 521.545V632.909C639.636 652 620.545 671.091 598.273 671.091H423.273C404.182 671.091 385.091 652 385.091 629.727V518.364C385.091 499.273 404.182 480.182 423.273 480.182V432.455C423.273 387.909 467.818 352.909 512.364 352.909ZM512.364 391.091C486.909 391.091 464.636 407 464.636 432.455V480.182H560.091V432.455C560.091 407 537.818 391.091 512.364 391.091Z" fill="white" style="fill:white;fill-opacity:1;"/>
|
||||
</g>
|
||||
<g opacity="0.8" filter="url(#filter2_ii_26133_116870)">
|
||||
<path d="M512.364 162L226 289.273V480.182C226 656.773 348.182 821.909 512.364 862C676.545 821.909 798.727 656.773 798.727 480.182V289.273L512.364 162ZM512.364 352.909C556.909 352.909 601.455 387.909 601.455 432.455V480.182C620.546 480.182 639.636 499.273 639.636 521.545V632.909C639.636 652 620.545 671.091 598.273 671.091H423.273C404.182 671.091 385.091 652 385.091 629.727V518.364C385.091 499.273 404.182 480.182 423.273 480.182V432.455C423.273 387.909 467.818 352.909 512.364 352.909ZM512.364 391.091C486.909 391.091 464.636 407 464.636 432.455V480.182H560.091V432.455C560.091 407 537.818 391.091 512.364 391.091Z" fill="white" style="fill:white;fill-opacity:1;"/>
|
||||
</g>
|
||||
</g>
|
||||
<defs>
|
||||
<filter id="filter0_dii_26133_116870" x="46.613" y="90.2452" width="931.501" height="1058.77" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
|
||||
<feFlood flood-opacity="0" result="BackgroundImageFix"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="107.632"/>
|
||||
<feGaussianBlur stdDeviation="89.6935"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.35 0"/>
|
||||
<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_26133_116870"/>
|
||||
<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_26133_116870" result="shape"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="17.9387"/>
|
||||
<feGaussianBlur stdDeviation="8.96935"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="shape" result="effect2_innerShadow_26133_116870"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="-8.96935"/>
|
||||
<feGaussianBlur stdDeviation="4.48467"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="effect2_innerShadow_26133_116870" result="effect3_innerShadow_26133_116870"/>
|
||||
</filter>
|
||||
<filter id="filter1_dii_26133_116870" x="46.613" y="90.2452" width="931.501" height="1058.77" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
|
||||
<feFlood flood-opacity="0" result="BackgroundImageFix"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="107.632"/>
|
||||
<feGaussianBlur stdDeviation="89.6935"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.12 0"/>
|
||||
<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_26133_116870"/>
|
||||
<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_26133_116870" result="shape"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="17.9387"/>
|
||||
<feGaussianBlur stdDeviation="8.96935"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="shape" result="effect2_innerShadow_26133_116870"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="-8.96935"/>
|
||||
<feGaussianBlur stdDeviation="4.48467"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="effect2_innerShadow_26133_116870" result="effect3_innerShadow_26133_116870"/>
|
||||
</filter>
|
||||
<filter id="filter2_ii_26133_116870" x="226" y="153.031" width="572.727" height="726.908" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
|
||||
<feFlood flood-opacity="0" result="BackgroundImageFix"/>
|
||||
<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="17.9387"/>
|
||||
<feGaussianBlur stdDeviation="8.96935"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="shape" result="effect1_innerShadow_26133_116870"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="-8.96935"/>
|
||||
<feGaussianBlur stdDeviation="4.48467"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="effect1_innerShadow_26133_116870" result="effect2_innerShadow_26133_116870"/>
|
||||
</filter>
|
||||
<linearGradient id="paint0_linear_26133_116870" x1="96.5" y1="71" x2="985" y2="977.5" gradientUnits="userSpaceOnUse">
|
||||
<stop stop-color="#C373F2" style="stop-color:#C373F2;stop-color:color(display-p3 0.7647 0.4510 0.9490);stop-opacity:1;"/>
|
||||
<stop offset="1" stop-color="#9610D6" style="stop-color:#9610D6;stop-color:color(display-p3 0.5882 0.0627 0.8392);stop-opacity:1;"/>
|
||||
</linearGradient>
|
||||
<clipPath id="clip0_26133_116870">
|
||||
<rect width="1024" height="1024" rx="234" fill="white" style="fill:white;fill-opacity:1;"/>
|
||||
</clipPath>
|
||||
</defs>
|
||||
</svg>
|
||||
|
Before Width: | Height: | Size: 7.1 KiB |
@@ -1 +1 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866"><defs><radialGradient id="a" cx="261" cy="240" r="341" gradientTransform="matrix(.087249 6.3692e-5 -6.8457e-5 .09396 -5.8182 -5.6417)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#ff0"/><stop offset="1" stop-color="#fa0"/></radialGradient></defs><path fill="url(#a)" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width=".711" d="m16.947 0.3557-15.235 8.2551-0.028193 16.577 15.235 8.3222 15.235-8.2551 0.02819-16.577zm-0.04771 6.5705v4.03e-4c0.25369 0 0.51007 0.01993 0.77182 0.05872 2.7584 0.4141 4.8457 2.7249 4.4564 4.7316-0.38926 2-2.2349 3.7584-2.6913 4.141-0.45638 0.38255 2.49 11.074 2.49 11.074h-10s3.1007-10.537 2.4497-11.074c-0.65101-0.54631-2.7651-2.4765-2.443-4.6242 0.32282-2.1544 2.5235-4.2953 4.9799-4.302z"/></svg>
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866"><defs><radialGradient id="a" cx="261" cy="240" r="341" gradientTransform="matrix(.087249 6.3692e-5 -6.8457e-5 .09396 -5.8182 -5.6417)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#ff0"/><stop offset="1" stop-color="#fa0"/></radialGradient></defs><path fill="url(#a)" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width=".711" d="m16.947 0.3557-15.235 8.2551-0.028193 16.577 15.235 8.3222 15.235-8.2551 0.02819-16.577zm-0.04771 6.5705v4.03e-4c0.25369 0 0.51007 0.01993 0.77182 0.05872 2.7584 0.4141 4.8457 2.7249 4.4564 4.7316-0.38926 2-2.2349 3.7584-2.6913 4.141-0.45638 0.38255 2.49 11.074 2.49 11.074h-10s3.1007-10.537 2.4497-11.074c-0.65101-0.54631-2.7651-2.4765-2.443-4.6242 0.32282-2.1544 2.5235-4.2953 4.9799-4.302z"/></svg>
|
||||
|
Before Width: | Height: | Size: 876 B After Width: | Height: | Size: 875 B |
@@ -1,7 +1,7 @@
|
||||
/**
|
||||
* @overview Generates a list of topics on a Discourse forum.
|
||||
* @author Jonah Aragon <jonah@triplebit.net>
|
||||
* @version 3.1.0
|
||||
* @version 3.0.0
|
||||
* @license
|
||||
* Copyright (c) 2023 - 2024 Jonah Aragon
|
||||
*
|
||||
@@ -30,7 +30,7 @@ async function getData(url) {
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const elements = document.querySelectorAll("ul[data-forum]");
|
||||
const elements = document.querySelectorAll("div[data-forum]");
|
||||
|
||||
for (let j = 0; j < elements.length; j++) {
|
||||
|
||||
@@ -53,7 +53,7 @@ async function main() {
|
||||
var title = list[i]['title'];
|
||||
var id = list[i]['id'];
|
||||
|
||||
var topic = document.createElement("li");
|
||||
var topic = document.createElement("div");
|
||||
topic.className = "discourse-topic";
|
||||
|
||||
var h3 = document.createElement('p');
|
||||
@@ -62,37 +62,13 @@ async function main() {
|
||||
|
||||
a1.href = dataset.forum + '/t/' + id;
|
||||
|
||||
var boldTitle = document.createElement('strong');
|
||||
boldTitle.innerText = title;
|
||||
a1.appendChild(boldTitle);
|
||||
a1.innerText = title;
|
||||
h3.appendChild(a1);
|
||||
|
||||
var authorinfo = document.createElement('p');
|
||||
authorinfo.className = "discourse-author";
|
||||
|
||||
var author_id = list[i]['posters'][0]['user_id'];
|
||||
var author_data = profiles.find(profile => profile['id'] == author_id);
|
||||
var author = document.createElement('span');
|
||||
author.className = "discourse-author";
|
||||
var avatar = document.createElement('img');
|
||||
avatar.src = dataset.forum + author_data['avatar_template'].replace("{size}", "40");
|
||||
avatar.width = 20;
|
||||
avatar.height = 20;
|
||||
avatar.className = "middle";
|
||||
author.appendChild(avatar);
|
||||
var namespan = document.createElement('span');
|
||||
namespan.innerText = " Posted by " + author_data['username'];
|
||||
author.appendChild(namespan);
|
||||
authorinfo.appendChild(author);
|
||||
|
||||
var postinfo = document.createElement('p');
|
||||
var postinfo = document.createElement('ul');
|
||||
postinfo.className = "discourse-data";
|
||||
|
||||
var dateIcon = document.createElement('span');
|
||||
dateIcon.className = "twemoji";
|
||||
dateIcon.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1-2.1-2M12.5 7v5.2l4 2.4-1 1L11 13V7h1.5M11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2v1.8Z"></path></svg>';
|
||||
|
||||
var date = document.createElement('span');
|
||||
var date = document.createElement('li');
|
||||
date.className = "discourse-date";
|
||||
var datestring = list[i]['bumped_at'];
|
||||
var dateobject = new Date(datestring);
|
||||
@@ -103,46 +79,55 @@ async function main() {
|
||||
var days = Math.floor(hours / 24);
|
||||
if (days > 0) {
|
||||
if (days == 1) {
|
||||
date.innerText = " 1 day ago ";
|
||||
date.innerText = "Last reply 1 day ago";
|
||||
}
|
||||
else {
|
||||
date.innerText = " " + days + " days ago ";
|
||||
date.innerText = "Last reply " + days + " days ago";
|
||||
}
|
||||
}
|
||||
else if (hours > 0){
|
||||
if (hours == 1) {
|
||||
date.innerText = " 1 hour ago ";
|
||||
date.innerText = "Last reply 1 hour ago";
|
||||
}
|
||||
else {
|
||||
date.innerText = " " + hours + " hours ago ";
|
||||
date.innerText = "Last reply "+ hours + " hours ago";
|
||||
}
|
||||
}
|
||||
else {
|
||||
if (minutes == 1) {
|
||||
date.innerText = " 1 minute ago ";
|
||||
date.innerText = "Last reply 1 minute ago";
|
||||
}
|
||||
else {
|
||||
date.innerText = " " + minutes + " minutes ago ";
|
||||
date.innerText = "Last reply " + minutes + " minutes ago";
|
||||
}
|
||||
}
|
||||
postinfo.appendChild(dateIcon);
|
||||
postinfo.appendChild(date);
|
||||
|
||||
var likesicon = document.createElement('span');
|
||||
likesicon.classList = "twemoji pg-red";
|
||||
likesicon.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="m12 21.35-1.45-1.32C5.4 15.36 2 12.27 2 8.5 2 5.41 4.42 3 7.5 3c1.74 0 3.41.81 4.5 2.08C13.09 3.81 14.76 3 16.5 3 19.58 3 22 5.41 22 8.5c0 3.77-3.4 6.86-8.55 11.53L12 21.35Z"></path></svg>';
|
||||
var author_id = list[i]['posters'][0]['user_id'];
|
||||
var author_data = profiles.find(profile => profile['id'] == author_id);
|
||||
var author = document.createElement('li');
|
||||
author.className = "discourse-author";
|
||||
var avatar = document.createElement('img');
|
||||
avatar.src = dataset.forum + author_data['avatar_template'].replace("{size}", "40");
|
||||
avatar.width = 20;
|
||||
avatar.height = 20;
|
||||
author.appendChild(avatar);
|
||||
var namespan = document.createElement('span');
|
||||
namespan.innerText = " " + author_data['username'];
|
||||
author.appendChild(namespan);
|
||||
postinfo.appendChild(author);
|
||||
|
||||
var likes = document.createElement('span');
|
||||
var likes = document.createElement('li');
|
||||
likes.className = "discourse-likes";
|
||||
likes.innerText = " " + list[i]['like_count'] + " ";
|
||||
postinfo.appendChild(likesicon);
|
||||
if (list[i]['like_count'] == 1) {
|
||||
likes.innerText = "1 Like";
|
||||
}
|
||||
else {
|
||||
likes.innerText = list[i]['like_count'] + " Likes";
|
||||
}
|
||||
postinfo.appendChild(likes);
|
||||
|
||||
var replyIcon = document.createElement('span');
|
||||
replyIcon.classList = "twemoji";
|
||||
replyIcon.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 9V5l-7 7 7 7v-4.1c5 0 8.5 1.6 11 5.1-1-5-4-10-11-11Z"></path></svg>';
|
||||
|
||||
var replies = document.createElement('span');
|
||||
var replies = document.createElement('li');
|
||||
replies.className = "discourse-replies";
|
||||
|
||||
var reply_count = list[i]['posts_count'] - 1;
|
||||
@@ -150,14 +135,11 @@ async function main() {
|
||||
replies.innerText = "1 Reply"
|
||||
}
|
||||
else {
|
||||
replies.innerText = " " + reply_count
|
||||
replies.innerText = reply_count + " Replies"
|
||||
}
|
||||
postinfo.appendChild(replyIcon);
|
||||
postinfo.appendChild(replies);
|
||||
|
||||
topic.appendChild(h3);
|
||||
topic.appendChild(document.createElement('hr'));
|
||||
topic.appendChild(authorinfo);
|
||||
topic.appendChild(postinfo);
|
||||
topics.appendChild(topic);
|
||||
}
|
||||
|
||||
@@ -23,13 +23,16 @@
|
||||
|
||||
/* Homepage hero section */
|
||||
.mdx-container {
|
||||
background: #ffdd98;
|
||||
background: url("data:image/svg+xml;utf8,<svg width='100%' height='100%' viewBox='0 0 1123 258' version='1.1' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' xml:space='preserve' xmlns:serif='http://www.serif.com/' style='fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2;'><g transform='matrix(-1.01432,0,0,0.388868,1134.41,161.501)'><path d='M1124,2L1124,258L-1,258L-1,210C-1,210 15,215 54,215C170,215 251,123 379,123C500,123 493,169 633,169C773,169 847,2 1205,3L1124,2Z' style='fill:rgb(247, 247, 252);fill-rule:nonzero;'/></g></svg>")
|
||||
no-repeat bottom,
|
||||
linear-gradient(to bottom, rgb(255 255 255/.8), #ffdd98 99%, var(--md-default-bg-color) 99%);
|
||||
background-size: contain;
|
||||
padding-top: 1rem;
|
||||
padding-bottom: 1rem;
|
||||
}
|
||||
[data-md-color-scheme="slate"] .mdx-container {
|
||||
background: rgba(9, 9, 9, 0.95);
|
||||
background: url("data:image/svg+xml;utf8,<svg width='100%' height='100%' viewBox='0 0 1123 258' version='1.1' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' xml:space='preserve' xmlns:serif='http://www.serif.com/' style='fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2;'><g transform='matrix(-1.01432,0,0,0.388868,1134.41,161.501)'><path d='M1124,2L1124,258L-1,258L-1,210C-1,210 15,215 54,215C170,215 251,123 379,123C500,123 493,169 633,169C773,169 847,2 1205,3L1124,2Z' style='fill:rgb(26, 26, 27);fill-rule:nonzero;'/></g></svg>")
|
||||
no-repeat bottom, rgba(9, 9, 9, 0.95);
|
||||
background-size: contain;
|
||||
}
|
||||
|
||||
.mdx-hero {
|
||||
@@ -46,17 +49,18 @@
|
||||
font-size: 1.4rem;
|
||||
}
|
||||
}
|
||||
.mdx-hero__content {
|
||||
padding-bottom: 6rem;
|
||||
}
|
||||
@media screen and (min-width: 60em) {
|
||||
.mdx-hero {
|
||||
align-items: stretch;
|
||||
display: flex;
|
||||
}
|
||||
.mdx-hero__content {
|
||||
margin-top: 3rem;
|
||||
margin-bottom: 3rem;
|
||||
p, h1 {
|
||||
max-width: 38rem;
|
||||
}
|
||||
margin-top: 3.5rem;
|
||||
max-width: 38rem;
|
||||
padding-bottom: 14vw;
|
||||
}
|
||||
.mdx-hero__image {
|
||||
order: 1;
|
||||
@@ -91,7 +95,7 @@ nav[class="md-tabs"] {
|
||||
.md-typeset a.headerlink {
|
||||
display: none;
|
||||
}
|
||||
/* article.md-content__inner {
|
||||
article.md-content__inner {
|
||||
max-width: 50rem;
|
||||
margin: auto;
|
||||
padding-bottom: 3rem;
|
||||
@@ -104,12 +108,20 @@ nav[class="md-tabs"] {
|
||||
}
|
||||
article.md-content__inner > * {
|
||||
max-width: 38rem;
|
||||
} */
|
||||
}
|
||||
/* article.md-content__inner > *:nth-child(n+8):nth-child(-n+12) {
|
||||
margin-left: auto;
|
||||
margin-right: 0;
|
||||
text-align: right;
|
||||
} */
|
||||
#what-should-i-do, #what-should-i-do ~ :not( .mdx-cat ~ * ):not( .mdx-cta ):not( .mdx-discourse-topics) {
|
||||
margin-left: auto;
|
||||
margin-right: 0;
|
||||
text-align: right;
|
||||
}
|
||||
article.md-content__inner > hr {
|
||||
margin: 3rem;
|
||||
}
|
||||
.pg-end-right-align, .mdx-cta {
|
||||
margin-left: auto;
|
||||
margin-right: auto;
|
||||
@@ -122,3 +134,56 @@ article.md-content__inner > * {
|
||||
--md-icon-size: 1.8em;
|
||||
margin: 0.4rem;
|
||||
}
|
||||
|
||||
.mdx-discourse-topics {
|
||||
max-width: 100% !important;
|
||||
margin-left: auto;
|
||||
margin-right: auto;
|
||||
text-align: center;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list {
|
||||
grid-template-columns: repeat(5, 1fr);
|
||||
}
|
||||
.mdx-discourse-topics .discourse-title {
|
||||
min-height: 4em;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list {
|
||||
display: grid;
|
||||
text-align: left;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-title {
|
||||
line-height: 1.2;
|
||||
margin: 0;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-topic {
|
||||
padding: 0.4em;
|
||||
margin-bottom: 1em;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-data {
|
||||
color: var(--md-default-fg-color--light);
|
||||
list-style: none;
|
||||
padding: 0;
|
||||
margin: 0;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-data li {
|
||||
margin: 0;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-data li img {
|
||||
vertical-align: middle;
|
||||
}
|
||||
@media screen and (max-width: 1000px) {
|
||||
.mdx-discourse-topics .topics-list {
|
||||
grid-template-columns: repeat(3, 1fr);
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-title {
|
||||
min-height: 0;
|
||||
}
|
||||
}
|
||||
@media screen and (max-width: 600px) {
|
||||
.mdx-discourse-topics .topics-list {
|
||||
grid-template-columns: repeat(1, 1fr);
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-title {
|
||||
min-height: 0;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -50,15 +50,21 @@
|
||||
{% endblock %}
|
||||
{% block content %}
|
||||
{% if config.theme.language == "en" %}
|
||||
<h2>Top discussions this week</h2>
|
||||
<div class="grid cards">
|
||||
<ul
|
||||
<div class="mdx-discourse-topics">
|
||||
<h2>Top discussions this week</h2>
|
||||
<div
|
||||
class="topics-list"
|
||||
data-forum="https://discuss.privacyguides.net"
|
||||
data-feed="https://discuss.privacyguides.net/top.json?period=weekly"
|
||||
data-count="6">
|
||||
</ul>
|
||||
data-count="5">
|
||||
</div>
|
||||
<noscript>
|
||||
<a href="https://discuss.privacyguides.net/" class="md-button md-button--primary">
|
||||
Join the forum
|
||||
</a>
|
||||
</noscript>
|
||||
|
||||
<hr />
|
||||
</div>
|
||||
{% endif %}
|
||||
{{ page.content }}
|
||||
@@ -76,14 +82,12 @@
|
||||
</div>
|
||||
{% if config.theme.language == "en" %}
|
||||
<div class="mdx-discourse-topics">
|
||||
<h3>Latest discussions</h3>
|
||||
<div class="grid cards">
|
||||
<ul
|
||||
class="topics-list"
|
||||
data-forum="https://discuss.privacyguides.net"
|
||||
data-feed="https://discuss.privacyguides.net/latest.json"
|
||||
data-count="12">
|
||||
</ul>
|
||||
<h3>Join a discussion</h3>
|
||||
<div
|
||||
class="topics-list"
|
||||
data-forum="https://discuss.privacyguides.net"
|
||||
data-feed="https://discuss.privacyguides.net/latest.json"
|
||||
data-count="15">
|
||||
</div>
|
||||
<noscript>
|
||||
<a href="https://discuss.privacyguides.net/" class="md-button md-button--primary">
|
||||
|
||||
Reference in New Issue
Block a user