mirror of
https://github.com/privacyguides/privacyguides.org.git
synced 2025-08-14 14:54:47 +00:00
Compare commits
1 Commits
2024.07.29
...
russian-se
| Author | SHA1 | Date | |
|---|---|---|---|
727a2be2f9
|
@@ -38,6 +38,6 @@ Privacy Guides is a **non-profit** organization. We use donations for a variety
|
||||
|
||||
: We occasionally purchase products and services for the purposes of testing our [recommended tools](../tools.md).
|
||||
|
||||
Your donation will go to a dedicated fund within [MAGIC Grants](https://magicgrants.org), a 501(c)(3) organization. The funds will only be used for this project specifically. You may qualify for a tax deduction. If you need a donation receipt, please email <info@magicgrants.org>.
|
||||
Your donation will go to a dedicated fund within [MAGIC Grants](https://magicgrants.org/), a 501(c)(3) organization. The funds will only be used for this project specifically. You may qualify for a tax deduction. If you need a donation receipt, please email <info@magicgrants.org>.
|
||||
|
||||
Thank you to all those who support our mission! :material-heart:{ .pg-red }
|
||||
|
||||
463
docs/android.md
Normal file
463
docs/android.md
Normal file
@@ -0,0 +1,463 @@
|
||||
---
|
||||
meta_title: "Android Recommendations: GrapheneOS and DivestOS - Privacy Guides"
|
||||
title: "Android"
|
||||
icon: 'simple/android'
|
||||
description: You can replace the operating system on your Android phone with these secure and privacy-respecting alternatives.
|
||||
cover: android.webp
|
||||
schema:
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
name: Private Android Operating Systems
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: Android
|
||||
image: /assets/img/android/android.svg
|
||||
url: https://source.android.com/
|
||||
sameAs: https://en.wikipedia.org/wiki/Android_(operating_system)
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: GrapheneOS
|
||||
image: /assets/img/android/grapheneos.svg
|
||||
url: https://grapheneos.org/
|
||||
sameAs: https://en.wikipedia.org/wiki/GrapheneOS
|
||||
subjectOf:
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: Divest
|
||||
image: /assets/img/android/divestos.svg
|
||||
url: https://divestos.org/
|
||||
sameAs: https://en.wikipedia.org/wiki/DivestOS
|
||||
subjectOf:
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": Product
|
||||
name: Pixel
|
||||
brand:
|
||||
"@type": Brand
|
||||
name: Google
|
||||
image: /assets/img/android/google-pixel.png
|
||||
sameAs: https://en.wikipedia.org/wiki/Google_Pixel
|
||||
review:
|
||||
"@type": Review
|
||||
author:
|
||||
"@type": Organization
|
||||
name: Privacy Guides
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Shelter
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Auditor
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Secure Camera
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Secure PDF Viewer
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
---
|
||||
|
||||
{ align=right }
|
||||
|
||||
The **Android Open Source Project** is an open-source mobile operating system led by Google which powers the majority of the world's mobile devices. Most phones sold with Android are modified to include invasive integrations and apps such as Google Play Services, so you can significantly improve your privacy on your mobile device by replacing your phone's default installation with a version of Android without these invasive features.
|
||||
|
||||
[:octicons-home-16:](https://source.android.com){ .card-link title=Homepage }
|
||||
[:octicons-info-16:](https://source.android.com/docs){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://cs.android.com/android/platform/superproject){ .card-link title="Source Code" }
|
||||
|
||||
These are the Android operating systems, devices, and apps we recommend to maximize your mobile device's security and privacy. To learn more about Android:
|
||||
|
||||
[General Android Overview :material-arrow-right-drop-circle:](os/android-overview.md){ .md-button }
|
||||
|
||||
## AOSP Derivatives
|
||||
|
||||
We recommend installing one of these custom Android operating systems on your device, listed in order of preference, depending on your device's compatibility with these operating systems.
|
||||
|
||||
<div class="admonition note" markdown>
|
||||
<p class="admonition-title">Note</p>
|
||||
|
||||
End-of-life devices (such as GrapheneOS's or CalyxOS's "extended support" devices) do not have full security patches (firmware updates) due to the OEM discontinuing support. These devices cannot be considered completely secure regardless of installed software.
|
||||
|
||||
</div>
|
||||
|
||||
### GrapheneOS
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**GrapheneOS** is the best choice when it comes to privacy and security.
|
||||
|
||||
GrapheneOS provides additional [security hardening](https://en.wikipedia.org/wiki/Hardening_(computing)) and privacy improvements. It has a [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), network and sensor permissions, and various other [security features](https://grapheneos.org/features). GrapheneOS also comes with full firmware updates and signed builds, so verified boot is fully supported.
|
||||
|
||||
[:octicons-home-16: Homepage](https://grapheneos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://grapheneos.org/faq#privacy-policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://grapheneos.org/faq){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://grapheneos.org/source){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), which runs [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) fully sandboxed like any other regular app. This means you can take advantage of most Google Play Services, such as [push notifications](https://firebase.google.com/docs/cloud-messaging), while giving you full control over their permissions and access, and while containing them to a specific [work profile](os/android-overview.md#work-profile) or [user profile](os/android-overview.md#user-profiles) of your choice.
|
||||
|
||||
Google Pixel phones are the only devices that currently meet GrapheneOS's [hardware security requirements](https://grapheneos.org/faq#future-devices).
|
||||
|
||||
[Why we recommend GrapheneOS over CalyxOS :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos){ .md-button }
|
||||
|
||||
### DivestOS
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org).
|
||||
DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
|
||||
|
||||
[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" }
|
||||
[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates.
|
||||
DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled.
|
||||
|
||||
DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) and SENSORS permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and higher features GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features).
|
||||
|
||||
DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repositories ([DivestOS Official](https://divestos.org/fdroid/official/?fingerprint=E4BE8D6ABFA4D9D4FEEF03CDDA7FF62A73FD64B75566F6DD4E5E577550BE8467) and [DivestOS WebView](https://divestos.org/fdroid/webview/?fingerprint=FB426DA1750A53D7724C8A582B4D34174E64A84B38940E5D5A802E1DFF9A40D2)). We recommend disabling the official F-Droid app and using [F-Droid Basic](https://f-droid.org/en/packages/org.fdroid.basic) **with the DivestOS repositories enabled** to keep those components up to date. For other apps, our recommended methods of obtaining them still apply.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
DivestOS firmware update [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) and quality control varies across the devices it supports. We still recommend GrapheneOS depending on your device's compatibility. For other devices, DivestOS is a good alternative.
|
||||
|
||||
Not all of the supported devices have verified boot, and some perform it better than others.
|
||||
|
||||
</div>
|
||||
|
||||
## Android Devices
|
||||
|
||||
When purchasing a device, we recommend getting one as new as possible. The software and firmware of mobile devices are only supported for a limited time, so buying new extends that lifespan as much as possible.
|
||||
|
||||
Avoid buying phones from mobile network operators. These often have a **locked bootloader** and do not support [OEM unlocking](https://source.android.com/devices/bootloader/locking_unlocking). These phone variants will prevent you from installing any kind of alternative Android distribution.
|
||||
|
||||
Be very **careful** about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen, there's a possibility of it being entered in the [IMEI database](https://gsma.com/get-involved/working-groups/terminal-steering-group/imei-database). There is also a risk involved with you being associated with the activity of the previous owner.
|
||||
|
||||
A few more tips regarding Android devices and operating system compatibility:
|
||||
|
||||
- Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.
|
||||
- Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper [Verified Boot](https://source.android.com/security/verifiedboot) support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
|
||||
- In short, if a device or Android distribution is not listed here, there is probably a good reason. Check out our [forum](https://discuss.privacyguides.net) to find details!
|
||||
|
||||
### Google Pixel
|
||||
|
||||
Google Pixel phones are the **only** devices we recommend for purchase. Pixel phones have stronger hardware security than any other Android devices currently on the market, due to proper AVB support for third-party operating systems and Google's custom [Titan](https://security.googleblog.com/2021/10/pixel-6-setting-new-standard-for-mobile.html) security chips acting as the Secure Element.
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Google Pixel** devices are known to have good security and properly support [Verified Boot](https://source.android.com/security/verifiedboot), even when installing custom operating systems.
|
||||
|
||||
Beginning with the **Pixel 8** and **8 Pro**, Pixel devices receive a minimum of 7 years of guaranteed security updates, ensuring a much longer lifespan compared to the 2-5 years competing OEMs typically offer.
|
||||
|
||||
[:material-shopping: Store](https://store.google.com/category/phones){ .md-button .md-button--primary }
|
||||
|
||||
</div>
|
||||
|
||||
Secure Elements like the Titan M2 are more limited than the processor's Trusted Execution Environment used by most other phones as they are only used for secrets storage, hardware attestation, and rate limiting, not for running "trusted" programs. Phones without a Secure Element have to use the TEE for *all* of those functions, resulting in a larger attack surface.
|
||||
|
||||
Google Pixel phones use a TEE OS called Trusty which is [open source](https://source.android.com/security/trusty#whyTrusty), unlike many other phones.
|
||||
|
||||
The installation of GrapheneOS on a Pixel phone is easy with their [web installer](https://grapheneos.org/install/web). If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the [NitroPhone](https://shop.nitrokey.com/shop) as they come preloaded with GrapheneOS from the reputable [Nitrokey](https://nitrokey.com/about) company.
|
||||
|
||||
A few more tips for purchasing a Google Pixel:
|
||||
|
||||
- If you're after a bargain on a Pixel device, we suggest buying an "**a**" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
|
||||
- Consider price beating options and specials offered at physical stores.
|
||||
- Look at online community bargain sites in your country. These can alert you to good sales.
|
||||
- Google provides a list showing the [support cycle](https://support.google.com/nexus/answer/4457705) for each one of their devices. The price per day for a device can be calculated as:
|
||||
<math xmlns="http://www.w3.org/1998/Math/MathML" display="inline" class="tml-display" style="display:inline math;">
|
||||
<mfrac>
|
||||
<mtext>Cost</mtext>
|
||||
<mrow>
|
||||
<mtext>End of Life Date</mtext>
|
||||
<mo>−</mo>
|
||||
<mtext>Current Date</mtext>
|
||||
</mrow>
|
||||
</mfrac>
|
||||
</math>
|
||||
, meaning that the longer use of the device the lower cost per day.
|
||||
- If the Pixel is unavailable in your region, the [NitroPhone](https://shop.nitrokey.com/shop) can be shipped globally.
|
||||
|
||||
## General Apps
|
||||
|
||||
We recommend a wide variety of Android apps throughout this site. The apps listed here are Android-exclusive and specifically enhance or replace key system functionality.
|
||||
|
||||
### Shelter
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Shelter** is an app that helps you leverage Android's Work Profile functionality to isolate or duplicate apps on your device.
|
||||
|
||||
Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager ([DocumentsUI](https://source.android.com/devices/architecture/modular-system/documentsui)).
|
||||
|
||||
[:octicons-repo-16: Repository](https://gitea.angry.im/PeterCxy/Shelter#shelter){ .md-button .md-button--primary }
|
||||
[:octicons-code-16:](https://gitea.angry.im/PeterCxy/Shelter){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://patreon.com/PeterCxy){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Shelter is recommended over [Insular](https://secure-system.gitlab.io/Insular) and [Island](https://github.com/oasisfeng/island) as it supports [contact search blocking](https://secure-system.gitlab.io/Insular/faq.html).
|
||||
|
||||
When using Shelter, you are placing complete trust in its developer, as Shelter acts as a [Device Admin](https://developer.android.com/guide/topics/admin/device-admin) to create the Work Profile, and it has extensive access to the data stored within the Work Profile.
|
||||
|
||||
</div>
|
||||
|
||||
### Secure Camera
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Secure Camera** is a camera app focused on privacy and security which can capture images, videos and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/GrapheneOS/Camera){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://grapheneos.org/usage#camera){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/GrapheneOS/Camera){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.camera.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/Camera/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Main privacy features include:
|
||||
|
||||
- Auto removal of [Exif](https://en.wikipedia.org/wiki/Exif) metadata (enabled by default)
|
||||
- Use of the new [Media](https://developer.android.com/training/data-storage/shared/media) API, therefore [storage permissions](https://developer.android.com/training/data-storage) are not required
|
||||
- Microphone permission not required unless you want to record sound
|
||||
|
||||
<div class="admonition note" markdown>
|
||||
<p class="admonition-title">Note</p>
|
||||
|
||||
Metadata is not currently deleted from video files but that is planned.
|
||||
|
||||
The image orientation metadata is not deleted. If you enable location (in Secure Camera) that **won't** be deleted either. If you want to delete that later you will need to use an external app such as [ExifEraser](data-redaction.md#exiferaser-android).
|
||||
|
||||
</div>
|
||||
|
||||
### Secure PDF Viewer
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [webview](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files.
|
||||
|
||||
[Content-Security-Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) is used to enforce that the JavaScript and styling properties within the WebView are entirely static content.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/GrapheneOS/PdfViewer){ .md-button .md-button--primary }
|
||||
[:octicons-code-16:](https://github.com/GrapheneOS/PdfViewer){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.pdfviewer.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/PdfViewer/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
## Obtaining Applications
|
||||
|
||||
### Obtainium
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Obtainium** is an app manager which allows you to install and update apps directly from the developer's own releases page (i.e. GitHub, GitLab, the developer's website, etc.), rather than a centralized app store/repository. It supports automatic background updates on Android 12 and higher.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/ImranR98/Obtainium#readme){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://github.com/ImranR98/Obtainium/wiki){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/ImranR98/Obtainium){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://github.com/sponsors/ImranR98){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-github: GitHub](https://github.com/ImranR98/Obtainium/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Obtainium allows you to download APK installer files from a wide variety of sources, and it is up to you to ensure those sources and apps are legitimate. For example, using Obtainium to install Signal from [Signal's APK landing page](https://signal.org/android/apk) should be fine, but installing from third-party APK repositories like Aptoide or APKPure may pose additional risks. The risk of installing a malicious *update* is lower, because Android itself verifies that all app updates are signed by the same developer as the existing app on your phone before installing them.
|
||||
|
||||
### GrapheneOS App Store
|
||||
|
||||
GrapheneOS's app store is available on [GitHub](https://github.com/GrapheneOS/Apps/releases). It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the [Auditor](https://attestation.app), [Camera](https://github.com/GrapheneOS/Camera), and [PDF Viewer](https://github.com/GrapheneOS/PdfViewer). If you are looking for these applications, we highly recommend that you get them from GrapheneOS's app store instead of the Play Store, as the apps on their store are signed by the GrapheneOS's project own signature that Google does not have access to.
|
||||
|
||||
### Aurora Store
|
||||
|
||||
The Google Play Store requires a Google account to login which is not great for privacy. You can get around this by using an alternative client, such as Aurora Store.
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Aurora Store** is a Google Play Store client which does not require a Google Account, Google Play Services, or microG to download apps.
|
||||
|
||||
[:octicons-home-16: Homepage](https://auroraoss.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://gitlab.com/AuroraOSS/AuroraStore/-/blob/master/POLICY.md){ .card-link title="Privacy Policy" }
|
||||
[:octicons-code-16:](https://gitlab.com/AuroraOSS/AuroraStore){ .card-link title="Source Code" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-gitlab: GitLab](https://gitlab.com/AuroraOSS/AuroraStore/-/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Aurora Store does not allow you to download paid apps with their anonymous account feature. You can optionally log in with your Google account with Aurora Store to download apps you have purchased, which does give access to the list of apps you've installed to Google. However, you still benefit from not requiring the full Google Play client and Google Play Services or microG on your device.
|
||||
|
||||
### Manually with RSS Notifications
|
||||
|
||||
For apps that are released on platforms like GitHub and GitLab, you may be able to add an RSS feed to your [news aggregator](news-aggregators.md) that will help you keep track of new releases.
|
||||
|
||||
   
|
||||
|
||||
#### GitHub
|
||||
|
||||
On GitHub, using [Secure Camera](#secure-camera) as an example, you would navigate to its [releases page](https://github.com/GrapheneOS/Camera/releases) and append `.atom` to the URL:
|
||||
|
||||
`https://github.com/GrapheneOS/Camera/releases.atom`
|
||||
|
||||
#### GitLab
|
||||
|
||||
On GitLab, using [Aurora Store](#aurora-store) as an example, you would navigate to its [project repository](https://gitlab.com/AuroraOSS/AuroraStore) and append `/-/tags?format=atom` to the URL:
|
||||
|
||||
`https://gitlab.com/AuroraOSS/AuroraStore/-/tags?format=atom`
|
||||
|
||||
#### Verifying APK Fingerprints
|
||||
|
||||
If you download APK files to install manually, you can verify their signature with the [`apksigner`](https://developer.android.com/studio/command-line/apksigner) tool, which is a part of Android [build-tools](https://developer.android.com/studio/releases/build-tools).
|
||||
|
||||
1. Install [Java JDK](https://oracle.com/java/technologies/downloads).
|
||||
|
||||
2. Download the [Android Studio command line tools](https://developer.android.com/studio#command-tools).
|
||||
|
||||
3. Extract the downloaded archive:
|
||||
|
||||
```bash
|
||||
unzip commandlinetools-*.zip
|
||||
cd cmdline-tools
|
||||
./bin/sdkmanager --sdk_root=./ "build-tools;29.0.3"
|
||||
```
|
||||
|
||||
4. Run the signature verification command:
|
||||
|
||||
```bash
|
||||
./build-tools/29.0.3/apksigner verify --print-certs ../Camera-37.apk
|
||||
```
|
||||
|
||||
5. The resulting hashes can then be compared with another source. Some developers such as Signal [show the fingerprints](https://signal.org/android/apk) on their website.
|
||||
|
||||
```bash
|
||||
Signer #1 certificate DN: CN=GrapheneOS
|
||||
Signer #1 certificate SHA-256 digest: 6436b155b917c2f9a9ed1d15c4993a5968ffabc94947c13f2aeee14b7b27ed59
|
||||
Signer #1 certificate SHA-1 digest: 23e108677a2e1b1d6e6b056f3bb951df7ad5570c
|
||||
Signer #1 certificate MD5 digest: dbbcd0cac71bd6fa2102a0297c6e0dd3
|
||||
```
|
||||
|
||||
### F-Droid
|
||||
|
||||
{ align=right width=120px }
|
||||
|
||||
==We only recommend F-Droid as a way to obtain apps which cannot be obtained via the means above.== F-Droid is often recommended as an alternative to Google Play, particularly in the privacy community. The option to add third-party repositories and not be confined to Google's walled garden has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds) for some applications and is dedicated to free and open-source software. However, there are some security-related downsides to how F-Droid builds, signs, and delivers packages:
|
||||
|
||||
Due to their process of building apps, apps in the official F-Droid repository often fall behind on updates. F-Droid maintainers also reuse package IDs while signing apps with their own keys, which is not ideal as it gives the F-Droid team ultimate trust. Additionally, the requirements for an app to be included in the official F-Droid repo are less strict than other app stores like Google Play, meaning that F-Droid tends to host a lot more apps which are older, unmaintained, or otherwise no longer meet [modern security standards](https://developer.android.com/google/play/requirements/target-sdk).
|
||||
|
||||
Other popular third-party repositories for F-Droid such as [IzzyOnDroid](https://apt.izzysoft.de/fdroid) alleviate some of these concerns. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. However, it is not something that we can fully recommend, as apps are typically [removed](https://github.com/vfsfitvnm/ViMusic/issues/240#issuecomment-1225564446) from that repository if they are later added to the main F-Droid repository. While that makes sense (since the goal of that particular repository is to host apps before they're accepted into the main F-Droid repository), it can leave you with installed apps which no longer receive updates.
|
||||
|
||||
That said, the [F-Droid](https://f-droid.org/en/packages) and [IzzyOnDroid](https://apt.izzysoft.de/fdroid) repositories are home to countless apps, so they can be a useful tool to search for and discover open-source apps that you can then download through other means such as the Play Store, Aurora Store, or by getting the APK directly from the developer. You should use your best judgement when looking for new apps via this method, and keep an eye on how frequently the app is updated. Outdated apps may rely on unsupported libraries, among other things, posing a potential security risk.
|
||||
|
||||
<div class="admonition note" markdown>
|
||||
<p class="admonition-title">F-Droid Basic</p>
|
||||
|
||||
In some rare cases, the developer of an app will only distribute it through F-Droid ([Gadgetbridge](https://gadgetbridge.org) is one example of this). If you really need an app like that, we recommend using the newer [F-Droid Basic](https://f-droid.org/en/packages/org.fdroid.basic) client instead of the original F-Droid app to obtain it. F-Droid Basic supports automatic background updates without privileged extension or root, and has a reduced feature set (limiting attack surface).
|
||||
|
||||
</div>
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
### Operating Systems
|
||||
|
||||
- Must be open-source software.
|
||||
- Must support bootloader locking with custom AVB key support.
|
||||
- Must receive major Android updates within 0-1 months of release.
|
||||
- Must receive Android feature updates (minor version) within 0-14 days of release.
|
||||
- Must receive regular security patches within 0-5 days of release.
|
||||
- Must **not** be "rooted" out of the box.
|
||||
- Must **not** enable Google Play Services by default.
|
||||
- Must **not** require system modification to support Google Play Services.
|
||||
|
||||
### Devices
|
||||
|
||||
- Must support at least one of our recommended custom operating systems.
|
||||
- Must be currently sold new in stores.
|
||||
- Must receive a minimum of 5 years of security updates.
|
||||
- Must have dedicated secure element hardware.
|
||||
|
||||
### Applications
|
||||
|
||||
- Applications on this page must not be applicable to any other software category on the site.
|
||||
- General applications should extend or replace core system functionality.
|
||||
- Applications should receive regular updates and maintenance.
|
||||
@@ -1,108 +0,0 @@
|
||||
---
|
||||
meta_title: "The Best Custom Android OSes (aka Custom ROMs) - Privacy Guides"
|
||||
title: "Alternative Distributions"
|
||||
description: You can replace the operating system on your Android phone with these secure and privacy-respecting alternatives.
|
||||
schema:
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
name: Private Android Operating Systems
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: GrapheneOS
|
||||
image: /assets/img/android/grapheneos.svg
|
||||
url: https://grapheneos.org/
|
||||
sameAs: https://en.wikipedia.org/wiki/GrapheneOS
|
||||
subjectOf:
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: Divest
|
||||
image: /assets/img/android/divestos.svg
|
||||
url: https://divestos.org/
|
||||
sameAs: https://en.wikipedia.org/wiki/DivestOS
|
||||
subjectOf:
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
---
|
||||
A **custom Android-based operating system** (often known as a **custom ROM**) is a popular way to achieve higher levels of privacy and security on your device. This is in contrast to the "stock" version of Android which comes with your phone from the factory, and is often deeply integrated with Google Play Services.
|
||||
|
||||
We recommend installing one of these custom Android operating systems on your device, listed in order of preference, depending on your device's compatibility with these operating systems.
|
||||
|
||||
## AOSP Derivatives
|
||||
|
||||
### GrapheneOS
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**GrapheneOS** is the best choice when it comes to privacy and security.
|
||||
|
||||
GrapheneOS provides additional [security hardening](https://en.wikipedia.org/wiki/Hardening_(computing)) and privacy improvements. It has a [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), network and sensor permissions, and various other [security features](https://grapheneos.org/features). GrapheneOS also comes with full firmware updates and signed builds, so verified boot is fully supported.
|
||||
|
||||
[:octicons-home-16: Homepage](https://grapheneos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://grapheneos.org/faq#privacy-policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://grapheneos.org/faq){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://grapheneos.org/source){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
GrapheneOS supports [sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), which runs [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) fully sandboxed like any other regular app. This means you can take advantage of most Google Play Services, such as [push notifications](https://firebase.google.com/docs/cloud-messaging), while giving you full control over their permissions and access, and while containing them to a specific [work profile](../os/android-overview.md#work-profile) or [user profile](../os/android-overview.md#user-profiles) of your choice.
|
||||
|
||||
[Google Pixel phones](../mobile-phones.md#google-pixel) are the only devices that currently meet GrapheneOS's [hardware security requirements](https://grapheneos.org/faq#future-devices).
|
||||
|
||||
### DivestOS
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**DivestOS** is a soft-fork of [LineageOS](https://lineageos.org).
|
||||
DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
|
||||
|
||||
[:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" }
|
||||
[:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates.
|
||||
DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled.
|
||||
|
||||
DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) and SENSORS permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://grapheneos.org/usage#exec-spawning), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and higher features GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, [`ptrace_scope`](https://kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, [automatic reboot](https://grapheneos.org/features#auto-reboot), and Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features#attack-surface-reduction).
|
||||
|
||||
DivestOS uses F-Droid as its default app store. We normally [recommend avoiding F-Droid](obtaining-apps.md#f-droid), but doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repository, [DivestOS Official](https://divestos.org/fdroid/official). We recommend disabling the official F-Droid app and using [F-Droid Basic](https://f-droid.org/en/packages/org.fdroid.basic) **with the DivestOS repository enabled** to keep those components up to date. For other apps, our recommended [methods of obtaining them](obtaining-apps.md) still apply.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
DivestOS firmware update [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) and quality control varies across the devices it supports. We still recommend GrapheneOS depending on your device's compatibility. For other devices, DivestOS is a good alternative.
|
||||
|
||||
Not all of the supported devices have verified boot, and some perform it better than others.
|
||||
|
||||
</div>
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
- Must be open-source software.
|
||||
- Must support bootloader locking with custom AVB key support.
|
||||
- Must receive major Android updates within 0-1 months of release.
|
||||
- Must receive Android feature updates (minor version) within 0-14 days of release.
|
||||
- Must receive regular security patches within 0-5 days of release.
|
||||
- Must **not** be "rooted" out of the box.
|
||||
- Must **not** enable Google Play Services by default.
|
||||
- Must **not** require system modification to support Google Play Services.
|
||||
@@ -1,127 +0,0 @@
|
||||
---
|
||||
title: "General Apps"
|
||||
schema:
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
name: General Android Apps
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Shelter
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Secure Camera
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": MobileApplication
|
||||
name: Secure PDF Viewer
|
||||
applicationCategory: Utilities
|
||||
operatingSystem: Android
|
||||
---
|
||||
We recommend a wide variety of Android apps throughout this site. The apps listed here are Android-exclusive and specifically enhance or replace key system functionality.
|
||||
|
||||
### Shelter
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Shelter** is an app that helps you leverage Android's Work Profile functionality to isolate or duplicate apps on your device.
|
||||
|
||||
Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager ([DocumentsUI](https://source.android.com/devices/architecture/modular-system/documentsui)).
|
||||
|
||||
[:octicons-repo-16: Repository](https://gitea.angry.im/PeterCxy/Shelter#shelter){ .md-button .md-button--primary }
|
||||
[:octicons-code-16:](https://gitea.angry.im/PeterCxy/Shelter){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://patreon.com/PeterCxy){ .card-link title=Contribute }
|
||||
|
||||
</div>
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Shelter is recommended over [Insular](https://secure-system.gitlab.io/Insular) and [Island](https://github.com/oasisfeng/island) as it supports [contact search blocking](https://secure-system.gitlab.io/Insular/faq.html).
|
||||
|
||||
When using Shelter, you are placing complete trust in its developer, as Shelter acts as a [Device Admin](https://developer.android.com/guide/topics/admin/device-admin) to create the Work Profile, and it has extensive access to the data stored within the Work Profile.
|
||||
|
||||
</div>
|
||||
|
||||
### Secure Camera
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Secure Camera** is a camera app focused on privacy and security which can capture images, videos, and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/GrapheneOS/Camera){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://grapheneos.org/usage#camera){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/GrapheneOS/Camera){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.camera.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/Camera/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Main privacy features include:
|
||||
|
||||
- Auto removal of [Exif](https://en.wikipedia.org/wiki/Exif) metadata (enabled by default)
|
||||
- Use of the new [Media](https://developer.android.com/training/data-storage/shared/media) API, therefore [storage permissions](https://developer.android.com/training/data-storage) are not required
|
||||
- Microphone permission not required unless you want to record sound
|
||||
|
||||
<div class="admonition note" markdown>
|
||||
<p class="admonition-title">Note</p>
|
||||
|
||||
Metadata is not currently deleted from video files but that is planned.
|
||||
|
||||
The image orientation metadata is not deleted. If you enable location (in Secure Camera) that **won't** be deleted either. If you want to delete that later you will need to use an external app such as [ExifEraser](../data-redaction.md#exiferaser-android).
|
||||
|
||||
</div>
|
||||
|
||||
### Secure PDF Viewer
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [WebView](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files.
|
||||
|
||||
[Content-Security-Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) is used to enforce that the JavaScript and styling properties within the WebView are entirely static content.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/GrapheneOS/PdfViewer){ .md-button .md-button--primary }
|
||||
[:octicons-code-16:](https://github.com/GrapheneOS/PdfViewer){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.pdfviewer.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/PdfViewer/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](../about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
- Applications on this page must not be applicable to any other software category on the site.
|
||||
- General applications should extend or replace core system functionality.
|
||||
- Applications should receive regular updates and maintenance.
|
||||
@@ -1,36 +0,0 @@
|
||||
---
|
||||
title: "Android"
|
||||
icon: 'simple/android'
|
||||
cover: android.webp
|
||||
schema:
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
name: Android Recommendations
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": CreativeWork
|
||||
name: Android
|
||||
image: /assets/img/android/android.svg
|
||||
url: https://source.android.com/
|
||||
sameAs: https://en.wikipedia.org/wiki/Android_(operating_system)
|
||||
---
|
||||
|
||||
{ align=right }
|
||||
|
||||
The **Android Open Source Project** (AOSP) is an open-source mobile operating system led by Google which powers the majority of the world's mobile devices. Most phones sold with Android are modified to include invasive integrations and apps such as Google Play Services, so you can significantly improve your privacy on your mobile device by replacing your phone's default installation with a version of Android without these invasive features.
|
||||
|
||||
[:octicons-home-16:](https://source.android.com){ .card-link title=Homepage }
|
||||
[:octicons-info-16:](https://source.android.com/docs){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://cs.android.com/android/platform/superproject/main){ .card-link title="Source Code" }
|
||||
|
||||
We recommend the following Android-specific tools to maximize your mobile device's security and privacy.
|
||||
|
||||
- [Alternative Distributions](distributions.md)
|
||||
- [General Apps](general-apps.md)
|
||||
- [Obtaining Applications](obtaining-apps.md)
|
||||
|
||||
To learn more about Android:
|
||||
|
||||
[General Android Overview :material-arrow-right-drop-circle:](../os/android-overview.md){ .md-button }
|
||||
@@ -1,125 +0,0 @@
|
||||
---
|
||||
title: "Obtaining Applications"
|
||||
---
|
||||
There are many ways to obtain Android apps privately, even from the Play Store, without interacting with Google Play Services. We recommend the following methods of obtaining applications on Android, listed in order of preference.
|
||||
|
||||
## Obtainium
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Obtainium** is an app manager which allows you to install and update apps directly from the developer's own releases page (i.e. GitHub, GitLab, the developer's website, etc.), rather than a centralized app store/repository. It supports automatic background updates on Android 12 and higher.
|
||||
|
||||
[:octicons-repo-16: Repository](https://github.com/ImranR98/Obtainium#readme){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://github.com/ImranR98/Obtainium/wiki){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/ImranR98/Obtainium){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://github.com/sponsors/ImranR98){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-github: GitHub](https://github.com/ImranR98/Obtainium/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Obtainium allows you to download APK installer files from a wide variety of sources, and it is up to you to ensure those sources and apps are legitimate. For example, using Obtainium to install Signal from [Signal's APK landing page](https://signal.org/android/apk) should be fine, but installing from third-party APK repositories like Aptoide or APKPure may pose additional risks. The risk of installing a malicious *update* is lower, because Android itself verifies that all app updates are signed by the same developer as the existing app on your phone before installing them.
|
||||
|
||||
## GrapheneOS App Store
|
||||
|
||||
GrapheneOS's app store is available on [GitHub](https://github.com/GrapheneOS/Apps/releases). It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the [Auditor](../device-integrity.md#auditor-android), [Camera](general-apps.md#secure-camera), and [PDF Viewer](general-apps.md#secure-pdf-viewer). If you are looking for these applications, we highly recommend that you get them from GrapheneOS's app store instead of the Play Store, as the apps on their store are signed by the GrapheneOS's project own signature that Google does not have access to.
|
||||
|
||||
## Aurora Store
|
||||
|
||||
The Google Play Store requires a Google account to log in, which is not great for privacy. You can get around this by using an alternative client, such as Aurora Store.
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Aurora Store** is a Google Play Store client which does not require a Google account, Google Play Services, or microG to download apps.
|
||||
|
||||
[:octicons-home-16: Homepage](https://auroraoss.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://gitlab.com/AuroraOSS/AuroraStore/-/blob/master/POLICY.md){ .card-link title="Privacy Policy" }
|
||||
[:octicons-code-16:](https://gitlab.com/AuroraOSS/AuroraStore){ .card-link title="Source Code" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-gitlab: GitLab](https://gitlab.com/AuroraOSS/AuroraStore/-/releases)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
Aurora Store does not allow you to download paid apps with their anonymous account feature. You can optionally log in with your Google account with Aurora Store to download apps you have purchased, which does give access to the list of apps you've installed to Google. However, you still benefit from not requiring the full Google Play client and Google Play Services or microG on your device.
|
||||
|
||||
## Manually with RSS Notifications
|
||||
|
||||
For apps that are released on platforms like GitHub and GitLab, you may be able to add an RSS feed to your [news aggregator](../news-aggregators.md) that will help you keep track of new releases.
|
||||
|
||||
   
|
||||
|
||||
### GitHub
|
||||
|
||||
On GitHub, using [Secure Camera](general-apps.md#secure-camera) as an example, you would navigate to its [releases page](https://github.com/GrapheneOS/Camera/releases) and append `.atom` to the URL:
|
||||
|
||||
`https://github.com/GrapheneOS/Camera/releases.atom`
|
||||
|
||||
### GitLab
|
||||
|
||||
On GitLab, using [Aurora Store](#aurora-store) as an example, you would navigate to its [project repository](https://gitlab.com/AuroraOSS/AuroraStore) and append `/-/tags?format=atom` to the URL:
|
||||
|
||||
`https://gitlab.com/AuroraOSS/AuroraStore/-/tags?format=atom`
|
||||
|
||||
### Verifying APK Fingerprints
|
||||
|
||||
If you download APK files to install manually, you can verify their signature with the [`apksigner`](https://developer.android.com/studio/command-line/apksigner) tool, which is a part of Android [build-tools](https://developer.android.com/studio/releases/build-tools).
|
||||
|
||||
1. Install [Java JDK](https://oracle.com/java/technologies/downloads).
|
||||
|
||||
2. Download the [Android Studio command line tools](https://developer.android.com/studio#command-tools).
|
||||
|
||||
3. Extract the downloaded archive:
|
||||
|
||||
```bash
|
||||
unzip commandlinetools-*.zip
|
||||
cd cmdline-tools
|
||||
./bin/sdkmanager --sdk_root=./ "build-tools;29.0.3"
|
||||
```
|
||||
|
||||
4. Run the signature verification command:
|
||||
|
||||
```bash
|
||||
./build-tools/29.0.3/apksigner verify --print-certs ../Camera-37.apk
|
||||
```
|
||||
|
||||
5. The resulting hashes can then be compared with another source. Some developers such as Signal [show the fingerprints](https://signal.org/android/apk) on their website.
|
||||
|
||||
```bash
|
||||
Signer #1 certificate DN: CN=GrapheneOS
|
||||
Signer #1 certificate SHA-256 digest: 6436b155b917c2f9a9ed1d15c4993a5968ffabc94947c13f2aeee14b7b27ed59
|
||||
Signer #1 certificate SHA-1 digest: 23e108677a2e1b1d6e6b056f3bb951df7ad5570c
|
||||
Signer #1 certificate MD5 digest: dbbcd0cac71bd6fa2102a0297c6e0dd3
|
||||
```
|
||||
|
||||
## F-Droid
|
||||
|
||||
{ align=right width=120px }
|
||||
|
||||
==We only recommend F-Droid as a way to obtain apps which cannot be obtained via the means above.== F-Droid is often recommended as an alternative to Google Play, particularly within the privacy community. The option to add third-party repositories and not be confined to Google's walled garden has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds) for some applications and is dedicated to free and open-source software. However, there are some security-related downsides to how F-Droid builds, signs, and delivers packages:
|
||||
|
||||
Due to their process of building apps, apps in the *official* F-Droid repository often fall behind on updates. F-Droid maintainers also reuse package IDs while signing apps with their own keys, which is not ideal as it gives the F-Droid team ultimate trust. Additionally, the requirements for an app to be included in the official F-Droid repo are less strict than other app stores like Google Play, meaning that F-Droid tends to host a lot more apps which are older, unmaintained, or otherwise no longer meet [modern security standards](https://developer.android.com/google/play/requirements/target-sdk).
|
||||
|
||||
Other popular third-party repositories for F-Droid such as [IzzyOnDroid](https://apt.izzysoft.de/fdroid) alleviate some of these concerns. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. However, it is not something that we can fully recommend, as apps are typically [removed](https://github.com/vfsfitvnm/ViMusic/issues/240#issuecomment-1225564446) from that repository if they are later added to the main F-Droid repository. While that makes sense (since the goal of that particular repository is to host apps before they're accepted into the main F-Droid repository), it can leave you with installed apps which no longer receive updates.
|
||||
|
||||
That said, the [F-Droid](https://f-droid.org/en/packages) and [IzzyOnDroid](https://apt.izzysoft.de/fdroid) repositories are home to countless apps, so they can be a useful tool to search for and discover open-source apps that you can then download through other means such as the Play Store, Aurora Store, or by getting the APK directly from the developer. You should use your best judgement when looking for new apps via this method, and keep an eye on how frequently the app is updated. Outdated apps may rely on unsupported libraries, among other things, posing a potential security risk.
|
||||
|
||||
<div class="admonition note" markdown>
|
||||
<p class="admonition-title">F-Droid Basic</p>
|
||||
|
||||
In some rare cases, the developer of an app will only distribute it through F-Droid ([Gadgetbridge](https://gadgetbridge.org) is one example of this). If you really need an app like that, we recommend using the newer [F-Droid Basic](https://f-droid.org/en/packages/org.fdroid.basic) client instead of the original F-Droid app to obtain it. F-Droid Basic supports automatic background updates without privileged extension or root, and has a reduced feature set (limiting attack surface).
|
||||
|
||||
</div>
|
||||
@@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential
|
||||
[^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf)
|
||||
[^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism)
|
||||
[^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques.
|
||||
[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights).
|
||||
[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights).
|
||||
|
||||
@@ -1,146 +0,0 @@
|
||||
---
|
||||
title: "Choosing Your Hardware"
|
||||
icon: 'material/chip'
|
||||
description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy.
|
||||
---
|
||||
|
||||
When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup.
|
||||
|
||||
## Picking a Computer
|
||||
|
||||
The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates.
|
||||
|
||||
### Hardware Security Programs
|
||||
|
||||
Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example:
|
||||
|
||||
- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates.
|
||||
- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys.
|
||||
- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems.
|
||||
- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot).
|
||||
|
||||
Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates.
|
||||
|
||||
### Preinstalled OS
|
||||
|
||||
New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware).
|
||||
|
||||
### Firmware Updates
|
||||
|
||||
Hardware often has security issues that are discovered and patched through firmware updates for your hardware.
|
||||
|
||||
Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported.
|
||||
|
||||
If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard.
|
||||
|
||||
### TPM/Secure Cryptoprocessor
|
||||
|
||||
Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM.
|
||||
|
||||
<div class="admonition Note" markdown>
|
||||
<p class="admonition-title">Note</p>
|
||||
|
||||
Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs).
|
||||
|
||||
</div>
|
||||
|
||||
### Biometrics
|
||||
|
||||
Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password.
|
||||
|
||||
Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option.
|
||||
|
||||
Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability.
|
||||
|
||||
</div>
|
||||
|
||||
Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics.
|
||||
|
||||
### Device Encryption
|
||||
|
||||
If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it.
|
||||
|
||||
This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key.
|
||||
|
||||
## External Hardware
|
||||
|
||||
Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model.
|
||||
|
||||
### Hardware Security Keys
|
||||
|
||||
Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks.
|
||||
|
||||
[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button }
|
||||
|
||||
### Camera/Microphone
|
||||
|
||||
If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features.
|
||||
|
||||
</div>
|
||||
|
||||
For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid.
|
||||
|
||||
Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system.
|
||||
|
||||
### Privacy Screens
|
||||
|
||||
Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen.
|
||||
|
||||
### Dead Man's Switches
|
||||
|
||||
A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present.
|
||||
|
||||
Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature.
|
||||
|
||||
You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected.
|
||||
|
||||
### Anti-Interdiction/Evil Maid Attack
|
||||
|
||||
The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address.
|
||||
|
||||
Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible.
|
||||
|
||||
## Secure your Network
|
||||
|
||||
### Compartmentalization
|
||||
|
||||
Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games.
|
||||
|
||||
For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks.
|
||||
|
||||
Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc.
|
||||
|
||||
### Minimalism
|
||||
|
||||
As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date.
|
||||
|
||||
You may find it useful to go around your home and make a list of every connected device you have to help you keep track.
|
||||
|
||||
### Routers
|
||||
|
||||
Your router handles all your network traffic and acts as your first line of defense between you and the open internet.
|
||||
|
||||
<div class="admonition Note" markdown>
|
||||
<p class="admonition-title">Note</p>
|
||||
|
||||
A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised.
|
||||
|
||||
</div>
|
||||
|
||||
The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway".
|
||||
|
||||
If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually.
|
||||
|
||||
Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers.
|
||||
|
||||
Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa.
|
||||
@@ -4,7 +4,7 @@ icon: material/calendar
|
||||
description: Calendars contain some of your most sensitive data; use products that implement encryption at rest.
|
||||
cover: calendar.webp
|
||||
---
|
||||
**Calendars** contain some of your most sensitive data; use products that implement E2EE at rest to prevent a provider from reading them.
|
||||
Calendars contain some of your most sensitive data; use products that implement E2EE at rest to prevent a provider from reading them.
|
||||
|
||||
## Tuta
|
||||
|
||||
|
||||
@@ -5,14 +5,14 @@ icon: material/file-cloud
|
||||
description: Many cloud storage providers require your trust that they will not look at your files. These are private alternatives!
|
||||
cover: cloud.webp
|
||||
---
|
||||
Many **cloud storage providers** require your full trust that they will not look at your files. The alternatives listed below eliminate the need for trust by implementing secure E2EE.
|
||||
Many cloud storage providers require your full trust that they will not look at your files. The alternatives listed below eliminate the need for trust by implementing secure E2EE.
|
||||
|
||||
If these alternatives do not fit your needs, we suggest you look into using encryption software like [Cryptomator](encryption.md#cryptomator-cloud) with another cloud provider. Using Cryptomator in conjunction with **any** cloud provider (including these) may be a good idea to reduce the risk of encryption flaws in a provider's native clients.
|
||||
|
||||
<details class="admonition info" markdown>
|
||||
<details class="TYPE" markdown>
|
||||
<summary>Looking for Nextcloud?</summary>
|
||||
|
||||
Nextcloud is [still a recommended tool](document-collaboration.md#nextcloud) for self-hosting a file management suite, however we do not recommend third-party Nextcloud storage providers at the moment, because we do [not recommend](https://discuss.privacyguides.net/t/dont-recommend-nextcloud-e2ee/10352/29) Nextcloud's built-in E2EE functionality for home users.
|
||||
Nextcloud is [still a recommended tool](productivity.md) for self-hosting a file management suite, however we do not recommend third-party Nextcloud storage providers at the moment, because we do [not recommend](https://discuss.privacyguides.net/t/dont-recommend-nextcloud-e2ee/10352/29) Nextcloud's built-in E2EE functionality for home users.
|
||||
|
||||
</details>
|
||||
|
||||
@@ -22,7 +22,7 @@ Nextcloud is [still a recommended tool](document-collaboration.md#nextcloud) for
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Proton Drive** is an encrypted cloud storage provider from the popular encrypted email provider [Proton Mail](email.md#proton-mail). The initial free storage is limited to 2GB, but with completion of certain steps, additional storage can be obtained up to 5GB.
|
||||
**Proton Drive** is a Swiss encrypted cloud storage provider from the popular encrypted email provider [Proton Mail](email.md#proton-mail). The initial free storage is limited to 2GB, but with completion of certain steps, additional storage can be obtained up to 5GB.
|
||||
|
||||
[:octicons-home-16: Homepage](https://proton.me/drive){ class="md-button md-button--primary" }
|
||||
[:octicons-eye-16:](https://proton.me/legal/privacy){ .card-link title="Privacy Policy" }
|
||||
@@ -82,7 +82,7 @@ Tresorit has received a number of independent security audits:
|
||||
|
||||
[^1]: [ISO/IEC 27001](https://en.wikipedia.org/wiki/ISO/IEC_27001):2013 compliance relates to the company's [information security management system](https://en.wikipedia.org/wiki/Information_security_management) and covers the sales, development, maintenance and support of their cloud services.
|
||||
|
||||
They have also received the Digital Trust Label, a certification from the [Swiss Digital Initiative](https://efd.admin.ch/en/swiss-digital-initiative-en) which requires passing [35 criteria](https://swiss-digital-initiative.org/criteria) related to security, privacy, and reliability.
|
||||
They have also received the Digital Trust Label, a certification from the [Swiss Digital Initiative](https://www.efd.admin.ch/efd/en/home/digitalisierung/swiss-digital-initiative.html) which requires passing [35 criteria](https://digitaltrust-label.swiss/criteria) related to security, privacy, and reliability.
|
||||
|
||||
## Peergos
|
||||
|
||||
|
||||
@@ -38,14 +38,14 @@ With Monero, outside observers cannot decipher addresses trading Monero, transac
|
||||
For optimal privacy, make sure to use a noncustodial wallet where the view key stays on the device. This means that only you will have the ability to spend your funds and see incoming and outgoing transactions. If you use a custodial wallet, the provider can see **everything** you do; if you use a “lightweight” wallet where the provider retains your private view key, the provider can see almost everything you do. Some noncustodial wallets include:
|
||||
|
||||
- [Official Monero client](https://getmonero.org/downloads) (Desktop)
|
||||
- [Cake Wallet](https://cakewallet.com) (iOS, Android, macOS)
|
||||
- Cake Wallet supports multiple cryptocurrencies. A Monero-only version of Cake Wallet for iOS and Android is available at [Monero.com](https://monero.com).
|
||||
- [Cake Wallet](https://cakewallet.com) (iOS, Android, macOS, Linux BETA)
|
||||
- Cake Wallet supports multiple cryptocurrencies. A Monero-only version of Cake Wallet is available at [Monero.com](https://monero.com).
|
||||
- [Feather Wallet](https://featherwallet.org) (Desktop)
|
||||
- [Monerujo](https://monerujo.io) (Android)
|
||||
|
||||
For maximum privacy (even with a noncustodial wallet), you should run your own Monero node. Using another person’s node will expose some information to them, such as the IP address that you connect to it from, the timestamps that you sync your wallet, and the transactions that you send from your wallet (though no other details about those transactions). Alternatively, you can connect to someone else’s Monero node over Tor or [I2P](alternative-networks.md#i2p-the-invisible-internet-project).
|
||||
For maximum privacy (even with a noncustodial wallet), you should run your own Monero node. Using another person’s node will expose some information to them, such as the IP address that you connect to it from, the timestamps that you sync your wallet, and the transactions that you send from your wallet (though no other details about those transactions). Alternatively, you can connect to someone else’s Monero node over Tor or i2p.
|
||||
|
||||
In August 2021, CipherTrace [announced](https://web.archive.org/web/20240223224846/https://ciphertrace.com/enhanced-monero-tracing) enhanced Monero tracing capabilities for government agencies. Public postings show that the US Department of the Treasury's Financial Crimes Enforcement Network [licensed](https://sam.gov/opp/d12cbe9afbb94ca68006d0f006d355ac/view) CipherTrace's "Monero Module" in late 2022.
|
||||
In August 2021, CipherTrace [announced](https://ciphertrace.com/enhanced-monero-tracing) enhanced Monero tracing capabilities for government agencies. Public postings show that the US Department of the Treasury's Financial Crimes Enforcement Network [licensed](https://sam.gov/opp/d12cbe9afbb94ca68006d0f006d355ac/view) CipherTrace's "Monero Module" in late 2022.
|
||||
|
||||
Monero transaction graph privacy is limited by its relatively small ring signatures, especially against targeted attacks. Monero's privacy features have also been [called into question](https://web.archive.org/web/20180331203053/https://wired.com/story/monero-privacy) by some security researchers, and a number of severe vulnerabilities have been found and patched in the past, so the claims made by organizations like CipherTrace are not out of the question. While it's unlikely that Monero mass surveillance tools exist like they do for Bitcoin and others, it's certain that tracing tools assist with targeted investigations.
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
meta_title: "Privacy Respecting Web Browsers for PC and Mac - Privacy Guides"
|
||||
title: "Desktop Browsers"
|
||||
icon: material/laptop
|
||||
description: These privacy-protecting browsers are what we currently recommend for standard/non-anonymous internet browsing on desktop systems.
|
||||
description: These web browsers provide stronger privacy protections than Google Chrome.
|
||||
cover: desktop-browsers.webp
|
||||
schema:
|
||||
-
|
||||
@@ -56,7 +56,7 @@ schema:
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
---
|
||||
These are our currently recommended **desktop web browsers** and configurations for standard/non-anonymous browsing. We recommend [Mullvad Browser](#mullvad-browser) if you are focused on strong privacy protections and anti-fingerprinting out of the box, [Firefox](#firefox) for casual internet browsers looking for a good alternative to Google Chrome, and [Brave](#brave) if you need Chromium browser compatibility.
|
||||
These are our currently recommended desktop web browsers and configurations for standard/non-anonymous browsing. We recommend [Mullvad Browser](#mullvad-browser) if you are focused on strong privacy protections and anti-fingerprinting out of the box, [Firefox](#firefox) for casual internet browsers looking for a good alternative to Google Chrome, and [Brave](#brave) if you need Chromium browser compatibility.
|
||||
|
||||
If you need to browse the internet anonymously, you should use [Tor](tor.md) instead. We make some configuration recommendations on this page, but all browsers other than Tor Browser will be traceable by *somebody* in some manner or another.
|
||||
|
||||
@@ -253,6 +253,8 @@ Brave is built upon the Chromium web browser project, so it should feel familiar
|
||||
|
||||
</div>
|
||||
|
||||
**macOS users:** The download for Brave Browser from their official website is a `.pkg` installer which requires admin privileges to run (and may run other unnecessary scripts on your machine). As an alternative, you can download the latest `Brave-Browser-universal.dmg` file from their [GitHub releases](https://github.com/brave/brave-browser/releases/latest) page, which provides a traditional "drag to Applications folder" install.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
@@ -264,7 +266,9 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave%
|
||||
|
||||
These options can be found in :material-menu: → **Settings**.
|
||||
|
||||
#### Shields
|
||||
#### Settings
|
||||
|
||||
##### Shields
|
||||
|
||||
Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit.
|
||||
|
||||
@@ -272,6 +276,7 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
|
||||
|
||||
<div class="annotate" markdown>
|
||||
|
||||
- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
|
||||
- [x] Select **Aggressive** under *Trackers & ads blocking*
|
||||
|
||||
<details class="warning" markdown>
|
||||
@@ -284,7 +289,6 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
- [x] Select **Strict** under *Upgrade connections to HTTPS*
|
||||
- [x] (Optional) Select **Block Scripts** (1)
|
||||
- [x] Check **Block fingerprinting**
|
||||
- [x] Select **Block third-party cookies**
|
||||
- [x] Check **Forget me when I close this site** (2)
|
||||
- [ ] Uncheck all social media components
|
||||
|
||||
@@ -293,54 +297,42 @@ Brave allows you to select additional content filters within the internal `brave
|
||||
1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode).
|
||||
2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar.
|
||||
|
||||
#### Privacy and security
|
||||
##### Privacy and security
|
||||
|
||||
<div class="annotate" markdown>
|
||||
|
||||
- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1)
|
||||
- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings*
|
||||
- [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc)
|
||||
- [ ] Uncheck **Use Google services for push messaging**
|
||||
- [x] Select **Auto-redirect AMP pages**
|
||||
- [x] Select **Auto-redirect tracking URLs**
|
||||
- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
|
||||
- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)**
|
||||
- [ ] Uncheck **Automatically send daily usage ping to Brave**
|
||||
- [ ] Uncheck **Automatically send diagnostic reports**
|
||||
- [ ] Uncheck **Private window with Tor** (1)
|
||||
|
||||
</div>
|
||||
|
||||
1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.
|
||||
1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser).
|
||||
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Sanitizing on close</p>
|
||||
|
||||
- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*.
|
||||
- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**.
|
||||
|
||||
If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
|
||||
|
||||
</div>
|
||||
|
||||
##### Tor windows
|
||||
##### Extensions
|
||||
|
||||
[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser).
|
||||
- [ ] Uncheck all built-in extensions you do not use
|
||||
|
||||
##### Data Collection
|
||||
##### Web3
|
||||
|
||||
- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)**
|
||||
- [ ] Uncheck **Automatically send daily usage ping to Brave**
|
||||
- [ ] Uncheck **Automatically send diagnostic reports**
|
||||
Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled.
|
||||
|
||||
#### Web3
|
||||
|
||||
Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled.
|
||||
|
||||
- Select **Extensions (no fallback)** under *Default Ethereum wallet*
|
||||
- Select **Extensions (no fallback)** under *Default Solana wallet*
|
||||
- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet*
|
||||
- Set *Method to resolve IPFS resources* to **Disabled**
|
||||
|
||||
#### Extensions
|
||||
|
||||
- [ ] Uncheck all built-in extensions you don't use
|
||||
|
||||
#### System
|
||||
##### System
|
||||
|
||||
<div class="annotate" markdown>
|
||||
|
||||
|
||||
@@ -162,9 +162,9 @@ Using these apps is insufficient to determine that a device is "clean", and not
|
||||
|
||||
</div>
|
||||
|
||||
Auditor is not a scanning/analysis tool like some other tools on this page. Rather, it uses your device's hardware-backed keystore to allow you to verify the identity of your device and gain assurance that the operating system itself hasn't been tampered with or downgraded via verified boot. This provides a very robust integrity check of your device itself, but doesn't necessarily check whether the user-level apps running on your device are malicious.
|
||||
Auditor is not a scanning/analysis tool like some other tools on this page; rather it uses your device's hardware-backed keystore to allow you to verify the identity of your device and gain assurance that the operating system itself hasn't been tampered with or downgraded via verified boot. This provides a very robust integrity check of your device itself, but doesn't necessarily check whether the user-level apps running on your device are malicious.
|
||||
|
||||
Auditor performs attestation and intrusion detection with **two** devices, an *auditee* (the device being verified) and an *auditor* (the device performing the verification). The auditor can be any Android 10+ device (or a remote web service operated by [GrapheneOS](android/distributions.md#grapheneos)), while the auditee must be a specifically [supported device](https://attestation.app/about#device-support). Auditor works by:
|
||||
Auditor performs attestation and intrusion detection with **two** devices, an *auditee* (the device being verified) and an *auditor* (the device performing the verification). The auditor can be any Android 10+ device (or a remote web service operated by [GrapheneOS](android.md#grapheneos)), while the auditee must be a specifically [supported device](https://attestation.app/about#device-support). Auditor works by:
|
||||
|
||||
- Using a [Trust On First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) model between an *auditor* and *auditee*, the pair establish a private key in the [hardware-backed keystore](https://source.android.com/security/keystore) of the *Auditor*.
|
||||
- The *auditor* can either be another instance of the Auditor app or the [Remote Attestation Service](https://attestation.app).
|
||||
@@ -196,7 +196,7 @@ Using these apps is insufficient to determine that a device is "clean", and not
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android/distributions.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally).
|
||||
**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud. Scans are performed entirely locally.
|
||||
|
||||
[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" }
|
||||
|
||||
@@ -17,14 +17,12 @@ These are our favorite public DNS resolvers based on their privacy and security
|
||||
|
||||
| DNS Provider | Protocols | Logging / Privacy Policy | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||
|---|---|---|---|---|---|
|
||||
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) |
|
||||
| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:octicons-link-external-24:](https://docs.controld.com/docs/macos-platform) |
|
||||
| [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||
| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice, malware blocking by default. | Yes [:octicons-link-external-24:](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||
|
||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||
[^4]: dns0.eu collects some data for their threat intelligence feeds, to monitor for newly registered/observed/active domains and other bulk data. That data is shared with some [partners](https://docs.dns0.eu/data-feeds/introduction) for e.g. security research. They do not collect any Personally Identifiable Information. [https://dns0.eu/privacy](https://dns0.eu/privacy)
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
---
|
||||
title: "Document Collaboration"
|
||||
icon: material/account-group
|
||||
description: Most online office suites do not support E2EE, meaning the cloud provider has access to everything you do.
|
||||
cover: document-collaboration.webp
|
||||
---
|
||||
<!-- markdownlint-disable MD024 -->
|
||||
Most online office suites do not support E2EE, meaning the cloud provider has access to everything you do. The provider's privacy policy may legally protect your rights, but it does not provide technical access constraints.
|
||||
|
||||
## Collaboration Platforms
|
||||
|
||||
### Nextcloud
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Nextcloud** is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control.
|
||||
|
||||
[:octicons-home-16: Homepage](https://nextcloud.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nextcloud.com/privacy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://nextcloud.com/support){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/nextcloud){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://nextcloud.com/contribute){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.nextcloud.client)
|
||||
- [:simple-appstore: App Store](https://apps.apple.com/app/id1125420102)
|
||||
- [:simple-github: GitHub](https://github.com/nextcloud/android/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://nextcloud.com/install/#install-clients)
|
||||
- [:simple-apple: macOS](https://nextcloud.com/install/#install-clients)
|
||||
- [:simple-linux: Linux](https://nextcloud.com/install/#install-clients)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="admonition danger" markdown>
|
||||
<p class="admonition-title">Danger</p>
|
||||
|
||||
We don't recommend using the [E2EE App](https://apps.nextcloud.com/apps/end_to_end_encryption) for Nextcloud as it may lead to data loss; it is highly experimental and not production quality. For this reason, we don't recommend third-party Nextcloud providers.
|
||||
|
||||
</div>
|
||||
|
||||
### CryptPad
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**CryptPad** is a private-by-design alternative to popular office tools. All content on this web service is end-to-end encrypted and can be shared with other users easily.
|
||||
|
||||
[:octicons-home-16: Homepage](https://cryptpad.fr){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://cryptpad.fr/pad/#/2/pad/view/GcNjAWmK6YDB3EO2IipRZ0fUe89j43Ryqeb4fjkjehE){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://docs.cryptpad.fr){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/xwiki-labs/cryptpad){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://opencollective.com/cryptpad){ .card-link title=Contribute }
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
### Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
#### Minimum Requirements
|
||||
|
||||
In general, we define collaboration platforms as full-fledged suites which could reasonably act as a replacement to Google Drive.
|
||||
|
||||
- Must be open source.
|
||||
- Must make files accessible via WebDAV unless it is impossible due to E2EE.
|
||||
- Must have sync clients for Linux, macOS, and Windows.
|
||||
- Must support document and spreadsheet editing.
|
||||
- Must support real-time document collaboration.
|
||||
- Must support exporting documents to standard document formats (e.g. ODF).
|
||||
|
||||
#### Best-Case
|
||||
|
||||
Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page.
|
||||
|
||||
- Should store files in a conventional filesystem.
|
||||
- Should support TOTP or FIDO2 multi-factor authentication support, or passkey logins.
|
||||
@@ -4,7 +4,7 @@ icon: material/email-lock
|
||||
description: An email aliasing service allows you to easily generate a new email address for every website you register for.
|
||||
cover: email-aliasing.webp
|
||||
---
|
||||
An **email aliasing service** allows you to easily generate a new email address for every website you register for. The email aliases you generate are then forwarded to an email address of your choosing, hiding both your "main" email address and the identity of your [email provider](email.md). True email aliasing is better than plus addressing commonly used and supported by many providers, which allows you to create aliases like `yourname+[anythinghere]@example.com`, because websites, advertisers, and tracking networks can trivially remove anything after the `+` sign. Organizations like the [IAB](https://en.wikipedia.org/wiki/Interactive_Advertising_Bureau) require that advertisers [normalize email addresses](https://shkspr.mobi/blog/2023/01/the-iab-loves-tracking-users-but-it-hates-users-tracking-them) so that they can be correlated and tracked, regardless of users' privacy wishes.
|
||||
An email aliasing service allows you to easily generate a new email address for every website you register for. The email aliases you generate are then forwarded to an email address of your choosing, hiding both your "main" email address and the identity of your [email provider](email.md). True email aliasing is better than plus addressing commonly used and supported by many providers, which allows you to create aliases like `yourname+[anythinghere]@example.com`, because websites, advertisers, and tracking networks can trivially remove anything after the `+` sign. Organizations like the [IAB](https://en.wikipedia.org/wiki/Interactive_Advertising_Bureau) require that advertisers [normalize email addresses](https://shkspr.mobi/blog/2023/01/the-iab-loves-tracking-users-but-it-hates-users-tracking-them) so that they can be correlated and tracked, regardless of users' privacy wishes.
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@ icon: material/email-open
|
||||
description: These email clients are privacy-respecting and support OpenPGP email encryption.
|
||||
cover: email-clients.webp
|
||||
---
|
||||
The **email clients** we recommend support both [OpenPGP](encryption.md#openpgp) and strong authentication such as [Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth). OAuth allows you to use [Multi-Factor Authentication](basics/multi-factor-authentication.md) and prevent account theft.
|
||||
Our recommendation list contains email clients that support both [OpenPGP](encryption.md#openpgp) and strong authentication such as [Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth). OAuth allows you to use [Multi-Factor Authentication](basics/multi-factor-authentication.md) and prevent account theft.
|
||||
|
||||
<details class="warning" markdown>
|
||||
<summary>Email does not provide forward secrecy</summary>
|
||||
|
||||
@@ -5,7 +5,7 @@ icon: material/file-lock
|
||||
description: Encryption of data is the only way to control who can access it. These tools allow you to encrypt your emails and any other files.
|
||||
cover: encryption.webp
|
||||
---
|
||||
**Encryption** is the only secure way to control who can access your data. If you are currently not using encryption software for your hard disk, emails, or files, you should pick an option here.
|
||||
Encryption of data is the only way to control who can access it. If you are currently not using encryption software for your hard disk, emails or files, you should pick an option here.
|
||||
|
||||
## Multi-platform
|
||||
|
||||
|
||||
@@ -15,7 +15,7 @@ There are a number of services which provide "virtual debit cards" which you can
|
||||
<div class="admonition tip" markdown>
|
||||
<p class="admonition-title">Check your current bank</p>
|
||||
|
||||
Many banks and credit card providers offer native virtual card functionality. If you use one which provides this option already, you should use it over the following recommendations in most cases. That way, you are not trusting multiple parties with your personal information.
|
||||
Many banks and credit card providers offer native virtual card functionality. If you use one which provides this option already, you should use it over the following recommendations in most cases. That way you are not trusting multiple parties with your personal information.
|
||||
|
||||
</div>
|
||||
|
||||
@@ -26,7 +26,7 @@ Many banks and credit card providers offer native virtual card functionality. If
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Privacy.com**'s free plan allows you to create up to 12 virtual cards per month, set spend limits on those cards, and shut off cards instantly. Their paid plans provide higher limits on the number of cards that can be created each month and the option to hide transaction information from your bank.
|
||||
**Privacy.com**'s free plan allows you to create up to 12 virtual cards per month, set spend limits on those cards, and shut off cards instantly. Their paid plan allows you to create up to 36 cards per month, get 1% cash back on purchases, and hide transaction information from your bank.
|
||||
|
||||
[:octicons-home-16: Homepage](https://privacy.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://privacy.com/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -36,7 +36,7 @@ Many banks and credit card providers offer native virtual card functionality. If
|
||||
|
||||
</div>
|
||||
|
||||
Privacy.com gives information about the merchants you purchase from to your bank by default. Their paid "discreet merchants" feature hides merchant information from your bank, so your bank only sees that a purchase was made with Privacy.com, but not where that money was spent. However, that is not foolproof, and of course, Privacy.com still has knowledge about the merchants you are spending money with.
|
||||
Privacy.com gives information about the merchants you purchase from to your bank by default. Their paid "discreet merchants" feature hides merchant information from your bank, so your bank only sees that a purchase was made with Privacy.com but not where that money was spent, however that is not foolproof, and of course Privacy.com still has knowledge about the merchants you are spending money with.
|
||||
|
||||
### MySudo (US, Paid)
|
||||
|
||||
@@ -66,15 +66,15 @@ MySudo's virtual cards are currently only available via their iOS app.
|
||||
|
||||
## Gift Card Marketplaces
|
||||
|
||||
These services allow you to purchase gift cards for a variety of merchants online with [cryptocurrency](cryptocurrency.md). Some of these services offer ID verification options for higher limits, but they also allow accounts with just an email address. Basic limits typically start at $5,000-10,000 a day for basic accounts, with significantly higher limits for ID verified accounts (if offered).
|
||||
These services allow you to purchase gift cards for a variety of merchants online with [cryptocurrency](cryptocurrency.md). Some of these services offer ID verification options for higher limits, but they also allow accounts with just an email address. Basic limits typically start at $5,000-10,000 a day for basic accounts, and significantly higher limits for ID verified accounts (if offered).
|
||||
|
||||
### Coincards
|
||||
### CoinCards
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Coincards** allows you to purchase gift cards for a large variety of merchants. Their homepage has a complete listing of the various countries where their service is available.
|
||||
**CoinCards** (available in the US and Canada) allows you to purchase gift cards for a large variety of merchants.
|
||||
|
||||
[:octicons-home-16: Homepage](https://coincards.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://coincards.com/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@@ -104,7 +104,7 @@ By default, FreeTube blocks all YouTube advertisements. In addition, FreeTube op
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
When using FreeTube, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io), or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](vpn.md) or [Tor](tor.md) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
|
||||
When using FreeTube, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io) or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](vpn.md) or [Tor](tor.md) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
|
||||
|
||||
</div>
|
||||
|
||||
@@ -114,9 +114,9 @@ When using FreeTube, your IP address may still be known to YouTube, [Invidious](
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Yattee** is a free and open-source privacy oriented video player for iOS, tvOS, and macOS for [YouTube](https://youtube.com). When using Yattee, your subscription list is saved locally on your device.
|
||||
**Yattee** is a free and open-source privacy oriented video player for iOS, tvOS and macOS for [YouTube](https://youtube.com). When using Yattee, your subscription list are saved locally on your device.
|
||||
|
||||
You will need to take a few [extra steps](https://web.archive.org/web/20230330122839/https://gonzoknows.com/posts/Yattee) before you can use Yattee to watch YouTube, due to App Store restrictions.
|
||||
You will need to take a few [extra steps](https://gonzoknows.com/posts/Yattee) before you can use Yattee to watch YouTube, due to App Store restrictions.
|
||||
|
||||
[:octicons-home-16: Homepage](https://github.com/yattee/yattee){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://r.yattee.stream/docs/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -137,7 +137,7 @@ You will need to take a few [extra steps](https://web.archive.org/web/2023033012
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
When using Yattee, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io), [Piped](https://github.com/TeamPiped/Piped/wiki/Instances), or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](vpn.md) or [Tor](tor.md) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
|
||||
When using Yattee, your IP address may still be known to YouTube, [Invidious](https://instances.invidious.io), [Piped](https://github.com/TeamPiped/Piped/wiki/Instances) or [SponsorBlock](https://sponsor.ajay.app) depending on your configuration. Consider using a [VPN](vpn.md) or [Tor](tor.md) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -37,8 +37,6 @@ schema:
|
||||
query-input: required name=search_term_string
|
||||
---
|
||||
<!-- markdownlint-disable -->
|
||||
<div class="grid" markdown>
|
||||
<div markdown>
|
||||
## Why should I care?
|
||||
|
||||
##### “I have nothing to hide. Why should I care about my privacy?”
|
||||
@@ -48,9 +46,7 @@ Much like the right to interracial marriage, woman's suffrage, freedom of speech
|
||||
You shouldn't confuse privacy with secrecy. We know what happens in the bathroom, but you still close the door. That's because you want privacy, not secrecy. **Everyone** has something to protect. Privacy is something that makes us human.
|
||||
|
||||
[:material-book-outline: Why Privacy Matters](basics/why-privacy-matters.md){ class="md-button md-button--primary" }
|
||||
</div>
|
||||
|
||||
<div markdown>
|
||||
## What should I do?
|
||||
|
||||
##### First, you need to make a plan
|
||||
@@ -60,5 +56,3 @@ Trying to protect all your data from everyone all the time is impractical, expen
|
||||
==This process of identifying threats and defining countermeasures is called **threat modeling**==, and it forms the basis of every good security and privacy plan.
|
||||
|
||||
[:material-book-outline: Learn More About Threat Modeling](basics/threat-modeling.md){ class="md-button md-button--primary" }
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
---
|
||||
title: "Language Tools"
|
||||
icon: material/alphabetical-variant
|
||||
description: These language tools do not send your input text to a server and can be used offline and self-hosted.
|
||||
cover: language-tools.webp
|
||||
---
|
||||
Text inputted to grammar, spelling, and style checkers, as well as translation services, can contain sensitive information which may be stored on their servers for an indefinite amount of time. The language tools listed on this page do not send your submitted text to a server, and can be self-hosted and used offline for maximum control of your data.
|
||||
|
||||
## LanguageTool
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**LanguageTool** is a multilingual grammar, style and spell checker that supports more than 20 languages. The software is [self-hostable](https://dev.languagetool.org/http-server), and the extensions do not send your input text to their server.
|
||||
|
||||
LanguageTool offers integration with a variety of [office suites](https://languagetool.org/services#text_editors) and [email clients](https://languagetool.org/services#mail_clients).
|
||||
|
||||
[:octicons-home-16: Homepage](https://languagetool.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://languagetool.org/legal/privacy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://languagetooler.freshdesk.com/en/support/solutions){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/languagetool-org){ .card-link title="Source Code" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-appstore: App Store](https://apps.apple.com/app/id1534275760)
|
||||
- [:fontawesome-brands-windows: Windows](https://languagetool.org/windows-desktop)
|
||||
- [:simple-apple: macOS](https://languagetool.org/mac-desktop)
|
||||
- [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/languagetool)
|
||||
- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/grammar-and-spell-checker/oldceeleldhonbafppcapldpdifcinji)
|
||||
- [:fontawesome-brands-edge: Edge](https://microsoftedge.microsoft.com/addons/detail/hfjadhjooeceemgojogkhlppanjkbobc)
|
||||
- [:simple-safari: Safari](https://apps.apple.com/app/id1534275760)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
- Must be open source.
|
||||
- Must be possible to self-host.
|
||||
@@ -2,11 +2,11 @@
|
||||
title: Uploading Images
|
||||
---
|
||||
|
||||
If you make changes to this website that involve adding new images or replacing existing ones, here are a couple of general recommendations:
|
||||
Here are a couple of general rules for contributing to Privacy Guides:
|
||||
|
||||
## Images
|
||||
|
||||
- We **prefer** SVG images, but if those do not exist we can use PNG images. Additionally, for cover images, we prefer that they are obtained from [Unsplash](https://unsplash.com) and are in the WebP format.
|
||||
- We **prefer** SVG images, but if those do not exist we can use PNG images
|
||||
|
||||
Company logos have canvas size of:
|
||||
|
||||
@@ -17,7 +17,7 @@ Company logos have canvas size of:
|
||||
|
||||
### PNG
|
||||
|
||||
Use the [OptiPNG](https://sourceforge.net/projects/optipng) tool to optimize PNG images:
|
||||
Use the [OptiPNG](https://sourceforge.net/projects/optipng) to optimize the PNG image:
|
||||
|
||||
```bash
|
||||
optipng -o7 file.png
|
||||
@@ -87,11 +87,3 @@ scour --set-precision=5 \
|
||||
--protect-ids-noninkscape \
|
||||
input.svg output.svg
|
||||
```
|
||||
|
||||
### WebP
|
||||
|
||||
Use the [cwebp](https://developers.google.com/speed/webp/docs/using) command to convert PNG or JPEG image files to WebP format:
|
||||
|
||||
```bash
|
||||
cwebp -q 70 -m 6 input_file -o output.webp
|
||||
```
|
||||
|
||||
@@ -36,7 +36,7 @@ schema:
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
---
|
||||
These are our currently recommended **mobile web browsers** and configurations for standard/non-anonymous internet browsing. If you need to browse the internet anonymously, you should use [Tor](tor.md) instead.
|
||||
These are our currently recommended mobile web browsers and configurations for standard/non-anonymous internet browsing. If you need to browse the internet anonymously, you should use [Tor](tor.md) instead.
|
||||
|
||||
## Android
|
||||
|
||||
@@ -171,7 +171,7 @@ Firefox (Gecko)-based browsers on Android [lack](https://bugzilla.mozilla.org/sh
|
||||
[^1]: This should not be mistaken for [state partitioning](https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning) (or dynamic [first party isolation](https://2019.www.torproject.org/projects/torbrowser/design/#identifier-linkability)), where website data such as cookies and cache is restricted so that a third-party embedded in one top-level site cannot access data stored under another top-level site. This is an important privacy feature to prevent cross-site tracking and **is** supported by Firefox on Android.
|
||||
[^2]: GeckoView also [does not](https://bugzilla.mozilla.org/show_bug.cgi?id=1565196) take advantage of Android's native process sandboxing by using the [isolatedProcess](https://developer.android.com/guide/topics/manifest/service-element#isolated) flag, which normally allows an app to safely run less trusted code in a separate process that has no permissions of its own.
|
||||
|
||||
Enable DivestOS's [F-Droid repository](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer.
|
||||
Enable DivestOS's [F-Droid Repo](https://divestos.org/fdroid/official) to receive updates directly from the developer. Downloading Mull from the default F-Droid repo will mean your updates could be delayed by a few days or longer.
|
||||
|
||||
Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid.
|
||||
|
||||
|
||||
@@ -1,102 +0,0 @@
|
||||
---
|
||||
title: "Mobile Phones"
|
||||
icon: material/cellphone-check
|
||||
description: These mobile devices have proper Android Verified Boot support for custom operating systems.
|
||||
cover: android.webp
|
||||
schema:
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": WebPage
|
||||
name: Mobile Phone Recommendations
|
||||
url: "./"
|
||||
-
|
||||
"@context": http://schema.org
|
||||
"@type": Product
|
||||
name: Pixel
|
||||
brand:
|
||||
"@type": Brand
|
||||
name: Google
|
||||
image: /assets/img/android/google-pixel.png
|
||||
sameAs: https://en.wikipedia.org/wiki/Google_Pixel
|
||||
review:
|
||||
"@type": Review
|
||||
author:
|
||||
"@type": Organization
|
||||
name: Privacy Guides
|
||||
---
|
||||
Most **mobile phones** receive short or limited windows of security updates from OEMs; after these devices reach the end of their support period, they **cannot** be considered secure as they no longer receive firmware or driver security updates.
|
||||
|
||||
The mobile devices listed here provide a long lifespan of guaranteed security updates and allow you to install a custom operating system without violating the Android security model.
|
||||
|
||||
[Recommended Custom OSes :material-arrow-right-drop-circle:](android/distributions.md){ .md-button .md-button--primary } [Details about Android Security :material-arrow-right-drop-circle:](os/android-overview.md#security-protections){ .md-button }
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
End-of-life devices (such as GrapheneOS's "extended support" devices) do not have full security patches (firmware updates) due to the OEM discontinuing support. These devices cannot be considered completely secure regardless of installed software.
|
||||
|
||||
</div>
|
||||
|
||||
## Purchasing Advice
|
||||
|
||||
When purchasing a device, we recommend getting one as new as possible. The software and firmware of mobile devices are only supported for a limited time, so buying new extends that lifespan as much as possible.
|
||||
|
||||
Avoid buying phones from mobile network operators. These often have a **locked bootloader** and do not support [OEM unlocking](https://source.android.com/devices/bootloader/locking_unlocking). These phone variants will prevent you from installing any kind of alternative Android distribution.
|
||||
|
||||
Be very **careful** about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen, there's a possibility of it being entered in the [IMEI database](https://gsma.com/get-involved/working-groups/terminal-steering-group/imei-database). There is also a risk involved with you being associated with the activity of the previous owner.
|
||||
|
||||
A few more tips regarding Android devices and operating system compatibility:
|
||||
|
||||
- Do not buy devices that have reached or are near their end-of-life; additional firmware updates must be provided by the manufacturer.
|
||||
- Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper [Verified Boot](https://source.android.com/security/verifiedboot) support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
|
||||
- In short, if a device is not listed here, there is probably a good reason. Check out our [forum](https://discuss.privacyguides.net) to find details!
|
||||
|
||||
## Google Pixel
|
||||
|
||||
Google Pixel phones are the **only** devices we recommend for purchase. Pixel phones have stronger hardware security than any other Android devices currently on the market, due to proper AVB support for third-party operating systems and Google's custom [Titan](https://security.googleblog.com/2021/10/pixel-6-setting-new-standard-for-mobile.html) security chips acting as the Secure Element.
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Google Pixel** devices are known to have good security and properly support [Verified Boot](https://source.android.com/security/verifiedboot), even when installing custom operating systems.
|
||||
|
||||
Beginning with the **Pixel 8** and **8 Pro**, Pixel devices receive a minimum of 7 years of guaranteed security updates, ensuring a much longer lifespan compared to the 2-5 years competing OEMs typically offer.
|
||||
|
||||
[:material-shopping: Store](https://store.google.com/category/phones){ .md-button .md-button--primary }
|
||||
|
||||
</div>
|
||||
|
||||
Secure Elements like the Titan M2 are more limited than the processor's Trusted Execution Environment used by most other phones as they are only used for secrets storage, hardware attestation, and rate limiting, not for running "trusted" programs. Phones without a Secure Element have to use the TEE for *all* of those functions, resulting in a larger attack surface.
|
||||
|
||||
Google Pixel phones use a TEE OS called Trusty which is [open source](https://source.android.com/security/trusty#whyTrusty), unlike many other phones.
|
||||
|
||||
The installation of GrapheneOS on a Pixel phone is easy with their [web installer](https://grapheneos.org/install/web). If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the [NitroPhone](https://shop.nitrokey.com/shop) as they come preloaded with GrapheneOS from the reputable [Nitrokey](https://nitrokey.com/about) company.
|
||||
|
||||
A few more tips for purchasing a Google Pixel:
|
||||
|
||||
- If you're after a bargain on a Pixel device, we suggest buying an "**a**" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
|
||||
- Consider price beating options and specials offered at physical stores.
|
||||
- Look at online community bargain sites in your country. These can alert you to good sales.
|
||||
- Google provides a list showing the [support cycle](https://support.google.com/nexus/answer/4457705) for each one of their devices. The price per day for a device can be calculated as:
|
||||
<math xmlns="http://www.w3.org/1998/Math/MathML" display="inline" class="tml-display" style="display:inline math;">
|
||||
<mfrac>
|
||||
<mtext>Cost</mtext>
|
||||
<mrow>
|
||||
<mtext>End of Life Date</mtext>
|
||||
<mo>−</mo>
|
||||
<mtext>Current Date</mtext>
|
||||
</mrow>
|
||||
</mfrac>
|
||||
</math>
|
||||
, meaning that the longer use of the device the lower cost per day.
|
||||
- If the Pixel is unavailable in your region, the [NitroPhone](https://shop.nitrokey.com/shop) can be shipped globally.
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
- Must support at least one of our recommended custom operating systems.
|
||||
- Must be currently sold new in stores.
|
||||
- Must receive a minimum of 5 years of security updates.
|
||||
- Must have dedicated secure element hardware.
|
||||
@@ -20,7 +20,7 @@ We highly recommend that you use mobile TOTP apps instead of desktop alternative
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Ente Auth** is a free and open-source app which stores and generates TOTP tokens. It can be used with an online account to backup and sync your tokens across your devices (and access them via a web interface) in a secure, end-to-end encrypted fashion. It can also be used offline on a single device with no account necessary.
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@ description: These news aggregator clients let you keep up with your favorite bl
|
||||
cover: news-aggregators.webp
|
||||
---
|
||||
|
||||
A **news aggregator** is software which aggregates digital content from online newspapers, blogs, podcasts, and other resources to one location for easy viewing. Using one can be a great way to keep up with your favorite content.
|
||||
A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to keep up with your favorite blogs and news sites.
|
||||
|
||||
## Aggregator clients
|
||||
|
||||
@@ -179,7 +179,7 @@ https://reddit.com/r/[SUBREDDIT]/new/.rss
|
||||
|
||||
### YouTube
|
||||
|
||||
You can subscribe YouTube channels without logging in and associating usage information with your Google account.
|
||||
You can subscribe YouTube channels without logging in and associating usage information with your Google Account.
|
||||
|
||||
<div class="admonition example" markdown>
|
||||
<p class="admonition-title">Example</p>
|
||||
|
||||
@@ -1,72 +0,0 @@
|
||||
---
|
||||
title: "Office Suites"
|
||||
icon: material/file-edit-outline
|
||||
description: These office suites offer their full functionality without an account and can be used offline.
|
||||
cover: office-suites.webp
|
||||
---
|
||||
Choose an **office suite** that does not require logging in to an account to access its full functionality. The tools listed here can be used offline and could reasonably act as a replacement for Microsoft Office for most needs.
|
||||
|
||||
## LibreOffice
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**LibreOffice** is a free and open-source office suite with extensive functionality.
|
||||
|
||||
[:octicons-home-16: Homepage](https://libreoffice.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://libreoffice.org/about-us/privacy/privacy-policy-en){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://documentation.libreoffice.org/en/english-documentation){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://libreoffice.org/about-us/source-code){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://libreoffice.org/donate){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://libreoffice.org/download/android-and-ios)
|
||||
- [:simple-appstore: App Store](https://libreoffice.org/download/android-and-ios)
|
||||
- [:fontawesome-brands-windows: Windows](https://libreoffice.org/download/download)
|
||||
- [:simple-apple: macOS](https://libreoffice.org/download/download)
|
||||
- [:simple-linux: Linux](https://libreoffice.org/download/download)
|
||||
- [:simple-flathub: Flathub](https://flathub.org/apps/details/org.libreoffice.LibreOffice)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
## OnlyOffice
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**OnlyOffice** is a cloud-based free and open-source office suite with extensive functionality, including integration with Nextcloud.
|
||||
|
||||
[:octicons-home-16: Homepage](https://onlyoffice.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://help.onlyoffice.com/products/files/doceditor.aspx?fileid=5048502&doc=SXhWMEVzSEYxNlVVaXJJeUVtS0kyYk14YWdXTEFUQmRWL250NllHNUFGbz0_IjUwNDg1MDIi0){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://helpcenter.onlyoffice.com/userguides.aspx){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/ONLYOFFICE){ .card-link title="Source Code" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.onlyoffice.documents)
|
||||
- [:simple-appstore: App Store](https://apps.apple.com/app/id944896972)
|
||||
- [:fontawesome-brands-windows: Windows](https://onlyoffice.com/download-desktop.aspx)
|
||||
- [:simple-apple: macOS](https://onlyoffice.com/download-desktop.aspx)
|
||||
- [:simple-linux: Linux](https://onlyoffice.com/download-desktop.aspx)
|
||||
- [:simple-flathub: Flathub](https://flathub.org/apps/details/org.onlyoffice.desktopeditors)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
- Must be cross-platform.
|
||||
- Must be open-source software.
|
||||
- Must function offline.
|
||||
- Must support editing documents, spreadsheets, and slideshows.
|
||||
- Must export files to standard document formats.
|
||||
@@ -17,7 +17,7 @@ This problem could be solved by using a custom Android distribution that does no
|
||||
|
||||
Ideally, when choosing a custom Android distribution, you should make sure that it upholds the Android security model. At the very least, the distribution should have production builds, support for AVB, rollback protection, timely firmware and operating system updates, and SELinux in [enforcing mode](https://source.android.com/security/selinux/concepts#enforcement_levels). All of our recommended Android distributions satisfy these criteria.
|
||||
|
||||
[Our Android System Recommendations :material-arrow-right-drop-circle:](../android/distributions.md){ .md-button }
|
||||
[Our Android System Recommendations :material-arrow-right-drop-circle:](../android.md){ .md-button }
|
||||
|
||||
### Avoid Rooting
|
||||
|
||||
@@ -43,11 +43,9 @@ For example, if you want to post a picture to Discord you can open your file man
|
||||
|
||||
## Security Protections
|
||||
|
||||
Key components of the Android security model include [verified boot](#verified-boot), [firmware updates](#firmware-updates), and a robust [permission system](#android-permissions). These important security features form the baseline of the minimum criteria for our [mobile phone](../mobile-phones.md) and [custom Android OS](../android/distributions.md) recommendations.
|
||||
|
||||
### Verified Boot
|
||||
|
||||
[**Verified Boot**](https://source.android.com/security/verifiedboot) is an important part of the Android security model. It provides protection against [evil maid](https://en.wikipedia.org/wiki/Evil_maid_attack) attacks, malware persistence, and ensures security updates cannot be downgraded with [rollback protection](https://source.android.com/security/verifiedboot/verified-boot#rollback-protection).
|
||||
[Verified Boot](https://source.android.com/security/verifiedboot) is an important part of the Android security model. It provides protection against [evil maid](https://en.wikipedia.org/wiki/Evil_maid_attack) attacks, malware persistence, and ensures security updates cannot be downgraded with [rollback protection](https://source.android.com/security/verifiedboot/verified-boot#rollback-protection).
|
||||
|
||||
Android 10 and above has moved away from full-disk encryption to more flexible [file-based encryption](https://source.android.com/security/encryption/file-based). Your data is encrypted using unique encryption keys, and the operating system files are left unencrypted.
|
||||
|
||||
@@ -59,7 +57,7 @@ Many OEMs also have broken implementation of Verified Boot that you have to be a
|
||||
|
||||
### Firmware Updates
|
||||
|
||||
**Firmware updates** are critical for maintaining security and without them your device cannot be secure. OEMs have support agreements with their partners to provide the closed-source components for a limited support period. These are detailed in the monthly [Android Security Bulletins](https://source.android.com/security/bulletin).
|
||||
Firmware updates are critical for maintaining security and without them your device cannot be secure. OEMs have support agreements with their partners to provide the closed-source components for a limited support period. These are detailed in the monthly [Android Security Bulletins](https://source.android.com/security/bulletin).
|
||||
|
||||
As the components of the phone, such as the processor and radio technologies rely on closed-source components, the updates must be provided by the respective manufacturers. Therefore, it is important that you purchase a device within an active support cycle. [Qualcomm](https://www.qualcomm.com/news/releases/2020/12/qualcomm-and-google-announce-collaboration-extend-android-os-support-and) and [Samsung](https://news.samsung.com/us/samsung-galaxy-security-extending-updates-knox) support their devices for 4 years, while cheaper products often have shorter support cycles. With the introduction of the [Pixel 6](https://support.google.com/pixelphone/answer/4457705), Google now makes their own SoC, and they will provide a minimum of 5 years of support. With the introduction of the Pixel 8 series, Google increased that support window to 7 years.
|
||||
|
||||
@@ -69,9 +67,9 @@ Fairphone, for example, markets their Fairphone 4 device as receiving 6 years of
|
||||
|
||||
### Android Permissions
|
||||
|
||||
[**Permissions on Android**](https://developer.android.com/guide/topics/permissions/overview) grant you control over what apps are allowed to access. Google regularly makes [improvements](https://developer.android.com/about/versions/11/privacy/permissions) on the permission system in each successive version. All apps you install are strictly [sandboxed](https://source.android.com/security/app-sandbox), therefore, there is no need to install any antivirus apps.
|
||||
[Permissions on Android](https://developer.android.com/guide/topics/permissions/overview) grant you control over what apps are allowed to access. Google regularly makes [improvements](https://developer.android.com/about/versions/11/privacy/permissions) on the permission system in each successive version. All apps you install are strictly [sandboxed](https://source.android.com/security/app-sandbox), therefore, there is no need to install any antivirus apps.
|
||||
|
||||
A smartphone with the latest version of Android will always be more secure than an old smartphone with an antivirus that you have paid for. It's better not to pay for antivirus software and to save money to buy a new smartphone such as a [Google Pixel](../mobile-phones.md#google-pixel).
|
||||
A smartphone with the latest version of Android will always be more secure than an old smartphone with an antivirus that you have paid for. It's better not to pay for antivirus software and to save money to buy a new smartphone such as a Google Pixel.
|
||||
|
||||
Android 10:
|
||||
|
||||
@@ -126,7 +124,7 @@ With user profiles, you can impose restrictions on a specific profile, such as:
|
||||
|
||||
[Work Profiles](https://support.google.com/work/android/answer/6191949) are another way to isolate individual apps and may be more convenient than separate user profiles.
|
||||
|
||||
A **device controller** app such as [Shelter](../android/general-apps.md#shelter) is required to create a Work Profile without an enterprise MDM, unless you're using a custom Android OS which includes one.
|
||||
A **device controller** app such as [Shelter](../android.md#shelter) is required to create a Work Profile without an enterprise MDM, unless you're using a custom Android OS which includes one.
|
||||
|
||||
The work profile is dependent on a device controller to function. Features such as *File Shuttle* and *contact search blocking* or any kind of isolation features must be implemented by the controller. You must also fully trust the device controller app, as it has full access to your data inside the work profile.
|
||||
|
||||
@@ -146,7 +144,7 @@ If you are using a device with Google services—whether with the stock operatin
|
||||
|
||||
### Advanced Protection Program
|
||||
|
||||
If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection). It is available at no cost to anyone with two or more hardware security keys with [FIDO](../basics/multi-factor-authentication.md#fido-fast-identity-online) support. Alternatively, you can use [passkeys](https://fidoalliance.org/passkeys).
|
||||
If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection). It is available at no cost to anyone with two or more hardware security keys with [FIDO](../basics/multi-factor-authentication.md#fido-fast-identity-online) support.
|
||||
|
||||
The Advanced Protection Program provides enhanced threat monitoring and enables:
|
||||
|
||||
|
||||
@@ -1,11 +1,9 @@
|
||||
---
|
||||
title: Operating Systems
|
||||
---
|
||||
We publish configuration guides for the major operating systems, because you can generally improve the amount of data that is collected about you on any option, especially if you use privacy tools like our [recommended web browsers](../desktop-browsers.md) in place of native tools where appropriate. However, some operating systems will be more privacy-respecting inherently, and it will be much harder to achieve an equivalent level of privacy on other choices.
|
||||
We publish configuration guides for the major operating systems, because you can generally improve the amount of data that is collected about you on any option, especially if you use [privacy tools](../tools.md) like our recommended web browsers in place of native tools where appropriate. However, some operating systems will be more privacy-respecting inherently, and it will be much harder to achieve an equivalent level of privacy on other choices.
|
||||
|
||||
- [Recommended Linux Distros :material-arrow-right-drop-circle:](../desktop.md)
|
||||
- [Recommended Android Distros :material-arrow-right-drop-circle:](../android.md)
|
||||
The articles marked with a :material-star: are our more mature articles.
|
||||
If you're starting from scratch, we strongly recommend [Linux](../desktop.md) on desktop and [Android](../android.md) on mobile. If you already use something else and aren't interested in switching, we hope you'll find these guides useful.
|
||||
|
||||
## Mobile Operating Systems
|
||||
|
||||
|
||||
@@ -9,7 +9,7 @@ description: iOS is a mobile operating system developed by Apple for the iPhone.
|
||||
|
||||
iOS devices are frequently praised by security experts for their robust data protection and adherence to modern best practices. However, the restrictiveness of Apple's ecosystem—particularly with their mobile devices—does still hamper privacy in a number of ways.
|
||||
|
||||
We generally consider iOS to provide better than average privacy and security protections for most people, compared to stock Android devices from any manufacturer. However, you can achieve even higher standards of privacy with a [custom Android operating system](../android/distributions.md#aosp-derivatives) like GrapheneOS, if you want or need to be completely independent of Apple or Google's cloud services.
|
||||
We generally consider iOS to provide better than average privacy and security protections for most people, compared to stock Android devices from any manufacturer. However, you can achieve even higher standards of privacy with a [custom Android operating system](../android.md#aosp-derivatives) like GrapheneOS, if you want or need to be completely independent of Apple or Google's cloud services.
|
||||
|
||||
### Activation Lock
|
||||
|
||||
@@ -226,4 +226,4 @@ Apple always makes beta versions of iOS available early for those that wish to h
|
||||
|
||||
### Before First Unlock
|
||||
|
||||
If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation.
|
||||
If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation.
|
||||
|
||||
@@ -2,11 +2,13 @@
|
||||
title: Windows Overview
|
||||
icon: material/microsoft-windows
|
||||
---
|
||||
**Microsoft Windows** is a common OS shipped with many PCs by default. The following guides aim to provide some ways to improve privacy and reduce the default telemetry and data stored by disabling some unnecessary features. Over time, Microsoft adds features to the OS which can sometimes rely on cloud-based services. These features will often require certain types of [optional data](https://privacy.microsoft.com/data-collection-windows) that is sometimes sent to remote servers for processing.
|
||||
**Microsoft Windows** is a proprietary operating system in widespread use. Recent versions of Windows, especially Windows 11, are widely considered to be the most privacy-invasive and least secure modern operating systems.
|
||||
|
||||
One of the newest examples was called **Recall**, a part of the Copilot AI feature set. Recall periodically screenshots anything you've seen on your PC in order to show it to you at a later date. These "helpful" features create considerable metadata which can be forensically analyzed. In most cases browsing history is sufficient and this feature can be safely disabled. The main concerns with Recall was that the data is stored in a local database that is decrypted when your device is powered on, meaning it is an easy target for hackers if the device ever becomes infected with malware. Recall will not redact sensitive information like copied passwords or financial information from the database, but it does protect against making screenshots of any copyrighted content protected by digital rights management (DRM) systems.
|
||||
If you have the choice between Windows 10 and Windows 11, we would recommend using Windows 10 for as long as possible. Windows 10 will be supported until October 2025. However, no current version of Windows respects your privacy without extensive modifications that are often undone by future updates from Microsoft. Consider [Linux](../linux-overview.md) if you'd prefer an operating system that respects your privacy and preferences.
|
||||
|
||||
Unfortunately, this feature was added without too much thought about the privacy implications of having such a feature enabled by default (which it now [no longer is](https://wired.com/story/microsoft-recall-off-default-security-concerns)). It is not an isolated example, however. Another example was Microsoft automatically [enabling folder backups to OneDrive](https://neowin.net/news/windows-11-is-now-automatically-enabling-onedrive-folder-backup-without-asking-permission) on new Windows 11 installations without asking for permission.
|
||||
Microsoft continually adds new cloud-based features to Windows 11 which are enabled by default without user consent. Most recently (as of May 2024), they've introduced a built-in keylogger called **Recall** (part of their AI features) which records every keystroke on your device, and records your screen by screenshotting at regular intervals. This data is stored unsafely in a local database that is decrypted when your device is powered on, meaning it is an easy target for hackers. It will not redact sensitive information like copied passwords or financial information from the database, but it does protect Hollywood movie studios by not recording copyrighted content. This feature is currently only on certain newer devices, but it serves as an example of how little Microsoft cares about your security and privacy.
|
||||
|
||||
## Guides
|
||||
|
||||
You can enhance your privacy and security on Windows without downloading any third-party tools with these guides:
|
||||
|
||||
@@ -16,47 +18,44 @@ You can enhance your privacy and security on Windows without downloading any thi
|
||||
- Application Sandboxing (coming soon)
|
||||
- Security Hardening (coming soon)
|
||||
|
||||
<div class="admonition example" markdown>
|
||||
<p class="admonition-title">This section is new</p>
|
||||
This section is a work in progress, because it takes considerably more time and effort to make a Windows installation usable compared to other operating systems. Additional guides are coming soon!
|
||||
|
||||
This section is a work in progress, because it takes considerably more time and effort to make a Windows installation more privacy friendly than other operating systems.
|
||||
## Privacy History
|
||||
|
||||
</div>
|
||||
Especially since the release of Windows 8, Microsoft has demonstrated extremely privacy-invasive behavior with their operating system releases, consistently taking advantage of the fact that Windows is the most widely-used desktop operating system. Windows 10 was widely [criticized](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings) for having default settings that sent a lot of data and telemetry back to Microsoft, [including](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) "User's contacts and calendar events, location data and history, 'telemetry' (diagnostics data) [...] and 'advertising ID', as well as further data when the Cortana assistant is enabled" (which it is by default). Windows 10 also made it much more challenging to change default applications (such as your web browser) away from Microsoft-provided apps, which is behavior that still persists today.
|
||||
|
||||
## Privacy Notes
|
||||
At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce the teletetry](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) sent to them.
|
||||
|
||||
Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_(virtual_assistant)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them.
|
||||
Windows 11 has introduced even more privacy-invasive behavior, including:
|
||||
|
||||
With Windows 11 there are a number of restrictions or defaults such as:
|
||||
- Being forced to use a Microsoft account instead of a local account on Home editions, and still hiding away local account options on Pro editions and higher.
|
||||
- Enabling virtually all data collection options by default.
|
||||
- Heavily integrating Microsoft services like Bing, OneDrive, and Teams in ways which are difficult to remove.
|
||||
- Adding (cloud-based) AI features to many areas in Windows and various Microsoft Apps.
|
||||
- Unnecessarily storing massive amounts of sensitive data. Even data which is stored locally and not sent to Microsoft is still a target for hackers or malware on your device.
|
||||
|
||||
- Requiring the use of a Microsoft account instead of a local account.
|
||||
- Making it more difficult to find local account options for Windows **Pro** and **Enterprise**.
|
||||
- Enabling all data collection options by default, requiring users to "opt out".
|
||||
- Heavily integrating Microsoft services like Bing, OneDrive, and Teams in ways which are difficult to remove and presented as the only option to users.
|
||||
- Setting the default browser always to Edge, or reverting to Edge if it's changed.
|
||||
- Adding cloud-based AI features to many areas in Windows and various Microsoft Apps.
|
||||
- Unnecessarily storing sensitive data. Even data which is stored locally and not sent to Microsoft is still a target for hackers or malware on your device.
|
||||
Microsoft often abuses the automatic updates feature to add new functionality to your device that collects your data and is enabled by default.
|
||||
|
||||
Microsoft often uses the automatic updates feature to add new functionality to your device and make changes that collect your data and are enabled by default. Some [privacy features](https://blogs.windows.com/windows-insider/2023/11/16/previewing-changes-in-windows-to-comply-with-the-digital-markets-act-in-the-european-economic-area) such as the option to *opt out* of syncing an online Microsoft account with Windows, require you to select a country in the EEA (European Economic Area) during installation. It can be changed to your real country after Windows is installed.
|
||||
Some privacy features in Windows 11 are locked to devices in the European Union. We have not yet found a way to reliably access those settings worldwide.
|
||||
|
||||
## Windows Editions
|
||||
|
||||
Many critical privacy and security features are unfortunately locked away behind higher-cost editions of Windows, instead of being available in Windows **Home**. Some features missing from **Home** include Bitlocker Drive Encryption, Hyper-V, and Windows Sandbox. In our Windows guides we will cover how to use all of these features appropriately, so having a premium edition of Windows will be necessary.
|
||||
Many critical privacy and security features are unfortunately locked away behind higher-cost editions of Windows, instead of being available in Windows Home Edition. Some features missing from **Windows Home Edition** include Bitlocker Drive Encryption, Hyper-V, and Windows Sandbox. In our Windows guides we will cover how to use all of these features appropriately, so having a premium edition of Windows will be critical.
|
||||
|
||||
Windows **Enterprise** provides the most flexibility when it comes to configuring privacy and security settings built in to Windows. For example, they are the only editions that allow you to enable the highest level of restrictions on data sent to Microsoft via telemetry tools. Unfortunately, Enterprise is not available for retail purchase, so it may not be available to you.
|
||||
**Windows Enterprise** provides the most flexibility when it comes to configuring privacy and security settings built in to Windows. For example, they are the only editions that allow you to enable the highest level of restrictions on data sent to Microsoft via telemetry tools. Unfortunately, Enterprise is not available for retail purchase, so it may not be available to you.
|
||||
|
||||
The best version available for *retail* purchase is Windows **Pro** as it has nearly all of the features you'll want to use to secure your device, including Bitlocker, Hyper-V, etc. The only thing missing is some of the most restrictive limitations on Microsoft's telemetry unfortunately.
|
||||
The best version available for *retail* purchase is **Windows Pro Edition**. This version does not allow you to set some of the most restrictive limitations on Microsoft's telemetry unfortunately, but does have nearly all of the features you'll want to use to secure your device, including Bitlocker, Hyper-V, etc.
|
||||
|
||||
Students and teachers may be able to obtain a Windows **Education** (equivalent to Enterprise) or **Pro Education** license (equivalent to Pro) for free, including on personal devices, from their educational institution. Many schools partner with Microsoft via OnTheHub or Microsoft Azure for Education, so you can check those sites or your school's benefits page to see if you qualify. Whether or not you are able to get these licenses depends entirely on your institution. This may be the best way for many people to obtain an Enterprise-level edition of Windows for personal use. There are no additional privacy or security risks associated with using an Education license compared to the retail versions.
|
||||
Students and teachers may be able to obtain **Windows Education** (equivalent to Enterprise) or **Windows Pro Education** (equivalent to Pro) for free (including on personal devices) from their educational institution. Many schools partner with Microsoft via OnTheHub or Microsoft Azure for Education, so you can check those sites or your school's benefits page to see if you qualify. Whether or not you are able to get these licenses depends entirely on your institution. This may be the best way for many people to obtain an Enterprise-level edition of Windows for personal use. There are no additional privacy or security risks associated with using an Education license compared to the retail versions.
|
||||
|
||||
It is not recommended to use third party modified versions of Windows such as Windows AME. Since modified versions of Windows like Windows AME don't receive updates, security features and antivirus definitions in Windows Defender will fall behind the current threat landscape, opening you up to attacks, thus making you even less secure.
|
||||
It is not recommended to use forks or modified versions of Windows such as Windows AME. Since modified versions of Windows like Windows AME don't receive updates, security features and antivirus definitions in Windows Defender will fall behind the current threat landscape, opening you up to attacks.
|
||||
|
||||
## Obtaining Windows
|
||||
|
||||
Currently, only Windows 11 license keys are available for purchase, but these keys will work on Windows 10 as well, so you can still purchase a Windows 11 Pro key to activate a Windows 10 install.
|
||||
|
||||
The official [Media Creation Tool](https://microsoft.com/software-download/windows11) is the best way to put a Windows installer on a USB flash drive. Third-party tools like Rufus or Etcher may unexpectedly modify the files, which could lead to boot issues or other troubles when installing.
|
||||
The official [Media Creation tool](https://www.microsoft.com/software-download/windows10) is the best way to put a Windows installer on a USB flash drive. Third-party tools like Rufus or Etcher may unexpectedly modify the files, which could lead to boot issues or other troubles with installing.
|
||||
|
||||
This tool only lets you install a **Home** or **Pro** installation, as there are no publicly available downloads for Windows **Enterprise** edition. If you have an **Enterprise** license key, you can easily upgrade a **Pro** installation. To do this, install Windows **Pro** without entering a license key during setup, then enter your **Enterprise** key in the Settings app after completing the install. Your **Pro** install will be upgraded to **Enterprise** automatically after entering a valid license key.
|
||||
This tool only lets you install a Home or Pro edition installation, as there are no publicly available downloads for Windows Enterprise Edition. However, if you have an Enterprise Edition license key, you can easily upgrade a Pro installation. Just install Windows Pro without entering a license key during setup, then enter your Enterprise key in the Settings app after completing the install. Your Pro Edition install will upgrade to Enterprise Edition automatically after entering a valid license key.
|
||||
|
||||
If you are installing an **Education** license then you will typically have a private download link that will be provided alongside your license key when you obtain it from your institution's benefits portal.
|
||||
If you are installing an Education edition, typically a private download will be provided alongside your license key when you obtain it from your institution's benefits portal.
|
||||
|
||||
@@ -131,7 +131,7 @@ schema:
|
||||
"@type": WebPage
|
||||
url: "./"
|
||||
---
|
||||
**Password managers** allow you to securely store and manage passwords and other credentials with the use of a master password.
|
||||
Password managers allow you to securely store and manage passwords and other credentials with the use of a master password.
|
||||
|
||||
[Introduction to Passwords :material-arrow-right-drop-circle:](./basics/passwords-overview.md)
|
||||
|
||||
@@ -376,7 +376,7 @@ KeePassXC stores its export data as [CSV](https://en.wikipedia.org/wiki/Comma-se
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Strongbox** is a native password manager for iOS and macOS. Supporting both KeePass and Password Safe formats, Strongbox can be used in tandem with other password managers, like KeePassXC, on non-Apple platforms. By employing a [freemium model](https://strongboxsafe.com/pricing), Strongbox offers most features under its free tier, with more convenience-oriented [features](https://strongboxsafe.com/comparison)—such as biometric authentication—locked behind a subscription or perpetual license.
|
||||
**Strongbox** is a native, open-source password manager for iOS and macOS. Supporting both KeePass and Password Safe formats, Strongbox can be used in tandem with other password managers, like KeePassXC, on non-Apple platforms. By employing a [freemium model](https://strongboxsafe.com/pricing), Strongbox offers most features under its free tier, with more convenience-oriented [features](https://strongboxsafe.com/comparison)—such as biometric authentication—locked behind a subscription or perpetual license.
|
||||
|
||||
[:octicons-home-16: Homepage](https://strongboxsafe.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://strongboxsafe.com/privacy){ .card-link title="Privacy Policy" }
|
||||
|
||||
@@ -1,38 +0,0 @@
|
||||
---
|
||||
title: "Pastebins"
|
||||
icon: material/content-paste
|
||||
description: These tools allow you to have full control of any pasted data you share to other parties.
|
||||
cover: pastebins.webp
|
||||
---
|
||||
[**Pastebins**](https://en.wikipedia.org/wiki/Pastebin) are online services most commonly used to share large blocks of code in a convenient and efficient manner. The pastebins listed here employ client-side encryption and password protection for pasted content; both of these features prevent the website or server operator from reading or accessing the contents of any paste.
|
||||
|
||||
## PrivateBin
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**PrivateBin** is a minimalist, open-source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256-bit AES. It is the improved version of ZeroBin.
|
||||
|
||||
[:octicons-home-16: Homepage](https://privatebin.info){ .md-button .md-button--primary }
|
||||
[:octicons-server-16:](https://privatebin.info/directory){ .card-link title="Public Instances"}
|
||||
[:octicons-info-16:](https://github.com/PrivateBin/PrivateBin/wiki/FAQ){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/PrivateBin/PrivateBin){ .card-link title="Source Code" }
|
||||
|
||||
</div>
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
### Minimum Requirements
|
||||
|
||||
- Must be open source.
|
||||
- Must implement "zero-trust" end-to-end encryption.
|
||||
- Must support password-protected files.
|
||||
|
||||
### Best-Case
|
||||
|
||||
Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page.
|
||||
|
||||
- Should have a published audit from a reputable, independent third-party.
|
||||
@@ -4,7 +4,7 @@ icon: material/image
|
||||
description: Photo management tools to keep your personal photos safe from the prying eyes of cloud storage providers and other unauthorized access.
|
||||
cover: photo-management.webp
|
||||
---
|
||||
Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon Photos don't secure your photos against being accessed by the cloud storage provider themselves. These options keep your personal photos private, while allowing you to share them only with family and trusted people.
|
||||
Most cloud photo management solutions like Google Photos, Flickr, and Amazon Photos don't secure your photos against being accessed by the cloud storage provider themselves. These options keep your personal photos private, while allowing you to share them only with family and trusted people.
|
||||
|
||||
## Ente Photos
|
||||
|
||||
|
||||
227
docs/productivity.md
Normal file
227
docs/productivity.md
Normal file
@@ -0,0 +1,227 @@
|
||||
---
|
||||
title: "Productivity Tools"
|
||||
icon: material/file-sign
|
||||
description: Most online office suites do not support E2EE, meaning the cloud provider has access to everything you do.
|
||||
cover: productivity.webp
|
||||
---
|
||||
<!-- markdownlint-disable MD024 -->
|
||||
Most online office suites do not support E2EE, meaning the cloud provider has access to everything you do. The privacy policy may legally protect your rights, but it does not provide technical access constraints.
|
||||
|
||||
## Collaboration Platforms
|
||||
|
||||
### Nextcloud
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Nextcloud** is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control.
|
||||
|
||||
[:octicons-home-16: Homepage](https://nextcloud.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nextcloud.com/privacy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://nextcloud.com/support){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/nextcloud){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://nextcloud.com/contribute){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.nextcloud.client)
|
||||
- [:simple-appstore: App Store](https://apps.apple.com/app/id1125420102)
|
||||
- [:simple-github: GitHub](https://github.com/nextcloud/android/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://nextcloud.com/install/#install-clients)
|
||||
- [:simple-apple: macOS](https://nextcloud.com/install/#install-clients)
|
||||
- [:simple-linux: Linux](https://nextcloud.com/install/#install-clients)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="admonition danger" markdown>
|
||||
<p class="admonition-title">Danger</p>
|
||||
|
||||
We don't recommend using the [E2EE App](https://apps.nextcloud.com/apps/end_to_end_encryption) for Nextcloud as it may lead to data loss; it is highly experimental and not production quality. For this reason, we don't recommend third-party Nextcloud providers.
|
||||
|
||||
</div>
|
||||
|
||||
### CryptPad
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**CryptPad** is a private-by-design alternative to popular office tools. All content on this web service is end-to-end encrypted and can be shared with other users easily.
|
||||
|
||||
[:octicons-home-16: Homepage](https://cryptpad.fr){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://cryptpad.fr/pad/#/2/pad/view/GcNjAWmK6YDB3EO2IipRZ0fUe89j43Ryqeb4fjkjehE){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://docs.cryptpad.fr){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/xwiki-labs/cryptpad){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://opencollective.com/cryptpad){ .card-link title=Contribute }
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
### Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
#### Minimum Requirements
|
||||
|
||||
In general, we define collaboration platforms as full-fledged suites which could reasonably act as a replacement to collaboration platforms like Google Drive.
|
||||
|
||||
- Open source.
|
||||
- Makes files accessible via WebDAV unless it is impossible due to E2EE.
|
||||
- Has sync clients for Linux, macOS, and Windows.
|
||||
- Supports document and spreadsheet editing.
|
||||
- Supports real-time document collaboration.
|
||||
- Supports exporting documents to standard document formats (e.g. ODF).
|
||||
|
||||
#### Best-Case
|
||||
|
||||
Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page.
|
||||
|
||||
- Should store files in a conventional filesystem.
|
||||
- Should support TOTP or FIDO2 multi-factor authentication support, or passkey logins.
|
||||
|
||||
## Office Suites
|
||||
|
||||
### LibreOffice
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**LibreOffice** is a free and open-source office suite with extensive functionality.
|
||||
|
||||
[:octicons-home-16: Homepage](https://libreoffice.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://libreoffice.org/about-us/privacy/privacy-policy-en){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://documentation.libreoffice.org/en/english-documentation){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://libreoffice.org/about-us/source-code){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://libreoffice.org/donate){ .card-link title=Contribute }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://libreoffice.org/download/android-and-ios)
|
||||
- [:simple-appstore: App Store](https://libreoffice.org/download/android-and-ios)
|
||||
- [:fontawesome-brands-windows: Windows](https://libreoffice.org/download/download)
|
||||
- [:simple-apple: macOS](https://libreoffice.org/download/download)
|
||||
- [:simple-linux: Linux](https://libreoffice.org/download/download)
|
||||
- [:simple-flathub: Flathub](https://flathub.org/apps/details/org.libreoffice.LibreOffice)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
### OnlyOffice
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**OnlyOffice** is a cloud-based free and open-source office suite with extensive functionality, including integration with Nextcloud.
|
||||
|
||||
[:octicons-home-16: Homepage](https://onlyoffice.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://help.onlyoffice.com/products/files/doceditor.aspx?fileid=5048502&doc=SXhWMEVzSEYxNlVVaXJJeUVtS0kyYk14YWdXTEFUQmRWL250NllHNUFGbz0_IjUwNDg1MDIi0){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://helpcenter.onlyoffice.com/userguides.aspx){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/ONLYOFFICE){ .card-link title="Source Code" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.onlyoffice.documents)
|
||||
- [:simple-appstore: App Store](https://apps.apple.com/app/id944896972)
|
||||
- [:fontawesome-brands-windows: Windows](https://onlyoffice.com/download-desktop.aspx)
|
||||
- [:simple-apple: macOS](https://onlyoffice.com/download-desktop.aspx)
|
||||
- [:simple-linux: Linux](https://onlyoffice.com/download-desktop.aspx)
|
||||
- [:simple-flathub: Flathub](https://flathub.org/apps/details/org.onlyoffice.desktopeditors)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
### Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
In general, we define office suites as applications which could reasonably act as a replacement for Microsoft Word for most needs.
|
||||
|
||||
- Must be cross-platform.
|
||||
- Must be open-source software.
|
||||
- Must function offline.
|
||||
- Must support editing documents, spreadsheets, and slideshows.
|
||||
- Must export files to standard document formats.
|
||||
|
||||
## Paste services
|
||||
|
||||
### PrivateBin
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
|
||||
**PrivateBin** is a minimalist, open-source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256-bit AES. It is the improved version of ZeroBin.
|
||||
|
||||
[:octicons-home-16: Homepage](https://privatebin.info){ .md-button .md-button--primary }
|
||||
[:octicons-server-16:](https://privatebin.info/directory){ .card-link title="Public Instances"}
|
||||
[:octicons-info-16:](https://github.com/PrivateBin/PrivateBin/wiki/FAQ){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/PrivateBin/PrivateBin){ .card-link title="Source Code" }
|
||||
|
||||
</div>
|
||||
|
||||
### Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
#### Minimum Requirements
|
||||
|
||||
- Must be open source.
|
||||
- Must implement "zero-trust" end-to-end encryption.
|
||||
- Must support password-protected files.
|
||||
|
||||
#### Best-Case
|
||||
|
||||
Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page.
|
||||
|
||||
- Should have a published audit from a reputable, independent third-party.
|
||||
|
||||
## Language services
|
||||
|
||||
### LanguageTool
|
||||
|
||||
<div class="admonition recommendation" markdown>
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**LanguageTool** is a multilingual grammar, style and spell checker that supports more than 20 languages. The software is [self-hostable](https://dev.languagetool.org/http-server), and the extensions do not send your input text to their server.
|
||||
|
||||
LanguageTool offers integration with a variety of [office suites](https://languagetool.org/services#text_editors) and [email clients](https://languagetool.org/services#mail_clients).
|
||||
|
||||
[:octicons-home-16: Homepage](https://languagetool.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://languagetool.org/legal/privacy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://languagetooler.freshdesk.com/en/support/solutions){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://github.com/languagetool-org){ .card-link title="Source Code" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-appstore: App Store](https://apps.apple.com/app/id1534275760)
|
||||
- [:fontawesome-brands-windows: Windows](https://languagetool.org/windows-desktop)
|
||||
- [:simple-apple: macOS](https://languagetool.org/mac-desktop)
|
||||
- [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/languagetool)
|
||||
- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/grammar-and-spell-checker/oldceeleldhonbafppcapldpdifcinji)
|
||||
- [:fontawesome-brands-edge: Edge](https://microsoftedge.microsoft.com/addons/detail/hfjadhjooeceemgojogkhlppanjkbobc)
|
||||
- [:simple-safari: Safari](https://apps.apple.com/app/id1534275760)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
### Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
- Must be open source.
|
||||
- Must be possible to self-host.
|
||||
@@ -6,7 +6,7 @@ description: Other instant messengers make all of your private conversations ava
|
||||
cover: real-time-communication.webp
|
||||
---
|
||||
|
||||
These are our recommendations for encrypted **real-time communication**.
|
||||
These are our recommendations for encrypted real-time communication.
|
||||
|
||||
[Types of Communication Networks :material-arrow-right-drop-circle:](./advanced/communication-network-types.md)
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@ cover: search-engines.webp
|
||||
global:
|
||||
- [randomize-element, "table tbody"]
|
||||
---
|
||||
Use a **search engine** that doesn't build an advertising profile based on your searches.
|
||||
Use a search engine that doesn't build an advertising profile based on your searches.
|
||||
|
||||
## Recommended Providers
|
||||
|
||||
|
||||
@@ -156,7 +156,7 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Coincards](financial-services.md#coincards)
|
||||
- { .twemoji loading=lazy } [CoinCards](financial-services.md#coincards)
|
||||
|
||||
</div>
|
||||
|
||||
@@ -249,17 +249,6 @@ If you're looking for added **security**, you should always ensure you're connec
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](data-redaction.md)
|
||||
|
||||
### Document Collaboration
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Nextcloud (Self-Hostable)](document-collaboration.md#nextcloud)
|
||||
- { .twemoji loading=lazy } [CryptPad](document-collaboration.md#cryptpad)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](document-collaboration.md)
|
||||
|
||||
### Email Clients
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
@@ -321,7 +310,7 @@ For encrypting your operating system drive, we typically recommend using whichev
|
||||
- { .twemoji loading=lazy } [Send](file-sharing.md#send)
|
||||
- { .twemoji loading=lazy } [OnionShare](file-sharing.md#onionshare)
|
||||
- { .twemoji loading=lazy } [FreedomBox](file-sharing.md#freedombox)
|
||||
- { .twemoji loading=lazy } [Nextcloud (Self-Hostable)](file-sharing.md#nextcloud-client-server)
|
||||
- { .twemoji loading=lazy } [Nextcloud (Self-Hostable)](file-sharing.md#nextcloud-client-server)
|
||||
- { .twemoji loading=lazy } [Syncthing](file-sharing.md#syncthing-p2p)
|
||||
|
||||
</div>
|
||||
@@ -345,23 +334,13 @@ For encrypting your operating system drive, we typically recommend using whichev
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](frontends.md)
|
||||
|
||||
### Language Tools
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [LanguageTool](language-tools.md#languagetool)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](language-tools.md)
|
||||
|
||||
### Multi-Factor Authentication Tools
|
||||
|
||||
**Note:** [Hardware security keys](#security-keys) have been moved to their own category.
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Ente Auth](multi-factor-authentication.md#ente-auth)
|
||||
- { .twemoji loading=lazy } [Ente Auth](multi-factor-authentication.md#ente-auth)
|
||||
- { .twemoji loading=lazy } [Aegis Authenticator (Android)](multi-factor-authentication.md#aegis-authenticator-android)
|
||||
|
||||
</div>
|
||||
@@ -398,17 +377,6 @@ For encrypting your operating system drive, we typically recommend using whichev
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](notebooks.md)
|
||||
|
||||
### Office Suites
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [LibreOffice](office-suites.md#libreoffice)
|
||||
- { .twemoji loading=lazy } [OnlyOffice](office-suites.md#onlyoffice)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](office-suites.md)
|
||||
|
||||
### Password Managers
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
@@ -426,15 +394,20 @@ For encrypting your operating system drive, we typically recommend using whichev
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](passwords.md)
|
||||
|
||||
### Pastebins
|
||||
### Productivity Tools
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [PrivateBin](pastebins.md#privatebin)
|
||||
- { .twemoji loading=lazy } [Nextcloud (Self-Hostable)](productivity.md#nextcloud)
|
||||
- { .twemoji loading=lazy } [LibreOffice](productivity.md#libreoffice)
|
||||
- { .twemoji loading=lazy } [OnlyOffice](productivity.md#onlyoffice)
|
||||
- { .twemoji loading=lazy } [CryptPad](productivity.md#cryptpad)
|
||||
- { .twemoji loading=lazy } [PrivateBin (Pastebin)](productivity.md#privatebin)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [LanguageTool](productivity.md#languagetool)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](pastebins.md)
|
||||
[Learn more :material-arrow-right-drop-circle:](productivity.md)
|
||||
|
||||
### Real-Time Communication
|
||||
|
||||
@@ -464,53 +437,32 @@ For encrypting your operating system drive, we typically recommend using whichev
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](security-keys.md)
|
||||
|
||||
### Mobile Phones
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Google Pixel](mobile-phones.md#google-pixel)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](mobile-phones.md)
|
||||
|
||||
## Operating Systems
|
||||
|
||||
### Mobile
|
||||
|
||||
#### Custom Android Operating Systems
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [GrapheneOS](android/distributions.md#grapheneos)
|
||||
- { .twemoji loading=lazy } [DivestOS](android/distributions.md#divestos)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [GrapheneOS](android.md#grapheneos)
|
||||
- { .twemoji loading=lazy } [DivestOS](android.md#divestos)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](android/distributions.md)
|
||||
[Learn more :material-arrow-right-drop-circle:](android.md)
|
||||
|
||||
#### Android Apps
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Shelter (Work Profiles)](android/general-apps.md#shelter)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [Secure Camera](android/general-apps.md#secure-camera)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [Secure PDF Viewer](android/general-apps.md#secure-pdf-viewer)
|
||||
- { .twemoji loading=lazy } [Obtainium (App Manager)](android.md#obtainium)
|
||||
- { .twemoji loading=lazy } [Aurora Store (Google Play Client)](android.md#aurora-store)
|
||||
- { .twemoji loading=lazy } [Shelter (Work Profiles)](android.md#shelter)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [Secure Camera](android.md#secure-camera)
|
||||
- { .twemoji loading=lazy }{ .twemoji loading=lazy } [Secure PDF Viewer](android.md#secure-pdf-viewer)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](android/general-apps.md)
|
||||
|
||||
#### Ways to Obtain Android Apps
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Obtainium (App Manager)](android/obtaining-apps.md#obtainium)
|
||||
- { .twemoji loading=lazy } [Aurora Store (Google Play Client)](android/obtaining-apps.md#aurora-store)
|
||||
|
||||
</div>
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](android/obtaining-apps.md)
|
||||
[Learn more :material-arrow-right-drop-circle:](android.md#general-apps)
|
||||
|
||||
### Desktop/PC
|
||||
|
||||
|
||||
@@ -9,7 +9,7 @@ global:
|
||||
---
|
||||
<!-- markdownlint-disable MD024 -->
|
||||
|
||||
If you're looking for additional *privacy* from your ISP, on a public Wi-Fi network, or while torrenting files, a **VPN** may be the solution for you.
|
||||
If you're looking for additional **privacy** from your ISP, on a public Wi-Fi network, or while torrenting files, a VPN may be the solution for you.
|
||||
|
||||
<div class="admonition danger" markdown>
|
||||
<p class="admonition-title">VPNs do not provide anonymity</p>
|
||||
|
||||
@@ -8,7 +8,6 @@
|
||||
*[CLI]: Command Line Interface
|
||||
*[CSV]: Comma-Separated Values
|
||||
*[CVE]: Common Vulnerabilities and Exposures
|
||||
*[dark pattern]: A deceptive design pattern intended to trick a user into doing things
|
||||
*[digital legacy feature]: Digital Legacy refers to features that allow you to give other people access to your data when you die
|
||||
*[DNSSEC]: Domain Name System Security Extensions
|
||||
*[DNS]: Domain Name System
|
||||
@@ -94,7 +93,6 @@
|
||||
*[UEFI]: Unified Extensible Firmware Interface
|
||||
*[UDP]: User Datagram Protocol
|
||||
*[VPN]: Virtual Private Network
|
||||
*[VLAN]: Virtual Local Area Network
|
||||
*[VoIP]: Voice over IP (Internet Protocol)
|
||||
*[W3C]: World Wide Web Consortium
|
||||
*[XMPP]: Extensible Messaging and Presence Protocol
|
||||
|
||||
@@ -17,12 +17,6 @@ HOMEPAGE_RSS_STORIES_LINK="https://share.privacyguides.org/web-stories/feed/"
|
||||
HOMEPAGE_RSS_STORIES_TITLE="Privacy Guides web stories feed"
|
||||
HOMEPAGE_RSS_FORUM_LINK="https://discuss.privacyguides.net/latest.rss"
|
||||
HOMEPAGE_RSS_FORUM_TITLE="Latest Privacy Guides forum topics"
|
||||
HOMEPAGE_HEADER="The collaborative privacy advocacy community."
|
||||
HOMEPAGE_SUBHEADER="Privacy Guides is a not-for-profit, volunteer-run project that hosts online communities and publishes news and recommendations surrounding privacy and security tools, services, and knowledge."
|
||||
HOMEPAGE_BUTTON_GET_STARTED_NAME="Start Your Privacy Journey"
|
||||
HOMEPAGE_BUTTON_GET_STARTED_TITLE="The first step of your privacy journey"
|
||||
HOMEPAGE_BUTTON_TOOLS_NAME="Recommended Tools"
|
||||
HOMEPAGE_BUTTON_TOOLS_TITLE="Recommended privacy tools, services, and knowledge"
|
||||
NAV_ABOUT="About"
|
||||
NAV_ADVANCED="Advanced"
|
||||
NAV_ADVANCED_TOPICS="Advanced Topics"
|
||||
|
||||
15
mkdocs.yml
15
mkdocs.yml
@@ -295,8 +295,6 @@ plugins:
|
||||
search: {}
|
||||
privacy:
|
||||
enabled: !ENV [BUILD_PRIVACY, true]
|
||||
offline:
|
||||
enabled: !ENV [BUILD_OFFLINE, false]
|
||||
group:
|
||||
enabled: !ENV [BUILD_INSIDERS, false]
|
||||
plugins:
|
||||
@@ -409,29 +407,20 @@ nav:
|
||||
- "calendar.md"
|
||||
- "cryptocurrency.md"
|
||||
- "data-redaction.md"
|
||||
- "document-collaboration.md"
|
||||
- "email-clients.md"
|
||||
- "encryption.md"
|
||||
- "file-sharing.md"
|
||||
- "frontends.md"
|
||||
- "language-tools.md"
|
||||
- "multi-factor-authentication.md"
|
||||
- "news-aggregators.md"
|
||||
- "notebooks.md"
|
||||
- "office-suites.md"
|
||||
- "passwords.md"
|
||||
- "pastebins.md"
|
||||
- "productivity.md"
|
||||
- "real-time-communication.md"
|
||||
- !ENV [NAV_HARDWARE, "Hardware"]:
|
||||
- "basics/hardware.md"
|
||||
- "mobile-phones.md"
|
||||
- "security-keys.md"
|
||||
- !ENV [NAV_OPERATING_SYSTEMS, "Operating Systems"]:
|
||||
- !ENV [NAV_ANDROID, "Android"]:
|
||||
- "android/index.md"
|
||||
- "android/distributions.md"
|
||||
- "android/general-apps.md"
|
||||
- "android/obtaining-apps.md"
|
||||
- "android.md"
|
||||
- "desktop.md"
|
||||
- "router.md"
|
||||
- !ENV [NAV_ADVANCED, "Advanced"]:
|
||||
|
||||
8
run.sh
8
run.sh
@@ -86,13 +86,11 @@ if [ "$language" != "en" ]; then
|
||||
export BUILD_SITE_DIR="site/$language"
|
||||
export BUILD_SITE_URL="https://privacyguides.org/$language"
|
||||
export BUILD_THEME_LANGUAGE="$language"
|
||||
fi
|
||||
|
||||
# Source per-language strings
|
||||
set -a
|
||||
set -a
|
||||
# shellcheck disable=SC1090
|
||||
source "$PWD/includes/strings.$language.env"
|
||||
set +a
|
||||
set +a
|
||||
fi
|
||||
|
||||
# Set font if hebrew
|
||||
if [ "$language" == "he" ]; then
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 169 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 287 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 284 KiB |
|
Before Width: | Height: | Size: 44 KiB After Width: | Height: | Size: 44 KiB |
BIN
theme/assets/img/multi-factor-authentication/ente-auth.png
Normal file
BIN
theme/assets/img/multi-factor-authentication/ente-auth.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 4.6 KiB |
@@ -1,81 +0,0 @@
|
||||
<svg width="1024" height="1024" viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg">
|
||||
<g clip-path="url(#clip0_26133_116870)">
|
||||
<rect width="1024" height="1024" rx="234" fill="url(#paint0_linear_26133_116870)" style=""/>
|
||||
<g opacity="0.8" filter="url(#filter0_dii_26133_116870)">
|
||||
<path d="M512.364 162L226 289.273V480.182C226 656.773 348.182 821.909 512.364 862C676.545 821.909 798.727 656.773 798.727 480.182V289.273L512.364 162ZM512.364 352.909C556.909 352.909 601.455 387.909 601.455 432.455V480.182C620.546 480.182 639.636 499.273 639.636 521.545V632.909C639.636 652 620.545 671.091 598.273 671.091H423.273C404.182 671.091 385.091 652 385.091 629.727V518.364C385.091 499.273 404.182 480.182 423.273 480.182V432.455C423.273 387.909 467.818 352.909 512.364 352.909ZM512.364 391.091C486.909 391.091 464.636 407 464.636 432.455V480.182H560.091V432.455C560.091 407 537.818 391.091 512.364 391.091Z" fill="white" style="fill:white;fill-opacity:1;"/>
|
||||
</g>
|
||||
<g opacity="0.8" filter="url(#filter1_dii_26133_116870)">
|
||||
<path d="M512.364 162L226 289.273V480.182C226 656.773 348.182 821.909 512.364 862C676.545 821.909 798.727 656.773 798.727 480.182V289.273L512.364 162ZM512.364 352.909C556.909 352.909 601.455 387.909 601.455 432.455V480.182C620.546 480.182 639.636 499.273 639.636 521.545V632.909C639.636 652 620.545 671.091 598.273 671.091H423.273C404.182 671.091 385.091 652 385.091 629.727V518.364C385.091 499.273 404.182 480.182 423.273 480.182V432.455C423.273 387.909 467.818 352.909 512.364 352.909ZM512.364 391.091C486.909 391.091 464.636 407 464.636 432.455V480.182H560.091V432.455C560.091 407 537.818 391.091 512.364 391.091Z" fill="white" style="fill:white;fill-opacity:1;"/>
|
||||
</g>
|
||||
<g opacity="0.8" filter="url(#filter2_ii_26133_116870)">
|
||||
<path d="M512.364 162L226 289.273V480.182C226 656.773 348.182 821.909 512.364 862C676.545 821.909 798.727 656.773 798.727 480.182V289.273L512.364 162ZM512.364 352.909C556.909 352.909 601.455 387.909 601.455 432.455V480.182C620.546 480.182 639.636 499.273 639.636 521.545V632.909C639.636 652 620.545 671.091 598.273 671.091H423.273C404.182 671.091 385.091 652 385.091 629.727V518.364C385.091 499.273 404.182 480.182 423.273 480.182V432.455C423.273 387.909 467.818 352.909 512.364 352.909ZM512.364 391.091C486.909 391.091 464.636 407 464.636 432.455V480.182H560.091V432.455C560.091 407 537.818 391.091 512.364 391.091Z" fill="white" style="fill:white;fill-opacity:1;"/>
|
||||
</g>
|
||||
</g>
|
||||
<defs>
|
||||
<filter id="filter0_dii_26133_116870" x="46.613" y="90.2452" width="931.501" height="1058.77" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
|
||||
<feFlood flood-opacity="0" result="BackgroundImageFix"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="107.632"/>
|
||||
<feGaussianBlur stdDeviation="89.6935"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.35 0"/>
|
||||
<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_26133_116870"/>
|
||||
<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_26133_116870" result="shape"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="17.9387"/>
|
||||
<feGaussianBlur stdDeviation="8.96935"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="shape" result="effect2_innerShadow_26133_116870"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="-8.96935"/>
|
||||
<feGaussianBlur stdDeviation="4.48467"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="effect2_innerShadow_26133_116870" result="effect3_innerShadow_26133_116870"/>
|
||||
</filter>
|
||||
<filter id="filter1_dii_26133_116870" x="46.613" y="90.2452" width="931.501" height="1058.77" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
|
||||
<feFlood flood-opacity="0" result="BackgroundImageFix"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="107.632"/>
|
||||
<feGaussianBlur stdDeviation="89.6935"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.12 0"/>
|
||||
<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_26133_116870"/>
|
||||
<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_26133_116870" result="shape"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="17.9387"/>
|
||||
<feGaussianBlur stdDeviation="8.96935"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="shape" result="effect2_innerShadow_26133_116870"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="-8.96935"/>
|
||||
<feGaussianBlur stdDeviation="4.48467"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="effect2_innerShadow_26133_116870" result="effect3_innerShadow_26133_116870"/>
|
||||
</filter>
|
||||
<filter id="filter2_ii_26133_116870" x="226" y="153.031" width="572.727" height="726.908" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
|
||||
<feFlood flood-opacity="0" result="BackgroundImageFix"/>
|
||||
<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="17.9387"/>
|
||||
<feGaussianBlur stdDeviation="8.96935"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="shape" result="effect1_innerShadow_26133_116870"/>
|
||||
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
|
||||
<feOffset dy="-8.96935"/>
|
||||
<feGaussianBlur stdDeviation="4.48467"/>
|
||||
<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
|
||||
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.25 0"/>
|
||||
<feBlend mode="normal" in2="effect1_innerShadow_26133_116870" result="effect2_innerShadow_26133_116870"/>
|
||||
</filter>
|
||||
<linearGradient id="paint0_linear_26133_116870" x1="96.5" y1="71" x2="985" y2="977.5" gradientUnits="userSpaceOnUse">
|
||||
<stop stop-color="#C373F2" style="stop-color:#C373F2;stop-color:color(display-p3 0.7647 0.4510 0.9490);stop-opacity:1;"/>
|
||||
<stop offset="1" stop-color="#9610D6" style="stop-color:#9610D6;stop-color:color(display-p3 0.5882 0.0627 0.8392);stop-opacity:1;"/>
|
||||
</linearGradient>
|
||||
<clipPath id="clip0_26133_116870">
|
||||
<rect width="1024" height="1024" rx="234" fill="white" style="fill:white;fill-opacity:1;"/>
|
||||
</clipPath>
|
||||
</defs>
|
||||
</svg>
|
||||
|
Before Width: | Height: | Size: 7.1 KiB |
|
Before Width: | Height: | Size: 1.4 KiB After Width: | Height: | Size: 1.4 KiB |
|
Before Width: | Height: | Size: 2.2 KiB After Width: | Height: | Size: 2.2 KiB |
|
Before Width: | Height: | Size: 2.2 KiB After Width: | Height: | Size: 2.2 KiB |
File diff suppressed because one or more lines are too long
|
Before Width: | Height: | Size: 6.2 KiB After Width: | Height: | Size: 6.2 KiB |
@@ -1 +1 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867"><path id="XMLID_107_" fill="#0082c9" d="m16.959 5.8379c-3.5104 0-6.4858 2.3798-7.408 5.6042-0.80146-1.7103-2.5382-2.9085-4.5387-2.9085-2.7511 0-5.0126 2.2615-5.0126 5.0126 0 2.7511 2.2615 5.0137 5.0126 5.0137 2.0005 0 3.7373-1.1989 4.5387-2.9095 0.92217 3.2246 3.8975 5.6053 7.408 5.6053 3.4845 0 6.4447-2.3447 7.3904-5.533 0.81627 1.6717 2.5316 2.8372 4.5036 2.8372 2.7511 0 5.0137-2.2625 5.0137-5.0137 0-2.7511-2.2625-5.0126-5.0137-5.0126-1.9721 0-3.6874 1.1647-4.5036 2.8362-0.94575-3.188-3.9059-5.532-7.3904-5.532zm0 2.9425c2.65 0 4.7669 2.1159 4.7669 4.7659 0 2.65-2.1169 4.7669-4.7669 4.7669-2.65 0-4.7659-2.1169-4.7659-4.7669 0-2.65 2.1159-4.7659 4.7659-4.7659zm-11.947 2.6958c1.161 0 2.0711 0.90908 2.0711 2.0701 0 1.161-0.91012 2.0711-2.0711 2.0711-1.161 0-2.0701-0.91012-2.0701-2.0711 0-1.161 0.90909-2.0701 2.0701-2.0701zm23.841 0c1.161 0 2.0711 0.90908 2.0711 2.0701 0 1.161-0.91012 2.0711-2.0711 2.0711-1.161 0-2.0701-0.91012-2.0701-2.0711 0-1.161 0.90909-2.0701 2.0701-2.0701z" color="#000" color-rendering="auto" image-rendering="auto" shape-rendering="auto" solid-color="#000000" style="isolation:auto;mix-blend-mode:normal;text-decoration-color:#000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-transform:none;white-space:normal"/><g fill="#0082c9" transform="matrix(.13987 0 0 .13987 3.3867 17.958)"><path id="XMLID_121_" d="m37.67 48.9c5.9 0 9.2 4.2 9.2 10.5 0 0.6-0.5 1.1-1.1 1.1h-15.9c0.1 5.6 4 8.8 8.5 8.8 2.8 0 4.8-1.2 5.8-2 0.6-0.4 1.1-0.3 1.4 0.3l0.3 0.5c0.3 0.5 0.2 1-0.3 1.4-1.2 0.9-3.8 2.4-7.3 2.4-6.5 0-11.5-4.7-11.5-11.5 0.1-7.2 4.9-11.5 10.9-11.5zm6.1 9.4c-0.2-4.6-3-6.9-6.2-6.9-3.7 0-6.9 2.4-7.6 6.9z"/><path id="XMLID_119_" d="m76.9 52.1v-7.7c0-0.7 0.4-1.1 1.1-1.1h0.8c0.7 0 1 0.4 1 1.1v5.2h4.5c0.7 0 1.1 0.4 1.1 1.1v0.3c0 0.7-0.4 1-1.1 1h-4.5v11c0 5.1 3.1 5.7 4.8 5.8 0.9 0.1 1.2 0.3 1.2 1.1v0.6c0 0.7-0.3 1-1.2 1-4.8 0-7.7-2.9-7.7-8.1z"/><path id="XMLID_117_" d="m99.8 48.9c3.8 0 6.2 1.6 7.3 2.5 0.5 0.4 0.6 0.9 0.1 1.5l-0.3 0.5c-0.4 0.6-0.9 0.6-1.5 0.2-1-0.7-2.9-2-5.5-2-4.8 0-8.6 3.6-8.6 8.9 0 5.2 3.8 8.8 8.6 8.8 3.1 0 5.2-1.4 6.2-2.3 0.6-0.4 1-0.3 1.4 0.3l0.3 0.4c0.3 0.6 0.2 1-0.3 1.5-1.1 0.9-3.8 2.8-7.8 2.8-6.5 0-11.5-4.7-11.5-11.5 0.1-6.8 5.1-11.6 11.6-11.6z"/><path id="XMLID_115_" d="m113.1 41.8c0-0.7-0.4-1.1 0.3-1.1h0.8c0.7 0 1.8 0.4 1.8 1.1v23.9c0 2.8 1.3 3.1 2.3 3.2 0.5 0 0.9 0.3 0.9 1v0.7c0 0.7-0.3 1.1-1.1 1.1-1.8 0-5-0.6-5-5.4z"/><path id="XMLID_112_" d="m133.6 48.9c6.4 0 11.6 4.9 11.6 11.4 0 6.6-5.2 11.6-11.6 11.6s-11.6-5-11.6-11.6c0-6.5 5.2-11.4 11.6-11.4zm0 20.4c4.7 0 8.5-3.8 8.5-9 0-5-3.8-8.7-8.5-8.7s-8.6 3.8-8.6 8.7c0.1 5.1 3.9 9 8.6 9z"/><path id="XMLID_109_" d="m183.5 48.9c5.3 0 7.2 4.4 7.2 4.4h0.1s-0.1-0.7-0.1-1.7v-9.9c0-0.7-0.3-1.1 0.4-1.1h0.8c0.7 0 1.8 0.4 1.8 1.1v28.5c0 0.7-0.3 1.1-1 1.1h-0.7c-0.7 0-1.1-0.3-1.1-1v-1.7c0-0.8 0.2-1.4 0.2-1.4h-0.1s-1.9 4.6-7.6 4.6c-5.9 0-9.6-4.7-9.6-11.5-0.2-6.8 3.9-11.4 9.7-11.4zm0.1 20.4c3.7 0 7.1-2.6 7.1-8.9 0-4.5-2.3-8.8-7-8.8-3.9 0-7.1 3.2-7.1 8.8 0.1 5.4 2.9 8.9 7 8.9z"/><path id="XMLID_103_" d="m1 71.4h0.8c0.7 0 1.1-0.4 1.1-1.1v-21.472c0-3.4 3.7-5.8277 7.9-5.8277s7.9 2.4277 7.9 5.8277v21.472c0 0.7 0.4 1.1 1.1 1.1h0.8c0.7 0 1-0.4 1-1.1v-21.6c0-5.7-5.7-8.5-10.9-8.5-5 0-10.7 2.8-10.7 8.5v21.6c0 0.7 0.3 1.1 1 1.1z"/><path id="XMLID_102_" d="m167.9 49.4h-0.8c-0.7 0-1.1 0.4-1.1 1.1v12.1c0 3.4-2.2 6.5-6.5 6.5-4.2 0-6.5-3.1-6.5-6.5v-12.1c0-0.7-0.4-1.1-1.1-1.1h-0.8c-0.7 0-1 0.4-1 1.1v12.9c0 5.7 4.2 8.5 9.4 8.5s9.4-2.8 9.4-8.5v-12.9c0.1-0.7-0.3-1.1-1-1.1z"/><path d="m68.908 49.236c-0.24494 0.0391-0.4801 0.20259-0.70508 0.4707l-4.0469 4.8242-3.0293 3.6094-4.5859-5.4668-2.4883-2.9668c-0.22498-0.26812-0.47975-0.41472-0.74414-0.4375-0.26439-0.02278-0.53852 0.07775-0.80664 0.30273l-0.61328 0.51367c-0.53623 0.44995-0.50854 0.94814-0.05859 1.4844l4.0488 4.8242 3.3574 4-4.916 5.8574c-0.0037 0.0044-0.0061 0.0093-0.0098 0.01367l-2.4805 2.9551c-0.44995 0.53623-0.39953 1.1008 0.13672 1.5508l0.61328 0.51172c0.53623 0.44995 1.0227 0.33701 1.4727-0.19922l4.0469-4.8242 3.0293-3.6094 4.5859 5.4668c3e-3 0.0036 0.0067 0.0062 0.0098 0.0098l2.4805 2.957c0.44995 0.53623 1.0126 0.58474 1.5488 0.13476l0.61328-0.51367c0.53623-0.44995 0.50854-0.94814 0.05859-1.4844l-4.0488-4.8242-3.3574-4 4.916-5.8574c0.0037-0.0044 0.0061-0.0093 0.0098-0.01367l2.4805-2.9551c0.44995-0.53623 0.39953-1.1008-0.13672-1.5508l-0.61328-0.51367c-0.26812-0.22498-0.52264-0.30864-0.76758-0.26953z"/></g></svg>
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867"><path id="XMLID_107_" fill="#0082c9" d="m16.959 5.8379c-3.5104 0-6.4858 2.3798-7.408 5.6042-0.80146-1.7103-2.5382-2.9085-4.5387-2.9085-2.7511 0-5.0126 2.2615-5.0126 5.0126 0 2.7511 2.2615 5.0137 5.0126 5.0137 2.0005 0 3.7373-1.1989 4.5387-2.9095 0.92217 3.2246 3.8975 5.6053 7.408 5.6053 3.4845 0 6.4447-2.3447 7.3904-5.533 0.81627 1.6717 2.5316 2.8372 4.5036 2.8372 2.7511 0 5.0137-2.2625 5.0137-5.0137 0-2.7511-2.2625-5.0126-5.0137-5.0126-1.9721 0-3.6874 1.1647-4.5036 2.8362-0.94575-3.188-3.9059-5.532-7.3904-5.532zm0 2.9425c2.65 0 4.7669 2.1159 4.7669 4.7659 0 2.65-2.1169 4.7669-4.7669 4.7669-2.65 0-4.7659-2.1169-4.7659-4.7669 0-2.65 2.1159-4.7659 4.7659-4.7659zm-11.947 2.6958c1.161 0 2.0711 0.90908 2.0711 2.0701 0 1.161-0.91012 2.0711-2.0711 2.0711-1.161 0-2.0701-0.91012-2.0701-2.0711 0-1.161 0.90909-2.0701 2.0701-2.0701zm23.841 0c1.161 0 2.0711 0.90908 2.0711 2.0701 0 1.161-0.91012 2.0711-2.0711 2.0711-1.161 0-2.0701-0.91012-2.0701-2.0711 0-1.161 0.90909-2.0701 2.0701-2.0701z" color="#000" color-rendering="auto" image-rendering="auto" shape-rendering="auto" solid-color="#000000" style="isolation:auto;mix-blend-mode:normal;text-decoration-color:#000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-transform:none;white-space:normal"/><g fill="#0082c9" transform="matrix(.13987 0 0 .13987 3.3867 17.958)"><path id="XMLID_121_" d="m37.67 48.9c5.9 0 9.2 4.2 9.2 10.5 0 0.6-0.5 1.1-1.1 1.1h-15.9c0.1 5.6 4 8.8 8.5 8.8 2.8 0 4.8-1.2 5.8-2 0.6-0.4 1.1-0.3 1.4 0.3l0.3 0.5c0.3 0.5 0.2 1-0.3 1.4-1.2 0.9-3.8 2.4-7.3 2.4-6.5 0-11.5-4.7-11.5-11.5 0.1-7.2 4.9-11.5 10.9-11.5zm6.1 9.4c-0.2-4.6-3-6.9-6.2-6.9-3.7 0-6.9 2.4-7.6 6.9z"/><path id="XMLID_119_" d="m76.9 52.1v-7.7c0-0.7 0.4-1.1 1.1-1.1h0.8c0.7 0 1 0.4 1 1.1v5.2h4.5c0.7 0 1.1 0.4 1.1 1.1v0.3c0 0.7-0.4 1-1.1 1h-4.5v11c0 5.1 3.1 5.7 4.8 5.8 0.9 0.1 1.2 0.3 1.2 1.1v0.6c0 0.7-0.3 1-1.2 1-4.8 0-7.7-2.9-7.7-8.1z"/><path id="XMLID_117_" d="m99.8 48.9c3.8 0 6.2 1.6 7.3 2.5 0.5 0.4 0.6 0.9 0.1 1.5l-0.3 0.5c-0.4 0.6-0.9 0.6-1.5 0.2-1-0.7-2.9-2-5.5-2-4.8 0-8.6 3.6-8.6 8.9 0 5.2 3.8 8.8 8.6 8.8 3.1 0 5.2-1.4 6.2-2.3 0.6-0.4 1-0.3 1.4 0.3l0.3 0.4c0.3 0.6 0.2 1-0.3 1.5-1.1 0.9-3.8 2.8-7.8 2.8-6.5 0-11.5-4.7-11.5-11.5 0.1-6.8 5.1-11.6 11.6-11.6z"/><path id="XMLID_115_" d="m113.1 41.8c0-0.7-0.4-1.1 0.3-1.1h0.8c0.7 0 1.8 0.4 1.8 1.1v23.9c0 2.8 1.3 3.1 2.3 3.2 0.5 0 0.9 0.3 0.9 1v0.7c0 0.7-0.3 1.1-1.1 1.1-1.8 0-5-0.6-5-5.4z"/><path id="XMLID_112_" d="m133.6 48.9c6.4 0 11.6 4.9 11.6 11.4 0 6.6-5.2 11.6-11.6 11.6s-11.6-5-11.6-11.6c0-6.5 5.2-11.4 11.6-11.4zm0 20.4c4.7 0 8.5-3.8 8.5-9 0-5-3.8-8.7-8.5-8.7s-8.6 3.8-8.6 8.7c0.1 5.1 3.9 9 8.6 9z"/><path id="XMLID_109_" d="m183.5 48.9c5.3 0 7.2 4.4 7.2 4.4h0.1s-0.1-0.7-0.1-1.7v-9.9c0-0.7-0.3-1.1 0.4-1.1h0.8c0.7 0 1.8 0.4 1.8 1.1v28.5c0 0.7-0.3 1.1-1 1.1h-0.7c-0.7 0-1.1-0.3-1.1-1v-1.7c0-0.8 0.2-1.4 0.2-1.4h-0.1s-1.9 4.6-7.6 4.6c-5.9 0-9.6-4.7-9.6-11.5-0.2-6.8 3.9-11.4 9.7-11.4zm0.1 20.4c3.7 0 7.1-2.6 7.1-8.9 0-4.5-2.3-8.8-7-8.8-3.9 0-7.1 3.2-7.1 8.8 0.1 5.4 2.9 8.9 7 8.9z"/><path id="XMLID_103_" d="m1 71.4h0.8c0.7 0 1.1-0.4 1.1-1.1v-21.472c0-3.4 3.7-5.8277 7.9-5.8277s7.9 2.4277 7.9 5.8277v21.472c0 0.7 0.4 1.1 1.1 1.1h0.8c0.7 0 1-0.4 1-1.1v-21.6c0-5.7-5.7-8.5-10.9-8.5-5 0-10.7 2.8-10.7 8.5v21.6c0 0.7 0.3 1.1 1 1.1z"/><path id="XMLID_102_" d="m167.9 49.4h-0.8c-0.7 0-1.1 0.4-1.1 1.1v12.1c0 3.4-2.2 6.5-6.5 6.5-4.2 0-6.5-3.1-6.5-6.5v-12.1c0-0.7-0.4-1.1-1.1-1.1h-0.8c-0.7 0-1 0.4-1 1.1v12.9c0 5.7 4.2 8.5 9.4 8.5s9.4-2.8 9.4-8.5v-12.9c0.1-0.7-0.3-1.1-1-1.1z"/><path d="m68.908 49.236c-0.24494 0.0391-0.4801 0.20259-0.70508 0.4707l-4.0469 4.8242-3.0293 3.6094-4.5859-5.4668-2.4883-2.9668c-0.22498-0.26812-0.47975-0.41472-0.74414-0.4375-0.26439-0.02278-0.53852 0.07775-0.80664 0.30273l-0.61328 0.51367c-0.53623 0.44995-0.50854 0.94814-0.05859 1.4844l4.0488 4.8242 3.3574 4-4.916 5.8574c-0.0037 0.0044-0.0061 0.0093-0.0098 0.01367l-2.4805 2.9551c-0.44995 0.53623-0.39953 1.1008 0.13672 1.5508l0.61328 0.51172c0.53623 0.44995 1.0227 0.33701 1.4727-0.19922l4.0469-4.8242 3.0293-3.6094 4.5859 5.4668c3e-3 0.0036 0.0067 0.0062 0.0098 0.0098l2.4805 2.957c0.44995 0.53623 1.0126 0.58474 1.5488 0.13476l0.61328-0.51367c0.53623-0.44995 0.50854-0.94814 0.05859-1.4844l-4.0488-4.8242-3.3574-4 4.916-5.8574c0.0037-0.0044 0.0061-0.0093 0.0098-0.01367l2.4805-2.9551c0.44995-0.53623 0.39953-1.1008-0.13672-1.5508l-0.61328-0.51367c-0.26812-0.22498-0.52264-0.30864-0.76758-0.26953z"/></g></svg>
|
||||
|
Before Width: | Height: | Size: 4.4 KiB After Width: | Height: | Size: 4.4 KiB |
@@ -1 +1 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867"><defs><linearGradient id="paint2_linear" x1="35.974" x2="35.974" y1="43.955" y2="-.461" gradientTransform="matrix(.47037 0 0 .47037 1.7083e-6 1.1367)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#C2EBFA"/><stop offset="1" stop-color="#26A8DE"/></linearGradient><linearGradient id="paint1_linear" x1="35.974" x2="35.974" y1="57.171" y2="24.532" gradientTransform="matrix(.47037 0 0 .47037 1.7083e-6 1.1367)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#DEEDC9"/><stop offset=".661" stop-color="#8BBA25"/></linearGradient><linearGradient id="paint0_linear" x1="35.974" x2="35.974" y1="78.659" y2="29.03" gradientTransform="matrix(.47037 0 0 .47037 1.7083e-6 1.1367)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#FCC2B1"/><stop offset=".885" stop-color="#D9420B"/></linearGradient></defs><g fill-rule="evenodd" clip-rule="evenodd"><path fill="url(#paint0_linear)" d="m14.818 32.075-13.928-6.3941c-1.1865-0.55824-1.1865-1.4209 0-1.9284l4.8491-2.2329 9.0277 4.1613c1.1865 0.55819 3.0952 0.55819 4.2302 0l9.0277-4.1613 4.8492 2.2329c1.1865 0.55819 1.1865 1.4209 0 1.9284l-13.928 6.3941c-1.0833 0.50743-2.992 0.50743-4.127 0z" style="fill:url(#paint0_linear);stroke-width:.47037"/><path fill="url(#paint1_linear)" d="m14.818 24.209-13.928-6.3942c-1.1865-0.55819-1.1865-1.4209 0-1.9284l4.746-2.1821 9.1824 4.212c1.1865 0.55819 3.0952 0.55819 4.2301 0l9.1825-4.212 4.746 2.1821c1.1865 0.55824 1.1865 1.421 0 1.9284l-13.928 6.3942c-1.1865 0.55819-3.0952 0.55819-4.2301 0z" style="fill:url(#paint1_linear);stroke-width:.47037"/><path fill="url(#paint2_linear)" d="m14.818 16.546-13.928-6.3941c-1.1865-0.55823-1.1865-1.4209 0-1.9284l13.928-6.3941c1.1865-0.55822 3.0952-0.55822 4.2301 0l13.928 6.3941c1.1865 0.55819 1.1865 1.4209 0 1.9284l-13.928 6.3941c-1.1865 0.50748-3.0952 0.50748-4.2301 0z" style="fill:url(#paint2_linear);stroke-width:.47037"/></g></svg>
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867"><defs><linearGradient id="paint2_linear" x1="35.974" x2="35.974" y1="43.955" y2="-.461" gradientTransform="matrix(.47037 0 0 .47037 1.7083e-6 1.1367)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#C2EBFA"/><stop offset="1" stop-color="#26A8DE"/></linearGradient><linearGradient id="paint1_linear" x1="35.974" x2="35.974" y1="57.171" y2="24.532" gradientTransform="matrix(.47037 0 0 .47037 1.7083e-6 1.1367)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#DEEDC9"/><stop offset=".661" stop-color="#8BBA25"/></linearGradient><linearGradient id="paint0_linear" x1="35.974" x2="35.974" y1="78.659" y2="29.03" gradientTransform="matrix(.47037 0 0 .47037 1.7083e-6 1.1367)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#FCC2B1"/><stop offset=".885" stop-color="#D9420B"/></linearGradient></defs><g fill-rule="evenodd" clip-rule="evenodd"><path fill="url(#paint0_linear)" d="m14.818 32.075-13.928-6.3941c-1.1865-0.55824-1.1865-1.4209 0-1.9284l4.8491-2.2329 9.0277 4.1613c1.1865 0.55819 3.0952 0.55819 4.2302 0l9.0277-4.1613 4.8492 2.2329c1.1865 0.55819 1.1865 1.4209 0 1.9284l-13.928 6.3941c-1.0833 0.50743-2.992 0.50743-4.127 0z" style="fill:url(#paint0_linear);stroke-width:.47037"/><path fill="url(#paint1_linear)" d="m14.818 24.209-13.928-6.3942c-1.1865-0.55819-1.1865-1.4209 0-1.9284l4.746-2.1821 9.1824 4.212c1.1865 0.55819 3.0952 0.55819 4.2301 0l9.1825-4.212 4.746 2.1821c1.1865 0.55824 1.1865 1.421 0 1.9284l-13.928 6.3942c-1.1865 0.55819-3.0952 0.55819-4.2301 0z" style="fill:url(#paint1_linear);stroke-width:.47037"/><path fill="url(#paint2_linear)" d="m14.818 16.546-13.928-6.3941c-1.1865-0.55823-1.1865-1.4209 0-1.9284l13.928-6.3941c1.1865-0.55822 3.0952-0.55822 4.2301 0l13.928 6.3941c1.1865 0.55819 1.1865 1.4209 0 1.9284l-13.928 6.3941c-1.1865 0.50748-3.0952 0.50748-4.2301 0z" style="fill:url(#paint2_linear);stroke-width:.47037"/></g></svg>
|
||||
|
Before Width: | Height: | Size: 2.0 KiB After Width: | Height: | Size: 2.0 KiB |
@@ -1 +1 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866"><defs><radialGradient id="a" cx="261" cy="240" r="341" gradientTransform="matrix(.087249 6.3692e-5 -6.8457e-5 .09396 -5.8182 -5.6417)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#ff0"/><stop offset="1" stop-color="#fa0"/></radialGradient></defs><path fill="url(#a)" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width=".711" d="m16.947 0.3557-15.235 8.2551-0.028193 16.577 15.235 8.3222 15.235-8.2551 0.02819-16.577zm-0.04771 6.5705v4.03e-4c0.25369 0 0.51007 0.01993 0.77182 0.05872 2.7584 0.4141 4.8457 2.7249 4.4564 4.7316-0.38926 2-2.2349 3.7584-2.6913 4.141-0.45638 0.38255 2.49 11.074 2.49 11.074h-10s3.1007-10.537 2.4497-11.074c-0.65101-0.54631-2.7651-2.4765-2.443-4.6242 0.32282-2.1544 2.5235-4.2953 4.9799-4.302z"/></svg>
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866"><defs><radialGradient id="a" cx="261" cy="240" r="341" gradientTransform="matrix(.087249 6.3692e-5 -6.8457e-5 .09396 -5.8182 -5.6417)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#ff0"/><stop offset="1" stop-color="#fa0"/></radialGradient></defs><path fill="url(#a)" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width=".711" d="m16.947 0.3557-15.235 8.2551-0.028193 16.577 15.235 8.3222 15.235-8.2551 0.02819-16.577zm-0.04771 6.5705v4.03e-4c0.25369 0 0.51007 0.01993 0.77182 0.05872 2.7584 0.4141 4.8457 2.7249 4.4564 4.7316-0.38926 2-2.2349 3.7584-2.6913 4.141-0.45638 0.38255 2.49 11.074 2.49 11.074h-10s3.1007-10.537 2.4497-11.074c-0.65101-0.54631-2.7651-2.4765-2.443-4.6242 0.32282-2.1544 2.5235-4.2953 4.9799-4.302z"/></svg>
|
||||
|
Before Width: | Height: | Size: 876 B After Width: | Height: | Size: 875 B |
@@ -1,7 +1,7 @@
|
||||
/**
|
||||
* @overview Generates a list of topics on a Discourse forum.
|
||||
* @author Jonah Aragon <jonah@triplebit.net>
|
||||
* @version 3.1.0
|
||||
* @version 3.0.0
|
||||
* @license
|
||||
* Copyright (c) 2023 - 2024 Jonah Aragon
|
||||
*
|
||||
@@ -30,7 +30,7 @@ async function getData(url) {
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const elements = document.querySelectorAll("ul[data-forum]");
|
||||
const elements = document.querySelectorAll("div[data-forum]");
|
||||
|
||||
for (let j = 0; j < elements.length; j++) {
|
||||
|
||||
@@ -53,7 +53,7 @@ async function main() {
|
||||
var title = list[i]['title'];
|
||||
var id = list[i]['id'];
|
||||
|
||||
var topic = document.createElement("li");
|
||||
var topic = document.createElement("div");
|
||||
topic.className = "discourse-topic";
|
||||
|
||||
var h3 = document.createElement('p');
|
||||
@@ -62,37 +62,13 @@ async function main() {
|
||||
|
||||
a1.href = dataset.forum + '/t/' + id;
|
||||
|
||||
var boldTitle = document.createElement('strong');
|
||||
boldTitle.innerText = title;
|
||||
a1.appendChild(boldTitle);
|
||||
a1.innerText = title;
|
||||
h3.appendChild(a1);
|
||||
|
||||
var authorinfo = document.createElement('p');
|
||||
authorinfo.className = "discourse-author";
|
||||
|
||||
var author_id = list[i]['posters'][0]['user_id'];
|
||||
var author_data = profiles.find(profile => profile['id'] == author_id);
|
||||
var author = document.createElement('span');
|
||||
author.className = "discourse-author";
|
||||
var avatar = document.createElement('img');
|
||||
avatar.src = dataset.forum + author_data['avatar_template'].replace("{size}", "40");
|
||||
avatar.width = 20;
|
||||
avatar.height = 20;
|
||||
avatar.className = "middle";
|
||||
author.appendChild(avatar);
|
||||
var namespan = document.createElement('span');
|
||||
namespan.innerText = " Posted by " + author_data['username'];
|
||||
author.appendChild(namespan);
|
||||
authorinfo.appendChild(author);
|
||||
|
||||
var postinfo = document.createElement('p');
|
||||
var postinfo = document.createElement('ul');
|
||||
postinfo.className = "discourse-data";
|
||||
|
||||
var dateIcon = document.createElement('span');
|
||||
dateIcon.className = "twemoji";
|
||||
dateIcon.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1-2.1-2M12.5 7v5.2l4 2.4-1 1L11 13V7h1.5M11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2v1.8Z"></path></svg>';
|
||||
|
||||
var date = document.createElement('span');
|
||||
var date = document.createElement('li');
|
||||
date.className = "discourse-date";
|
||||
var datestring = list[i]['bumped_at'];
|
||||
var dateobject = new Date(datestring);
|
||||
@@ -103,46 +79,55 @@ async function main() {
|
||||
var days = Math.floor(hours / 24);
|
||||
if (days > 0) {
|
||||
if (days == 1) {
|
||||
date.innerText = " 1 day ago ";
|
||||
date.innerText = "Last reply 1 day ago";
|
||||
}
|
||||
else {
|
||||
date.innerText = " " + days + " days ago ";
|
||||
date.innerText = "Last reply " + days + " days ago";
|
||||
}
|
||||
}
|
||||
else if (hours > 0){
|
||||
if (hours == 1) {
|
||||
date.innerText = " 1 hour ago ";
|
||||
date.innerText = "Last reply 1 hour ago";
|
||||
}
|
||||
else {
|
||||
date.innerText = " " + hours + " hours ago ";
|
||||
date.innerText = "Last reply "+ hours + " hours ago";
|
||||
}
|
||||
}
|
||||
else {
|
||||
if (minutes == 1) {
|
||||
date.innerText = " 1 minute ago ";
|
||||
date.innerText = "Last reply 1 minute ago";
|
||||
}
|
||||
else {
|
||||
date.innerText = " " + minutes + " minutes ago ";
|
||||
date.innerText = "Last reply " + minutes + " minutes ago";
|
||||
}
|
||||
}
|
||||
postinfo.appendChild(dateIcon);
|
||||
postinfo.appendChild(date);
|
||||
|
||||
var likesicon = document.createElement('span');
|
||||
likesicon.classList = "twemoji pg-red";
|
||||
likesicon.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="m12 21.35-1.45-1.32C5.4 15.36 2 12.27 2 8.5 2 5.41 4.42 3 7.5 3c1.74 0 3.41.81 4.5 2.08C13.09 3.81 14.76 3 16.5 3 19.58 3 22 5.41 22 8.5c0 3.77-3.4 6.86-8.55 11.53L12 21.35Z"></path></svg>';
|
||||
var author_id = list[i]['posters'][0]['user_id'];
|
||||
var author_data = profiles.find(profile => profile['id'] == author_id);
|
||||
var author = document.createElement('li');
|
||||
author.className = "discourse-author";
|
||||
var avatar = document.createElement('img');
|
||||
avatar.src = dataset.forum + author_data['avatar_template'].replace("{size}", "40");
|
||||
avatar.width = 20;
|
||||
avatar.height = 20;
|
||||
author.appendChild(avatar);
|
||||
var namespan = document.createElement('span');
|
||||
namespan.innerText = " " + author_data['username'];
|
||||
author.appendChild(namespan);
|
||||
postinfo.appendChild(author);
|
||||
|
||||
var likes = document.createElement('span');
|
||||
var likes = document.createElement('li');
|
||||
likes.className = "discourse-likes";
|
||||
likes.innerText = " " + list[i]['like_count'] + " ";
|
||||
postinfo.appendChild(likesicon);
|
||||
if (list[i]['like_count'] == 1) {
|
||||
likes.innerText = "1 Like";
|
||||
}
|
||||
else {
|
||||
likes.innerText = list[i]['like_count'] + " Likes";
|
||||
}
|
||||
postinfo.appendChild(likes);
|
||||
|
||||
var replyIcon = document.createElement('span');
|
||||
replyIcon.classList = "twemoji";
|
||||
replyIcon.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 9V5l-7 7 7 7v-4.1c5 0 8.5 1.6 11 5.1-1-5-4-10-11-11Z"></path></svg>';
|
||||
|
||||
var replies = document.createElement('span');
|
||||
var replies = document.createElement('li');
|
||||
replies.className = "discourse-replies";
|
||||
|
||||
var reply_count = list[i]['posts_count'] - 1;
|
||||
@@ -150,14 +135,11 @@ async function main() {
|
||||
replies.innerText = "1 Reply"
|
||||
}
|
||||
else {
|
||||
replies.innerText = " " + reply_count
|
||||
replies.innerText = reply_count + " Replies"
|
||||
}
|
||||
postinfo.appendChild(replyIcon);
|
||||
postinfo.appendChild(replies);
|
||||
|
||||
topic.appendChild(h3);
|
||||
topic.appendChild(document.createElement('hr'));
|
||||
topic.appendChild(authorinfo);
|
||||
topic.appendChild(postinfo);
|
||||
topics.appendChild(topic);
|
||||
}
|
||||
|
||||
@@ -23,13 +23,16 @@
|
||||
|
||||
/* Homepage hero section */
|
||||
.mdx-container {
|
||||
background: #ffdd98;
|
||||
background: url("data:image/svg+xml;utf8,<svg width='100%' height='100%' viewBox='0 0 1123 258' version='1.1' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' xml:space='preserve' xmlns:serif='http://www.serif.com/' style='fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2;'><g transform='matrix(-1.01432,0,0,0.388868,1134.41,161.501)'><path d='M1124,2L1124,258L-1,258L-1,210C-1,210 15,215 54,215C170,215 251,123 379,123C500,123 493,169 633,169C773,169 847,2 1205,3L1124,2Z' style='fill:rgb(247, 247, 252);fill-rule:nonzero;'/></g></svg>")
|
||||
no-repeat bottom,
|
||||
linear-gradient(to bottom, rgb(255 255 255/.8), #ffdd98 99%, var(--md-default-bg-color) 99%);
|
||||
background-size: contain;
|
||||
padding-top: 1rem;
|
||||
padding-bottom: 1rem;
|
||||
}
|
||||
[data-md-color-scheme="slate"] .mdx-container {
|
||||
background: rgba(9, 9, 9, 0.95);
|
||||
background: url("data:image/svg+xml;utf8,<svg width='100%' height='100%' viewBox='0 0 1123 258' version='1.1' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' xml:space='preserve' xmlns:serif='http://www.serif.com/' style='fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2;'><g transform='matrix(-1.01432,0,0,0.388868,1134.41,161.501)'><path d='M1124,2L1124,258L-1,258L-1,210C-1,210 15,215 54,215C170,215 251,123 379,123C500,123 493,169 633,169C773,169 847,2 1205,3L1124,2Z' style='fill:rgb(26, 26, 27);fill-rule:nonzero;'/></g></svg>")
|
||||
no-repeat bottom, rgba(9, 9, 9, 0.95);
|
||||
background-size: contain;
|
||||
}
|
||||
|
||||
.mdx-hero {
|
||||
@@ -46,17 +49,18 @@
|
||||
font-size: 1.4rem;
|
||||
}
|
||||
}
|
||||
.mdx-hero__content {
|
||||
padding-bottom: 6rem;
|
||||
}
|
||||
@media screen and (min-width: 60em) {
|
||||
.mdx-hero {
|
||||
align-items: stretch;
|
||||
display: flex;
|
||||
}
|
||||
.mdx-hero__content {
|
||||
margin-top: 3rem;
|
||||
margin-bottom: 3rem;
|
||||
p, h1 {
|
||||
max-width: 38rem;
|
||||
}
|
||||
margin-top: 3.5rem;
|
||||
max-width: 38rem;
|
||||
padding-bottom: 14vw;
|
||||
}
|
||||
.mdx-hero__image {
|
||||
order: 1;
|
||||
@@ -91,7 +95,7 @@ nav[class="md-tabs"] {
|
||||
.md-typeset a.headerlink {
|
||||
display: none;
|
||||
}
|
||||
/* article.md-content__inner {
|
||||
article.md-content__inner {
|
||||
max-width: 50rem;
|
||||
margin: auto;
|
||||
padding-bottom: 3rem;
|
||||
@@ -104,12 +108,20 @@ nav[class="md-tabs"] {
|
||||
}
|
||||
article.md-content__inner > * {
|
||||
max-width: 38rem;
|
||||
} */
|
||||
}
|
||||
/* article.md-content__inner > *:nth-child(n+8):nth-child(-n+12) {
|
||||
margin-left: auto;
|
||||
margin-right: 0;
|
||||
text-align: right;
|
||||
} */
|
||||
#what-should-i-do, #what-should-i-do ~ :not( .mdx-cat ~ * ):not( .mdx-cta ):not( .mdx-discourse-topics) {
|
||||
margin-left: auto;
|
||||
margin-right: 0;
|
||||
text-align: right;
|
||||
}
|
||||
article.md-content__inner > hr {
|
||||
margin: 3rem;
|
||||
}
|
||||
.pg-end-right-align, .mdx-cta {
|
||||
margin-left: auto;
|
||||
margin-right: auto;
|
||||
@@ -122,3 +134,56 @@ article.md-content__inner > * {
|
||||
--md-icon-size: 1.8em;
|
||||
margin: 0.4rem;
|
||||
}
|
||||
|
||||
.mdx-discourse-topics {
|
||||
max-width: 100% !important;
|
||||
margin-left: auto;
|
||||
margin-right: auto;
|
||||
text-align: center;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list {
|
||||
grid-template-columns: repeat(5, 1fr);
|
||||
}
|
||||
.mdx-discourse-topics .discourse-title {
|
||||
min-height: 4em;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list {
|
||||
display: grid;
|
||||
text-align: left;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-title {
|
||||
line-height: 1.2;
|
||||
margin: 0;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-topic {
|
||||
padding: 0.4em;
|
||||
margin-bottom: 1em;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-data {
|
||||
color: var(--md-default-fg-color--light);
|
||||
list-style: none;
|
||||
padding: 0;
|
||||
margin: 0;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-data li {
|
||||
margin: 0;
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-data li img {
|
||||
vertical-align: middle;
|
||||
}
|
||||
@media screen and (max-width: 1000px) {
|
||||
.mdx-discourse-topics .topics-list {
|
||||
grid-template-columns: repeat(3, 1fr);
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-title {
|
||||
min-height: 0;
|
||||
}
|
||||
}
|
||||
@media screen and (max-width: 600px) {
|
||||
.mdx-discourse-topics .topics-list {
|
||||
grid-template-columns: repeat(1, 1fr);
|
||||
}
|
||||
.mdx-discourse-topics .topics-list .discourse-title {
|
||||
min-height: 0;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -50,15 +50,21 @@
|
||||
{% endblock %}
|
||||
{% block content %}
|
||||
{% if config.theme.language == "en" %}
|
||||
<h2>Top discussions this week</h2>
|
||||
<div class="grid cards">
|
||||
<ul
|
||||
<div class="mdx-discourse-topics">
|
||||
<h2>Top discussions this week</h2>
|
||||
<div
|
||||
class="topics-list"
|
||||
data-forum="https://discuss.privacyguides.net"
|
||||
data-feed="https://discuss.privacyguides.net/top.json?period=weekly"
|
||||
data-count="6">
|
||||
</ul>
|
||||
data-count="5">
|
||||
</div>
|
||||
<noscript>
|
||||
<a href="https://discuss.privacyguides.net/" class="md-button md-button--primary">
|
||||
Join the forum
|
||||
</a>
|
||||
</noscript>
|
||||
|
||||
<hr />
|
||||
</div>
|
||||
{% endif %}
|
||||
{{ page.content }}
|
||||
@@ -76,14 +82,12 @@
|
||||
</div>
|
||||
{% if config.theme.language == "en" %}
|
||||
<div class="mdx-discourse-topics">
|
||||
<h3>Latest discussions</h3>
|
||||
<div class="grid cards">
|
||||
<ul
|
||||
class="topics-list"
|
||||
data-forum="https://discuss.privacyguides.net"
|
||||
data-feed="https://discuss.privacyguides.net/latest.json"
|
||||
data-count="12">
|
||||
</ul>
|
||||
<h3>Join a discussion</h3>
|
||||
<div
|
||||
class="topics-list"
|
||||
data-forum="https://discuss.privacyguides.net"
|
||||
data-feed="https://discuss.privacyguides.net/latest.json"
|
||||
data-count="15">
|
||||
</div>
|
||||
<noscript>
|
||||
<a href="https://discuss.privacyguides.net/" class="md-button md-button--primary">
|
||||
|
||||
Reference in New Issue
Block a user