Rebased on #2606, swapped legacy admonitions

Co-authored-by: noClaps <github@zerolimits.dev>
Co-authored-by: Pa1NarK <69745008+pixincreate@users.noreply.github.com>

.all-contributorsrc

@@ -2965,15 +2965,6 @@
       "contributions": [
         "translation"
       ]
-    },
-    {
-      "login": "qiyongzheng",
-      "name": "qiyongzheng",
-      "avatar_url": "https://avatars.githubusercontent.com/u/153378707?v=4",
-      "profile": "https://github.com/qiyongzheng",
-      "contributions": [
-        "doc"
-      ]
     }
   ],
   "contributorsPerLine": 5,

README.md

@@ -611,7 +611,6 @@ Privacy Guides wouldn't be possible without these wonderful people ([emoji key](
     </tr>
     <tr>
       <td align="center" valign="top" width="20%"><a rel="nofollow noopener noreferrer" href="https://github.com/bruch-alex"><img src="https://avatars.githubusercontent.com/u/173354246?v=4" width="100px;" loading=lazy /><br /><sub><b>Alex Bruch</b></sub></a><br /><a href="#translation-bruch-alex" title="Translation">🌍</a></td>
-      <td align="center" valign="top" width="20%"><a rel="nofollow noopener noreferrer" href="https://github.com/qiyongzheng"><img src="https://avatars.githubusercontent.com/u/153378707?v=4" width="100px;" loading=lazy /><br /><sub><b>qiyongzheng</b></sub></a><br /><a href="https://github.com/privacyguides/privacyguides.org/commits?author=qiyongzheng" title="Documentation">📖</a></td>
     </tr>
   </tbody>
   <tfoot>

blog/posts/privacy-guides-hires-three-staff-members.md

@@ -1,65 +0,0 @@
----
-date:
-    created: 2025-01-17
-categories:
-    - Announcements
-authors:
-    - niek-de-wilde
-tags:
-    - Privacy Guides
-description: Privacy Guides is welcoming three new additions to the team.
-schema_type: NewsArticle
----
-
-# Privacy Guides Hires Three Staff Members
-
-At Privacy Guides, we are always looking for ways to be more effective at our mission of promoting privacy and security for everyone. To help us grow, reach a broader audience, and provide more high quality educational resources, we are thrilled to announce the hiring of three talented individuals to our team! Each of them brings a strong passion to their respective roles, and we are excited about working with them.<!-- more -->
-
-## Em – Journalist
-
-![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/ematprivacyguides/288/8211_2.png){ align=right }
-
-We’re excited to welcome Em (she/her), our new journalist, who will play an important role in taking our [articles](https://www.privacyguides.org/articles/) to the next level. She will be focusing on creating in-depth, interesting posts that explore the most important topics in the world of online privacy, security, and digital rights. Em will also conduct interviews with experts in the industry, analyze reports and studies, and produce investigative news stories to keep our readers informed.
-
-*Em is a privacy advocate and public‑interest technologist who has been fervently defending privacy rights online (and offline) since 2018. Her work focuses on raising awareness and informing the public and organizations on data privacy tools, practices, and regulations. She is a passionate writer and thorough investigator, continuously working on ways to improve adoption of better privacy practices, and regularly creating educational material to make protective tools accessible to the groups who need them most.*
-
-*Em is also a human rights activist who deeply values inclusivity, diversity, accessibility, and software for the public good. In her free time, you can find Em on Mastodon sharing privacy tips or boosting photos of cats and moss.*
-
-[:material-mastodon: Follow Em at @Em0nM4stodon@infosec.exchange](https://infosec.exchange/@Em0nM4stodon)
-
-## Jordan – Content Producer
-
-![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/jordan/288/7793_2.png){ align=right }
-
-We also welcome Jordan Warne (they/them), our new content producer who will manage our channels on various video platforms! Jordan has a strong background in video production and content strategy, and we’re confident that they will help us expand our reach and connect with a broader audience. Through informative, easy-to-understand videos, Jordan will simplify complex privacy topics and keep our community engaged. Expect a significantly larger presence on our [PeerTube](https://neat.tube/c/privacyguides/videos) and [YouTube](https://www.youtube.com/@privacyguides) channels in the coming months!
-
-*Jordan is a passionate creative with an education in both cybersecurity and photography. Having completed a Diploma of Digital Imaging at Billy Blue College of Design, Jordan is equipped with the skills and experience to take Privacy Guides' video content to the next level. Having recently completed a Diploma of Information Technology (Cybersecurity) Jordan has the unique skillset to simplify complex cybersecurity topics and turn them into engaging and approachable content.*
-
-*Outside producing high-quality videos, Jordan enjoys exploring the Australian bush, capturing intricate details of its flora and fauna through photography.*
-
-[:material-mastodon: Follow Jordan at @jw@social.lol](https://social.lol/@jw)
-
-## Kevin – Intern
-
-![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/kevpham/288/8198_2.png){ align=right }
-
-Last but not least, we are excited to start working with Kevin Pham (he/him), our new intern focused on community & news, who will support both Em and Jordan in their roles while also engaging with our community across all platforms. His enthusiasm for digital privacy and his commitment to helping others make him a perfect fit for our team. He will help with managing our community, and interact with our growing online community to ensure that everyone has a voice. Kevin’s passion and eagerness to learn will no doubt contribute greatly to our mission.
-
-*Kevin is a senior at Tufts University studying Political Science and Science & Technology Studies. Originally from Florida, he is now freezing up in the greater Boston area. Kevin is passionate about usable security and privacy for vulnerable populations. He has previously worked with Freedom of the Press Foundation's Digital Security Team and Cornell Tech's Clinic to End Tech Abuse to help journalists and domestic violence survivors alike.*
-
-*Besides doomscrolling on social media, he loves cooking new recipes, reading philosophy essays, and perpetuating his caffeine addiction with Vietnamese coffee. Please feel free to reach out to him to discuss anything regarding best operational security practices and threat modeling...or just say hi!*
-
-[:material-mastodon: Follow Kevin at @kevpham@mastodon.social](https://mastodon.social/@kevpham)
-
-## What This Means for Privacy Guides
-
-The expansion of the Privacy Guides team continues our commitment to provide the best quality resources and information on privacy and security. With Em’s investigative work, Jordan’s video content, and Kevin’s hands-on support, we look forward to communicating easy to understand and factual information with a broader audience.
-
-We’re excited to see how these talented people will help Privacy Guides continue to grow, and we look forward to the amazing work they will contribute in the coming months.
-
-Thank you for being a part of our community, and stay tuned for the exciting new content and updates that will be coming your way soon!
-Welcome aboard, Em, Jordan, and Kevin! Let’s make privacy accessible for everyone. 🚀
-
-[:material-mastodon: Follow Privacy Guides at @privacyguides@neat.computer](https://mastodon.neat.computer/@privacyguides)
-
-[:material-youtube: Subscribe to Privacy Guides on YouTube](https://www.youtube.com/@privacyguides)

docs/about.md

@@ -98,50 +98,6 @@ The project executive committee consists of five volunteers charged with managem
 
 </div>
 
-## Staff
-
-Our staff are paid to contribute to supplemental content at Privacy Guides, like [video production](https://www.youtube.com/@privacyguides), [news articles and tutorials](https://www.privacyguides.org/articles/), and our discussion communities and social media. Most are available and paid on a full-time basis to assist the organization.
-
-<div class="grid cards" markdown>
-
--   :jack_o_lantern:{ .lg .middle } **Em**
-
-    ---
-
-    :material-text-account: Journalist
-
-    [:material-account: Profile](https://discuss.privacyguides.net/u/ematprivacyguides)
-
-    [:material-github:](https://github.com/EmAtPrivacyGuides "GitHub")
-    [:material-mastodon:](https://infosec.exchange/@Em0nM4stodon "@Em0nM4stodon@infosec.exchange"){rel=me}
-    [:material-email:](mailto:em@privacyguides.org "Email")
-
--   :full_moon_with_face:{ .lg .middle } **Jordan Warne**
-
-    ---
-
-    :material-text-account: Content Producer
-
-    [:material-account: Profile](https://discuss.privacyguides.net/u/Jordan)
-
-    [:material-github:](https://github.com/jordan-warne "GitHub")
-    [:material-mastodon:](https://social.lol/@jw "@jw@social.lol"){rel=me}
-    [:material-email:](mailto:jordan@privacyguides.org "Email")
-
--   :japanese_goblin:{ .lg .middle } **Kevin Pham**
-
-    ---
-
-    :material-text-account: Community & News Intern
-
-    [:material-account: Profile](https://discuss.privacyguides.net/u/kevpham)
-
-    [:material-github:](https://github.com/kevpham123 "GitHub")
-    [:material-mastodon:](https://mastodon.social/@kevpham "@kevpham@mastodon.social"){rel=me}
-    [:material-email:](mailto:kevin@privacyguides.org "Email")
-
-</div>
-
 ## In The Media
 
 > To find [privacy-focused alternative] apps, check out sites like Good Reports and **Privacy Guides**, which list privacy-focused apps in a variety of categories, notably including email providers (usually on paid plans) that aren’t run by the big tech companies.

docs/android/distributions.md

@@ -1,5 +1,5 @@
 ---
-meta_title: "The Best Android Operating Systems - Privacy Guides"
+meta_title: "The Best Custom Android OSes (aka Custom ROMs) - Privacy Guides"
 title: "Alternative Distributions"
 description: You can replace the operating system on your Android phone with these secure and privacy-respecting alternatives.
 schema:
@@ -26,15 +26,13 @@ robots: nofollow, max-snippet:-1, max-image-preview:large
 - [:material-target-account: Targeted Attacks](../basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
 - [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }
 
-A **custom Android-based operating system** (sometimes referred to as a **custom ROM**) can be a way to achieve a higher level of privacy and security on your device. This is in contrast to the "stock" version of Android which comes with your phone from the factory, and is often deeply integrated with Google Play Services as well as other vendor software.
+A **custom Android-based operating system** (often known as a **custom ROM**) is a popular way to achieve higher levels of privacy and security on your device. This is in contrast to the "stock" version of Android which comes with your phone from the factory, and is often deeply integrated with Google Play Services.
 
-We recommend installing GrapheneOS if you have a Google Pixel as it provides improved security hardening and additional privacy features. The reasons we don't list other operating systems or devices are as follows:
+We recommend installing one of these custom Android operating systems on your device, listed in order of preference, depending on your device's compatibility with these operating systems.
 
-- They often have [weaker security](index.md#install-a-custom-distribution).
-- Support is frequently dropped when the maintainer loses interest or upgrades their device, which is in contrast to the predictable [support cycle](https://grapheneos.org/faq#device-lifetime) that GrapheneOS follows.
-- They generally have few or no notable privacy or security improvements that make installing them worthwhile.
+## AOSP Derivatives
 
-## GrapheneOS
+### GrapheneOS
 
 <div class="admonition recommendation" markdown>
 

docs/cryptocurrency.md

@@ -74,7 +74,7 @@ There are numerous centralized exchanges (CEX) as well as P2P marketplaces where
 - [Kraken](https://kraken.com): A well-known CEX. Registration and KYC are mandatory. Card payments and bank transfers accepted. Make sure not to leave your newly purchased Monero on Kraken's platform after the purchase; withdraw them to a self-custody wallet. Monero is not available in all jurisdictions that Kraken operates in.[^1]
 - [Cake Wallet](https://cakewallet.com): A self-custody cross-platform wallet for Monero and other cryptocurrencies. You can buy Monero directly in the app using card payments or bank transfers (through third-party providers such as [Guardarian](https://guardarian.com) or [DFX](https://dfx.swiss)).[^2] KYC is usually not required, but it depends on your country and the amount you are purchasing. In countries where directly purchasing Monero is not possible, you can also use a provider within Cake Wallet to first buy another cryptocurrency such as Bitcoin, Bitcoin Cash, or Litecoin and then exchange it to Monero in-app.
     - [Monero.com](https://monero.com) is an associated website where you can buy Monero and other cryptocurrencies without having to download an app. The funds will simply be sent to the wallet address of your choice.
-- [RetoSwap](https://retoswap.com) (formerly known as Haveno-Reto) is a self-custody, decentralized P2P exchange platform based on the [Haveno](https://haveno.exchange) project which is available for Linux, Windows, and macOS. Monero can be bought and sold with maximum privacy, since most trading counterparties do not require KYC, trades are made directly between users (P2P), and all connections run through the Tor network. It is possible to buy Monero via bank transfer, Paypal, or even by paying in cash (meeting in person or sending by mail). Arbitrators can step in to resolve disputes between buyer and seller, but be careful when sharing your bank account or other sensitive information with your trading counterparty. Trading with some accounts may be against those accounts' terms of service.
+- [RetoSwap](https://retoswap.com) (formerly known as Haveno-Reto) is a self-custody, decentralized P2P exchange platform based on the [Haveno](https://haveno.exchange) project which is available for Linux, Windows, and macOS. Monero can be bought and sold with maximum privacy, since most trading counterparties do not require KYC, trades are made directly between users (P2P), and all connections run through the Tor network. It is possible to buy Monero via bank transfer, Paypal, or even by paying in cash (meeting in person or sending by mail). Arbitrators can step in to resolve disputes between buyer and seller, but be careful when sharing your bank account or other sensitive information with your trading counterparty. Trading with some accounts may be against those accounts' terms of service. Please note that you can only buy Monero on RetoSwap if you already own a small amount of Monero (currently a minimum of 0.11 XMR) in order to fund security deposits, although there are ongoing efforts to drop this requirement in the future.
 
 ## Criteria
 

docs/mobile-phones.md

@@ -34,7 +34,7 @@ Most **mobile phones** receive short or limited windows of security updates from
 
 The mobile devices listed here provide a long lifespan of guaranteed security updates and allow you to install a custom operating system without violating the Android security model.
 
-[Recommended Android Distributions :material-arrow-right-drop-circle:](android/distributions.md){ .md-button .md-button--primary } [Details about Android Security :material-arrow-right-drop-circle:](os/android-overview.md#security-protections){ .md-button }
+[Recommended Custom OSes :material-arrow-right-drop-circle:](android/distributions.md){ .md-button .md-button--primary } [Details about Android Security :material-arrow-right-drop-circle:](os/android-overview.md#security-protections){ .md-button }
 
 <div class="admonition warning" markdown>
 <p class="admonition-title">Warning</p>

docs/os/android-overview.md

@@ -155,7 +155,7 @@ All devices with Google Play Services installed automatically generate an [adver
 
 On Android distributions with [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), go to :gear: **Settings** → **Apps** → **Sandboxed Google Play** → **Google Settings** → **Ads**, and select *Delete advertising ID*.
 
-On Android distributions with privileged Google Play Services (which includes the stock installation on most devices), the setting may be in one of several locations. Check
+On Android distributions with privileged Google Play Services (such as stock OSes), the setting may be in one of several locations. Check
 
 - :gear: **Settings** → **Google** → **Ads**
 - :gear: **Settings** → **Privacy** → **Ads**

docs/os/ios-overview.md

@@ -250,20 +250,11 @@ In addition to locking apps behind biometrics, you can also hide apps so that th
 
 You can hide an app by long-pressing on it and selecting **Require Face ID/Touch ID** → **Hide and Require Face ID/Touch ID**. Note that pre-installed Apple apps, as well as the default web browser and email app, cannot be hidden. Hidden apps reside in a **Hidden** folder at the bottom of the App Library, which can be unlocked using biometrics. This folder appears in the App Library whether you hid any apps or not, which provides you a degree of plausible deniability.
 
-### Redacting Elements in Images
+### Blacking Out Faces/Information
 
 If you need to hide information in a photo, you can use Apple's built-in editing tools to do so.
 
-If your device supports it, you can use the [Clean Up](https://support.apple.com/en-us/121429) feature to pixelate faces or remove objects from images.
-
 - Open the **Photos** app and tap the photo you have selected for redaction
-- Tap the :material-tune: (at the bottom of the screen)
-- Tap the button labeled **Clean Up**
-- Draw a circle around whatever you want to redact. Faces will be pixelated and it will attempt to delete anything else.
-
-Our warning [against blurring text](../data-redaction.md) also applies here, so we recommend to instead add a black shape with 100% opacity over it. In addition to redacting text, you can also black out any face or object using the **Photos** app.
-
-- Tap the image you have selected for redaction
 - Tap the :material-tune: (at the bottom of the screen) → markup symbol (top right) → plus icon at the bottom right
 - Select **Add Shape** and choose the square or circle
 - On the toolbar, tap the circle (left-most option) and choose black as the color for filling in the shape. You can also move the shape and increase its size as you see fit.

docs/os/windows/hardening.md

@@ -0,0 +1,272 @@
+---
+title: System Hardening
+icon: material/monitor-lock
+---
+
+## Setting up Windows after Installation
+
+If you wish to limit the amount of data Microsoft obtains from your device, an [offline/local account](https://answers.microsoft.com/en-us/windows/forum/all/how-to-create-a-local-or-offline-account-in/95097c32-40c4-48c0-8f3b-3bcb67afaf7c) is **recommended**.
+
+![user-account](/assets/img/windows/user-account.webp)
+
+<div class="admonition note" markdown>
+<p class="admonition-title">Note</p>
+
+Microsoft is pushing users to use Microsoft accounts for other editions except Education and Enterprise after installation.
+
+So, You could also follow the guide by [ghacks.net](https://www.ghacks.net/2022/05/13/how-to-bypass-the-microsoft-account-requirement-during-windows-setup/) to bypass the Microsoft account requirement during setup and use Local account.
+</div>
+
+While setting up, it is recommended to use a generic name such as `user` and `host` and avoid identifying terms such as your name or operating system. This can make it more difficult for privileged `Win32` apps or attackers to discern your identity.
+
+For security, it's recommended to set up Windows Hello on all of your accounts because it uses the trusted platform module (TPM) if applicable, which protects against brute-force attacks; see the documentation: [How Windows Uses the TPM](https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/how-windows-uses-the-tpm#windows-hello-for-business)
+
+- [ ] Toggle off all privacy related settings as shown in the image:
+
+![Privacy Settings](/assets/img/windows/privacy-settings.webp)
+
+## Encrypting the Drive
+
+After you have installed Windows, turn on full disk encryption (FDE) using BitLocker via the Control Panel.
+
+<div class="admonition info" markdown>
+<p class="admonition-title">Choosing the Way to Encrypt</p>
+
+It is recommended to use only the Control Panel because if you go to encrypt via settings app, Microsoft named it as `Device Encryption` and designed it in a way that the encryption keys for BitLocker would be stored on Microsoft's server which is attached to your Microsoft account. This can be dangerous to your privacy and security as anyone who gains access to your account, as could an attacker if they were able to gain access to Microsoft's servers or any Law Enforcement could by a Gag order.
+
+</div>
+
+The best way is to go to the Control Panel by searching for it in the Start Menu or from the context menu (right-click) in File Explorer and set it up for all of the drives that you have.
+
+![Bitlocker in Control Panel](/assets/img/windows/Bitlocker%20Group%20Policies/bitlocker-control%20panel.webp)
+
+Bitlocker is suggested because of the native implementation by the OS and along with the usage of hardware to be resistant against encryption flaws.
+
+### Security policies for Bitlocker
+
+Enable the Following group policies before you start encrypting your drives.
+
+<div class="admonition tip" markdown>
+<p class="admonition-title">Tip</p>
+
+To go to it, search **Group Policy** in the **Windows Search Bar** and press **Enter** or type `gpedit.msc` in ++win+r++. Then, proceed as mentioned below.
+
+</div>
+
+General Policies :
+
+Go to `Computer Configuration` > `Administrative Templates` > `Windows Components` > `Bitlocker Drive Encryption`
+
+![Encryption & Cipher](/assets/img/windows/Bitlocker%20Group%20Policies/encryption-method-and-cipher.webp)
+![Disable DMA](/assets/img/windows/Bitlocker%20Group%20Policies/Disable%20DMA.webp)
+
+For OS drives :
+
+Go to `Computer Configuration` > `Administrative Templates` > `Windows Components` > `Bitlocker Drive Encryption` > `Operating System Drives`
+
+Enable Group policies as in the images below <!--(Check images side by side)--> :
+
+![Enforcing full encryption](/assets/img/windows/Bitlocker%20Group%20Policies/enforce-full-encryption.webp)
+![secure boot integrity validation](/assets/img/windows/Bitlocker%20Group%20Policies/Secure-boot-integrity-validation.webp)
+![TPM & PIN](/assets/img/windows/Bitlocker%20Group%20Policies/TPM+PIN.webp)
+![enhanced PINS](/assets/img/windows/Bitlocker%20Group%20Policies/enhanced-pins.webp)
+![Disallow others changing PIN](/assets/img/windows/Bitlocker%20Group%20Policies/disallow-user-from-changing-PIN.webp)
+
+For Fixed Drives :
+
+Go to `Computer Configuration` > `Administrative Templates` > `Windows Components` > `Bitlocker Drive Encryption` > `Fixed Data Drives` > `Enforce drive encryption type on fixed data drives`
+
+![Encryption Type](/assets/img/windows/Bitlocker%20Group%20Policies/fixed-drives.webp)
+
+These policies ensure that your drives are encrypted with `XTS-AES-256` Bit encryption, **fully**.
+
+### Setting up Pre-boot Authentication
+
+<div class="admonition warning" markdown>
+<p class="admonition-title">Update your TPM</p>
+
+Before enabling Bitlocker in your device,It is strongly recommended to update your TPM chip by downloading package only from **OEM** Websites.
+
+</div>
+
+As you are using Windows 11, TPM is used to encrypt and decrypt the drive but it is susceptible to [cold boot attacks](https://blog.elcomsoft.com/2021/01/understanding-bitlocker-tpm-protection/). So, it is recommended to use TPM + PIN to protect the drives
+
+After enabling all the group policies above, Go to Control panel and click on Add PIN. It can be alphanumeric if you had enabled the above policies.
+
+You can check if it's enabled by typing `manage-bde -status`. It will normally show in **Key Protectors**: **Numerical Password** (it's the recovery key) and **TPM And PIN**.
+
+<div class="admonition abstract" markdown>
+<p class="admonition-title">Disabling pre-boot Authentication (Not Recommended)</p>
+
+- open a **terminal** as an **administrator** and type this command `manage-bde -protectors -add c: -TPM`.
+- You can again check if it worked by typing `manage-bde -status c:` and it will show you **Numerical Password** and **TPM**
+
+</div>
+
+<div class="admonition info" markdown>
+<p class="admonition-title">Info</p>
+
+The above Group Policy configuration tells the TPM to release the encryption keys after entering PIN instead of releasing it on boot automatically.
+
+Doing this will set a double password. So, you enter the PIN to release the encryption keys from TPM & boot Windows and another credential to unlock your user account.
+
+The pre-boot PIN not only protects the OS drive but also other fixed drives used just for storage if bitlocker is enabled for that drive also.
+
+</div>
+
+When you do this, the encryption keys of your drive are only unlocked once you enter the PIN, and the decryption happens after. If you forget or lose the PIN, you won't be able to access your drives and OS anymore, and the only way to recover is using the Recovery Key provided during the initial setup of BitLocker. **Make sure you store it in a safe place**, such as a password manager, and keep backups of your Recovery Key or even use an encrypted USB drive.
+
+The preboot authentication is recommend to avoid data being accessed by removal of user Account passwords by methods like this - [How to Reset Windows 11 Password Without Any Software](https://youtu.be/0gOZoroPNuA) and access data even though Bitlocker is enabled and managed by TPM
+
+But when you use TPM + Startup PIN, nobody can restart to load the shell and bypass password. Because you need to enter your PIN to go to the Advanced Startup settings as in the video.
+
+Enabling or not-enabling is up to the user's threat model.
+
+If it's a personal device, Startup PIN + TPM is recommended.
+If a family computer, Normal Bitlocker (Managed by TPM) for OS drive is recommended.
+
+It is recommended to encrypt the OS drive at the least. Encrypting secondary drives either via Bitlocker or other encryption tools such as Veracrypt is upto the user's threat model.
+
+## Creation of User Account and usage
+
+- By Default Windows gives `administrator` access to the user account. Create another `standard` user account to reduce the attack surface enormously as most vulnerabilities today come from the fact that the user is always in `administrator` mode. In addition, you shouldn't use the same password for standard and administrator account.
+
+- Don't use admin account for any of your personal tasks!
+
+- Just restrict it to the standard account created.
+
+- Set [UAC](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings) settings to the [Highest Privilege](https://support.microsoft.com/en-us/windows/about-user-account-control-settings-d5b2046b-dcb8-54eb-f732-059f321afe18).
+
+- Only use your account for you, if someone needs to use your computer **ALWAYS** create another standard account, even if it's for a one-time use, even if it's your family or someone you trust. This person can plug a malicious USB, can connect to malicious Wi-Fi network, download infectious files, etc... without you knowing about it.
+
+- You might be afraid that the user accessing your device via another User account can access your Internal drive and access critical files violating your privacy. Refer, [Privacy page](windows/privacy/#restrict-access-to-data-drives) on How to restrict access to certain drives only or use EFS on a per-file basis. You can read more about EFS on [Privacy page](privacy.md).
+
+<div class="admonition tip" markdown>
+<p class="admonition-title">Tip</p>
+
+You should ALWAYS do the quick shortcut ++win+l++ to lock your device when you are away to prevent unauthorized access.
+
+</div>
+
+- If you don't like managing a standard account, then enforce authentication for Administrator accounts too like Standard ones by following the guide by [Wikihow](https://www.wikihow.tech/Require-UAC-Passwords-on-Administrator-Accounts)
+    - This way, Even administrators need to use Password to approve processes instead of just clicking `Yes` or `No`.
+
+## Securing the Boot chain
+
+- In your BIOS/UEFI settings, disable the booting of USB devices
+- Add a password to your BIOS/UEFI settings which restricts anyone from changing them.
+
+### Enabling Secure Boot
+
+- Windows 11 secures its bootloader by default by using Secure boot with the usage of TPM.
+
+- Windows 10, on the other hand, doesn't come with Secure boot enabled by default except for new devices.
+
+To enable Secure Boot from the PC BIOS menu. Follow this Step-by-Step Instructions by visiting this [documentation](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/disabling-secure-boot?view=windows-11#re-enable-secure-boot).
+
+Visit: [https://docs.microsoft.com/en-us/mem/intune/user-help/you-need-to-enable-secure-boot-windows#check-secure-boot-status](https://docs.microsoft.com/en-us/mem/intune/user-help/you-need-to-enable-secure-boot-windows#check-secure-boot-status) on how to verify if enabled after enabling secure boot.
+
+### Firmware Protection
+
+As there are thousands of PC vendors that produce many models with different UEFI BIOS versions, there becomes an incredibly large number of SRTM measurements upon bootup. Two techniques exist to establish trust here—either maintain a list of known 'bad' SRTM measurements (also known as a blocklist), or a list of known 'good' SRTM measurements (also known as an allowlist).
+
+**System Guard** lets the system freely boot into untrusted code initially, but shortly after launches the system into a trusted state by taking control of all CPUs and forcing them down a well-known and measured code path. This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state.
+
+- [x] Enable [System Guard](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows) by following the instructions of [Microsoft Docs](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) to secure the boot chain.
+
+You can also know how to check if it is enabled or not in the guide.
+
+<div class="admonition note" markdown>
+<p class="admonition-title">Note</p>
+
+System Guard is mostly available on Windows Secured-Core PCs not on regular consumer devices. So, Before enabling it check the requirements of your Device.
+
+</div>
+
+## Protection against Malware and Viruses
+
+- Just use the built-in Windows Defender Security to protect against threats and stick to it. Don't use any other Antivirus or Anti-Malware software [as it can weaken your security and your privacy](https://wonderfall.space/windows-hardening/#microsoft-defender-antivirus).
+
+- [x] **Enable** [Windows Defender in a Sandbox](https://www.microsoft.com/security/blog/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox/) by launching a **terminal** as an **administrator** and copy/paste this command ```setx /M MP_FORCE_USE_SANDBOX 1```. Restart your device and check if there's a process called **MsMpEngCP.exe** by typing `tasklist` in the terminal to verify.
+
+- [ ] Disable Autoplay for devices so that malware hidden in USB don't execute on plugging in
+    ![Disable autoplay](/assets/img/windows/autoplay.webp)
+- [x] Enable [Controlled Folder Access](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-controlled-folders) in Windows defender settings. So, The Important folders you listed for protection doesn't get attacked or held hostage in case of a ransomware attack and also stops apps from accessing your important folders. This could also be used as a firewall for the filesystem such as Choosing the drives in the protected ones. And allowing each app when it request access to your device.
+
+- [x] Enable [Microsoft Defender Application Guard](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview). After installing by going to "[Turn Windows Features on or off](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard)" you can enable it. This runs Microsoft Edge in an Isolated Hyper-V container preventing unknown Malware from damaging the system.
+
+<div class="admonition warning" markdown>
+<p class="admonition-title">Warning</p>
+
+When you use Microsoft Defender Application Guard it bypasses the VPN you are using as when you use WDAG is launching the application in what is essentially a virtual machine, so it bypasses the host, where the VPN is connected.
+
+</div>
+
+- [x] Enable [Memory Integrity](https://support.microsoft.com/en-us/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78) (also called Hypervisor-Protected Code Integrity) in Windows Defender settings which will run important system process isolated in an environment that cannot be attacked by viruses & malware.
+
+- [x] Enable `Display File Extensions` as most problems start here.
+
+<div class="admonition example" markdown>
+<p class="admonition-title">Enabling file extension</p>
+
+On standard Windows settings, Malware can hide itself if the filename is like: `Secure-File.txt.exe`
+
+What you see? A file named `Secure-File.txt`
+
+Of course the attacker can add a different icon to the file, so it looks like you open the file type extension you think.
+
+And if you open it, the Malware start's.
+
+Just Open the File Explorer's settings and change it to show File Extensions by clicking on `View` > `Show` or by configuring via [Registry Editor](https://github.com/beerisgood/Windows11_Hardening/blob/master/always%20display%20file%20typ%20extension)
+</div>
+
+## Apps
+
+- Avoid any types of Cleaning software at all cost. As Microsoft is working on its own implementation specfically designed for windows.
+- To Install apps, using the `winget` (Windows Package manager). More details in [Sandboxing page](/windows/sandboxing/#using-winget-to-install-sofwaret)
+
+## Security Improvements
+
+- Use [PeaZip](https://peazip.github.io/) archiver instead of 7-zip as it disables [Mark of the Web(MoW)](https://nolongerset.com/mark-of-the-web-details/) [support by default](https://github.com/nmantani/archiver-MOTW-support-comparison#*2) leading to execution of malicious instantly after extracting.
+
+- Using MS edge or brave over Firefox. Edge is recommended with MDAG mode for secure browsing if security is your priority. Brave is recommeded if content blocking is important for you (Brave shields)
+
+- [Check](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt#how-to-check-if-kernel-dma-protection-is-enabled) if Kernel DMA protections is turned on.
+
+- Use [Winget](/windows/sandboxing/#using-winget-to-install-sofware) tool to remove Bloatware instead of third party apps.
+
+- [x] Block all incoming connections in Windows firewall.
+    - Go to `Firewall & Network Protection` in Windows defender security.
+    - Go to `Domain`, `Private` and `Public` network settings
+    - Scroll and check the box under **Incoming Connections**
+
+<div class="admonition warning" markdown>
+<p class="admonition-title">A note regarding screen casting</p>
+
+If you try to cast your screen to another device or cast another device screen to your device via Wireless display (Optional feature). You won't be able to connect the devices. As we have blocked Incoming connections. Miracast (Wireless casting) requires incoming connection to send data back and forth to show the screen on other or vice versa.
+
+If you want to cast, then disable incoming connections in public network and cast your device and block connection again.
+
+There is no problem if you use normal Projection via cable.
+
+</div>
+
+## Keeping your device up-to-date
+
+You should keep your Windows Device up-to-date by enabling automatic updates. It is recommended to do so to keep your device with latest security fixes and new features.
+
+To get information about the latest updates, you can look at the [Windows Release Information](https://docs.microsoft.com/en-us/windows/release-health/windows11-release-information).
+
+It is recommended to stick to driver updates provided via Optional Updates, as they are thoroughly vetted by Microsoft for the stability of your device, and **do not rely on third-party apps for driver updates**. This way, you get the latest updates and security patches for your drivers along with firmware updates as long as your device is supported by the OEM.
+
+Some Hardware vendors like Nvidia, Intel has their own updater tool which will provide latest drivers.
+
+It is recommended to rather rely on Windows updates or first-party apps.
+
+**Credits** : The page is mostly made based on the recommendations of Windows Hardening Guide by [beerisgood](https://github.com/beerisgood/Windows11_Hardening)
+
+*[TPM]: Trusted Platform Module
+*[FDE]: Full Disk Encryption
+*[UAC]: User Account Control
+*[WDAG]: Windows Defender Application Guard
+*[SRTM]: Static Root-of-Trust Measurement

docs/os/windows/index.md

@@ -13,9 +13,9 @@ You can enhance your privacy and security on Windows without downloading any thi
 
 - Initial Installation (coming soon)
 - [Group Policy Settings](group-policies.md)
-- Privacy Settings (coming soon)
-- Application Sandboxing (coming soon)
-- Security Hardening (coming soon)
+- [Privacy Settings](privacy.md)
+- [Application Sandboxing](sandboxing.md)
+- [Security Hardening](hardening.md)
 
 <div class="admonition example" markdown>
 <p class="admonition-title">This section is new</p>

docs/os/windows/privacy.md

@@ -0,0 +1,86 @@
+---
+title: Achieving Privacy
+icon: material/incognito
+---
+
+## Using Microsoft account
+
+You should avoid sign in to Windows with a Microsoft account. As signing in to applications like Microsoft Office (which some users are required to do for their school or company) will trigger a dark pattern offering you to sign in to Windows, which will connect your device to your Microsoft account, and compels sending data to Microsoft servers and it is critical to reject this offer.
+
+It’s worth noting that according to [this study](https://www.autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/public_version_dutch_dpa_informal_translation_summary_of_investigation_report.pdf) it seems that Windows collects more telemetry when signed into a Microsoft Account.
+
+![Using account for specific app](/docs/assets/img/windows/signin-one-app.webp)
+
+You should log in to that specific app only if you need to.
+
+or
+
+Create another standard user account and connect it to Microsoft account if you are required for School or Work and keep the apps to that account alone. By restricting other data drive access, it is fully isolated from other profiles.
+
+## Telemetry
+
+To disable telemetry at full level, Open Group policy and navigate to `Computer Configuration` > `Administrative Templates` > `Windows Components` > `Data Collection and Preview builds` and choose as required
+
+![Disable telemetry](/docs/assets/img/windows/disable-telemetry.webp)
+
+The above works only if you use Enterprise or Education edition. If Professional, It will send required (Basic) data.
+
+If you read this article - [https://www.softscheck.com/en/blog/windows-10-enterprise-telemetry-analysis/](https://www.softscheck.com/en/blog/windows-10-enterprise-telemetry-analysis/), Enterprise even sends data even though telemetry is disabled. But there is no updated info about this available.
+
+Disabling full telemetry or sending basic data to Microsoft is totally upto the user's threat model.
+
+- [ ] Disable `Automatic Sample Submission` in Windows Defender, as the feature will send your files as a sample for Signature Database and might leak your data. You can do it via the below Group Policy so to not prompt you again and again constantly.
+
+    ```text
+    Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > MAPS > Send file samples when further analysis is required to Never Send.
+    ```
+
+- [ ] Disable Windows spotlight by navigating to `User Configuration` > `Administrative Templates` > `Windows Components` > `Cloud Content` and setting **Turn off all Windows Spotlight features** policy to enabled.
+
+<div class="admonition note" markdown>
+<p class="admonition-title">Note</p>
+
+This explicitly disables Windows spotlight features in Lockscreen and Desktop to sever unnecessary connections between Microsoft servers and the device.
+
+</div>
+
+- [ ] Disable Bing integration in Windows search, by navigating to `Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results`. This way your search queries for local indexed data is not sent to Microsoft.
+
+- [ ] Disable notification in the Lock screen in Windows settings
+    ![Lock screen notification](/docs/assets/img/windows/lock-screen-notifications.webp)
+
+- [ ] Disable Online Speech recognition and Voice activation
+        ![Alt text](/docs/docs/assets/img/windows/online-speech.webp)
+        ![Alt text](/docs/assets/img/windows/voice-activation.webp)
+
+- [ ] Disable delivery optimization in Windows Update settings.
+
+- Check all the App permissions and allow only necessary ones.
+
+## Hide MAC Address
+
+Go to `Settings` > `Network & Internet` > `Wifi`
+
+Enable **Random hardware addresses**
+
+## Restrict access to data drives
+
+To prevent other users from accessing your secondary data drives. Type `gpedit.msc` in Windows Run dialog box.
+
+Go to `User Configuration` > `Administrative Templates` > `Windows Components` > `File Explorer` and set the Group Policy as below.
+
+![Restrict-drive](/docs/assets/img/windows/drive-restriction.webp)
+
+The above configuration will restrict other users to the OS drive where Windows is installed. Making total isolation between your Account and other user account.
+
+If it's a shared drive with another person but you don't want the user to access sensitive data then use EFS. EFS encrypts the documents so that the user who encrypted it can only access it and not others.
+
+![EFS](/docs/assets/img/windows/EFS.gif)
+
+It is better to export the Private key certificate and store in a safe place so as to use the file later in other devices. To do so,
+
+Press, ++win+r++, Then type `certmgr.msc`, Under `Personal` > `Certificates`. Click the certificate that contains your username. Right Click and choose export. If you find this too tricky, then after using EFS for first time. You will see an encrypted locker Icon in system tray which help you in exporting on clicking it.
+
+To import in another device, simply open and install this certificate in that device and choose the above location. Then you can access EFS encrypted files in other system too.
+
+*[EFS]: Encrypted File System

docs/os/windows/sandboxing.md

@@ -0,0 +1,155 @@
+---
+title: Application Sandboxing
+icon: octicons/apps-16
+---
+
+## Native Application Sandboxing
+
+### Application Packaging by Windows
+
+Windows has two types of application packaging such as `.exe`/`.msi` (Win32) and `.appx`/`.msix` (UWA).
+
+#### Universal Windows Application (UWA)
+
+UWAs are processes that operate within the `AppContainer` is an application sandbox environment, which implements mechanisms for the restriction of `AppContainer` processes in terms of what system resources they can access. Basically, Application that is fully isolated and only given access to certain resources.
+
+#### Win32 Apps
+
+Win32 is the application platform of choice for developing and running classic Windows applications, that
+is, Win32 applications, that require direct access to Windows and hardware.
+
+The core of Win32 is the Win32 API implemented in the Windows SubDLLs (DLLs) and the ntdll.dll library file. With the combination of `SubDLLs` and `ntdll.dll`, the Win32 application has direct access to full system resources.
+
+#### A comparison between UWA and Win32
+
+| UWAs    | Windows |
+| :--------- | :---------------------------------- |
+|UWAs run as restricted, containerized `AppContainer` processes that run by accessing the WinRT API, a subset of COM functionalities and the Win32 API. They have specific properties that define process restrictions in terms of the system resources that processes can access.| Win32 applications run as Windows native, traditional processes that run by accessing the Win32 API and COM functionalities to their full extent and a subset of the WinRT API to directly access all system resources. They do not run as restricted processes, all system functionalities are by design directly available to them.|
+|Only a single instance of a given UWA may run at a given time. | Any number of instances of a given Win32 application may run simultaneously. |
+|UWAs are distributed as application packages, archive files with a pre-defined format and required content that is necessary for the deployment and operation of UWAs |The way in which Win32 applications are distributed is not restricted by the operating system. It is defined by the application vendors. |
+
+The above comparison gives a clear cut that UWA/UWP apps are the best ones to use in terms of sandboxing the app.
+
+### Choosing the way to install software
+
+UWA apps are primarily distributed through Microsoft store and are counter-signed by Microsoft while as third party UWA's are signed by the vendor without Microsoft's signature.
+
+It is recommended to use the UWA apps as they are sandboxed into their own containers.
+
+And for Win32 apps. If you are required to use Win32 apps. Install the application in the host and run it using [Windows Sandbox](/windows/sandboxing/#run-programs-instantly-in-sandbox).
+
+It is **recommended** to install in host and use in Sandbox to reduce your time installing the software again and again in Windows Sandbox.
+
+### Finding Win32 and UWP apps in Windows Store
+
+Generally, apps available in Microsoft store was UWP only before Windows 11 was launched but after the launch both Win32 and UWP apps co-exist in the store.
+
+At this point, it is difficult to differentiate between Win32 and UWP apps. To find which is UWP or Win32. Read below:
+
+When you see an app in store and scroll down to *Additional Information*  section and see if it asks for certain permissions like in the image below:
+
+![UWP in store](/assets/img/windows/UWP-in-MS-Store.webp)
+
+If the Win32 App, Microsoft store will explicitly state that it is Provided and Updated by `****`  and `Uses all System resources` as in the image below:
+
+![Win32 in store](/assets/img/windows/Win32-in-MS-Store.webp)
+
+<div class="admonition note" markdown>
+<p class="admonition-title">Un-sandboxed UWP apps</p>
+
+Some UWP apps in the store due to the lift of restrictions in Microsoft store developers can submit the app with a property named `runFullTrust` which disables sandboxing of that UWP application and shows that `Uses all System Resources` in *Additional Information* section such as Firefox. By this you can know if a UWP app is sandboxed or not.
+
+If it is sandboxed, it will show only certain permissions in *Additional Information* section.
+</div>
+
+<div class="admonition abstract" markdown>
+<p class="admonition-title">Note</p>
+
+Most apps will ask that if the app needs to be used for all users or just for your user account. It is best you keep the app to your user Account. So, We achieve better sandboxing between different user accounts.
+
+</div>
+
+#### Another way to find
+
+[rg-adguard.net](https://store.rg-adguard.net/) is a third party Microsoft store app which can be used to download `.appx` files (Installer for UWP) and install UWP apps. You can use this site to download Age Restricted apps in store and Install it. **Note** that paid apps don't work unless you connect a Microsoft Account.
+
+## Using Winget to Install Sofware
+
+Windows Package Manager winget command-line tool is bundled with Windows 11 and modern versions of Windows 10 by default as the App Installer.
+
+The winget command line tool enables users to discover, install, upgrade, remove and configure applications on Windows 10 and Windows 11 computers. This tool is the client interface to the Windows Package Manager service.
+
+More information here : [https://learn.microsoft.com/en-us/windows/package-manager/winget/](https://learn.microsoft.com/en-us/windows/package-manager/winget/)
+
+The Winget tool is a powerful tool to install apps that are safe, trusted and official ones. This should be used to avoid sketchy installers.
+
+Even you have apps installed via the traditional installer setup. You can continue using winget
+
+A Quick demo by ThioJoe - [https://youtu.be/uxr7m8wDeGA](https://youtu.be/uxr7m8wDeGA)
+
+Detailed info about the tool by Microsoft - [https://youtu.be/Lk1gbe_JTpY](https://youtu.be/Lk1gbe_JTpY)
+
+If you understood about Winget, then this tool - [https://winstall.app/](https://winstall.app/) is suggested to bulk install apps.
+
+Note : Be sure to install via Winget or using MSI installer to upgrade the app easily.
+
+### Benefits of winget
+
+There are general advantages in having a package manager regardless of the operating system.
+
+- Security : The packages that the package manager includes are usually safe because they’re verified by maintainers.
+- Automation : It’s easier to install or uninstall N applications using a package manager. No need to do it manually.
+- Maintenance : With a package manager usually you can update all your applications, including configurations.
+Exploration. Instead of searching manually in a browser for an application you can use the package manager. Since it’s centralized it should be easier to find what you want.
+
+## Windows Sandbox
+
+Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation. Software installed inside the Windows Sandbox environment remains "sandboxed" and runs separately from the host machine.
+
+The sandbox is temporary like TailsOS running on a USB drive. When it's closed, all the software and files and the state are deleted. You get a brand-new instance of the sandbox every time you open it.
+
+You can know more from the Official [Documentation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview).
+
+**Use case of Sandbox:** The Windows Sandbox can be used to run unknown software or if you want to isolate your Workspace from the host with only Specific set of apps, etc.
+
+### Using Sandbox
+
+To use Sandbox, you can create a configuration file as per the official Microsoft [Documentation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file) for your needs.
+
+So, when opening the file, sandbox opens with the Configurations you had set up in your file.
+
+If you do not understand the documentation, you can use [Windows Sandbox Editor](https://github.com/damienvanrobaeys/Windows_Sandbox_Editor) instead. It is a GUI application that can be used to create configuration files easily.
+
+<div class="admonition note" markdown>
+<p class="admonition-title">Regarding Windows Sandbox Editor</p>
+
+The repository doesn't provide a package. So, you need to download the whole codebase. After, extracting the zip Windows Defender or other Antivirus software may flag the [exe](https://github.com/damienvanrobaeys/Windows_Sandbox_Editor/tree/master/EXE) file as a malware. So, it is recommended to install it via the [Powershell Script](https://github.com/damienvanrobaeys/Windows_Sandbox_Editor/tree/master/Install%20on%20desktop%20(in%20case%20of%20issue%20with%20EXE)) they provide.
+
+By default, You cannot execute Scripts in Powershell and it is restricted to commands only. It is recommend you allow the Terminal to `Unrestricted` mode and use it to install the editor via Script after that change it back to `Restricted` [execution policy](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.2) to prevent accidental execution of malicious scripts in the future.
+
+</div>
+
+### Run programs instantly in Sandbox
+
+[Run in Sandbox](https://github.com/damienvanrobaeys/Run-in-Sandbox) is a tool to quickly run files in Windows Sandbox with a right click.
+
+We recommend you to use this software as it is convenient and easy to use and even credited by Microsoft.
+
+A full guide on How to use it can be found here: [https://www.systanddeploy.com/2021/11/run-in-sandbox-quick-way-to-runextract.html](https://www.systanddeploy.com/2021/11/run-in-sandbox-quick-way-to-runextract.html)
+
+Note: The same note of installing sandbox editor via PowerShell also applies here except this doesn't provide an `exe` at all.
+
+This page is based on the German BSI project - [SiSyPHuS Win10](https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendations/SiSyPHuS_Win10/SiSyPHuS_node.html)'s Work Package 9 Dcoument.
+
+**For Advanced Users :**
+
+Sandboxie Plus, is a Sandboxing tool which uses File system and registry Virtualization techniques to sandbox every apps and at the same data not being lost like Windows Sandbox.
+
+Use this at your own Risk !
+
+*[UWA]:Universal Windows Applications
+*[UWP]:Universal Windows Platform
+*[SubDLLs]: Subsystem Dynamic link libraries
+*[ntdll.dll]: A core Windows library file that implements functions for interaction with the kernel.
+*[WinRT]: Windows Runtime
+*[COM]: Component Object Model

docs/os/windows/windows-overview.md

@@ -0,0 +1,105 @@
+---
+title: Windows Overview
+icon: fontawesome/brands/microsoft
+---
+
+## Windows
+
+Windows is a proprietary operating system created by Microsoft Inc. in 1985. It is primarily focused on personal computing and is now the most popular desktop OS, used by about [75%](https://gs.statcounter.com/os-market-share/desktop/worldwide) of all desktop users. However, it has its own privacy and security issues.
+
+## Issues present in Windows
+
+Over the years, Microsoft has demonstrated a lot of privacy-invasive behaviour with their software and services. They have continually taken advantage of the fact that Windows is the most wide-used desktop OS, and that most people don't change the default settings, in order to collect users' personal information.
+
+Windows 10 was [criticized](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings) for having default settings that sent a lot of data and telemetry back to Microsoft, including:
+
+<div class="admonition quote" markdown>
+<p class="admonition-title">[Criticism of Microsoft - Wikipedia](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection)</p>
+
+User's contacts and calendar events, location data and history, "telemetry" (diagnostics data) ... and "advertising ID", as well as further data when the Cortana assistant is enabled.
+
+</div>
+
+At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. Only after [criticism](https://www.theverge.com/2016/7/21/12246266/france-microsoft-privacy-windows-10-cnil) from the France data protection commission, the [Electronic Frontier Foundation](https://www.eff.org/deeplinks/2016/08/windows-10-microsoft-blatantly-disregards-user-choice-and-privacy-deep-dive) and the [European Union](https://www.reuters.com/article/us-microsoft-dataprotection-eu-idUSKBN15Z1UI), Microsoft changed the way they collect telemetry, allowing users to choose between "Basic" (now renamed as `Required`) and "Full", with "Basic" mode collecting [much less telemetry](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects). Along with that, Microsoft collects a [lot more data from Windows 10](https://web.archive.org/web/20210711143017/https://privacytools.io/operating-systems/#win10).
+
+With the launch of Windows 11, a lot of [other](https://www.windowscentral.com/one-thing-microsoft-didnt-discuss-windows-11-privacy) [concerns](https://www.pcworld.com/article/539183/windows-11-review-an-unnecessary-replacement-for-windows-10.html) were raised, such as:
+
+- Integration of Microsoft Teams into the OS, which would encourage users to switch to the service, allowing Microsoft to collect even more data.
+- Removing the ability to have local accounts in Windows 11 Home, therefore forcing you to log into a Microsoft account so as to collect more data.
+- Having all data collection options on by default
+- Working with Amazon to bring Android apps to Windows through the Windows Subsystem for Android, likely allowing both Microsoft and Amazon to collect data about Android app usage on Windows.
+- Using users in a P2P way to distribute Windows updates to reduce load in Microsoft's servers without users' consent.
+
+## Choosing your Windows edition
+
+While using Windows, it is better to select either Windows **Enterprise** Edition or **Education** Edition because it gives more control over the system for hardening it for privacy and security by giving access to stops the OS from sending any Telemetry data using GP Editor.
+
+If you cannot get the above editions, you should opt for **Professional** Edition.
+
+### Editions to avoid
+
+- It is not recommended to use forks or modified versions of Windows such as Windows AME. It should be avoided at all cost. Since modified versions of Windows, such as AME, don't get updates, antivirus programs like Defender can fall out of date or be disabled entirely, opening you up to attacks.
+
+- Windows **Home** edition is **not** recommended as it does not have many advantages that Professional edition provides such as BitLocker Drive Encryption, Hyper-V, Windows Sandbox, etc. It also uploads Bitlocker Encryption keys to Microsoft servers which actually defies the aspect of the encryption implemented as the key was supposed to be hold by the user.
+
+#### Recommendations
+
+We recommend you choose Windows 11 over Windows 10 as it is the latest version and brings many security-related improvements with it by default such as [Secure Boot](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot), [VBS](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs), [HVCI](https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/device-guard-and-credential-guard), etc. Windows 10 will stop getting updates after [October 14, 2025](https://docs.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro).
+
+### Installing Windows
+
+We recommend that you use the official [Media Creation tool](https://www.microsoft.com/software-download/windows11) to flash the ISO to the USB, over third-party options such as Rufus, Balena Etcher, etc., so that you don't tamper the ISO.
+
+#### Downloading ISO
+
+To download the ISO. Follow these steps :
+
+- Download Media Creation tool under `Windows 11 Installation Media`
+- Open a Command prompt terminal in the directory where `mediacreationtool.exe` is downloaded.
+- And Input the following Command :
+
+    ```text
+    mediacreationtool.exe /Eula Accept /Retail /MediaArch x64 /MediaLangCode en-US /MediaEdition Enterprise
+    ```
+
+- If it asks for Activation key, Use this Generic Key `XGVPP-NMH47-7TTHJ-W3FW7-8HV2C`. This will just allow you to download the ISO but activation is totally upon the user.
+- Accept the UAC prompt
+- Download the ISO file or flash to a USB as you wish
+
+<div class="admonition note" markdown>
+<p class="admonition-title">Note</p>
+
+- The ISO will consists **only** of Professional, Education & Enterprise editions with a size of ~4.2 GB (Instead of >5.5GB when you download the Multi-Edition ISO). When you download using the above way, no other editions such as Home are included in it.
+- If you want to change the language of the ISO file, Just change the `en-US` part with the appropriate language and country code as per your needs.
+
+</div>
+
+### Activating Windows
+
+Activating Education/Enterprise edition is different because for Enterprise Edition it needs to be a part of an enterprise network or buying an enterprise License for several devices and use it for your one device & for Education Edition it needs to be a part of school network or managed by a school administrator.
+
+For activating Professional edition, you can buy the license key from resellers (not recommended) or the [Microsoft Store](https://www.microsoft.com/d/windows-11-pro/dg7gmgf0d8h4?rtc=1).
+
+If you are currently using Pro and want to upgrade to Enterprise. Then, Follow the guide [here](https://www.kapilarya.com/how-to-upgrade-windows-11-pro-to-enterprise-edition)
+
+<div class="admonition abstract" markdown>
+<p class="admonition-title">Note</p>
+
+This guide will be mostly on Windows 11 but some of the recommendations can be applied to Windows 10 too.
+
+</div>
+
+<div class="admonition danger" markdown>
+<p class="admonition-title">Warning</p>
+
+If you are going to install Windows 11, then install it only on supported devices. It is not recommended to use tools/scripts that are available online to bypass the requirements which would break the security of Windows 11 which it is aimed for.
+
+**Never** download *Pirated* ISO Files
+
+</div>
+
+*[GP]: Group Policy
+*[VBS]: Virtualization-Based Security
+*[HVCI]: Hypervisor-Protected Code Integrity
+*[AME]: Ameliorated
+*[P2P]: Peer-to-Peer

docs/real-time-communication.md

@@ -76,7 +76,7 @@ If you use Android and your threat model requires protecting against [:material-
 
 ![Molly logo](assets/img/messengers/molly.svg){ align=right }
 
-**Molly** is an alternative Signal client for Android which allows you to encrypt the local database with a passphrase at rest, to have unused RAM data securely shredded, to route your connection via Tor, and [more](https://blog.privacyguides.org/2022/07/07/signal-configuration-and-hardening#privacy-and-security-features). It also has usability improvements including scheduled backups, automatic locking, [UnifiedPush](https://unifiedpush.org) support, and the ability to use your Android phone as a linked device instead of the primary device for a Signal account.
+**Molly** is an alternative Signal client for Android which allows you to encrypt the local database with a passphrase at rest, to have unused RAM data securely shredded, to route your connection via Tor, and [more](https://blog.privacyguides.org/2022/07/07/signal-configuration-and-hardening#privacy-and-security-features). It also has usability improvements including scheduled backups, automatic locking, and the ability to use your Android phone as a linked device instead of the primary device for a Signal account.
 
 [:octicons-home-16: Homepage](https://molly.im){ .md-button .md-button--primary }
 [:octicons-eye-16:](https://signal.org/legal/#privacy-policy){ .card-link title="Privacy Policy" }
@@ -99,9 +99,11 @@ Molly is updated every two weeks to include the latest features and bug fixes fr
 
 Note that you are trusting multiple parties by using Molly, as you now need to trust the Signal team *and* the Molly team to deliver safe and timely updates.
 
-There is a version of Molly called **Molly-FOSS** which removes proprietary code like the Google services used by both Signal and Molly, at the expense of some features like battery-saving push notifications via Google Play Services. You can regain push notifications without Google Play Services in either version of Molly with [UnifiedPush](https://unifiedpush.org), but it requires running a separate program called [Mollysocket](https://github.com/mollyim/mollysocket) on another device to function. Mollysocket can either be self-hosted on a separate computer or server (VPS), or alternatively a public Mollysocket instance can be used ([step-by-step tutorial, in German](https://kuketz-blog.de/messenger-wechsel-von-signal-zu-molly-unifiedpush-mollysocket-ntfy)).
+There is a version of Molly called **Molly-FOSS** which removes proprietary code like the Google services used by both Signal and Molly, at the expense of some features like battery-saving push notifications via Google Play Services.
 
-All versions of Molly provide the same security improvements.
+There is also a version called [**Molly-UP**](https://github.com/mollyim/mollyim-android#unifiedpush) which is based on Molly-FOSS and adds support for push notifications with [UnifiedPush](https://unifiedpush.org), an open source alternative to the push notifications provided by Google Play Services, but it requires running a separate program called [Mollysocket](https://github.com/mollyim/mollysocket) to function. Mollysocket can either be self-hosted on a separate computer or server (VPS), or alternatively a public Mollysocket instance can be used ([step-by-step tutorial, in German](https://kuketz-blog.de/messenger-wechsel-von-signal-zu-molly-unifiedpush-mollysocket-ntfy)).
+
+All three versions of Molly provide the same security improvements.
 
 Molly and Molly-FOSS support [reproducible builds](https://github.com/mollyim/mollyim-android/tree/main/reproducible-builds), meaning it's possible to confirm that the compiled APKs match the source code.
 

includes/contributors.md

@@ -448,7 +448,6 @@
     </tr>
     <tr>
       <td align="center" valign="top" width="20%"><a rel="nofollow noopener noreferrer" href="https://github.com/bruch-alex"><img src="https://avatars.githubusercontent.com/u/173354246?v=4" width="100px;" loading=lazy /><br /><sub><b>Alex Bruch</b></sub></a><br /><a href="#translation-bruch-alex" title="Translation">🌍</a></td>
-      <td align="center" valign="top" width="20%"><a rel="nofollow noopener noreferrer" href="https://github.com/qiyongzheng"><img src="https://avatars.githubusercontent.com/u/153378707?v=4" width="100px;" loading=lazy /><br /><sub><b>qiyongzheng</b></sub></a><br /><a href="https://github.com/privacyguides/privacyguides.org/commits?author=qiyongzheng" title="Documentation">📖</a></td>
     </tr>
   </tbody>
   <tfoot>

mkdocs.yml

@@ -391,6 +391,9 @@ nav:
           - !ENV [NAV_OPERATING_SYSTEMS_WINDOWS, "Windows"]:
               - "os/windows/index.md"
               - "os/windows/group-policies.md"
+              - "os/windows/privacy.md"
+              - "os/windows/hardening.md"
+              - "os/windows/sandboxing.md"
   - !ENV [NAV_RECOMMENDATIONS, "Recommendations"]:
       - "tools.md"
       - !ENV [NAV_INTERNET_BROWSING, "Internet Browsing"]: