Split Android page into separate articles and update device recommendations (#1053)

Co-authored-by: Tad <8296104+SkewedZeppelin@users.noreply.github.com>

.gitattributes

@@ -1,2 +1,14 @@
 # Auto detect text files and perform LF normalization
 * text=auto
+
+docs/** -linguist-documentation
+.git* text
+*.json text
+*.js text
+*.md text linguist-detectable
+*.{yml,yaml} text
+*.{htm,html} text diff=html
+
+*.svg text
+*.png binary
+*.{jpeg,jpg} binary

.github/CODEOWNERS

@@ -1,21 +1,13 @@
 # Additional Co-Owners are added to the TOP of this file.
 
 # High-traffic pages
-/index.html @JonahAragon @dngray
-/blog.html @JonahAragon
+/docs/index.md @JonahAragon @dngray
+/theme/overrides/ @JonahAragon
 
-# Org/legal
-/notices.md @JonahAragon
-/privacy-policy.md @JonahAragon
+# Org
+/docs/about/ @JonahAragon
 LICENSE @JonahAragon
 
-# Website dev
-/_sass/ @JonahAragon
-/_layouts/ @JonahAragon
-Gemfile @JonahAragon
-Gemfile.lock @JonahAragon
-_config.yml @JonahAragon
-
 # Ops
 /.github/ @JonahAragon
 /.well-known/ @JonahAragon

.github/ISSUE_TEMPLATE/2_Website_Issues.md

@@ -1,7 +1,6 @@
 ---
 name: "Website Issue"
 about: Report a bug with the website. (NO CONTENT ISSUES)
-title: "Website Issue | "
 ---
 
 <!--

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,3 @@
-blank_issues_enabled: false
 contact_links:
   - name: Suggest a New Provider or Software
     url: https://github.com/privacyguides/privacyguides.org/discussions/new
@@ -9,3 +8,6 @@ contact_links:
   - name: Share an Idea
     url: https://github.com/privacyguides/privacyguides.org/discussions/new
     about: Suggest a new feature/section/page or anything else for the website.
+  - name: Report a Translation Issue
+    url: https://crowdin.com/project/privacyguides/discussions
+    about: Please report an issue with website translations on Crowdin.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,4 @@
-<!-- Submitting a PR? Awesome!! -->
-
-## Description
+<!-- Please use a descriptive title for your PR, it will be included in our changelog -->
 
 Resolves: # <!-- Did you solve an open GitHub issue? Put the number here so we mark it complete! -->
 

.github/workflows/build.yml

@@ -1,46 +0,0 @@
-name: Build Website
-on:
-  pull_request:
-    branches:
-      - main
-
-env:
-  PYTHON_VERSION: 3.x
-
-jobs:
-  build:
-    name: Build website
-    runs-on: ubuntu-latest
-    steps:
-
-      - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Set up Python runtime
-        uses: actions/setup-python@v3
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-      
-      - name: Cache files
-        uses: actions/cache@v3.0.1
-        with:
-          key: ${{ github.ref }}
-          path: .cache
-
-      - name: Install Python dependencies
-        run: |
-          pip install mkdocs
-          pip install mkdocs-material
-
-      - name: Build website
-        run: |
-          mkdocs build
-          mv .well-known site/
-          tar cvf site.tar site
-          mkdocs --version
-
-      - name: Package website
-        uses: actions/upload-artifact@v3
-        with:
-          name: generated-site
-          path: site.tar

.github/workflows/crowdin.yml

@@ -0,0 +1,27 @@
+name: Crowdin Upload
+
+on:
+  push:
+    branches: [ main ]
+
+jobs:
+  synchronize-with-crowdin:
+    runs-on: ubuntu-latest
+
+    steps:
+
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    - name: crowdin action
+      uses: crowdin/github-action@1.4.8
+      with:
+        upload_sources: true
+        upload_sources_args: '--auto-update --delete-obsolete'
+        upload_translations: false
+        download_translations: false
+        config: crowdin.yml
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+        CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

.github/workflows/deploy.yml

@@ -1,8 +1,8 @@
 name: Deploy Website
 on:
-  push:
-    branches:
-      - main
+  workflow_dispatch:
+  release:
+    types: [published]
 
 env:
   PYTHON_VERSION: 3.x
@@ -22,7 +22,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
       
       - name: Cache files
-        uses: actions/cache@v3.0.1
+        uses: actions/cache@v3.0.2
         with:
           key: ${{ github.ref }}
           path: .cache
@@ -30,18 +30,19 @@ jobs:
       - name: Install Python dependencies
         run: |
           pip install 'mkdocs>=1.3.0'
+          pip install mkdocs-static-i18n
 
       - name: Install mkdocs-material Insiders build
         if: github.event.repository.fork == false
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
         run: |
-          git clone --depth 1 https://${GH_TOKEN}@github.com/squidfunk/mkdocs-material-insiders.git
+          git clone --depth 1 https://${GH_TOKEN}@github.com/privacyguides/mkdocs-material-insiders.git
           pip install -e mkdocs-material-insiders
 
       - name: Build website
         run: |
-          mkdocs build --config-file mkdocs.production.yml
+          mkdocs build
           mv .well-known site/
           tar cvf site.tar site
           mkdocs --version

Pipfile

@@ -6,6 +6,7 @@ name = "pypi"
 [packages]
 mkdocs = "*"
 mkdocs-material = {path = "./mkdocs-material"}
+mkdocs-static-i18n = "*"
 
 [dev-packages]
 scour = "*"

Pipfile.lock

@@ -1,7 +1,7 @@
 {
     "_meta": {
         "hash": {
-            "sha256": "18f7bfb9a1d405016b6c63e1253e974e974d3e67b8e8a6b98d132ac1e780c822"
+            "sha256": "57e0161a7d6dbb050b1a0ab71eaaf145b951010f8a3054dfab1c5f24d4a293cf"
         },
         "pipfile-spec": 6,
         "requires": {
@@ -305,6 +305,13 @@
             "markers": "python_version >= '3.6'",
             "version": "==1.0.3"
         },
+        "mkdocs-static-i18n": {
+            "hashes": [
+                "sha256:0d97df64b5be7b34dc112d4ccfba28352b9fccd1b7a3babf229f30d25f6ebb36"
+            ],
+            "index": "pypi",
+            "version": "==0.44"
+        },
         "packaging": {
             "hashes": [
                 "sha256:dd47c42927d89ab911e606518907cc2d3a1f38bbd026385970643f9c5b8ecfeb",

README.md

@@ -34,13 +34,49 @@
   </a>
   <a href="https://github.com/privacyguides/privacyguides.org/pulls?q=is%3Apr+is%3Aclosed">
     <img src="https://img.shields.io/github/issues-pr-closed-raw/privacyguides/privacyguides.org">
+  </a>
+  <a href="https://crowdin.com/project/privacyguides">
+    <img src="https://badges.crowdin.net/privacyguides/localized.svg">
   </a></p>
 </div>
 
+## About
+
+**Privacy Guides** is a socially motivated website that provides information for protecting your data security and privacy. We are a non-profit collective operated entirely by volunteer team members and contributors.
+
+Our current list of team members can be found [here](https://github.com/orgs/privacyguides/people). Additionally, [many people](https://github.com/privacyguides/privacyguides.org/graphs/contributors) have made contributions to the project, and you can too!
+
+## Contributing
+
+- 💬 [Start a discussion or suggest an idea](https://github.com/privacyguides/privacyguides.org/discussions)
+- 💖 [Sponsor the project](https://github.com/sponsors/privacyguides)
+- 🈴 [Help translate the site](https://crwd.in/privacyguides) [[Matrix chat](https://matrix.to/#/#pg-i18n:aragon.sh)]
+- 📝 Edit the site, everything's accessible in this repo
+  - Browse our [open issues](https://github.com/privacyguides/privacyguides.org/issues) to see what needs to be updated
+  - View some contribution tips on our [contributor's wiki](https://github.com/privacyguides/privacyguides.org/wiki)
+
 ## Developing
 
-1. Clone this repository: `git clone https://github.com/privacyguides/privacyguides.org`
+1. Clone this repository and submodules: `git clone --recurse-submodules https://github.com/privacyguides/privacyguides.org`
 2. Install [Python 3.6+](https://www.python.org/downloads/)
-3. Install [mkdocs-material](https://squidfunk.github.io/mkdocs-material/getting-started/): `pip install mkdocs-material`
-4. Serve the site locally: `mkdocs serve`
-    - The site will be available at `http://localhost:8000/`.
+3. Install **pipenv**: `pip install pipenv`
+4. Start a pipenv shell: `pipenv shell`
+5. Install dependencies: `pipenv install --dev`
+6. Serve the site locally: `mkdocs serve --config-file mkdocs.production.yml`
+    - The site will be available at `http://localhost:8000`
+    - You can build the site locally with `mkdocs build --config-file mkdocs.production.yml`
+    - This version of the site should be identical to the live, production version
+
+## Releasing
+
+1. Create a new tag: `git tag -s v2.X.X -m 'Some message'`
+    - [View existing tags](https://github.com/privacyguides/privacyguides.org/tags)
+    - Tag [numbering](https://semver.org/): Increment the MINOR (2nd) number when making significant changes (adding/deleting pages, etc.), increment the PATCH (3rd) number when making minor changes (typos, bug fixes). Probably leave the MAJOR number at 2 until a massive redesign (v1 -> v2 was the Jekyll to MkDocs transition).
+2. Push the tag to GitHub: `git push --tags`
+3. [Create a new release](https://github.com/privacyguides/privacyguides.org/releases/new) selecting the new tag
+    - Title the release the same as the tag version number without the `v`, i.e. `2.X.X`
+      - For more significant releases, add a **short** title, for example [2.3.0 - Localization Support](https://github.com/privacyguides/privacyguides.org/releases/tag/v2.3.0) or [2.2.0 - Removing Social Networks](https://github.com/privacyguides/privacyguides.org/releases/tag/v2.2.0)
+    - GitHub should let you auto-generate release notes based on PR titles
+      - Mark more significant changes in bold, see [2.3.0](https://github.com/privacyguides/privacyguides.org/releases/tag/v2.3.0) for example
+4. Publish release, it will be deployed to the live site automatically
+    - When publishing more significant releases (generally any with a MINOR version increment) check the "Create a discussion for this release" box to post an announcement

crowdin.yml

@@ -0,0 +1,14 @@
+project_id_env: CROWDIN_PROJECT_ID
+api_token_env: CROWDIN_PERSONAL_TOKEN
+"preserve_hierarchy": true
+files:
+- source: "/docs/**/*.en.*"
+  translation: "/docs/**/%file_name%.%locale_with_underscore%.%file_extension%"
+  translation_replace:
+    "en.": ""
+  update_option: update_as_unapproved
+- source: "/theme/overrides/*.en.html"
+  translation: "/theme/overrides/%file_name%.%locale_with_underscore%.html"
+  translation_replace:
+    "en.": ""
+  update_option: update_as_unapproved

docs/about/notices.en.md

@@ -1,8 +1,5 @@
 ---
-layout: page
-permalink: /terms-and-notices/
 title: "Notices and Disclaimers"
-description: "Privacy Guides is provided with good intentions on an "as-is" basis, without warranty, and disclaiming liability for damages."
 icon: material/message-alert
 hide:
     - toc
@@ -30,7 +27,7 @@ Portions of this notice itself were adopted from [opensource.guide](https://gith
 
 This means that you can use the human-readable content in this repository for your own project, per the terms outlined in the CC0 1.0 Universal text. You **may not** use the Privacy Guides branding in your own project without express approval from this project. Privacy Guides's brand trademarks include the "Privacy Guides" wordmark and shield logo.
 
-We believe that the logos and other images in `assets` obtained from third-party providers are either in the public domain or **fair use**. In a nutshell, legal [fair use doctrine](https://en.wikipedia.org/wiki/Fair_use) allows the use of copyrighted image in order to identify the subject matter for purposes of public comment. However, these logos and other images may still be subject to trademark laws in one or more jurisdictions. Before using this content, please ensure that it is used to identify the entity or organization that owns the trademark and that you have the right to use it under the laws which apply in the circumstances of your intended use. *When copying content from this website, you are solely responsible for ensuring that you do not infringe someone else's trademark or copyright.*
+We believe that the logos and other images in `assets` obtained from third-party providers are either in the public domain or **fair use**. In a nutshell, legal [fair use doctrine](https://en.wikipedia.org/wiki/Fair_use) allows the use of copyrighted images in order to identify the subject matter for purposes of public comment. However, these logos and other images may still be subject to trademark laws in one or more jurisdictions. Before using this content, please ensure that it is used to identify the entity or organization that owns the trademark and that you have the right to use it under the laws which apply in the circumstances of your intended use. *When copying content from this website, you are solely responsible for ensuring that you do not infringe someone else's trademark or copyright.*
 
 When you contribute to this repository you are doing so under the above licenses.
 

docs/about/privacy-policy.en.md

@@ -1,8 +1,5 @@
 ---
-layout: page
-permalink: /privacy-policy/
 title: "Privacy Policy"
-description: "This Privacy Statement explains what information Privacy Guides and its related entities collect about its users, what we do with that information, and how we handle the content you place in our products and services."
 icon: material/file-search
 ---
 
@@ -101,6 +98,6 @@ For complaints under GDPR more generally, European Union users may lodge complai
 
 This version of our privacy statement took effect April 4th, 2022.
 
-We will post any new versions of this statement [here](/about/privacy-policy). We may change how we announce changes in future versions of this document. In the meantime we may update our contact information at any time without announcing a change. Please refer to the [Privacy Policy](/about/privacy-policy) for the latest contact information at any time.
+We will post any new versions of this statement [here](privacy-policy.en.md). We may change how we announce changes in future versions of this document. In the meantime we may update our contact information at any time without announcing a change. Please refer to the [Privacy Policy](privacy-policy.en.md) for the latest contact information at any time.
 
-A full revision [history](https://github.com/privacyguides/privacyguides.org/commits/main/docs/about/privacy-policy.md) of this page can be found on GitHub.
+A full revision [history](https://github.com/privacyguides/privacyguides.org/commits/main/docs/about/privacy-policy.en.md) of this page can be found on GitHub.

docs/android.en.md

@@ -0,0 +1,326 @@
+---
+title: "Android"
+icon: 'fontawesome/brands/android'
+---
+
+These are the Android operating systems, devices, and apps we recommend to maximize your mobile device's security and privacy. We also have additional Android-related information:
+
+- [General Android Overview and Recommendations :material-arrow-right:](android/overview.md)
+- [Android Security and Privacy Features :material-arrow-right:](android/security.md)
+- [GrapheneOS vs CalyxOS Comparison :material-arrow-right:](android/grapheneos-vs-calyxos.md)
+
+## AOSP Derivatives
+
+Generally speaking we recommend installing one of these custom Android operating systems on your device, listed in order of preference, depending on your device's compatibility with these operating systems. If you are unable to run any of the following operating systems on your device, you are likely going to be best off sticking with your stock Android installation (as opposed to an operating system not listed here such as LineageOS), but we would recommend upgrading to a new device if at all possible.
+
+!!! note
+
+    End-of-life devices (such as GrapheneOS or CalyxOS's "extended support" devices) do not have full security patches (firmware updates) due to the original equipment manufacturer (OEM) discontinuing support. These devices cannot be considered completely secure regardless of installed software.
+
+### GrapheneOS
+
+!!! recommendation
+
+    ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ align=right }
+    ![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ align=right }
+
+    **GrapheneOS** is the best choice when it comes to privacy and security.
+
+    GrapheneOS provides additional [security hardening](https://en.wikipedia.org/wiki/Hardening_(computing)) and privacy improvements. It has a [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), network and sensor permissions, and various other [security features](https://grapheneos.org/features). GrapheneOS also comes with full firmware updates and signed builds, so [verified boot](https://source.android.com/security/verifiedboot) is fully supported.
+
+    [Visit grapheneos.org](https://grapheneos.org/){ .md-button .md-button--primary } [Privacy Policy](https://grapheneos.org/faq#privacy-policy){ .md-button }
+
+Notably, GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play). Google Play Services can be run fully sandboxed like a regular user app and contained in a work profile or user [profile](#android-security-privacy) of your choice. This means that you can run apps dependant on Play Services, such as those that require push notifications using Google's [Firebase Cloud Messaging](https://firebase.google.com/docs/cloud-messaging/) service. GrapheneOS allows you to take advantage of most [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) whilst having full user control over their permissions and access.
+
+Currently, only [Pixel phones](https://grapheneos.org/faq#device-support) meet its hardware security requirement and are supported.
+
+### CalyxOS
+
+!!! recommendation
+
+    ![CalyxOS logo](assets/img/android/calyxos.svg){ align=right }
+
+    **CalyxOS** is a system with some privacy features on top of AOSP, including [Datura](https://calyxos.org/docs/tech/datura-details) firewall, [Signal](https://signal.org) integration in the dialer app, and a built in panic button. CalyxOS also comes with firmware updates and signed builds, so [verified boot](https://source.android.com/security/verifiedboot) is fully supported.
+
+    [Visit calyxos.org](https://calyxos.org/){ .md-button .md-button--primary } [Privacy Policy](https://calyxinstitute.org/legal/privacy-policy){ .md-button }
+
+To accomodate users who need Google Play Services, CalyxOS optionally includes [MicroG](https://microg.org/). With MicroG, CalyxOS also bundles in the [Mozilla](https://location.services.mozilla.com/) and [DejaVu](https://github.com/n76/DejaVu) location services.
+
+Currently, CalyxOS only supports [Pixel phones](https://calyxos.org/docs/guide/device-support/).
+
+### DivestOS
+
+!!! recommendation
+
+    ![DivestOS logo](assets/img/android/divestos.svg){ align=right }
+
+    **DivestOS** is a [soft-fork](https://en.wikipedia.org/wiki/Fork_(software_development)#Forking_of_free_and_open-source_software) of [LineageOS](https://lineageos.org/).
+    DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
+
+    [Visit divestos.org](https://divestos.org){ .md-button .md-button--primary } [Privacy Policy](https://divestos.org/index.php?page=privacy_policy){ .md-button }
+
+DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, a custom [hosts](https://divested.dev/index.php?page=dnsbl) file, and [F-Droid](https://www.f-droid.org) as the app store. It includes [UnifiedNlp](https://github.com/microg/UnifiedNlp) for network location. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and includes [network state partitioning](https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning).
+
+DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747/) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled.
+
+DivestOS 16.0, 17.1, and 18.1 implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and 18.1 feature GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, and [`ptrace_scope`](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features). All branches additionally have various miscellaneous patches courtesy of GrapheneOS.
+
+!!! attention
+
+    DivestOS firmware update [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) varies across the devices it supports. For Pixel phones, we still recommend using GrapheneOS or CalyxOS. For other supported devices, DivestOS is a good alternative.
+
+    Not all of the supported devices have [verified boot](https://source.android.com/security/verifiedboot), and some perform it better than others.
+
+## Android Devices
+
+Avoid buying phones from mobile network operators. These often have a **locked bootloader** and do not support [OEM unlocking](https://source.android.com/devices/bootloader/locking_unlocking). These phone variants will prevent you from installing any kind of alternative Android distribution.
+
+Be very **careful** about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen there's a possibility of [IMEI blacklisting](https://www.gsma.com/security/resources/imei-blacklisting/). There is also a risk involved with you being associated with the activity of the previous owner.
+
+A few more tips regarding Android devices and operating system compatibility:
+
+- Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.
+- Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper [Verified Boot](https://source.android.com/security/verifiedboot) support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
+- In short, if a device or Android distribution is not listed here, there is probably a good reason, so check our [discussions](https://github.com/privacyguides/privacyguides.org/discussions) page.
+
+### Google Pixel
+
+!!! recommendation
+
+    ![Google Pixel 6](assets/img/android/google-pixel.png){ align=right }
+
+    **Google Pixel** devices are known to have good security and properly support [Verified Boot](https://source.android.com/security/verifiedboot), even when installing custom operating systems.
+
+    Beginning with the **Pixel 6** and **6 Pro**, Pixel devices receive a minimum of 5 years of guaranteed security updates, ensuring a much longer lifespan compared to the 2-4 years competing OEMs typically offer.
+
+    [Visit store.google.com](https://store.google.com/category/phones){ .md-button .md-button--primary }
+
+Unless you know you have a specific need for [CalyxOS/microG features](https://calyxos.org/features/) that are unavailable on GrapheneOS, we strongly recommend GrapheneOS over other operating system choices on Pixel devices.
+
+[More about GrapheneOS vs CalyxOS](android/grapheneos-vs-calyxos.md){ .md-button }
+
+The installation of GrapheneOS on a Pixel phone is easy with their [web installer](https://grapheneos.org/install/web). If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the [NitroPhone](https://shop.nitrokey.com/shop) as they come preloaded with GrapheneOS from the reputable [Nitrokey](https://www.nitrokey.com/about) company.
+
+A few more tips for purchasing a Google Pixel:
+
+- If you're after a bargain on a Pixel device, we suggest buying an "**a**" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
+- Consider price beating options and specials offered at [brick and mortar](https://en.wikipedia.org/wiki/Brick_and_mortar) stores.
+- Look at online community bargain sites in your country. These can alert you to good sales.
+- Google provides a list showing the [support cycle](https://support.google.com/nexus/answer/4457705) for each one of their devices. The price per day for a device can be calculated as: $\text{Cost} \over \text {EoL Date }-\text{ Current Date}$, meaning that the longer use of the device the lower cost per day.
+
+### Other Devices
+
+!!! important
+
+    Google Pixel phones are the only devices which are fully supported by all of our recommended Android distributions. Additionally, Pixel devices have stronger hardware security than any other Android device currently on the market, due to Google's custom Titan security chips acting as the Secure Element for secrets storage and rate limiting. Secure Elements are more limited and have a smaller attack surface than the Trusted Execution Environment (TEE), which is also used to run "trusted" programs. Most other phones do not have a Secure Element and have to using the TEE for both secrets storage, rate limiting, and trusted computing."
+
+If you are unable to purchase a Pixel device, any device which is supported by CalyxOS should be reasonably secure and private enough for most users after installing CalyxOS.
+
+In any case, when purchasing a device we recommend getting one as new as possible. The software and firmware of mobile devices are only supported for a limited time, so buying new extends that lifespan as much as possible. 
+
+We do not recommend the following devices over a Google Pixel device, but we do have some notes on devices from other manufacturers:
+
+#### OnePlus
+
+If you are unable to obtain a Google Pixel, recent OnePlus devices provide a good balance of security with custom operating systems and longevity, with OnePlus 8 and later devices receiving 4 years of security updates. CalyxOS has [experimental support](https://calyxos.org/news/2022/04/01/fairphone4-oneplus8t-oneplus9-test-builds/) for the **OnePlus 8T** and **9**.
+
+DivestOS has support for most OnePlus devices up to the **OnePlus 7T Pro**, with varying levels of support.
+
+#### Fairphone
+
+!!! danger
+
+    Out of the box, Fairphone devices are incredibly insecure. [Fairphone's stock bootloader trusts the public AVB signing key](https://forum.fairphone.com/t/bootloader-avb-keys-used-in-roms-for-fairphone-3-4/83448/11), meaning any system can be installed and the phone will trust it as if it is the stock system. This essentially breaks verified boot on a stock Fairphone device.
+
+    This problem is solved when you install a custom operating system such as CalyxOS or DivestOS and trust the developer's signing keys rather than the stock system's. To reiterate, **you must install a custom operating system with custom boot keys to use Fairphone devices in a secure manner.**
+
+CalyxOS has [experimental support](https://calyxos.org/news/2022/04/01/fairphone4-oneplus8t-oneplus9-test-builds/) for the **Fairphone 4**. DivestOS has builds available for the **Fairphone 3**.
+
+While Fairphone markets their devices as receiving 6 years of support, the SOC (Qualcomm Snapdragon 750G on the Fairphone 4) has a considerably sooner EOL date. This means that firmware security updates from Qualcomm for the Fairphone 4 will end in September 2023, regardless of whether Fairphone continues to release software security updates.
+
+## General Apps
+
+### Orbot
+
+!!! recommendation
+
+    ![Orbot logo](assets/img/android/orbot.svg){ align=right }
+
+    **Orbot** is a free proxy app that routes your connections through the Tor Network.
+
+    [Visit orbot.app](https://orbot.app/){ .md-button .md-button--primary }
+
+    **Downloads**
+    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=org.torproject.android)
+    - [:pg-f-droid: F-Droid](https://guardianproject.info/fdroid)
+    - [:fontawesome-brands-github: GitHub](https://github.com/guardianproject/orbot)
+    - [:fontawesome-brands-gitlab: GitLab](https://gitlab.com/guardianproject/orbot)
+
+Orbot can proxy individual apps if they support SOCKS or HTTP proxying. It can also proxy all your network connections using [VpnService](https://developer.android.com/reference/android/net/VpnService) and can be used with the VPN killswitch (⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN).
+
+For resistance against traffic analysis attacks, consider enabling *Isolate Destination Address* ( ⁝ →Settings → Connectivity). This will use a completely different Tor Circuit (different middle relay and exit nodes) for every domain you connect to.
+
+!!! attention
+
+    Orbot is often outdated on the Guardian Project's [F-Droid repository](https://guardianproject.info/fdroid) and [Google Play](https://play.google.com/store/apps/details?id=org.torproject.android) so consider downloading directly from the [GitHub repository](https://github.com/guardianproject/orbot) instead.
+
+    All versions are signed using the same signature so they should be compatible with each other.
+
+### Shelter
+
+!!! recommendation
+
+    ![Shelter logo](assets/img/android/shelter.svg){ align=right }
+
+    **Shelter** is an app that helps you leverage the Android work profile to isolate other apps.
+
+    Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager ([DocumentsUI](https://source.android.com/devices/architecture/modular-system/documentsui)).
+
+    [Visit gitea.angry.im](https://gitea.angry.im/PeterCxy/Shelter){ .md-button .md-button--primary }
+
+    **Downloads:**
+    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=net.typeblog.shelter)
+    - [:pg-f-droid: F-Droid](https://f-droid.org/en/packages/net.typeblog.shelter)
+    - [:fontawesome-brands-github: GitHub](https://github.com/PeterCxy/Shelter)
+    - [:fontawesome-brands-git-alt: Source](https://gitea.angry.im/PeterCxy/Shelter)
+
+!!! attention
+
+    As CalyxOS includes a device controller, we recommend using their built in work profile instead.
+
+    Shelter is recommended over [Insular](https://secure-system.gitlab.io/Insular/) and [Island](https://github.com/oasisfeng/island) as it supports [contact search blocking](https://secure-system.gitlab.io/Insular/faq.html).
+
+    When using Shelter, you are placing complete trust in its developer as Shelter would be acting as a [Device Admin](https://developer.android.com/guide/topics/admin/device-admin) for the work profile and has extensive access to the data stored within it.
+
+### Auditor
+
+!!! recommendation
+
+    ![Auditor logo](assets/img/android/auditor.svg#only-light){ align=right }
+    ![Auditor logo](assets/img/android/auditor-dark.svg#only-dark){ align=right }
+
+    **Auditor** is an app which leverages hardware security features to provide device integrity monitoring for [supported devices](https://attestation.app/about#device-support). Currently it works with GrapheneOS and the device's stock operating system.
+
+    [Visit attestation.app](https://attestation.app){ .md-button .md-button--primary }
+
+    **Downloads:**
+    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=app.attestation.auditor)
+    - [:fontawesome-brands-github: GitHub](https://github.com/GrapheneOS/Auditor)
+
+Auditor performs attestation and intrusion detection by:
+
+- Using a [Trust On First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) model between an *auditor* and *auditee*, the pair establish a private key in the [hardware-backed keystore](https://source.android.com/security/keystore/) of the *Auditor*.
+- The *auditor* can either be another instance of the Auditor app or the [Remote Attestation Service](https://attestation.app).
+- The *auditor* records the current state and configuration of the *auditee*.
+- Should tampering with the operating system of the *auditee* after the pairing is complete, the auditor will be aware of the change in the device state and configurations.
+- The user will be alerted to the change.
+
+No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring.
+
+If your [threat model](threat-modeling.md) requires privacy you could consider using Orbot or a VPN to hide your IP address from the attestation service.
+To make sure that your hardware and operating system is genuine, [perform local attestation](https://grapheneos.org/install/web#verifying-installation) immediately after the device has been installed and prior to any internet connection.
+
+### Secure Camera
+
+!!! recommendation
+
+    ![Secure camera logo](assets/img/android/secure_camera.svg#only-light){ align=right }
+    ![Secure camera logo](assets/img/android/secure_camera-dark.svg#only-dark){ align=right }
+
+      **Secure Camera** is an camera app focused on privacy and security which can capture images, videos, and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices.
+
+    [Visit github.com](https://github.com/GrapheneOS/Camera){ .md-button .md-button--primary }
+
+    **Downloads:**
+    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.camera.play)
+    - [:fontawesome-brands-github: GitHub](https://github.com/GrapheneOS/Camera/releases)
+
+Main privacy features include:
+
+- Auto removal of [Exif](https://en.wikipedia.org/wiki/Exif) metadata (enabled by default)
+- Use of the new [Media](https://developer.android.com/training/data-storage/shared/media) API, therefore [storage permissions](https://developer.android.com/training/data-storage) are not required
+- Microphone permission not required unless you want to record sound
+
+!!! note
+
+    Metadata is not currently deleted from video files but that is planned.
+
+    The image orientation metadata is not deleted. If you enable location (in Secure Camera) that **won't** be deleted either. If you want to delete that later you will need to use an external app such as [Scrambled Exif](https://gitlab.com/juanitobananas/scrambled-exif/).
+
+### Secure PDF Viewer
+
+!!! recommendation
+
+    ![Secure PDF Viewer logo](assets/img/android/secure_pdf_viewer.svg#only-light){ align=right }
+    ![Secure PDF Viewer logo](assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ align=right }
+
+    **Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [webview](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files.
+
+    [Content-Security-Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) is used to enforce that the JavaScript and styling properties within the WebView are entirely static content.
+
+    [Visit github.com](https://github.com/GrapheneOS/PdfViewer){ .md-button .md-button--primary }
+
+    **Downloads:**
+    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.pdfviewer.play)
+    - [:fontawesome-brands-github: GitHub](https://github.com/GrapheneOS/PdfViewer/releases)
+
+### PrivacyBlur
+
+!!! recommendation
+
+    ![PrivacyBlur logo](assets/img/android/privacyblur.svg){ align=right }
+
+    **PrivacyBlur** is a free app which can blur sensitive portions of pictures before sharing them online.
+
+    [Visit privacyblur.app](https://privacyblur.app/){ .md-button .md-button--primary }
+
+    **Downloads:**
+    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=de.mathema.privacyblur)
+    - [:pg-f-droid: F-Droid](https://f-droid.org/en/packages/de.mathema.privacyblur/)
+    - [:fontawesome-brands-github: GitHub](https://github.com/MATHEMA-GmbH/privacyblur)
+
+!!! warning
+
+    You should **never** use blur to redact [text in images](https://bishopfox.com/blog/unredacter-tool-never-pixelation). If you want to redact text in an image, draw a box over the text. For this we suggest [Pocket Paint](https://github.com/Catrobat/Paintroid) or [Imagepipe](https://codeberg.org/Starfish/Imagepipe).
+
+## App Stores
+
+### GrapheneOS's App Store
+
+GrapheneOS's app store is available on [GitHub](https://github.com/GrapheneOS/Apps/releases). It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the [Auditor](https://attestation.app/), [Camera](https://github.com/GrapheneOS/Camera), and [PDF Viewer](https://github.com/GrapheneOS/PdfViewer). If you are looking for these applications, we highly recommend that you get them from GrapheneOS's app store instead of the Play Store, as the apps on their store are signed by the GrapheneOS's project own signature that Google does not have access to.
+
+### Aurora Store
+
+The Google Play Store requires a Google account to login which is not great for privacy. The [Aurora Store](https://auroraoss.com/download/AuroraStore/) (a Google Play Store proxy) does not, and works most of the time.
+
+### F-Droid
+
+F-Droid is often recommended as an alternative to Google Play, particularly in the privacy community. The option to add third party repositories and not be confined to Google's [walled garden](https://en.wikipedia.org/wiki/Closed_platform) has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds/) for some applications, and is dedicated to free and open source software. However, there are problems with the official F-Droid client, their quality control, and how they build, sign and deliver packages, outlined in this [post](https://wonderfall.dev/fdroid-issues/).
+
+Sometimes the official F-Droid repository may fall behind on updates. F-Droid maintainers reuse package IDs while signing apps with their own keys, which is not ideal as it does give the F-Droid team ultimate trust. The Google Play version of some apps may contain unwanted telemetry or lack features that are available in the F-Droid version.
+
+We have these general tips:
+
+- Check if the app developers have their own F-Droid repository first, e.g. [Bitwarden](https://bitwarden.com/), [Samourai Wallet](https://www.samouraiwallet.com/), or [Newpipe](https://newpipe.net/), which have their own repositories with less telemetry, additional features or faster updates. This is the ideal situation and you should be using these repositories if possible.
+- Check if an app is available on the [IzzyOnDroid](https://apt.izzysoft.de/fdroid/) repository. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. We recommend that you download the GitHub builds and install them manually first, then use IzzyOnDroid for any subsequent updates. This will ensure that the signature of the applications you get from IzzyOnDroid matches that of the developer and the packages have not been tampered with.
+- Check if there are any differences between the F-Droid version and the Google Play Store version. Some applications like [IVPN](https://www.ivpn.net/) do not include certain features (eg [AntiTracker](https://www.ivpn.net/knowledgebase/general/antitracker-faq/)) in their Google Play Store build out of fear of censorship by Google.
+
+Evaluate whether the additional features in the F-Droid build are worth the slower updates. Also think about whether faster updates from the Google Play Store are worth the potential privacy issues in your [threat model](threat-modeling.md).
+
+#### Droid-ify
+
+The official F-Droid client targets a [low API level](https://wonderfall.dev/fdroid-issues/#3-low-target-api-level-sdk-for-client--apps) and does not utilize the [seamless updates](https://www.androidcentral.com/google-will-finally-bring-seamless-app-updates-alternative-app-stores-android-12) feature introduced in Android 12. Targeting lower API levels means that the F-Droid client cannot take advantage of the new improvements in the application sandboxes that comes with higher API levels. For automatic updates to work, the F-Droid client requires that the [Privileged Extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged/) be included in the operating system, granting it more privileges than what a normal app would have, which is not great for security.
+
+To mitigate these problems, we recommend [Droid-ify](https://github.com/Iamlooker/Droid-ify) as it supports seamless updates on Android 12 and above without needing any special privileges and targets a higher API level.
+
+!!! recommendation
+
+    ![Droid-ify logo](assets/img/android/droid-ify.png){ align=right }
+
+    **Droid-ify** is a modern F-Droid client made with MaterialUI, forked from [Foxy Droid](https://github.com/kitsunyan/foxy-droid).
+
+    Unlike the official F-Droid client, Droid-ify supports seamless updates on Android 12 and above without the need for a privileged extension. If your Android distribution is on Android 12 or above and does not include the [F-Droid privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged/), it is highly recommended that you use Droid-ify instead of the official client.
+
+    **Downloads:**
+    - [:fontawesome-brands-android: APK Download](https://android.izzysoft.de/repo/apk/com.looker.droidify)
+    - [:fontawesome-brands-github: GitHub](https://github.com/Iamlooker/Droid-ify)

docs/android.md

@@ -1,420 +0,0 @@
----
-title: "Android"
-icon: 'fontawesome/brands/android'
----
-Android is a secure operating system that has strong [app sandboxing](https://source.android.com/security/app-sandbox), [Verified Boot](https://source.android.com/security/verifiedboot), and a robust [permission](https://developer.android.com/guide/topics/permissions/overview) control system.
-
-The main privacy concern with most Android devices is that they usually include [Google Play Services](https://developers.google.com/android/guides/overview). This component is proprietary, [closed source](https://en.wikipedia.org/wiki/Proprietary_software), has a privileged role on your phone, and may collect private user information. It is neither a part of the [Android Open Source Project](https://source.android.com/) (AOSP) nor is it included with the below derivatives.
-
-## AOSP Derivatives
-
-### GrapheneOS
-
-!!! recommendation
-
-    ![GrapheneOS logo](/assets/img/android/grapheneos.svg#only-light){ align=right }
-    ![GrapheneOS logo](/assets/img/android/grapheneos-dark.svg#only-dark){ align=right }
-
-    **GrapheneOS** is the best choice when it comes to privacy and security.
-
-    GrapheneOS provides additional [security hardening](https://en.wikipedia.org/wiki/Hardening_(computing)) and privacy improvements. It has a [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), network and sensor permissions, and various other [security features](https://grapheneos.org/features). GrapheneOS also comes with full firmware updates and signed builds, so [verified boot](https://source.android.com/security/verifiedboot) is fully supported.
-
-    [Visit grapheneos.org](https://grapheneos.org/){ .md-button .md-button--primary } [Privacy Policy](https://grapheneos.org/faq#privacy-policy){ .md-button }
-
-Notably, GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play). Google Play Services can be run fully sandboxed like a regular user app and contained in a work profile or user [profile](/android/#android-security-privacy) of your choice. This means that you can run apps dependant on Play Services, such as those that require push notifications using Google's [Firebase Cloud Messaging](https://firebase.google.com/docs/cloud-messaging/) service. GrapheneOS allows you to take advantage of most [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) whilst having full user control over their permissions and access.
-
-Currently, only [Pixel phones](https://grapheneos.org/faq#device-support) meet its hardware security requirement and are supported.
-
-!!! attention
-
-    GrapheneOS's "extended support" devices do not have full security patches (firmware updates) due to the original equipment manufacturer (OEM) discontinuing support. These devices cannot be considered completely secure.
-
-### CalyxOS
-
-!!! recommendation
-
-    ![CalyxOS logo](/assets/img/android/calyxos.svg){ align=right }
-
-    **CalyxOS** is a decent alternative to GrapheneOS.
-
-    It has some privacy features on top of AOSP, including [Datura firewall](https://calyxos.org/docs/tech/datura-details), [Signal](https://signal.org) integration in the dialer app, and a built in panic button. CalyxOS also comes with firmware updates and signed builds, so [verified boot](https://source.android.com/security/verifiedboot) is fully supported.
-
-    [Visit calyxos.org](https://calyxos.org/){ .md-button .md-button--primary } [Privacy Policy](https://calyxinstitute.org/legal/privacy-policy){ .md-button }
-
-To accomodate users who need Google Play Services, CalyxOS optionally includes [MicroG](https://microg.org/). With MicroG, CalyxOS also bundles in the [Mozilla](https://location.services.mozilla.com/) and [DejaVu](https://github.com/n76/DejaVu) location services.
-
-Currently, CalyxOS only supports [Pixel phones](https://calyxos.org/docs/guide/device-support/).
-
-!!! attention
-
-    CalyxOS's "extended support" does not have full security patches due to the original equipment manufacturer (OEM) discontinuing support; therefore, they cannot be considered completely secure.
-
-### DivestOS
-
-!!! recommendation
-
-    ![DivestOS logo](/assets/img/android/divestos.svg){ align=right }
-
-    **DivestOS** is a [soft-fork](https://en.wikipedia.org/wiki/Fork_(software_development)#Forking_of_free_and_open-source_software) of [LineageOS](https://lineageos.org/).
-    DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
-
-    [Visit divestos.org](https://divestos.org){ .md-button .md-button--primary } [Privacy Policy](https://divestos.org/index.php?page=privacy_policy){ .md-button }
-
-DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, a custom [hosts](https://divested.dev/index.php?page=dnsbl) file, and [F-Droid](https://www.f-droid.org) as the app store. It includes [UnifiedNlp](https://github.com/microg/UnifiedNlp) for network location. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and includes [network state partitioning](https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning).
-
-DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747/) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled.
-
-DivestOS 16.0, 17.1, and 18.1 implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](/android/#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and 18.1 feature GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, and [`ptrace_scope`](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features). All branches additionally have various miscellaneous patches courtesy of GrapheneOS.
-
-!!! attention
-
-    DivestOS firmware update [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) varies across the devices it supports. For Pixel phones, we still recommend using GrapheneOS or CalyxOS. For other supported devices, DivestOS is a good alternative.
-
-    Not all of the supported devices have [verified boot](https://source.android.com/security/verifiedboot), and some perform it better than others.
-
-## Android security and privacy features
-
-### User Profiles
-
-Multiple user profiles (Settings → System → Multiple users) are the simplest way to isolate in Android. With user profiles you can limit a user from making calls, SMS or installing apps on the device. Each profile is encrypted using its own encryption key and cannot access the data of any other profiles. Even the device owner cannot view the data of other profiles without knowing their password. Multiple user profiles is a more secure method of isolation.
-
-### Work Profile
-
-[Work Profiles](https://support.google.com/work/android/answer/6191949) are another way to isolate individual apps and may be more convenient than separate user profiles.
-
-A **device controller** such as [Shelter](#recommended-apps) is required, unless you're using CalyxOS which includes one.
-
-The work profile is dependent on a device controller to function. Features such as *File Shuttle* and *contact search blocking* or any kind of isolation features must be implemented by the controller. The user must also fully trust the device controller app, as it has full access to the data inside of the work profile.
-
-This method is generally less secure than a secondary user profile; however, it does allow you the convenience of running apps in both the work and personal profiles simultaneously.
-
-### Verified Boot
-
-[Verified Boot](https://source.android.com/security/verifiedboot) is an important part of the Android security model. It provides protection against [evil maid](https://en.wikipedia.org/wiki/Evil_maid_attack) attacks, malware persistence, and ensures security updates cannot be downgraded with [rollback protection](https://source.android.com/security/verifiedboot/verified-boot#rollback-protection).
-
-Android 10 and above has moved away from full-disk encryption (FDE) to more flexible [file-based encryption](https://source.android.com/security/encryption/file-based).
-
-Each user's data is encrypted using their own unique encryption key, and the operating system files are left unencrypted. Verified Boot ensures the integrity of the operating system files preventing an adversary with physical access from tampering or installing malware on the device. In the unlikely case that malware is able to exploit other parts of the system and gain higher privileged access, Verified Boot will prevent and revert changes to the system partition upon reboot of the device.
-
-Unfortunately, original equipment manufacturers (OEMs) are only obliged to support Verified Boot on their stock Android distribution. Only a few OEMs such as Google support custom Android Verified Boot (AVB) key enrollment on their devices. Some AOSP derivatives such as LineageOS or /e/ OS do not support Verified Boot even on hardware with Verified Boot support for third party operating systems. We recommend that you check for support **before** purchasing a new device. AOSP derivatives which do not support Verified Boot are **not** recommended.
-
-### VPN Killswitch
-
-Android 7 and above supports a VPN killswitch and it is available without the need to install third party apps. This feature can prevent leaks if the VPN is disconnected. It can be found in ⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN.
-
-### Global Toggles
-
-Modern Android devices have global toggles for disabling [Bluetooth](https://en.wikipedia.org/wiki/Bluetooth) and location services. Android 12 introduced toggles for the camera and microphone. When not in use, we recommend disabling these features. Apps cannot use disabled features (even if granted individual permission) until re-enabled.
-
-## Recommended Apps
-
-### Orbot
-
-!!! recommendation
-
-    ![Orbot logo](/assets/img/android/orbot.svg){ align=right }
-
-    **Orbot** is a free proxy app that routes your connections through the Tor Network.
-
-    [Visit orbot.app](https://orbot.app/){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=org.torproject.android)
-    - [:pg-f-droid: F-Droid](https://guardianproject.info/fdroid)
-    - [:fontawesome-brands-github: GitHub](https://github.com/guardianproject/orbot)
-    - [:fontawesome-brands-gitlab: GitLab](https://gitlab.com/guardianproject/orbot)
-
-Orbot can proxy individual apps if they support SOCKS or HTTP proxying. It can also proxy all your network connections using [VpnService](https://developer.android.com/reference/android/net/VpnService) and can be used with the VPN killswitch (⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN).
-
-For resistance against traffic analysis attacks, consider enabling *Isolate Destination Address* ( ⁝ →Settings → Connectivity). This will use a completely different Tor Circuit (different middle relay and exit nodes) for every domain you connect to.
-
-!!! attention
-
-    Orbot is often outdated on the Guardian Project's [F-Droid repository](https://guardianproject.info/fdroid) and [Google Play](https://play.google.com/store/apps/details?id=org.torproject.android) so consider downloading directly from the [GitHub repository](https://github.com/guardianproject/orbot) instead.
-
-    All versions are signed using the same signature so they should be compatible with each other.
-
-### Shelter
-
-!!! recommendation
-
-    ![Shelter logo](/assets/img/android/shelter.svg){ align=right }
-
-    **Shelter** is an app that helps you leverage the Android work profile to isolate other apps.
-
-    Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager ([DocumentsUI](https://source.android.com/devices/architecture/modular-system/documentsui)).
-
-    [Visit gitea.angry.im](https://gitea.angry.im/PeterCxy/Shelter){ .md-button .md-button--primary }
-
-    **Downloads:**
-    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=net.typeblog.shelter)
-    - [:pg-f-droid: F-Droid](https://f-droid.org/en/packages/net.typeblog.shelter)
-    - [:fontawesome-brands-github: GitHub](https://github.com/PeterCxy/Shelter)
-    - [:fontawesome-brands-git-alt: Source](https://gitea.angry.im/PeterCxy/Shelter)
-
-!!! attention
-
-    As CalyxOS includes a device controller, we recommend using their built in work profile instead.
-
-    Shelter is recommended over [Insular](https://secure-system.gitlab.io/Insular/) and [Island](https://github.com/oasisfeng/island) as it supports [contact search blocking](https://secure-system.gitlab.io/Insular/faq.html).
-
-    When using Shelter, you are placing complete trust in its developer as Shelter would be acting as a [Device Admin](https://developer.android.com/guide/topics/admin/device-admin) for the work profile and has extensive access to the data stored within it.
-
-### Auditor
-
-!!! recommendation
-
-    ![Auditor logo](/assets/img/android/auditor.svg#only-light){ align=right }
-    ![Auditor logo](/assets/img/android/auditor-dark.svg#only-dark){ align=right }
-
-    **Auditor** is an app which leverages hardware security features to provide device integrity monitoring for [supported devices](https://attestation.app/about#device-support). Currently it works with GrapheneOS and the device's stock operating system.
-
-    [Visit attestation.app](https://attestation.app){ .md-button .md-button--primary }
-
-    **Downloads:**
-    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=app.attestation.auditor)
-    - [:fontawesome-brands-github: GitHub](https://github.com/GrapheneOS/Auditor)
-
-Auditor performs attestation and intrusion detection by:
-
-- Using a [Trust On First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) model between an *auditor* and *auditee*, the pair establish a private key in the [hardware-backed keystore](https://source.android.com/security/keystore/) of the *Auditor*.
-- The *auditor* can either be another instance of the Auditor app or the [Remote Attestation Service](https://attestation.app).
-- The *auditor* records the current state and configuration of the *auditee*.
-- Should tampering with the operating system of the *auditee* after the pairing is complete, the auditor will be aware of the change in the device state and configurations.
-- The user will be alerted to the change.
-
-No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring.
-
-If your [threat model](/threat-modeling/) requires privacy you could consider using Orbot or a VPN to hide your IP address from the attestation service.
-To make sure that your hardware and operating system is genuine, [perform local attestation](https://grapheneos.org/install/web#verifying-installation) immediately after the device has been installed and prior to any internet connection.
-
-### Secure Camera
-
-!!! recommendation
-
-    ![Secure camera logo](/assets/img/android/secure_camera.svg#only-light){ align=right }
-    ![Secure camera logo](/assets/img/android/secure_camera-dark.svg#only-dark){ align=right }
-
-      **Secure Camera** is an camera app focused on privacy and security which can capture images, videos, and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices.
-
-    [Visit github.com](https://github.com/GrapheneOS/Camera){ .md-button .md-button--primary }
-
-    **Downloads:**
-    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.camera.play)
-    - [:fontawesome-brands-github: GitHub](https://github.com/GrapheneOS/Camera/releases)
-
-Main privacy features include:
-
-- Auto removal of [Exif](https://en.wikipedia.org/wiki/Exif) metadata (enabled by default)
-- Use of the new [Media](https://developer.android.com/training/data-storage/shared/media) API, therefore [storage permissions](https://developer.android.com/training/data-storage) are not required
-- Microphone permission not required unless you want to record sound
-
-!!! note
-
-    Metadata is not currently deleted from video files but that is planned.
-
-    The image orientation metadata is not deleted. If you enable location (in Secure Camera) that **won't** be deleted either. If you want to delete that later you will need to use an external app such as [Scrambled Exif](https://gitlab.com/juanitobananas/scrambled-exif/).
-
-### Secure PDF Viewer
-
-!!! recommendation
-
-    ![Secure PDF Viewer logo](/assets/img/android/secure_pdf_viewer.svg#only-light){ align=right }
-    ![Secure PDF Viewer logo](/assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ align=right }
-
-    **Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [webview](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files.
-
-    [Content-Security-Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) is used to enforce that the JavaScript and styling properties within the WebView are entirely static content.
-
-    [Visit github.com](https://github.com/GrapheneOS/PdfViewer){ .md-button .md-button--primary }
-
-    **Downloads:**
-    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.pdfviewer.play)
-    - [:fontawesome-brands-github: GitHub](https://github.com/GrapheneOS/PdfViewer/releases)
-
-### PrivacyBlur
-
-!!! recommendation
-
-    ![PrivacyBlur logo](/assets/img/android/privacyblur.svg){ align=right }
-
-    **PrivacyBlur** is a free app which can blur sensitive portions of pictures before sharing them online.
-
-    [Visit privacyblur.app](https://privacyblur.app/){ .md-button .md-button--primary }
-
-    **Downloads:**
-    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=de.mathema.privacyblur)
-    - [:pg-f-droid: F-Droid](https://f-droid.org/en/packages/de.mathema.privacyblur/)
-    - [:fontawesome-brands-github: GitHub](https://github.com/MATHEMA-GmbH/privacyblur)
-
-!!! warning
-
-    You should **never** use blur to redact [text in images](https://bishopfox.com/blog/unredacter-tool-never-pixelation). If you want to redact text in an image, draw a box over the text. For this we suggest [Pocket Paint](https://github.com/Catrobat/Paintroid) or [Imagepipe](https://codeberg.org/Starfish/Imagepipe).
-
-## General Recommendations
-
-### Avoid Root
-
-[Rooting](https://en.wikipedia.org/wiki/Rooting_(Android)) Android phones can decrease security significantly as it weakens the complete [Android security model](https://en.wikipedia.org/wiki/Android_(operating_system)#Security_and_privacy). This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful [Verified Boot](https://source.android.com/security/verifiedboot). Apps that require root will also modify the system partition meaning that Verified Boot would have to remain disabled. Having root exposed directly in the user interface also increases the [attack surface](https://en.wikipedia.org/wiki/Attack_surface) of your device and may assist in [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation) vulnerabilities and [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) policy bypasses.
-
-Adblockers (AdAway) which modify the [hosts file](https://en.wikipedia.org/wiki/Hosts_(file)) and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest encrypted [DNS](/dns) or [VPN](/vpn) server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.
-
-AFWall+ works based on the [packet filtering](https://en.wikipedia.org/wiki/Firewall_(computing)#Packet_filter) approach and may be bypassable in some situations.
-
-We do not believe that the security sacrifices made by rooting a phone are worth the questionable privacy benefits of those apps.
-
-### Firmware Updates
-
-Firmware updates are critical for maintaining security and without them your device cannot be secure. Original equipment manufacturers (OEMs)—in other words, phone manufacturers—have support agreements with their partners to provide the closed source components for a limited support period. These are detailed in the monthly [Android Security Bulletins](https://source.android.com/security/bulletin).
-
-As the components of the phone such as the processor and radio technologies rely on closed source components, the updates must be provided by the respective manufacturers. Therefore it is important that you purchase a device within an active support cycle. [Qualcomm](https://www.qualcomm.com/news/releases/2020/12/16/qualcomm-and-google-announce-collaboration-extend-android-os-support-and) and [Samsung](https://news.samsung.com/us/samsung-galaxy-security-extending-updates-knox/) support their devices for 4 years while cheaper products often have shorter support. With the introduction of the [Pixel 6](https://support.google.com/pixelphone/answer/4457705), Google now makes their own system on chip (SoC) and they will provide 5 years of support.
-
-Devices that have reached their end-of-life (EoL) and are no longer supported by the SoC manufacturer, cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.
-
-### Android Versions
-
-It's important to not use an [end-of-life](https://endoflife.date/android) version of Android. Newer versions of Android not only receive security updates for the operating system but also important privacy enhancing updates too. For example, [prior to Android 10](https://developer.android.com/about/versions/10/privacy/changes), any user apps with the [`READ_PHONE_STATE`](https://developer.android.com/reference/android/Manifest.permission#READ_PHONE_STATE) permission could access sensitive and unique serial numbers of your phone such as [IMEI](https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity), [MEID](https://en.wikipedia.org/wiki/Mobile_equipment_identifier), your SIM card's [IMSI](https://en.wikipedia.org/wiki/International_mobile_subscriber_identity), whereas now they must be system apps to do so. System apps are only provided by the OEM or Android distribution.
-
-### Android Permissions
-
-[Permissions on Android](https://developer.android.com/guide/topics/permissions/overview) grant users control over what apps are allowed to access. Google regularly makes [improvements](https://developer.android.com/about/versions/11/privacy/permissions) on the permission system in each successive version. All user installed apps are strictly [sandboxed](https://source.android.com/security/app-sandbox), therefore there is no need to install any antivirus apps. The savings you make from not purchasing or subscribing to security apps is better spent on paying for a supported device in the future.
-
-Should you want to run an app that you're unsure about, consider using a user or work [profile](/android/#android-security-privacy).
-
-### Advanced Protection Program
-
-If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection/). It is available at no cost to anyone with two or more hardware security keys with [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) support.
-
-The Advanced Protection Program provides enhanced threat monitoring and enables:
-
-- Stricter two factor authentication; e.g. that [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) or [FIDO2](https://en.wikipedia.org/wiki/WebAuthn) **must** be used and disallows the use of [SMS OTPs](https://en.wikipedia.org/wiki/One-time_password#SMS), [TOTP](https://en.wikipedia.org/wiki/Time-based_one-time_password), and [OAuth](https://en.wikipedia.org/wiki/OAuth)
-- Only Google and verified third party apps can access account data
-- Scanning of incoming emails on Gmail accounts for [phishing](https://en.wikipedia.org/wiki/Phishing#Email_phishing) attempts
-- Stricter [safe browser scanning](https://www.google.com/chrome/privacy/whitepaper.html#malware) with Google Chrome
-- Stricter recovery process for accounts with lost credentials
-
- For users that are using the privileged Google Play Services (common on stock operating systems), the Advanced Protection Program also comes with [additional benefits](https://support.google.com/accounts/answer/9764949?hl=en) such as:
-
-- Not allowing app installation outside of the Google Play Store, the OS vendor's app store, or via [`adb`](https://en.wikipedia.org/wiki/Android_Debug_Bridge)
-- Mandatory automatic device scanning with [Play Protect](https://support.google.com/googleplay/answer/2812853?hl=en#zippy=%2Chow-malware-protection-works%2Chow-privacy-alerts-work)
-- Warning the user about unverified applications
-
-### SafetyNet and Play Integrity API
-
-[SafetyNet](https://developer.android.com/training/safetynet/attestation) and the [Play Integrity APIs](https://developer.android.com/google/play/integrity) are generally used for [banking apps](https://grapheneos.org/usage#banking-apps). Many banking apps will work fine in GrapheneOS with sandboxed Play services, however some non-financal apps have their own crude anti-tampering mechanisms which might fail. GrapheneOS passes the `basicIntegrity` check, but not the certification check `ctsProfileMatch`. Devices with Android 8 or later have hardware attestation support which cannot be bypassed without leaked keys or serious vulnerabilities.
-
-As for Google Wallet, we don't recommend this due to their [privacy policy](https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en), which states you must opt-out if you don't want your credit rating and personal information shared with affiliate marketing services.
-
-### Advertising ID
-
-All devices with Google Play Services installed automatically generate an [advertising ID](https://support.google.com/googleplay/android-developer/answer/6048248?hl=en) used for targeted advertising. Disable this feature to limit the data collected about you.
-
-On Android distributions with [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), go to ⚙️ Settings → Apps → Sandboxed Google Play → Google Settings → Ads and select **Delete advertising ID**.
-
-On Android distributions with privileged Google Play Services (such as stock OSes), the setting may be in one of several locations. Check
-
-- ⚙️ Settings → Google → Ads
-- ⚙️ Settings → Privacy → Ads
-
-Depending on your system, you will either be given the option to delete your advertising ID or to "Opt out of interest-based ads". You should delete the advertising ID if you are given the option to, and if you are not, we recommend that you opt out of interested-based ads and then reset your advertising ID.
-
-### Android Device Shopping
-
-Google Pixels are known to have good security and properly support [Verified Boot](https://source.android.com/security/verifiedboot). Some other phones such as the Fairphone and OnePlus devices also support custom Android Verified Boot (AVB) key enrollment. However, there have been issues with their older models. In the past they were using [test keys](https://social.coop/@dazinism/105346943304083054) or not doing proper verification, making Verified Boot on those devices useless.
-
-Avoid buying phones from mobile network operators. These often have a **locked bootloader** and do not support [OEM unlocking](https://source.android.com/devices/bootloader/locking_unlocking). These phone variants will prevent you from installing any kind of alternative Android distribution. Phones that cannot be unlocked will often have an [IMEI](https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity) starting with "35", that includes phones from purchased from Verizon, Telus, Rogers, EE, etc.
-
-Be very **careful** about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen there's a possibility of [IMEI blacklisting](https://www.gsma.com/security/resources/imei-blacklisting/). There is also a risk involved with you being associated with the activity of the previous owner.
-
-We have these general tips:
-
-- If you're after a bargain on a Pixel device, we suggest buying an "**a**" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
-- Consider price beating options and specials offered at [brick and mortar](https://en.wikipedia.org/wiki/Brick_and_mortar) stores.
-- Look at online community bargain sites in your country. These can alert you to good sales.
-- Google provides a list showing the [support cycle](https://support.google.com/nexus/answer/4457705) for each one of their devices. The price per day for a device can be calculated as: $\text{Cost} \over \text {EoL Date }-\text{ Current Date}$, meaning that the longer use of the device the lower cost per day.
-- Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.
-- Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper [Verified Boot](https://source.android.com/security/verifiedboot) support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
-- In short, if a device or Android distribution is not listed here, there is probably a good reason, so check our [discussions](https://github.com/privacyguides/privacyguides.org/discussions) page.
-
-The installation of GrapheneOS on a Pixel phone is easy with their [web installer](https://grapheneos.org/install/web). If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the [NitroPhone](https://shop.nitrokey.com/shop) as they come preloaded with GrapheneOS from the reputable [Nitrokey](https://www.nitrokey.com/about) company. The GrapheneOS project is not currently affiliated with any vendor and cannot ensure the quality or security of their products.
-
-A [CalyxOS membership](https://calyxinstitute.org/membership/calyxos) also entitles you to a device preloaded with CalyxOS.
-
-## Where to get your applications
-
-### GrapheneOS's App Store
-
-GrapheneOS's app store is available on [GitHub](https://github.com/GrapheneOS/Apps/releases). It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the [Auditor](https://attestation.app/), [Camera](https://github.com/GrapheneOS/Camera), and [PDF Viewer](https://github.com/GrapheneOS/PdfViewer). If you are looking for these applications, we highly recommend that you get them from GrapheneOS's app store instead of the Play Store, as the apps on their store are signed by the GrapheneOS's project own signature that Google does not have access to.
-
-### Aurora Store
-
-The Google Play Store requires a Google account to login which is not great for privacy. The [Aurora Store](https://auroraoss.com/download/AuroraStore/) (a Google Play Store proxy) does not, and works most of the time.
-
-### F-Droid
-
-F-Droid is often recommended as an alternative to Google Play, particularly in the privacy community. The option to add third party repositories and not be confined to Google's [walled garden](https://en.wikipedia.org/wiki/Closed_platform) has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds/) for some applications, and is dedicated to free and open source software. However, there are problems with the official F-Droid client, their quality control, and how they build, sign and deliver packages, outlined in this [post](https://wonderfall.dev/fdroid-issues/).
-
-Sometimes the official F-Droid repository may fall behind on updates. F-Droid maintainers reuse package IDs while signing apps with their own keys, which is not ideal as it does give the F-Droid team ultimate trust. The Google Play version of some apps may contain unwanted telemetry or lack features that are available in the F-Droid version.
-
-We have these general tips:
-
-- Check if the app developers have their own F-Droid repository first, e.g. [Bitwarden](https://bitwarden.com/), [Samourai Wallet](https://www.samouraiwallet.com/), or [Newpipe](https://newpipe.net/), which have their own repositories with less telemetry, additional features or faster updates. This is the ideal situation and you should be using these repositories if possible.
-- Check if an app is available on the [IzzyOnDroid](https://apt.izzysoft.de/fdroid/) repository. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. We recommend that you download the GitHub builds and install them manually first, then use IzzyOnDroid for any subsequent updates. This will ensure that the signature of the applications you get from IzzyOnDroid matches that of the developer and the packages have not been tampered with.
-- Check if there are any differences between the F-Droid version and the Google Play Store version. Some applications like [IVPN](https://www.ivpn.net/) do not include certain features (eg [AntiTracker](https://www.ivpn.net/knowledgebase/general/antitracker-faq/)) in their Google Play Store build out of fear of censorship by Google.
-
-Evaluate whether the additional features in the F-Droid build are worth the slower updates. Also think about whether faster updates from the Google Play Store are worth the potential privacy issues in your [threat model](/threat-modeling/).
-
-#### Droid-ify
-
-The official F-Droid client targets a [low API level](https://wonderfall.dev/fdroid-issues/#3-low-target-api-level-sdk-for-client--apps) and does not utilize the [seamless updates](https://www.androidcentral.com/google-will-finally-bring-seamless-app-updates-alternative-app-stores-android-12) feature introduced in Android 12. Targeting lower API levels means that the F-Droid client cannot take advantage of the new improvements in the application sandboxes that comes with higher API levels. For automatic updates to work, the F-Droid client requires that the [Privileged Extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged/) be included in the operating system, granting it more privileges than what a normal app would have, which is not great for security.
-
-To mitigate these problems, we recommend [Droid-ify](https://github.com/Iamlooker/Droid-ify) as it supports seamless updates on Android 12 and above without needing any special privileges and targets a higher API level.
-
-!!! recommendation
-
-    ![Droid-ify logo](assets/img/android/droid-ify.png){ align=right }
-
-    **Droid-ify** is a modern F-Droid client made with MaterialUI, forked from [Foxy Droid](https://github.com/kitsunyan/foxy-droid).
-
-    Unlike the official F-Droid client, Droid-ify supports seamless updates on Android 12 and above without the need for a privileged extension. If your Android distribution is on Android 12 or above and does not include the [F-Droid privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged/), it is highly recommended that you use Droid-ify instead of the official client.
-
-    **Downloads:**
-    - [:fontawesome-brands-android: APK Download](https://android.izzysoft.de/repo/apk/com.looker.droidify)
-    - [:fontawesome-brands-github: GitHub](https://github.com/Iamlooker/Droid-ify)
-
-## Security comparison of GrapheneOS and CalyxOS
-
-### Profiles
-
-CalyxOS includes a device controller app so there is no need to install a third party app like [Shelter](/android/#recommended-apps). GrapheneOS plans to introduce nested profile support with better isolation in the future.
-
-GrapheneOS extends the [user profile](/android/#android-security-privacy) feature allowing a user to press an "End Session" button. This button clears the encryption key from memory. There are plans to add a [cross profile notifications system](https://github.com/GrapheneOS/os-issue-tracker/issues/88) in the future.
-
-### Sandboxed Google Play vs Privileged MicroG
-
-When Google Play services are used on GrapheneOS, they run as a user app and are contained within a user or work profile.
-
-Sandboxed Google Play is confined using the highly restrictive, default [`untrusted_app`](https://source.android.com/security/selinux/concepts) domain provided by [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux). Permissions for apps to use Google Play Services can be revoked at any time by the user.
-
-MicroG is a reimplementation of Google Play Services. This means it needs to be updated every time Android has a major version update (or the Android API changes). It also needs to run in the highly privileged [`system_app`](https://source.android.com/security/selinux/concepts) SELinux domain like normal Google Play Services and requires access to [signature spoofing](https://madaidans-insecurities.github.io/android.html#microg-signature-spoofing) so this is less secure than the Sandboxed Google Play approach. We do not believe MicroG provides any privacy advantages over Sandboxed Google Play except for the option to *shift trust* of the location backend from Google to another provider such as Mozilla or DejaVu.
-
-From a usability point of view, Sandboxed Google Play also works well with far more applications than MicroG, thanks to its support for services like [Google Play Games](https://play.google.com/googleplaygames) and [In-app Billing API](https://android-doc.github.io/google/play/billing/api.html).
-
-### Privileged App Extensions
-
-Android 12 comes with special support for seamless app updates with [third party app stores](https://android-developers.googleblog.com/2020/09/listening-to-developer-feedback-to.html). The popular Free and Open Source Software (FOSS) repository [F-Droid](https://f-droid.org) doesn't implement this feature and requires a [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged) to be included with the Android distribution in order to have unattended app installation.
-
-GrapheneOS doesn't compromise on security; therefore, they do not include the F-Droid extension. Users have to confirm all updates manually if they want to use F-Droid. Alternatively, they can use the Droid-ify client which does support seamless app updates in Android 12. GrapheneOS officially recommends [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play) instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like [NewPipe](/video-streaming)).
-
-CalyxOS includes the [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged), which may lower device security. Seamless app updates should be possible with [Aurora Store](https://auroraoss.com) in Android 12.
-
-### Additional hardening
-
-GrapheneOS improves upon [AOSP](https://source.android.com/) security with:
-
-- **Hardened WebView:** Vanadium WebView requires [64-bit](https://en.wikipedia.org/wiki/64-bit_computing) processes on the [WebView](https://developer.android.com/reference/android/webkit/WebView) process and disables legacy [32-bit](https://en.wikipedia.org/wiki/32-bit_computing) processes. It uses hardened compiler options such as [`-fwrapv`](https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html) and [`-fstack-protector-strong`](https://gcc.gnu.org/onlinedocs/gcc-4.9.3/gcc/Optimize-Options.html), which can help protect against [stack buffer overflows](https://en.wikipedia.org/wiki/Stack_buffer_overflow). [API](https://en.wikipedia.org/wiki/API)s such as the [battery status API](https://chromestatus.com/feature/4537134732017664) are disabled for privacy reasons. All system apps on GrapheneOS use the Vanadium WebView which means user installed apps that use WebView will also benefit from Vanadium's hardening. The [Vanadium patch set](https://github.com/GrapheneOS/Vanadium/tree/12/patches) is a lot more comprehensive than CalyxOS's [Chromium patch set](https://gitlab.com/CalyxOS/chromium-patches) which is derived from it.
-- **Hardened Kernel:** GrapheneOS kernel includes some hardening from the [linux-hardened](https://github.com/GrapheneOS/linux-hardened) project and the [Kernel Self Protection Project (KSPP)](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). CalyxOS uses the [same kernel](https://calyxos.org/docs/development/build/kernel/) as regular Android with some minor modifications.
-- **Hardened Memory Allocator:** GrapheneOS uses the [hardened malloc](https://github.com/GrapheneOS/hardened_malloc) subproject as its memory allocator. This focuses on hardening against [memory heap corruption](https://en.wikipedia.org/wiki/Memory_corruption). CalyxOS uses the default AOSP [Scudo Malloc](https://source.android.com/devices/tech/debug/scudo), which is generally [less effective](https://twitter.com/danielmicay/status/1033671709197398016). Hardened Malloc has uncovered vulnerabilities in AOSP which have been [fixed](https://github.com/GrapheneOS/platform_system_core/commit/be11b59725aa6118b0e1f0712572e835c3d50746) by GrapheneOS such as [CVE-2021-0703](https://nvd.nist.gov/vuln/detail/CVE-2021-0703).
-- **Secure Exec Spawning:** GrapheneOS [spawns](https://en.wikipedia.org/wiki/Spawn_(computing)) fresh processes as opposed to using the [Zygote model](https://ayusch.com/android-internals-the-android-os-boot-process) used by AOSP and CalyxOS. The Zygote model weakens [Address Space Layout Randomization](https://en.wikipedia.org/wiki/Address_space_layout_randomization) (ASLR) and is considered [less secure](https://wenke.gtisc.gatech.edu/papers/morula.pdf). Creating [fresh processes](https://grapheneos.org/usage#exec-spawning) is safer but will have some performance penalty when launching a new application. These penalties are not really noticeable unless you have an [old device](https://support.google.com/nexus/answer/4457705) with slow storage such as the Pixel 3a/3a XL as it has [eMMC](https://en.wikipedia.org/wiki/MultiMediaCard#eMMC).
-
-**Please note that these are just a few examples and are not an extensive list of GrapheneOS's hardening**. For a more complete list, please read GrapheneOS' [official documentation](https://grapheneos.org/features).

docs/android/grapheneos-vs-calyxos.md

@@ -0,0 +1,38 @@
+---
+title: "GrapheneOS vs CalyxOS"
+icon: 'material/cellphone-cog'
+---
+## Profiles
+
+CalyxOS includes a device controller app so there is no need to install a third party app like Shelter.
+
+GrapheneOS extends the user profile feature allowing a user to press an "End Session" button. This button clears the encryption key from memory. There are plans to add a [cross profile notifications system](https://github.com/GrapheneOS/os-issue-tracker/issues/88) in the future. GrapheneOS plans to introduce nested profile support with better isolation in the future.
+
+## Sandboxed Google Play vs Privileged MicroG
+
+When Google Play services are used on GrapheneOS, they run as a user app and are contained within a user or work profile.
+
+Sandboxed Google Play is confined using the highly restrictive, default [`untrusted_app`](https://source.android.com/security/selinux/concepts) domain provided by [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux). Permissions for apps to use Google Play Services can be revoked at any time by the user.
+
+MicroG is a reimplementation of Google Play Services. This means it needs to be updated every time Android has a major version update (or the Android API changes). It also needs to run in the highly privileged [`system_app`](https://source.android.com/security/selinux/concepts) SELinux domain like normal Google Play Services and requires access to [signature spoofing](https://madaidans-insecurities.github.io/android.html#microg-signature-spoofing) so this is less secure than the Sandboxed Google Play approach. We do not believe MicroG provides any privacy advantages over Sandboxed Google Play except for the option to *shift trust* of the location backend from Google to another provider such as Mozilla or DejaVu.
+
+From a usability point of view, Sandboxed Google Play also works well with far more applications than MicroG, thanks to its support for services like [Google Play Games](https://play.google.com/googleplaygames) and [In-app Billing API](https://android-doc.github.io/google/play/billing/api.html).
+
+## Privileged App Extensions
+
+Android 12 comes with special support for seamless app updates with [third party app stores](https://android-developers.googleblog.com/2020/09/listening-to-developer-feedback-to.html). The popular Free and Open Source Software (FOSS) repository [F-Droid](https://f-droid.org) doesn't implement this feature and requires a [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged) to be included with the Android distribution in order to have unattended app installation.
+
+GrapheneOS doesn't compromise on security; therefore, they do not include the F-Droid extension. Users have to confirm all updates manually if they want to use F-Droid. Alternatively, they can use the Droid-ify client which does support seamless app updates in Android 12. GrapheneOS officially recommends [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play) instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like [NewPipe](../video-streaming.md)).
+
+CalyxOS includes the [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged), which may lower device security. Seamless app updates should be possible with [Aurora Store](https://auroraoss.com) in Android 12.
+
+## Additional hardening
+
+GrapheneOS improves upon [AOSP](https://source.android.com/) security with:
+
+- **Hardened WebView:** Vanadium WebView requires [64-bit](https://en.wikipedia.org/wiki/64-bit_computing) processes on the [WebView](https://developer.android.com/reference/android/webkit/WebView) process and disables legacy [32-bit](https://en.wikipedia.org/wiki/32-bit_computing) processes. It uses hardened compiler options such as [`-fwrapv`](https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html) and [`-fstack-protector-strong`](https://gcc.gnu.org/onlinedocs/gcc-4.9.3/gcc/Optimize-Options.html), which can help protect against [stack buffer overflows](https://en.wikipedia.org/wiki/Stack_buffer_overflow). [API](https://en.wikipedia.org/wiki/API)s such as the [battery status API](https://chromestatus.com/feature/4537134732017664) are disabled for privacy reasons. All system apps on GrapheneOS use the Vanadium WebView which means user installed apps that use WebView will also benefit from Vanadium's hardening. The [Vanadium patch set](https://github.com/GrapheneOS/Vanadium/tree/12/patches) is a lot more comprehensive than CalyxOS's [Chromium patch set](https://gitlab.com/CalyxOS/chromium-patches) which is derived from it.
+- **Hardened Kernel:** GrapheneOS kernel includes some hardening from the [linux-hardened](https://github.com/GrapheneOS/linux-hardened) project and the [Kernel Self Protection Project (KSPP)](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). CalyxOS uses the [same kernel](https://calyxos.org/docs/development/build/kernel/) as regular Android with some minor modifications.
+- **Hardened Memory Allocator:** GrapheneOS uses the [hardened malloc](https://github.com/GrapheneOS/hardened_malloc) subproject as its memory allocator. This focuses on hardening against [memory heap corruption](https://en.wikipedia.org/wiki/Memory_corruption). CalyxOS uses the default AOSP [Scudo Malloc](https://source.android.com/devices/tech/debug/scudo), which is generally [less effective](https://twitter.com/danielmicay/status/1033671709197398016). Hardened Malloc has uncovered vulnerabilities in AOSP which have been [fixed](https://github.com/GrapheneOS/platform_system_core/commit/be11b59725aa6118b0e1f0712572e835c3d50746) by GrapheneOS such as [CVE-2021-0703](https://nvd.nist.gov/vuln/detail/CVE-2021-0703).
+- **Secure Exec Spawning:** GrapheneOS [spawns](https://en.wikipedia.org/wiki/Spawn_(computing)) fresh processes as opposed to using the [Zygote model](https://ayusch.com/android-internals-the-android-os-boot-process) used by AOSP and CalyxOS. The Zygote model weakens [Address Space Layout Randomization](https://en.wikipedia.org/wiki/Address_space_layout_randomization) (ASLR) and is considered [less secure](https://wenke.gtisc.gatech.edu/papers/morula.pdf). Creating [fresh processes](https://grapheneos.org/usage#exec-spawning) is safer but will have some performance penalty when launching a new application. These penalties are not really noticeable unless you have an [old device](https://support.google.com/nexus/answer/4457705) with slow storage such as the Pixel 3a/3a XL as it has [eMMC](https://en.wikipedia.org/wiki/MultiMediaCard#eMMC).
+
+**Please note that these are just a few examples and are not an extensive list of GrapheneOS's hardening**. For a more complete list, please read GrapheneOS' [official documentation](https://grapheneos.org/features).

docs/android/overview.md

@@ -0,0 +1,72 @@
+---
+title: Android Overview
+icon: material/cellphone-check
+---
+Android is a secure operating system that has strong [app sandboxing](https://source.android.com/security/app-sandbox), [Verified Boot](https://source.android.com/security/verifiedboot), and a robust [permission](https://developer.android.com/guide/topics/permissions/overview) control system.
+
+The main privacy concern with most Android devices is that they usually include [Google Play Services](https://developers.google.com/android/guides/overview). This component is proprietary, [closed source](https://en.wikipedia.org/wiki/Proprietary_software), has a privileged role on your phone, and may collect private user information. It is neither a part of the [Android Open Source Project](https://source.android.com/) (AOSP) nor is it included with the below derivatives.
+
+## Avoid Root
+
+[Rooting](https://en.wikipedia.org/wiki/Rooting_(Android)) Android phones can decrease security significantly as it weakens the complete [Android security model](https://en.wikipedia.org/wiki/Android_(operating_system)#Security_and_privacy). This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful [Verified Boot](https://source.android.com/security/verifiedboot). Apps that require root will also modify the system partition meaning that Verified Boot would have to remain disabled. Having root exposed directly in the user interface also increases the [attack surface](https://en.wikipedia.org/wiki/Attack_surface) of your device and may assist in [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation) vulnerabilities and [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) policy bypasses.
+
+Adblockers (AdAway) which modify the [hosts file](https://en.wikipedia.org/wiki/Hosts_(file)) and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest encrypted [DNS](../dns.md) or [VPN](../vpn.md) server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.
+
+AFWall+ works based on the [packet filtering](https://en.wikipedia.org/wiki/Firewall_(computing)#Packet_filter) approach and may be bypassable in some situations.
+
+We do not believe that the security sacrifices made by rooting a phone are worth the questionable privacy benefits of those apps.
+
+## Firmware Updates
+
+Firmware updates are critical for maintaining security and without them your device cannot be secure. Original equipment manufacturers (OEMs)—in other words, phone manufacturers—have support agreements with their partners to provide the closed source components for a limited support period. These are detailed in the monthly [Android Security Bulletins](https://source.android.com/security/bulletin).
+
+As the components of the phone such as the processor and radio technologies rely on closed source components, the updates must be provided by the respective manufacturers. Therefore it is important that you purchase a device within an active support cycle. [Qualcomm](https://www.qualcomm.com/news/releases/2020/12/16/qualcomm-and-google-announce-collaboration-extend-android-os-support-and) and [Samsung](https://news.samsung.com/us/samsung-galaxy-security-extending-updates-knox/) support their devices for 4 years while cheaper products often have shorter support. With the introduction of the [Pixel 6](https://support.google.com/pixelphone/answer/4457705), Google now makes their own system on chip (SoC) and they will provide 5 years of support.
+
+Devices that have reached their end-of-life (EoL) and are no longer supported by the SoC manufacturer, cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.
+
+## Android Versions
+
+It's important to not use an [end-of-life](https://endoflife.date/android) version of Android. Newer versions of Android not only receive security updates for the operating system but also important privacy enhancing updates too. For example, [prior to Android 10](https://developer.android.com/about/versions/10/privacy/changes), any user apps with the [`READ_PHONE_STATE`](https://developer.android.com/reference/android/Manifest.permission#READ_PHONE_STATE) permission could access sensitive and unique serial numbers of your phone such as [IMEI](https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity), [MEID](https://en.wikipedia.org/wiki/Mobile_equipment_identifier), your SIM card's [IMSI](https://en.wikipedia.org/wiki/International_mobile_subscriber_identity), whereas now they must be system apps to do so. System apps are only provided by the OEM or Android distribution.
+
+## Android Permissions
+
+[Permissions on Android](https://developer.android.com/guide/topics/permissions/overview) grant users control over what apps are allowed to access. Google regularly makes [improvements](https://developer.android.com/about/versions/11/privacy/permissions) on the permission system in each successive version. All user installed apps are strictly [sandboxed](https://source.android.com/security/app-sandbox), therefore there is no need to install any antivirus apps. The savings you make from not purchasing or subscribing to security apps is better spent on paying for a supported device in the future.
+
+Should you want to run an app that you're unsure about, consider using a user or work [profile](android/#android-security-privacy).
+
+## Advanced Protection Program
+
+If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection/). It is available at no cost to anyone with two or more hardware security keys with [FIDO](/security/multi-factor-authentication.md#fido-fast-identity-online) support.
+
+The Advanced Protection Program provides enhanced threat monitoring and enables:
+
+- Stricter two factor authentication; e.g. that [FIDO](/security/multi-factor-authentication/#fido-fast-identity-online) **must** be used and disallows the use of [SMS OTPs](/security/multi-factor-authentication/#sms-or-email-mfa), [TOTP](/security/multi-factor-authentication.md#time-based-one-time-password-totp), and [OAuth](https://en.wikipedia.org/wiki/OAuth)
+- Only Google and verified third party apps can access account data
+- Scanning of incoming emails on Gmail accounts for [phishing](https://en.wikipedia.org/wiki/Phishing#Email_phishing) attempts
+- Stricter [safe browser scanning](https://www.google.com/chrome/privacy/whitepaper.html#malware) with Google Chrome
+- Stricter recovery process for accounts with lost credentials
+
+ For users that are using the privileged Google Play Services (common on stock operating systems), the Advanced Protection Program also comes with [additional benefits](https://support.google.com/accounts/answer/9764949?hl=en) such as:
+
+- Not allowing app installation outside of the Google Play Store, the OS vendor's app store, or via [`adb`](https://en.wikipedia.org/wiki/Android_Debug_Bridge)
+- Mandatory automatic device scanning with [Play Protect](https://support.google.com/googleplay/answer/2812853?hl=en#zippy=%2Chow-malware-protection-works%2Chow-privacy-alerts-work)
+- Warning the user about unverified applications
+
+## SafetyNet and Play Integrity API
+
+[SafetyNet](https://developer.android.com/training/safetynet/attestation) and the [Play Integrity APIs](https://developer.android.com/google/play/integrity) are generally used for [banking apps](https://grapheneos.org/usage#banking-apps). Many banking apps will work fine in GrapheneOS with sandboxed Play services, however some non-financal apps have their own crude anti-tampering mechanisms which might fail. GrapheneOS passes the `basicIntegrity` check, but not the certification check `ctsProfileMatch`. Devices with Android 8 or later have hardware attestation support which cannot be bypassed without leaked keys or serious vulnerabilities.
+
+As for Google Wallet, we don't recommend this due to their [privacy policy](https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en), which states you must opt-out if you don't want your credit rating and personal information shared with affiliate marketing services.
+
+## Advertising ID
+
+All devices with Google Play Services installed automatically generate an [advertising ID](https://support.google.com/googleplay/android-developer/answer/6048248?hl=en) used for targeted advertising. Disable this feature to limit the data collected about you.
+
+On Android distributions with [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), go to ⚙️ Settings → Apps → Sandboxed Google Play → Google Settings → Ads and select **Delete advertising ID**.
+
+On Android distributions with privileged Google Play Services (such as stock OSes), the setting may be in one of several locations. Check
+
+- ⚙️ Settings → Google → Ads
+- ⚙️ Settings → Privacy → Ads
+
+Depending on your system, you will either be given the option to delete your advertising ID or to "Opt out of interest-based ads". You should delete the advertising ID if you are given the option to, and if you are not, we recommend that you opt out of interested-based ads and then reset your advertising ID.

docs/android/security.md

@@ -0,0 +1,36 @@
+---
+title: "Android Security and Privacy Features"
+icon: 'material/cellphone-lock'
+---
+
+## User Profiles
+
+Multiple user profiles (Settings → System → Multiple users) are the simplest way to isolate in Android. With user profiles you can limit a user from making calls, SMS or installing apps on the device. Each profile is encrypted using its own encryption key and cannot access the data of any other profiles. Even the device owner cannot view the data of other profiles without knowing their password. Multiple user profiles is a more secure method of isolation.
+
+## Work Profile
+
+[Work Profiles](https://support.google.com/work/android/answer/6191949) are another way to isolate individual apps and may be more convenient than separate user profiles.
+
+A **device controller** such as [Shelter](#recommended-apps) is required, unless you're using CalyxOS which includes one.
+
+The work profile is dependent on a device controller to function. Features such as *File Shuttle* and *contact search blocking* or any kind of isolation features must be implemented by the controller. The user must also fully trust the device controller app, as it has full access to the data inside of the work profile.
+
+This method is generally less secure than a secondary user profile; however, it does allow you the convenience of running apps in both the work and personal profiles simultaneously.
+
+## Verified Boot
+
+[Verified Boot](https://source.android.com/security/verifiedboot) is an important part of the Android security model. It provides protection against [evil maid](https://en.wikipedia.org/wiki/Evil_maid_attack) attacks, malware persistence, and ensures security updates cannot be downgraded with [rollback protection](https://source.android.com/security/verifiedboot/verified-boot#rollback-protection).
+
+Android 10 and above has moved away from full-disk encryption (FDE) to more flexible [file-based encryption](https://source.android.com/security/encryption/file-based).
+
+Each user's data is encrypted using their own unique encryption key, and the operating system files are left unencrypted. Verified Boot ensures the integrity of the operating system files preventing an adversary with physical access from tampering or installing malware on the device. In the unlikely case that malware is able to exploit other parts of the system and gain higher privileged access, Verified Boot will prevent and revert changes to the system partition upon reboot of the device.
+
+Unfortunately, original equipment manufacturers (OEMs) are only obliged to support Verified Boot on their stock Android distribution. Only a few OEMs such as Google support custom Android Verified Boot (AVB) key enrollment on their devices. Some AOSP derivatives such as LineageOS or /e/ OS do not support Verified Boot even on hardware with Verified Boot support for third party operating systems. We recommend that you check for support **before** purchasing a new device. AOSP derivatives which do not support Verified Boot are **not** recommended.
+
+## VPN Killswitch
+
+Android 7 and above supports a VPN killswitch and it is available without the need to install third party apps. This feature can prevent leaks if the VPN is disconnected. It can be found in ⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN.
+
+## Global Toggles
+
+Modern Android devices have global toggles for disabling [Bluetooth](https://en.wikipedia.org/wiki/Bluetooth) and location services. Android 12 introduced toggles for the camera and microphone. When not in use, we recommend disabling these features. Apps cannot use disabled features (even if granted individual permission) until re-enabled.

docs/assets/img/dns/dns-dark.svg

@@ -1,166 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
- "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<!-- Generated by graphviz version 2.48.0 (0)
- -->
-<!-- Title: DNS Pages: 1 -->
-<svg width="630pt" height="935pt"
- viewBox="0.00 0.00 630.00 935.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(36 899)">
-<title>DNS</title>
-<!-- Start -->
-<g id="node1" class="node">
-<title>Start</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M89,-863C89,-863 55,-863 55,-863 49,-863 43,-857 43,-851 43,-851 43,-839 43,-839 43,-833 49,-827 55,-827 55,-827 89,-827 89,-827 95,-827 101,-833 101,-839 101,-839 101,-851 101,-851 101,-857 95,-863 89,-863"/>
-<text text-anchor="middle" x="72" y="-841.3" font-family="monospace" font-size="14.00">Start</text>
-</g>
-<!-- anonymous -->
-<g id="node3" class="node">
-<title>anonymous</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-791 0,-733.5 72,-676 144,-733.5 72,-791"/>
-<text text-anchor="middle" x="72" y="-737.3" font-family="monospace" font-size="14.00">Trying to be</text>
-<text text-anchor="middle" x="72" y="-722.3" font-family="monospace" font-size="14.00"> anonymous?</text>
-</g>
-<!-- Start&#45;&gt;anonymous -->
-<g id="edge1" class="edge">
-<title>Start&#45;&gt;anonymous</title>
-<path fill="none" stroke="white" d="M72,-826.59C72,-826.59 72,-801.45 72,-801.45"/>
-<polygon fill="white" stroke="white" points="72,-791.45 76.5,-801.45 72,-796.45 72,-801.45 72,-801.45 72,-801.45 72,-796.45 67.5,-801.45 72,-791.45 72,-791.45"/>
-</g>
-<!-- nothing -->
-<g id="node2" class="node">
-<title>nothing</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M249.5,-36C249.5,-36 174.5,-36 174.5,-36 168.5,-36 162.5,-30 162.5,-24 162.5,-24 162.5,-12 162.5,-12 162.5,-6 168.5,0 174.5,0 174.5,0 249.5,0 249.5,0 255.5,0 261.5,-6 261.5,-12 261.5,-12 261.5,-24 261.5,-24 261.5,-30 255.5,-36 249.5,-36"/>
-<text text-anchor="middle" x="212" y="-14.3" font-family="monospace" font-size="14.00">Do nothing</text>
-</g>
-<!-- censorship -->
-<g id="node4" class="node">
-<title>censorship</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-640 0,-582.5 72,-525 144,-582.5 72,-640"/>
-<text text-anchor="middle" x="72" y="-586.3" font-family="monospace" font-size="14.00">Avoiding</text>
-<text text-anchor="middle" x="72" y="-571.3" font-family="monospace" font-size="14.00"> censorship?</text>
-</g>
-<!-- anonymous&#45;&gt;censorship -->
-<g id="edge3" class="edge">
-<title>anonymous&#45;&gt;censorship</title>
-<path fill="none" stroke="white" d="M72,-675.98C72,-675.98 72,-650.11 72,-650.11"/>
-<polygon fill="white" stroke="white" points="72,-640.11 76.5,-650.11 72,-645.11 72,-650.11 72,-650.11 72,-650.11 72,-645.11 67.5,-650.11 72,-640.11 72,-640.11"/>
-<text text-anchor="middle" x="63.5" y="-651.85" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- tor -->
-<g id="node8" class="node">
-<title>tor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-697.5C300,-697.5 406,-697.5 406,-697.5 412,-697.5 418,-703.5 418,-709.5 418,-709.5 418,-757.5 418,-757.5 418,-763.5 412,-769.5 406,-769.5 406,-769.5 300,-769.5 300,-769.5 294,-769.5 288,-763.5 288,-757.5 288,-757.5 288,-709.5 288,-709.5 288,-703.5 294,-697.5 300,-697.5"/>
-<text text-anchor="middle" x="353" y="-729.8" font-family="monospace" font-size="14.00">Use Tor</text>
-</g>
-<!-- anonymous&#45;&gt;tor -->
-<g id="edge2" class="edge">
-<title>anonymous&#45;&gt;tor</title>
-<path fill="none" stroke="white" d="M143.64,-733C143.64,-733 277.75,-733 277.75,-733"/>
-<polygon fill="white" stroke="white" points="287.75,-733 277.75,-737.5 282.75,-733 277.75,-733 277.75,-733 277.75,-733 282.75,-733 277.75,-728.5 287.75,-733 287.75,-733"/>
-<text text-anchor="middle" x="198.19" y="-736.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- privacy -->
-<g id="node5" class="node">
-<title>privacy</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-489 140,-431.5 212,-374 284,-431.5 212,-489"/>
-<text text-anchor="middle" x="212" y="-435.3" font-family="monospace" font-size="14.00">Want privacy</text>
-<text text-anchor="middle" x="212" y="-420.3" font-family="monospace" font-size="14.00"> from ISP?</text>
-</g>
-<!-- censorship&#45;&gt;privacy -->
-<g id="edge5" class="edge">
-<title>censorship&#45;&gt;privacy</title>
-<path fill="none" stroke="white" d="M84.7,-535C115.31,-535 190.67,-535 190.67,-535 190.67,-535 190.67,-482.11 190.67,-482.11"/>
-<polygon fill="white" stroke="white" points="190.67,-472.11 195.17,-482.11 190.67,-477.11 190.67,-482.11 190.67,-482.11 190.67,-482.11 190.67,-477.11 186.17,-482.11 190.67,-472.11 190.67,-472.11"/>
-<text text-anchor="middle" x="155.63" y="-538.8" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- vpnOrTor -->
-<g id="node9" class="node">
-<title>vpnOrTor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-546.5C300,-546.5 406,-546.5 406,-546.5 412,-546.5 418,-552.5 418,-558.5 418,-558.5 418,-606.5 418,-606.5 418,-612.5 412,-618.5 406,-618.5 406,-618.5 300,-618.5 300,-618.5 294,-618.5 288,-612.5 288,-606.5 288,-606.5 288,-558.5 288,-558.5 288,-552.5 294,-546.5 300,-546.5"/>
-<text text-anchor="middle" x="353" y="-586.3" font-family="monospace" font-size="14.00">Use VPN</text>
-<text text-anchor="middle" x="353" y="-571.3" font-family="monospace" font-size="14.00"> or Tor</text>
-</g>
-<!-- censorship&#45;&gt;vpnOrTor -->
-<g id="edge4" class="edge">
-<title>censorship&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="white" d="M129.88,-594C129.88,-594 277.82,-594 277.82,-594"/>
-<polygon fill="white" stroke="white" points="287.82,-594 277.82,-598.5 282.82,-594 277.82,-594 277.82,-594 277.82,-594 282.82,-594 277.82,-589.5 287.82,-594 287.82,-594"/>
-<text text-anchor="middle" x="191.35" y="-597.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- obnoxious -->
-<g id="node6" class="node">
-<title>obnoxious</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-338 140,-280.5 212,-223 284,-280.5 212,-338"/>
-<text text-anchor="middle" x="212" y="-291.8" font-family="monospace" font-size="14.00">ISP makes</text>
-<text text-anchor="middle" x="212" y="-276.8" font-family="monospace" font-size="14.00"> obnoxious</text>
-<text text-anchor="middle" x="212" y="-261.8" font-family="monospace" font-size="14.00"> redirects?</text>
-</g>
-<!-- privacy&#45;&gt;obnoxious -->
-<g id="edge7" class="edge">
-<title>privacy&#45;&gt;obnoxious</title>
-<path fill="none" stroke="white" d="M212,-373.98C212,-373.98 212,-348.11 212,-348.11"/>
-<polygon fill="white" stroke="white" points="212,-338.11 216.5,-348.11 212,-343.11 212,-348.11 212,-348.11 212,-348.11 212,-343.11 207.5,-348.11 212,-338.11 212,-338.11"/>
-<text text-anchor="middle" x="203.5" y="-349.85" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- privacy&#45;&gt;vpnOrTor -->
-<g id="edge6" class="edge">
-<title>privacy&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="white" d="M237.33,-468.98C237.33,-510 237.33,-570 237.33,-570 237.33,-570 277.73,-570 277.73,-570"/>
-<polygon fill="white" stroke="white" points="287.73,-570 277.73,-574.5 282.73,-570 277.73,-570 277.73,-570 277.73,-570 282.73,-570 277.73,-565.5 287.73,-570 287.73,-570"/>
-<text text-anchor="middle" x="224.83" y="-543.49" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- ispDNS -->
-<g id="node7" class="node">
-<title>ispDNS</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-187 140,-129.5 212,-72 284,-129.5 212,-187"/>
-<text text-anchor="middle" x="212" y="-148.3" font-family="monospace" font-size="14.00">Does ISP</text>
-<text text-anchor="middle" x="212" y="-133.3" font-family="monospace" font-size="14.00"> support</text>
-<text text-anchor="middle" x="212" y="-118.3" font-family="monospace" font-size="14.00"> encrypted</text>
-<text text-anchor="middle" x="212" y="-103.3" font-family="monospace" font-size="14.00"> DNS?</text>
-</g>
-<!-- obnoxious&#45;&gt;ispDNS -->
-<g id="edge9" class="edge">
-<title>obnoxious&#45;&gt;ispDNS</title>
-<path fill="none" stroke="white" d="M212,-222.98C212,-222.98 212,-197.11 212,-197.11"/>
-<polygon fill="white" stroke="white" points="212,-187.11 216.5,-197.11 212,-192.11 212,-197.11 212,-197.11 212,-197.11 212,-192.11 207.5,-197.11 212,-187.11 212,-187.11"/>
-<text text-anchor="middle" x="203.5" y="-198.85" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- encryptedDNS -->
-<g id="node10" class="node">
-<title>encryptedDNS</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-244.5C440,-244.5 546,-244.5 546,-244.5 552,-244.5 558,-250.5 558,-256.5 558,-256.5 558,-304.5 558,-304.5 558,-310.5 552,-316.5 546,-316.5 546,-316.5 440,-316.5 440,-316.5 434,-316.5 428,-310.5 428,-304.5 428,-304.5 428,-256.5 428,-256.5 428,-250.5 434,-244.5 440,-244.5"/>
-<text text-anchor="middle" x="493" y="-291.8" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-276.8" font-family="monospace" font-size="14.00"> DNS with 3rd</text>
-<text text-anchor="middle" x="493" y="-261.8" font-family="monospace" font-size="14.00"> party</text>
-</g>
-<!-- obnoxious&#45;&gt;encryptedDNS -->
-<g id="edge8" class="edge">
-<title>obnoxious&#45;&gt;encryptedDNS</title>
-<path fill="none" stroke="white" d="M283.64,-280C283.64,-280 417.75,-280 417.75,-280"/>
-<polygon fill="white" stroke="white" points="427.75,-280 417.75,-284.5 422.75,-280 417.75,-280 417.75,-280 417.75,-280 422.75,-280 417.75,-275.5 427.75,-280 427.75,-280"/>
-<text text-anchor="middle" x="338.19" y="-283.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- ispDNS&#45;&gt;nothing -->
-<g id="edge11" class="edge">
-<title>ispDNS&#45;&gt;nothing</title>
-<path fill="none" stroke="white" d="M212,-71.79C212,-71.79 212,-46.13 212,-46.13"/>
-<polygon fill="white" stroke="white" points="212,-36.13 216.5,-46.13 212,-41.13 212,-46.13 212,-46.13 212,-46.13 212,-41.13 207.5,-46.13 212,-36.13 212,-36.13"/>
-<text text-anchor="middle" x="203.5" y="-47.76" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- useISP -->
-<g id="node11" class="node">
-<title>useISP</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-93.5C440,-93.5 546,-93.5 546,-93.5 552,-93.5 558,-99.5 558,-105.5 558,-105.5 558,-153.5 558,-153.5 558,-159.5 552,-165.5 546,-165.5 546,-165.5 440,-165.5 440,-165.5 434,-165.5 428,-159.5 428,-153.5 428,-153.5 428,-105.5 428,-105.5 428,-99.5 434,-93.5 440,-93.5"/>
-<text text-anchor="middle" x="493" y="-133.3" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-118.3" font-family="monospace" font-size="14.00"> DNS with ISP</text>
-</g>
-<!-- ispDNS&#45;&gt;useISP -->
-<g id="edge10" class="edge">
-<title>ispDNS&#45;&gt;useISP</title>
-<path fill="none" stroke="white" d="M283.64,-129C283.64,-129 417.75,-129 417.75,-129"/>
-<polygon fill="white" stroke="white" points="427.75,-129 417.75,-133.5 422.75,-129 417.75,-129 417.75,-129 417.75,-129 422.75,-129 417.75,-124.5 427.75,-129 427.75,-129"/>
-<text text-anchor="middle" x="338.19" y="-132.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-</g>
-</svg>

docs/assets/img/dns/dns.svg

@@ -1,166 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
- "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<!-- Generated by graphviz version 2.48.0 (0)
- -->
-<!-- Title: DNS Pages: 1 -->
-<svg width="630pt" height="935pt"
- viewBox="0.00 0.00 630.00 935.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(36 899)">
-<title>DNS</title>
-<!-- Start -->
-<g id="node1" class="node">
-<title>Start</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M89,-863C89,-863 55,-863 55,-863 49,-863 43,-857 43,-851 43,-851 43,-839 43,-839 43,-833 49,-827 55,-827 55,-827 89,-827 89,-827 95,-827 101,-833 101,-839 101,-839 101,-851 101,-851 101,-857 95,-863 89,-863"/>
-<text text-anchor="middle" x="72" y="-841.3" font-family="monospace" font-size="14.00">Start</text>
-</g>
-<!-- anonymous -->
-<g id="node3" class="node">
-<title>anonymous</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-791 0,-733.5 72,-676 144,-733.5 72,-791"/>
-<text text-anchor="middle" x="72" y="-737.3" font-family="monospace" font-size="14.00">Trying to be</text>
-<text text-anchor="middle" x="72" y="-722.3" font-family="monospace" font-size="14.00"> anonymous?</text>
-</g>
-<!-- Start&#45;&gt;anonymous -->
-<g id="edge1" class="edge">
-<title>Start&#45;&gt;anonymous</title>
-<path fill="none" stroke="black" d="M72,-826.59C72,-826.59 72,-801.45 72,-801.45"/>
-<polygon fill="black" stroke="black" points="72,-791.45 76.5,-801.45 72,-796.45 72,-801.45 72,-801.45 72,-801.45 72,-796.45 67.5,-801.45 72,-791.45 72,-791.45"/>
-</g>
-<!-- nothing -->
-<g id="node2" class="node">
-<title>nothing</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M249.5,-36C249.5,-36 174.5,-36 174.5,-36 168.5,-36 162.5,-30 162.5,-24 162.5,-24 162.5,-12 162.5,-12 162.5,-6 168.5,0 174.5,0 174.5,0 249.5,0 249.5,0 255.5,0 261.5,-6 261.5,-12 261.5,-12 261.5,-24 261.5,-24 261.5,-30 255.5,-36 249.5,-36"/>
-<text text-anchor="middle" x="212" y="-14.3" font-family="monospace" font-size="14.00">Do nothing</text>
-</g>
-<!-- censorship -->
-<g id="node4" class="node">
-<title>censorship</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-640 0,-582.5 72,-525 144,-582.5 72,-640"/>
-<text text-anchor="middle" x="72" y="-586.3" font-family="monospace" font-size="14.00">Avoiding</text>
-<text text-anchor="middle" x="72" y="-571.3" font-family="monospace" font-size="14.00"> censorship?</text>
-</g>
-<!-- anonymous&#45;&gt;censorship -->
-<g id="edge3" class="edge">
-<title>anonymous&#45;&gt;censorship</title>
-<path fill="none" stroke="black" d="M72,-675.98C72,-675.98 72,-650.11 72,-650.11"/>
-<polygon fill="black" stroke="black" points="72,-640.11 76.5,-650.11 72,-645.11 72,-650.11 72,-650.11 72,-650.11 72,-645.11 67.5,-650.11 72,-640.11 72,-640.11"/>
-<text text-anchor="middle" x="63.5" y="-651.85" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- tor -->
-<g id="node8" class="node">
-<title>tor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-697.5C300,-697.5 406,-697.5 406,-697.5 412,-697.5 418,-703.5 418,-709.5 418,-709.5 418,-757.5 418,-757.5 418,-763.5 412,-769.5 406,-769.5 406,-769.5 300,-769.5 300,-769.5 294,-769.5 288,-763.5 288,-757.5 288,-757.5 288,-709.5 288,-709.5 288,-703.5 294,-697.5 300,-697.5"/>
-<text text-anchor="middle" x="353" y="-729.8" font-family="monospace" font-size="14.00">Use Tor</text>
-</g>
-<!-- anonymous&#45;&gt;tor -->
-<g id="edge2" class="edge">
-<title>anonymous&#45;&gt;tor</title>
-<path fill="none" stroke="black" d="M143.64,-733C143.64,-733 277.75,-733 277.75,-733"/>
-<polygon fill="black" stroke="black" points="287.75,-733 277.75,-737.5 282.75,-733 277.75,-733 277.75,-733 277.75,-733 282.75,-733 277.75,-728.5 287.75,-733 287.75,-733"/>
-<text text-anchor="middle" x="198.19" y="-736.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- privacy -->
-<g id="node5" class="node">
-<title>privacy</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-489 140,-431.5 212,-374 284,-431.5 212,-489"/>
-<text text-anchor="middle" x="212" y="-435.3" font-family="monospace" font-size="14.00">Want privacy</text>
-<text text-anchor="middle" x="212" y="-420.3" font-family="monospace" font-size="14.00"> from ISP?</text>
-</g>
-<!-- censorship&#45;&gt;privacy -->
-<g id="edge5" class="edge">
-<title>censorship&#45;&gt;privacy</title>
-<path fill="none" stroke="black" d="M84.7,-535C115.31,-535 190.67,-535 190.67,-535 190.67,-535 190.67,-482.11 190.67,-482.11"/>
-<polygon fill="black" stroke="black" points="190.67,-472.11 195.17,-482.11 190.67,-477.11 190.67,-482.11 190.67,-482.11 190.67,-482.11 190.67,-477.11 186.17,-482.11 190.67,-472.11 190.67,-472.11"/>
-<text text-anchor="middle" x="155.63" y="-538.8" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- vpnOrTor -->
-<g id="node9" class="node">
-<title>vpnOrTor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-546.5C300,-546.5 406,-546.5 406,-546.5 412,-546.5 418,-552.5 418,-558.5 418,-558.5 418,-606.5 418,-606.5 418,-612.5 412,-618.5 406,-618.5 406,-618.5 300,-618.5 300,-618.5 294,-618.5 288,-612.5 288,-606.5 288,-606.5 288,-558.5 288,-558.5 288,-552.5 294,-546.5 300,-546.5"/>
-<text text-anchor="middle" x="353" y="-586.3" font-family="monospace" font-size="14.00">Use VPN</text>
-<text text-anchor="middle" x="353" y="-571.3" font-family="monospace" font-size="14.00"> or Tor</text>
-</g>
-<!-- censorship&#45;&gt;vpnOrTor -->
-<g id="edge4" class="edge">
-<title>censorship&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="black" d="M129.88,-594C129.88,-594 277.82,-594 277.82,-594"/>
-<polygon fill="black" stroke="black" points="287.82,-594 277.82,-598.5 282.82,-594 277.82,-594 277.82,-594 277.82,-594 282.82,-594 277.82,-589.5 287.82,-594 287.82,-594"/>
-<text text-anchor="middle" x="191.35" y="-597.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- obnoxious -->
-<g id="node6" class="node">
-<title>obnoxious</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-338 140,-280.5 212,-223 284,-280.5 212,-338"/>
-<text text-anchor="middle" x="212" y="-291.8" font-family="monospace" font-size="14.00">ISP makes</text>
-<text text-anchor="middle" x="212" y="-276.8" font-family="monospace" font-size="14.00"> obnoxious</text>
-<text text-anchor="middle" x="212" y="-261.8" font-family="monospace" font-size="14.00"> redirects?</text>
-</g>
-<!-- privacy&#45;&gt;obnoxious -->
-<g id="edge7" class="edge">
-<title>privacy&#45;&gt;obnoxious</title>
-<path fill="none" stroke="black" d="M212,-373.98C212,-373.98 212,-348.11 212,-348.11"/>
-<polygon fill="black" stroke="black" points="212,-338.11 216.5,-348.11 212,-343.11 212,-348.11 212,-348.11 212,-348.11 212,-343.11 207.5,-348.11 212,-338.11 212,-338.11"/>
-<text text-anchor="middle" x="203.5" y="-349.85" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- privacy&#45;&gt;vpnOrTor -->
-<g id="edge6" class="edge">
-<title>privacy&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="black" d="M237.33,-468.98C237.33,-510 237.33,-570 237.33,-570 237.33,-570 277.73,-570 277.73,-570"/>
-<polygon fill="black" stroke="black" points="287.73,-570 277.73,-574.5 282.73,-570 277.73,-570 277.73,-570 277.73,-570 282.73,-570 277.73,-565.5 287.73,-570 287.73,-570"/>
-<text text-anchor="middle" x="224.83" y="-543.49" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- ispDNS -->
-<g id="node7" class="node">
-<title>ispDNS</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-187 140,-129.5 212,-72 284,-129.5 212,-187"/>
-<text text-anchor="middle" x="212" y="-148.3" font-family="monospace" font-size="14.00">Does ISP</text>
-<text text-anchor="middle" x="212" y="-133.3" font-family="monospace" font-size="14.00"> support</text>
-<text text-anchor="middle" x="212" y="-118.3" font-family="monospace" font-size="14.00"> encrypted</text>
-<text text-anchor="middle" x="212" y="-103.3" font-family="monospace" font-size="14.00"> DNS?</text>
-</g>
-<!-- obnoxious&#45;&gt;ispDNS -->
-<g id="edge9" class="edge">
-<title>obnoxious&#45;&gt;ispDNS</title>
-<path fill="none" stroke="black" d="M212,-222.98C212,-222.98 212,-197.11 212,-197.11"/>
-<polygon fill="black" stroke="black" points="212,-187.11 216.5,-197.11 212,-192.11 212,-197.11 212,-197.11 212,-197.11 212,-192.11 207.5,-197.11 212,-187.11 212,-187.11"/>
-<text text-anchor="middle" x="203.5" y="-198.85" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- encryptedDNS -->
-<g id="node10" class="node">
-<title>encryptedDNS</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-244.5C440,-244.5 546,-244.5 546,-244.5 552,-244.5 558,-250.5 558,-256.5 558,-256.5 558,-304.5 558,-304.5 558,-310.5 552,-316.5 546,-316.5 546,-316.5 440,-316.5 440,-316.5 434,-316.5 428,-310.5 428,-304.5 428,-304.5 428,-256.5 428,-256.5 428,-250.5 434,-244.5 440,-244.5"/>
-<text text-anchor="middle" x="493" y="-291.8" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-276.8" font-family="monospace" font-size="14.00"> DNS with 3rd</text>
-<text text-anchor="middle" x="493" y="-261.8" font-family="monospace" font-size="14.00"> party</text>
-</g>
-<!-- obnoxious&#45;&gt;encryptedDNS -->
-<g id="edge8" class="edge">
-<title>obnoxious&#45;&gt;encryptedDNS</title>
-<path fill="none" stroke="black" d="M283.64,-280C283.64,-280 417.75,-280 417.75,-280"/>
-<polygon fill="black" stroke="black" points="427.75,-280 417.75,-284.5 422.75,-280 417.75,-280 417.75,-280 417.75,-280 422.75,-280 417.75,-275.5 427.75,-280 427.75,-280"/>
-<text text-anchor="middle" x="338.19" y="-283.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- ispDNS&#45;&gt;nothing -->
-<g id="edge11" class="edge">
-<title>ispDNS&#45;&gt;nothing</title>
-<path fill="none" stroke="black" d="M212,-71.79C212,-71.79 212,-46.13 212,-46.13"/>
-<polygon fill="black" stroke="black" points="212,-36.13 216.5,-46.13 212,-41.13 212,-46.13 212,-46.13 212,-46.13 212,-41.13 207.5,-46.13 212,-36.13 212,-36.13"/>
-<text text-anchor="middle" x="203.5" y="-47.76" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- useISP -->
-<g id="node11" class="node">
-<title>useISP</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-93.5C440,-93.5 546,-93.5 546,-93.5 552,-93.5 558,-99.5 558,-105.5 558,-105.5 558,-153.5 558,-153.5 558,-159.5 552,-165.5 546,-165.5 546,-165.5 440,-165.5 440,-165.5 434,-165.5 428,-159.5 428,-153.5 428,-153.5 428,-105.5 428,-105.5 428,-99.5 434,-93.5 440,-93.5"/>
-<text text-anchor="middle" x="493" y="-133.3" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-118.3" font-family="monospace" font-size="14.00"> DNS with ISP</text>
-</g>
-<!-- ispDNS&#45;&gt;useISP -->
-<g id="edge10" class="edge">
-<title>ispDNS&#45;&gt;useISP</title>
-<path fill="none" stroke="black" d="M283.64,-129C283.64,-129 417.75,-129 417.75,-129"/>
-<polygon fill="black" stroke="black" points="427.75,-129 417.75,-133.5 422.75,-129 417.75,-129 417.75,-129 417.75,-129 422.75,-129 417.75,-124.5 427.75,-129 427.75,-129"/>
-<text text-anchor="middle" x="338.19" y="-132.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-</g>
-</svg>

docs/assets/img/social-media-aggregator/freepost.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(.25 0 0 .25 26.227 -5.5792)"><path d="m30.557 85.535c0-9.0311-7.0959-18.062-17.74-18.062 0 0-7.0959 9.0311-7.0959 18.062 0 9.0311 7.0959 18.062 7.0959 18.062 10.644 0 17.74-9.0311 17.74-18.062z" style="fill:#775641;stroke-linejoin:round;stroke-width:.50032"/><path d="m23.762 85.819c0-7.1466-6.5632-13.107-14.304-13.107 0 0-3.7364 6.796-3.7364 13.32 0 6.5245 3.5955 11.731 3.5955 11.731 7.7409 0 14.445-4.7979 14.445-11.945z" style="fill:#f6eab7;stroke-linejoin:round;stroke-width:.36266"/><path d="m-104.91 85.535c0-9.0311 7.0959-18.062 17.74-18.062 0 0 7.0959 9.0311 7.0959 18.062 0 9.0311-7.0959 18.062-7.0959 18.062-10.644 0-17.74-9.0311-17.74-18.062z" style="fill:#775641;stroke-linejoin:round;stroke-width:.50032"/><path d="m-98.115 85.819c0-7.1466 6.5632-13.107 14.304-13.107 0 0 3.7364 6.796 3.7364 13.321 0 6.5245-3.5955 11.731-3.5955 11.731-7.7409 0-14.445-4.7979-14.445-11.945z" style="fill:#f6eab7;stroke-linejoin:round;stroke-width:.36266"/><path d="m-37.177 31.348c-25.158 0-50.316 9.5839-50.316 38.336 1.1924 6.4728 2.7731 11.683 4.6475 15.865-7.5968 3.7523-13.034 10.248-13.034 21.274 0 33.544 33.544 41.93 58.702 41.93s58.702-8.386 58.702-41.93c0-11.026-5.4368-17.521-13.034-21.274 1.8744-4.1813 3.4552-9.3917 4.6475-15.865 0-28.752-25.158-38.336-50.316-38.336z" style="fill:#775641"/><path d="m-55.239 42.637c-14.963-2e-6 -24.836 12.13-24.836 27.093 0.0068 6.4722 2.3304 12.728 6.5501 17.636-8.7707 4.271-15.581 10.809-15.581 20.747 0 24.836 26.771 33.867 51.929 33.867 25.158 0 51.929-9.0311 51.929-33.867 0-9.9374-6.8105-16.476-15.581-20.747 4.2197-4.9075 6.5432-11.163 6.5501-17.636 0-14.963-9.8723-27.093-24.836-27.093-9.0311 0-13.461 3.4642-18.062 6.7733-4.6083-3.3145-11.289-6.7733-18.062-6.7733z" style="fill:#f6eab7;stroke-linejoin:round;stroke-width:1.0285"/><ellipse cx="-54.11" cy="74.246" rx="5.6444" ry="9.0311" style="fill:#775641;stroke-linejoin:round;stroke-width:.89246"/><ellipse cx="-20.243" cy="74.246" rx="5.6444" ry="9.0311" style="fill:#775641;stroke-linejoin:round;stroke-width:.89246"/><path d="m-71.233 110.23c12.984 13.436 55.127 13.436 68.112 0 0 0-5.0706 4.6382-16.903 7.1405-11.833 2.5023-17.153 2.034-17.153 2.034s-5.3106 0.35654-16.366-2.034c-11.055-2.3905-17.69-7.1405-17.69-7.1405z" style="fill:#775641;stroke-linejoin:round;stroke-width:4.1379;stroke:#775641"/></g></svg>

docs/assets/img/social-media-aggregator/lemmy.svg

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<svg width="100%" height="100%" viewBox="0 0 128 128" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linecap:round;stroke-linejoin:round;">
-    <g id="Layer-1" serif:id="Layer 1" transform="matrix(0.7115,0,0,0.7115,-4.30398,-12.0468)">
-        <path id="white-border" d="M31.32,50.773C31.142,50.772 30.965,50.773 30.788,50.777C29.979,50.791 29.177,50.844 28.385,50.935C22.051,51.665 16.345,55.035 12.847,60.924C9.42,66.695 8.576,73.049 10.323,78.937C12.07,84.825 16.302,90.174 22.566,94.412C22.604,94.437 22.643,94.462 22.682,94.485C28.054,97.725 33.403,99.91 39.133,101.039C38.993,103.404 38.997,105.834 39.149,108.323C39.606,115.843 42.263,122.767 46.292,128.886L31.853,134.781C30.295,135.392 29.539,137.159 30.171,138.708C30.803,140.256 32.58,140.989 34.12,140.336L50.001,133.853C52.946,137.364 56.33,140.543 59.961,143.335C60.1,143.441 60.241,143.545 60.38,143.651L51.078,155.968C50.055,157.289 50.309,159.191 51.643,160.198C52.976,161.205 54.875,160.929 55.866,159.584L65.314,147.074C70.505,150.362 76.015,152.925 81.452,154.621C84.243,159.736 89.697,162.992 96,162.992C102.363,162.992 107.82,159.489 110.588,154.473C115.97,152.746 121.416,150.173 126.553,146.898L136.134,159.584C137.125,160.929 139.024,161.205 140.357,160.198C141.691,159.191 141.945,157.289 140.922,155.968L131.479,143.464C131.542,143.417 131.605,143.37 131.668,143.323C135.256,140.576 138.61,137.456 141.55,134.016L157.03,140.336C158.57,140.989 160.347,140.256 160.98,138.708C161.612,137.159 160.855,135.392 159.298,134.781L145.322,129.075C149.479,122.92 152.266,115.944 152.848,108.364C153.041,105.86 153.079,103.409 152.968,101.019C158.66,99.883 163.977,97.706 169.318,94.485C169.357,94.462 169.396,94.437 169.434,94.412C175.698,90.174 179.93,84.825 181.677,78.937C183.424,73.049 182.58,66.695 179.153,60.924C175.655,55.035 169.949,51.665 163.615,50.935C162.823,50.844 162.021,50.791 161.212,50.777C155.548,50.675 149.505,52.431 143.694,55.786C139.419,58.253 135.565,62.032 132.549,66.155C124.112,61.327 113.135,58.608 99.647,58.385C98.437,58.365 97.207,58.365 95.957,58.386C80.922,58.631 68.885,61.481 59.794,66.634C59.771,66.599 59.748,66.563 59.724,66.528C56.67,62.26 52.71,58.328 48.306,55.786C42.677,52.536 36.829,50.786 31.32,50.773L31.32,50.773Z" style="fill:none;fill-rule:nonzero;stroke:white;stroke-width:5.25px;"/>
-        <path id="ears" d="M134.41,68.056C137.277,64.049 141.041,60.348 145.006,58.059C157.506,50.843 170.698,51.83 176.896,62.265C183.101,72.712 179.706,84.294 167.963,92.237C161.971,95.85 156.163,98.035 149.732,98.902M57.59,68.056C54.722,64.049 50.959,60.348 46.994,58.059C34.494,50.843 21.302,51.83 15.104,62.265C8.899,72.712 12.294,84.294 24.037,92.237C30.029,95.85 35.837,98.035 42.268,98.902" style="fill:white;fill-rule:nonzero;stroke:black;stroke-width:5.25px;"/>
-        <path id="head" d="M150.231,108.163C152.388,80.076 135.11,60.372 96,61.01C56.89,61.649 40.071,80.256 41.769,108.163C43.39,134.803 74.919,154.364 95.792,154.364C116.664,154.364 148.189,134.762 150.231,108.163Z" style="fill:white;fill-rule:nonzero;stroke:black;stroke-width:5.25px;"/>
-        <path id="eyes" d="M114.469,120.804C114.469,125.138 117.976,128.651 122.302,128.651C126.629,128.651 130.136,125.138 130.136,120.804C130.136,116.471 126.629,112.958 122.302,112.958C117.976,112.958 114.469,116.471 114.469,120.804ZM61.864,120.804C61.864,125.178 65.403,128.723 69.77,128.723C74.136,128.723 77.676,125.178 77.676,120.804C77.676,116.431 74.136,112.885 69.77,112.885C65.403,112.885 61.864,116.431 61.864,120.804Z" style="fill-rule:nonzero;"/>
-        <path id="whiskers" d="M63.699,144.234L53.472,157.776M128.301,144.234L138.528,157.776M49.441,130.841L32.986,137.558M141.71,130.841L158.164,137.558" style="fill:none;fill-rule:nonzero;stroke:black;stroke-width:6px;stroke-linejoin:miter;"/>
-        <path id="nose" d="M96,133.704C87.401,133.704 81.913,139.675 82.099,147.036C82.299,155.007 88.186,160.368 96,160.368C103.814,160.368 109.885,154.181 109.902,147.036C109.919,139.673 104.6,133.704 96,133.704Z" style="fill:white;fill-rule:nonzero;stroke:black;stroke-width:5.25px;"/>
-    </g>
-</svg>

docs/assets/img/social-media-aggregator/tildes.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866" xmlns="http://www.w3.org/2000/svg"><g stroke-width=".33866"><rect x="-5.6458e-7" y="-5.6458e-7" width="33.866" height="33.866" fill="#002b36"/><rect x="-5.6458e-7" y="16.933" width="4.2333" height="4.2333" fill="#859900"/><rect x="4.2332" y="12.7" width="4.2333" height="4.2333" fill="#2aa198"/><rect x="8.4665" y="8.4665" width="4.2333" height="4.2333" fill="#268bd2"/><rect x="12.7" y="12.7" width="4.2333" height="4.2333" fill="#6c71c4"/><rect x="16.933" y="16.933" width="4.2333" height="4.2333" fill="#d33682"/><rect x="21.166" y="21.166" width="4.2333" height="4.2333" fill="#dc322f"/><rect x="25.399" y="16.933" width="4.2333" height="4.2333" fill="#cb4b16"/><rect x="29.633" y="12.7" width="4.2333" height="4.2333" fill="#b58900"/></g></svg>

docs/assets/img/social-networks/diaspora.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(2 0 0 2 0 -560.12)"><circle cx="8.4667" cy="288.53" r="8.4667" fill="#3e4142" stroke-width=".38887"/><path d="m6.1306 293.62c-0.61195-0.40183-1.8023-1.3484-1.8383-1.4618-0.0175-0.0552 0.11761-0.25886 0.87712-1.3223 0.59137-0.82801 0.98432-1.3965 0.98432-1.424 0-0.01-0.4186-0.15726-0.93021-0.32777-1.5987-0.53278-2.1871-0.75809-2.2228-0.85129-0.0085-0.0222 0.02478-0.17879 0.07399-0.34805 0.16758-0.57651 0.70469-2.1925 0.72869-2.1925 0.01317 0 0.69903 0.22409 1.5242 0.49799 0.82512 0.27389 1.5369 0.50097 1.5818 0.50462 0.08051 7e-3 0.08184 5e-3 0.09981-0.11496 0.02567-0.17145 0.06852-1.3039 0.06863-1.8139 5e-5 -0.23526 0.0073-0.65934 0.016121-0.94238l0.016029-0.51464h2.7084l0.01692 1.1613c0.01638 1.1246 0.04908 2.0391 0.07784 2.1766 0.0077 0.0367 0.02929 0.0669 0.04798 0.0669 0.018709 0 0.4419-0.13256 0.94045-0.29459 1.1784-0.38294 1.6299-0.52224 1.9278-0.5948 0.22766-0.0555 0.24515-0.0565 0.27379-0.0177 0.11772 0.15956 0.87772 2.4073 0.82859 2.4506-0.08778 0.0772-0.64949 0.28794-1.8198 0.68268-1.3815 0.46598-1.3376 0.45035-1.3376 0.47651 0 0.0359 0.24771 0.39668 0.9244 1.3466 0.34304 0.48151 0.69854 0.98791 0.78999 1.1253l0.16629 0.2498-0.07093 0.0743c-0.28961 0.30347-1.9257 1.5297-2.041 1.5297-0.05832 0-0.32962-0.32111-0.76323-0.90341-0.23554-0.31633-0.59006-0.79236-0.78783-1.0579-0.19776-0.26553-0.3985-0.52655-0.44609-0.58004l-0.08653-0.0973-0.08516 0.0973c-0.11446 0.13074-0.58016 0.74722-0.99206 1.3132-0.56457 0.77581-0.94676 1.2524-1.0043 1.2524-0.013449 0-0.12479-0.0659-0.24742-0.1464z" fill="#fff" stroke-width=".024319"/></g></svg>

docs/assets/img/social-networks/friendica.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128"><path fill="#ffc019" d="M23.04 2.56c-11.508.055-20.48 9.027-20.48 20.48v81.92c0 11.673 8.972 20.48 20.48 20.48h20.48V92.16h40.96l-.108-30.633-40.853.215V35.839h40.96V2.56H23.036Z"/><path fill="#1872a2" d="M104.96 125.441c11.508 0 20.59-8.916 20.48-20.48V23.042c.1-11.541-9.046-20.48-20.48-20.48H84.48v33.28H43.52v28.16h40.96v28.16H43.52v33.28h61.441Z"/><path fill="none" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width="5.12" d="M84.482 2.56v33.28h-40.96V64m40.96 0v28.16h-40.96v33.28"/><path fill="none" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width="5.12" d="M23.04 2.56h81.918c11.311 0 20.48 9.17 20.48 20.48v81.918c0 11.311-9.169 20.48-20.48 20.48H23.04c-11.31 0-20.48-9.169-20.48-20.48V23.04c0-11.31 9.17-20.48 20.48-20.48Z"/><path fill="none" d="M22.035 2.56h83.929c10.755 0 19.475 8.72 19.475 19.476v22.542c0 10.756-8.72 19.476-19.475 19.476h-83.93c-10.755 0-19.474-8.72-19.474-19.476V22.036C2.56 11.28 11.28 2.56 22.035 2.56ZM22.035 125.441h83.929c10.755 0 19.475-8.687 19.475-19.404V83.575c0-10.717-8.72-19.405-19.475-19.405h-83.93C11.28 64.17 2.56 72.858 2.56 83.575v22.462c0 10.717 8.72 19.404 19.475 19.404Z"/><linearGradient id="a" x1="58.714" x2="70.659" y1="-1.227" y2="37.471" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#fff" stop-opacity=".744"/><stop offset="1" stop-color="#fff" stop-opacity="0"/></linearGradient><filter id="b" width="128" height="128" x="0" y="0" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"><feGaussianBlur stdDeviation="1.22"/></filter><path fill="url(#a)" d="M19.92-1.227c-3.062 0-5.946.448-8.531 1.227h11.654C10.885 0 .926 9.43.07 21.371v1.205c0 6.97 8.852 12.582 19.85 12.582h88.16c10.998 0 19.85-5.611 19.85-12.582V21.32C127.05 9.403 117.104 0 104.963 0h11.65c-2.585-.778-5.47-1.226-8.532-1.226H19.92Z" filter="url(#b)"/><linearGradient id="c" x1="69.089" x2="57.65" y1="125.276" y2="93.395" gradientUnits="userSpaceOnUse"><stop offset="0" stop-opacity=".5"/><stop offset="1" stop-color="#818080" stop-opacity="0"/></linearGradient><filter id="d" width="128" height="128" x="0" y="0" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"><feGaussianBlur stdDeviation="1.457"/></filter><path fill="url(#c)" d="M21.566 97.022h85.002c9.673 0 17.515 6.325 17.515 14.127 0 7.802-7.842 14.127-17.515 14.127H21.566c-9.673 0-17.515-6.325-17.515-14.127 0-7.802 7.842-14.127 17.515-14.127Z" filter="url(#d)" opacity=".567"/></svg>

docs/assets/img/social-networks/mastodon.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg"><path d="m32.056 20.303c-0.46437 2.389-4.1591 5.0036-8.4025 5.5103-2.2128 0.26403-4.3914 0.50671-6.7145 0.40015-3.7993-0.17407-6.7972-0.90685-6.7972-0.90685 0 0.36986 0.02281 0.72202 0.06843 1.0514 0.49393 3.7495 3.7179 3.9741 6.7718 4.0788 3.0824 0.10546 5.827-0.75997 5.827-0.75997l0.12663 2.7866s-2.156 1.1577-5.9967 1.3707c-2.1179 0.11641-4.7476-0.05328-7.8104-0.86397-6.6428-1.7582-7.7853-8.8392-7.9601-16.024-0.05328-2.1332-0.02044-4.1447-0.02044-5.827 0-7.3468 4.8136-9.5002 4.8136-9.5002 2.4272-1.1147 6.5919-1.5834 10.922-1.6188h0.10638c4.3297 0.0354 8.4972 0.50415 10.924 1.6188 0 0 4.8134 2.1535 4.8134 9.5002 0 0 0.0604 5.4205-0.67129 9.1838" fill="#2b90d9" stroke-width=".14597"/><path d="m27.05 11.689v8.8957h-3.5243v-8.6343c0-1.8201-0.76581-2.7439-2.2976-2.7439-1.6936 0-2.5425 1.0959-2.5425 3.2628v4.726h-3.5035v-4.726c0-2.167-0.84901-3.2628-2.5427-3.2628-1.5318 0-2.2976 0.92382-2.2976 2.7439v8.6343h-3.5243v-8.8957c0-1.8181 0.46292-3.2628 1.3928-4.3317 0.95886-1.0689 2.2146-1.6168 3.7734-1.6168 1.8035 0 3.1692 0.69319 4.0723 2.0797l0.87784 1.4716 0.87802-1.4716c0.90284-1.3866 2.2686-2.0797 4.0723-2.0797 1.5586 0 2.8143 0.54794 3.7734 1.6168 0.92966 1.0689 1.3926 2.5136 1.3926 4.3317" fill="#fff" stroke-width=".14597"/></svg>

docs/assets/img/social-networks/movim.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><linearGradient id="linearGradient4049" x1="40" x2="200" y1="40" y2="200" gradientUnits="userSpaceOnUse"><stop style="stop-color:#345cca" offset="0"/><stop style="stop-color:#5d47c6" offset="1"/></linearGradient><linearGradient id="linearGradient4057" x1="125" x2="174.95" y1="65" y2="210.1" gradientUnits="userSpaceOnUse"><stop style="stop-color:#344394" offset="0"/><stop style="stop-color:#7c45df" offset="1"/></linearGradient><filter id="filter4029" x="-.14248" y="-.24435" width="1.285" height="1.4887"><feGaussianBlur stdDeviation="10.685972"/></filter></defs><g transform="matrix(.15187 0 0 .15187 -1.2909 -124.66)"><circle transform="translate(0 812.36)" cx="120" cy="120" r="110" style="fill:url(#linearGradient4049);stroke-width:3;stroke:url(#linearGradient4057)"/><path transform="matrix(.91667 0 0 .91667 3.3333 73.963)" d="m109.28 887.56c-20.51 0-37.137 16.627-37.137 37.137 0 1.594 0.10688 3.1707 0.30171 4.7118-0.29375-9e-3 -0.58624-0.0232-0.88201-0.0232-17.434-7e-5 -31.567 14.133-31.567 31.567 0 17.434 14.133 31.567 31.567 31.567h122.44c14.357 0 25.996-11.639 25.996-25.996 0-14.357-11.639-25.996-25.996-25.996-0.0468 0-0.093-2.5e-4 -0.13928 0 0.0334-0.64832 0.0696-1.293 0.0696-1.9497 0-20.51-16.627-37.137-37.137-37.137-5.7242 0-11.15 1.3077-15.992 3.6209-6.5596-10.507-18.221-17.501-31.52-17.501z" style="fill:#332949;filter:url(#filter4029);opacity:.45896"/><path d="m101.59 885.71c-18.232 0-33.011 14.78-33.011 33.011 0 1.4169 0.095 2.8184 0.26819 4.1883-0.26111-8e-3 -0.5211-0.0206-0.78401-0.0206-15.497-9e-5 -28.059 12.562-28.059 28.059 0 15.497 12.563 28.059 28.059 28.059h108.83c12.762 0 23.108-10.346 23.108-23.108 0-12.762-10.346-23.108-23.108-23.108-0.0416 0-0.0827-2.2e-4 -0.1238 0 0.0297-0.57629 0.0619-1.1493 0.0619-1.7331 0-18.231-14.78-33.011-33.011-33.011-5.0882 0-9.9111 1.1624-14.215 3.2186-5.8308-9.3396-16.197-15.556-28.018-15.556z" style="fill:#fff"/></g></svg>

docs/assets/img/social-networks/pleroma.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(.1014 0 0 .1014 -9.0749 -9.0242)"><g fill="#fba457" stroke-width="0"><path transform="matrix(2.6094 0 0 2.6094 89.5 89)" d="m33.916 0a9.9641 9.9641 0 0 0-9.9648 9.9648v118.04h31.809v-128h-21.844z"/><path transform="matrix(2.6094 0 0 2.6094 89.5 89)" d="m71.855 0v64h22.229a9.9641 9.9641 0 0 0 9.9648-9.9648v-54.035h-32.193z"/><path transform="matrix(2.6094 0 0 2.6094 89.5 89)" d="m71.855 96.191v31.809h22.229a9.9641 9.9641 0 0 0 9.9648-9.9648v-21.844h-32.193z"/></g></g></svg>

docs/browsers.en.md

@@ -1,5 +1,5 @@
 ---
-title: Browser Recommendations
+title: "Web Browsers"
 icon: octicons/browser-16
 ---
 These are our current web browser recommendations and settings. We recommend keeping extensions to a minimum: they have privileged access within your browser, require you to trust the developer, can make you [stand out](https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint), and [weaken](https://groups.google.com/a/chromium.org/g/chromium-extensions/c/0ei-UCHNm34/m/lDaXwQhzBAAJ) site isolation.
@@ -12,7 +12,7 @@ These are our current web browser recommendations and settings. We recommend kee
 
 !!! recommendation
 
-    ![Tor Browser logo](/assets/img/browsers/tor.svg){ align=right }
+    ![Tor Browser logo](assets/img/browsers/tor.svg){ align=right }
 
     **Tor Browser** is the choice if you need anonymity. This browser provides you with access to the Tor Bridges and [Tor Network](https://en.wikipedia.org/wiki/Tor_(network)), along with extensions that can be automatically configured to fit its three security levels - *Standard*, *Safer* and *Safest*. We recommend that you do not change any of Tor Browser's default configurations outside of the standard security levels.
 
@@ -36,7 +36,7 @@ These are our current web browser recommendations and settings. We recommend kee
 
 !!! recommendation
 
-    ![Firefox logo](/assets/img/browsers/firefox.svg){ align=right }
+    ![Firefox logo](assets/img/browsers/firefox.svg){ align=right }
 
     **Firefox** provides strong privacy settings such as [Enhanced Tracking Protection](https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop), which can help block various [types of tracking](https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop#w_what-enhanced-tracking-protection-blocks).
 
@@ -95,11 +95,11 @@ You can still stay logged into websites by allowing exceptions.
 
 #### Sync
 
-The [Firefox sync](https://hacks.mozilla.org/2018/11/firefox-sync-privacy/) service is end-to-end encrypted.
+The [Firefox Sync](https://hacks.mozilla.org/2018/11/firefox-sync-privacy/) service is end-to-end encrypted.
 
 #### Extensions
 
-We generally do not recommend installing any extensions as they increase your [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [uBlock Origin](/browsers/#additional-resources) might be useful to you. The extension is also a 🏆️ [Recommended Extension](https://support.mozilla.org/kb/add-on-badges#w_recommended-extensions) by Mozilla.
+We generally do not recommend installing any extensions as they increase your [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [uBlock Origin](#additional-resources) might be useful to you. The extension is also a 🏆️ [Recommended Extension](https://support.mozilla.org/kb/add-on-badges#w_recommended-extensions) by Mozilla.
 
 #### Arkenfox (advanced)
 
@@ -115,7 +115,7 @@ On iOS, any app that can browse the web is [restricted](https://developer.apple.
 
 !!! recommendation
 
-    ![Bromite logo](/assets/img/browsers/bromite.svg){ align=right }
+    ![Bromite logo](assets/img/browsers/bromite.svg){ align=right }
 
     **Bromite** is a [Chromium](https://en.wikipedia.org/wiki/Chromium_(web_browser))-based browser with privacy and security enhancements, built-in ad blocking, and some fingerprinting randomization.
 
@@ -145,7 +145,7 @@ These options can be found in *Privacy and Security* ( ⁝ → ⚙️ Settings
 
 !!! recommendation
 
-    ![Safari logo](/assets/img/browsers/safari.svg){ align=right }
+    ![Safari logo](assets/img/browsers/safari.svg){ align=right }
 
     **Safari** is the default browser in iOS. It includes [privacy features](https://support.apple.com/guide/iphone/browse-the-web-privately-iphb01fc3c85/15.0/ios/15.0) such as Intelligent Tracking Protection, Privacy Report, isolated Private Browsing tabs, iCloud Private Relay, and automatic HTTPS upgrades.
 
@@ -197,7 +197,7 @@ If you use iCloud, we also recommend checking to ensure Safari's default downloa
 
 #### Extensions
 
-We generally do not recommend installing [any extensions](https://www.sentinelone.com/blog/inside-safari-extensions-malware-golden-key-user-data/) as they increase your browser's [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [AdGuard for Safari](/browsers/#additional-resources) might be useful to you.
+We generally do not recommend installing [any extensions](https://www.sentinelone.com/blog/inside-safari-extensions-malware-golden-key-user-data/) as they increase your browser's [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [AdGuard for Safari](#additional-resources) might be useful to you.
 
 ## Additional Resources
 
@@ -205,7 +205,7 @@ We generally do not recommend installing [any extensions](https://www.sentinelon
 
 !!! recommendation
 
-    ![uBlock Origin logo](/assets/img/browsers/ublock_origin.svg){ align=right }
+    ![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ align=right }
 
     **uBlock Origin** is a popular content blocker that could help you block ads, trackers, and fingerprinting scripts.
 
@@ -230,7 +230,7 @@ uBlock Origin also has different [blocking modes](https://github.com/gorhill/uBl
 
 !!! recommendation
 
-    ![AdGuard logo](/assets/img/browsers/adguard.svg){ align=right }
+    ![AdGuard logo](assets/img/browsers/adguard.svg){ align=right }
 
     **AdGuard for Safari** is a free and open-source content-blocking extension for Safari that uses the native [Content Blocker API](https://developer.apple.com/documentation/safariservices/creating_a_content_blocker). 
     
@@ -255,7 +255,7 @@ There is also [AdGuard for iOS](https://adguard.com/en/adguard-ios/overview.html
 
 !!! recommendation
 
-    ![Terms of Service; Didn't Read logo](/assets/img/browsers/terms_of_service_didnt_read.svg){ align=right }
+    ![Terms of Service; Didn't Read logo](assets/img/browsers/terms_of_service_didnt_read.svg){ align=right }
 
     **Terms of Service; Didn't Read** grades websites based on their terms of service agreements and privacy policies. It also gives short summaries of those agreements. The analyses and ratings are published transparently by a community of reviewers.
 

docs/calendar-contacts.en.md

@@ -1,19 +1,19 @@
 ---
-title: Calendar and Contact Sync Tools
+title: "Calendar and Contact Sync"
 icon: material/calendar
 ---
 Calendaring and contacts are some of the most sensitive data posess. Use only products that use end-to-end encryption (E2EE) at rest. This prevents a provider from reading your data.
 
 ## Software as a service (SaaS) only
 
-These products are included with an subscription to the respective [email providers](/email).
+These products are included with an subscription to the respective [email providers](email.md).
 
 ### Tutanota
 
 !!! recommendation
 
-    ![Tutanota logo](/assets/img/calendar-contacts/tutanota.svg#only-light){ align=right }
-    ![Tutanota logo](/assets/img/calendar-contacts/tutanota-dark.svg#only-dark){ align=right }
+    ![Tutanota logo](assets/img/calendar-contacts/tutanota.svg#only-light){ align=right }
+    ![Tutanota logo](assets/img/calendar-contacts/tutanota-dark.svg#only-dark){ align=right }
 
     **Tutanota** has an [encrypted calendar](https://tutanota.com/blog/posts/free-encrypted-calendar/) in their desktop and mobile clients.
 
@@ -33,7 +33,7 @@ These products are included with an subscription to the respective [email provid
 
 !!! recommendation
 
-    ![Proton Calendar logo](/assets/img/calendar-contacts/proton-calendar.svg){ align=right }
+    ![Proton Calendar logo](assets/img/calendar-contacts/proton-calendar.svg){ align=right }
 
     **Proton Calendar** is an calendar app that is available to ProtonMail users. All data stored within it is end-to-end encrypted when stored on ProtonMail's servers.
 
@@ -51,7 +51,7 @@ Some of these options are self-hostable, or able to be hosted by third party pro
 
 !!! recommendation
 
-    ![EteSync logo](/assets/img/calendar-contacts/etesync.svg){ align=right }
+    ![EteSync logo](assets/img/calendar-contacts/etesync.svg){ align=right }
 
     **EteSync** is a secure, end-to-end encrypted, and privacy-respecting cloud backup and synchronization software for your personal information (e.g. contacts and calendars). There are native clients for Android, iOS, and the web, and an adapter layer for most desktop clients.
 
@@ -70,7 +70,7 @@ Some of these options are self-hostable, or able to be hosted by third party pro
 
 !!! recommendation
 
-    ![Nextcloud logo](/assets/img/calendar-contacts/nextcloud.svg){ align=right }
+    ![Nextcloud logo](assets/img/calendar-contacts/nextcloud.svg){ align=right }
 
     **Nextcloud** is a suite of client-server software for creating and using file hosting services. This includes calendar sync via CalDAV and contacts sync via CardDAV. Nextcloud is free and open-source, thereby allowing anyone to install and operate it without charge on a private server.
 
@@ -92,11 +92,11 @@ Some of these options are self-hostable, or able to be hosted by third party pro
 
 !!! recommendation
 
-    ![DecSync logo](/assets/img/calendar-contacts/decsync.svg){ align=right }
+    ![DecSync logo](assets/img/calendar-contacts/decsync.svg){ align=right }
 
-    **DecSync CC** synchronizes contacts, calendars and tasks using DecSync. It stores this data in a shared directory, using [Syncthing](/file-sharing/#syncthing), or any other file synchronization service.
+    **DecSync CC** synchronizes contacts, calendars and tasks using DecSync. It stores this data in a shared directory, using [Syncthing](file-sharing/#syncthing), or any other file synchronization service.
 
-    There are [plugins](https://github.com/39aldo39/DecSync#rss) to sync other types of data such as [RSS](/news-aggregators).
+    There are [plugins](https://github.com/39aldo39/DecSync#rss) to sync other types of data such as [RSS](news-aggregators.md).
 
     [Visit github.com](https://github.com/39aldo39/DecSync){ .md-button .md-button--primary }
 

docs/cloud.en.md

@@ -1,5 +1,5 @@
 ---
-title: Cloud Storage
+title: "Cloud Storage"
 icon: material/file-cloud
 ---
 If you are currently using a Cloud Storage Service like Dropbox, Google Drive, Microsoft OneDrive or Apple iCloud, you are putting complete trust in your service provider to not look at your files.
@@ -10,7 +10,7 @@ Trust your provider by using an alternative below that supports [end-to-end encr
 
 !!! recommendation
 
-    ![Nextcloud logo](/assets/img/cloud/nextcloud.svg){ align=right }
+    ![Nextcloud logo](assets/img/cloud/nextcloud.svg){ align=right }
 
     **Nextcloud** is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control. It also comes with experimental end-to-end encryption (E2EE).
 
@@ -36,7 +36,7 @@ When self hosting Nextcloud, you should also remember to enable E2EE to protect
 
 !!! recommendation
 
-    ![Proton Drive logo](/assets/img/cloud/protondrive.svg){ align=right }
+    ![Proton Drive logo](assets/img/cloud/protondrive.svg){ align=right }
 
     **Proton Drive** is an end-to-end encrypted (E2EE) general file storage service by the popular encrypted email provider [ProtonMail](https://protonmail.com).
 
@@ -47,7 +47,7 @@ When self hosting Nextcloud, you should also remember to enable E2EE to protect
 
 Proton Drive is currently in beta and only is only available through a web client.
 
-When using a web client, you are placing trust in the server to send you proper JavaScript code to derive the decryption key and authentication token locally in your browser. A compromised server can send you malicious JavaScript code to steal your master password and decrypt your data. If this does not fit your [threat model](/threat-modeling/), consider using an alternative.
+When using a web client, you are placing trust in the server to send you proper JavaScript code to derive the decryption key and authentication token locally in your browser. A compromised server can send you malicious JavaScript code to steal your master password and decrypt your data. If this does not fit your [threat model](threat-modeling.md), consider using an alternative.
 
 ### Cryptee
 

docs/dns.en.md

@@ -0,0 +1,122 @@
+---
+title: "DNS Resolvers"
+icon: material/dns
+---
+
+!!! faq "Should I use encrypted DNS?"
+
+    Encrypted DNS with third party servers should only be used to get around basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences. Encrypted DNS will not help you hide any of your browsing activity.
+
+    [Learn more about DNS](technology/dns.md){ .md-button }
+
+## Recommended Providers
+
+| DNS Provider | Privacy Policy | Type | Protocols | Logging | ECS | Filtering |
+| ------------ | -------------- | ---- | --------- | ------- | --- | --------- |
+| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Commercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^1] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS)
+| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/) | Commercial | Cleartext <br> DoH <br> DoT | Some[^2] | No | Based on server choice.|
+| [**ControlD**](https://controld.com) | [:octicons-link-external-24:](https://controld.com/privacy) | Commercial | Cleartext <br> DoH <br> DoT | Optional[^3] | No |  Based on server choice.  |
+| [**MullvadDNS**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy/) | Commercial | DoH <br> DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock)
+| [**NextDNS**](https://www.nextdns.io) | [:octicons-link-external-24:](https://www.nextdns.io/privacy) | Commercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Optional[^5] | Optional | Based on server choice. |
+| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy/) | Non-Profit | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional |  Based on server choice, Malware blocking by default. |
+
+[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
+[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/)
+[^3]: Neither free nor premium users of ControlD have logging enabled by default. Premium users can enable logging/analytics at will. [https://controld.com/privacy](https://controld.com/privacy)
+[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy/)
+[^5]: NextDNS can provide insights and logging features on an opt-in basis. Users can choose retention times and log storage locations for any logs they choose to keep. If not specifically requested by the user, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
+[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://www.quad9.net/privacy/policy/](https://www.quad9.net/privacy/policy/)
+
+The criteria for the servers listed above are:
+
+- Must support [DNSSEC](technology/dns.md#what-is-dnssec-and-when-is-it-used)
+- Must have [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support
+- [QNAME Minimization](technology/dns.md#what-is-qname-minimization)
+- Allow for [ECS](technology/dns.md#what-is-edns-client-subnet-ecs) to be disabled
+
+## Native Operating System Support
+
+### Android
+
+Android 9 and above support DNS over TLS. Android 13 will support DNS over HTTPS. The settings can be found in: **Settings** &rarr; **Network & Internet** &rarr; **Private DNS**.
+
+### Apple Devices
+
+The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
+
+After installation of either a configuration profile or an app that utilizes the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
+
+#### Signed Profiles
+
+Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [ControlD](https://kb.controld.com/en/tutorials), [NextDNS](https://apple.nextdns.io), [Quad9](https://www.quad9.net/news/blog/ios-mobile-provisioning-profiles/).
+
+#### iOS/iPadOS
+
+Select **Settings** &rarr; **General** &rarr; **VPN, DNS, & Device Management** &rarr; **DNS**
+
+#### macOS
+
+Select **System Preferences &rarr; Profiles** or **System Preferences** &rarr; **Network** &rarr; **Advanced**, (depending on if you have configuration profiles installed).
+
+#### tvOS
+
+Select **Settings** &rarr; **General** &rarr; **Privacy** &rarr; **Share Apple TV Analytics** &rarr; then press the *Play* button on the remote.
+
+### Windows
+
+Windows users can [turn on DoH](https://docs.microsoft.com/en-us/windows-server/networking/dns/doh-client-support) by accessing Windows settings in the control panel.
+
+Select **Settings** &rarr; **Network & Internet** &rarr; **Ethernet or WiFi**, &rarr; **Edit DNS Settings** &rarr; **Preferred DNS encryption** &rarr; **Encrypted only (DNS over HTTPS)**.
+
+### Linux
+
+`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
+
+## Encrypted DNS Proxies
+
+Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](technology/dns.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](technology/dns.md#what-is-encrypted-dns).
+
+### RethinkDNS
+
+!!! recommendation
+
+    ![RethinkDNS logo](assets/img/android/rethinkdns.svg#only-light){ align=right }
+    ![RethinkDNS logo](assets/img/android/rethinkdns-dark.svg#only-dark){ align=right }
+
+    **RethinkDNS** is an open-source Android client supporting [DNS-over-HTTPS](technology/dns.md#dns-over-https-doh), [DNS-over-TLS](technology/dns.md#dns-over-tls-dot), [DNSCrypt](technology/dns.md#dnscrypt) and DNS Proxy along with caching DNS responses, locally logging DNS queries and can be used as a firewall too.
+
+    [Visit rethinkdns.com](https://rethinkdns.com){ .md-button .md-button--primary } [Privacy Policy](https://rethinkdns.com/privacy){ .md-button }
+
+    **Downloads**
+    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=com.celzero.bravedns)
+    - [:pg-f-droid: F-Droid](https://f-droid.org/packages/com.celzero.bravedns)
+    - [:fontawesome-brands-github: Source](https://github.com/celzero/rethink-app)
+
+### DNSCloak
+
+!!! recommendation
+
+    ![DNSCloak logo](assets/img/ios/dnscloak.png){ align=right }
+
+    **DNSCloak** is an open-source iOS client supporting [DNS-over-HTTPS](technology/dns.md#dns-over-https-doh), [DNSCrypt](technology/dns.md#dnscrypt), and [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy/wiki) options such as caching DNS responses, locally logging DNS queries, and custom block lists. Users can [add custom resolvers by DNS stamp](https://medium.com/privacyguides/adding-custom-dns-over-https-resolvers-to-dnscloak-20ff5845f4b5).
+
+    [Visit github.com](https://github.com/s-s/dnscloak/blob/master/README.md){ .md-button .md-button--primary } [Privacy Policy](https://drive.google.com/file/d/1050No_pU74CAWUS5-BwQWyO2x_aiMzWc/view){ .md-button }
+
+    **Downloads**
+    - [:fontawesome-brands-app-store-ios: App Store](https://apps.apple.com/app/id1452162351)
+    - [:fontawesome-brands-github: Source](https://github.com/s-s/dnscloak)
+
+### dnscrypt-proxy
+
+!!! recommendation
+
+    ![dnscrypt-proxy logo](assets/img/dns/dnscrypt-proxy.svg){ align=right }
+
+    **dnscrypt-proxy** is a DNS proxy with support for [DNSCrypt](technology/dns.md#dnscrypt), [DNS-over-HTTPS](technology/dns.md#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS).
+
+    [Visit github.com](https://github.com/DNSCrypt/dnscrypt-proxy/wiki){ .md-button .md-button--primary } [Privacy Policy](https://www.libreoffice.org/about-us/privacy/privacy-policy-en/){ .md-button }
+
+    **Downloads**
+    - [:fontawesome-brands-github: Source](https://github.com/DNSCrypt/dnscrypt-proxy)
+
+!!! warning "The anonymized DNS feature does [**not**](technology/dns.md#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic."

docs/dns.md

@@ -1,112 +0,0 @@
----
-title: "DNS Resolvers"
-icon: material/dns
----
-
-!!! faq "Should I use encrypted DNS?"
-
-    Encrypted DNS with third party servers should only be used to get around basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences. Encrypted DNS will not help you hide any of your browsing activity.
-
-    [Learn more about DNS](technology/dns.md){ .md-button }
-
-## Recommended Providers
-
-| DNS Provider | Privacy Policy | Type | Protocols | Logging | ECS | Filtering |
-| ------------ | -------------- | ---- | --------- | ------- | --- | --------- |
-| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Commercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^1] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS)
-| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/) | [:octicons-link-external-24:](https://www.cloudflare.com/privacypolicy) | Commercial | Cleartext <br> DoH <br> DoT | Some[^2] | No | Based on server choice.|
-| [**ControlID**](https://controld.com) | [:octicons-link-external-24:](https://controld.com/privacy) | Commercial | Cleartext <br> DoH <br> DoT | Optional[^3] | No |  Based on server choice.  |
-| [**MullvadDNS**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/privacy-policy/) [^4] | Commercial | DoH <br> DoT | No | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock)
-| [**NextDNS**](https://www.nextdns.io) | [:octicons-link-external-24:](https://www.nextdns.io/privacy) | Commercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Optional[^5] | Optional | Based on server choice. |
-| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/service/privacy) | Non-Profit | Cleartext <br> DoH <br> DoT <br> DNSCrypt | No | Optional |  Based on server choice, Malware blocking by default. |
-
-[^1]: We store aggregated performance metrics of our DNS server, namely the number of complete requests to a particular server, the number of blocked requests, the speed of processing requests. We keep and store the database of domains requested in the last 24 hours. We need this information to identify and block new trackers and threats. We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters.
-[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is only stored for 25 hours.
-[^3]: Neither free nor premium service have logging enabled by default. Premium users can enable logging/analytics at will.
-[^4]: Our public DNS service offers DNS over HTTPS (DoH) and DNS over TLS (DoT), with QNAME minimization and basic ad blocking. It has been audited by the security experts at Assured. You can use this privacy-enhancing service even if you don't use Mullvad.
-[^5]: NextDNS can provide insights and logging features on an opt-in basis. Users can choose retention times and log storage locations for any logs they choose to keep.
-
-The criteria for servers for this table are:
-
-- Must support [DNSSEC](technology/dns.md#what-is-dnssec-and-when-is-it-used)
-- Must have [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support
-- [QNAME Minimization](technology/dns.md#what-is-qname-minimization)
-
-## Native Operating System Support
-
-### Android
-
-Android 9 and above support DNS over TLS. Android 13 will support DNS over HTTPS. The settings can be found in: *Settings* &rarr; *Network & Internet* &rarr; *Private DNS*.
-
-### Apple Devices
-
-The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
-
-After installation of either a configuration profile or an app that utilizes the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
-
-- **iOS/iPadOS:** *Settings &rarr; General &rarr; VPN, DNS, & Device Management &rarr; DNS*
-- **macOS:** *System Preferences &rarr; Profiles* & *System Preferences &rarr; Network*
-- **tvOS:** *Settings &rarr; General &rarr; Privacy &rarr;* hover on "*Share Apple TV Analytics*" &rarr; press the play button on the remote
-
-Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
-
-- **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [ControlD](https://kb.controld.com/en/tutorials), [NextDNS](https://apple.nextdns.io), [Quad9](https://www.quad9.net/news/blog/ios-mobile-provisioning-profiles/).
-
-### Windows
-
-Windows users can [turn on DoH](https://docs.microsoft.com/en-us/windows-server/networking/dns/doh-client-support) by accessing Windows settings in the control panel.
-
-Select *Settings* &rarr; *Network & Internet* &rarr; *Ethernet* or *WiFi*, &rarr; *Edit DNS Settings* &rarr; Preferred DNS encryption &rarr; *Encrypted only (DNS over HTTPS)*.
-
-### Linux
-
-`systemd-resolved` doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639), which many Linux distributions use to do their DNS lookups. If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
-
-## Encrypted DNS Proxies
-
-Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](/dns/#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](/dns/#what-is-encrypted-dns).
-
-### RethinkDNS
-
-!!! recommendation
-
-    ![RethinkDNS logo](/assets/img/android/rethinkdns.svg#only-light){ align=right }
-    ![RethinkDNS logo](/assets/img/android/rethinkdns-dark.svg#only-dark){ align=right }
-
-    **RethinkDNS** is an open-source Android client supporting [DNS-over-HTTPS](/dns/#dns-over-https-doh), [DNS-over-TLS](/dns/#dns-over-tls-dot), [DNSCrypt](/dns/#dnscrypt) and DNS Proxy along with caching DNS responses, locally logging DNS queries and can be used as a firewall too.
-
-    [Visit rethinkdns.com](https://rethinkdns.com){ .md-button .md-button--primary } [Privacy Policy](https://rethinkdns.com/privacy){ .md-button }
-
-    **Downloads**
-    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=com.celzero.bravedns)
-    - [:pg-f-droid: F-Droid](https://f-droid.org/packages/com.celzero.bravedns)
-    - [:fontawesome-brands-github: Source](https://github.com/celzero/rethink-app)
-
-### DNSCloak
-
-!!! recommendation
-
-    ![DNSCloak logo](/assets/img/ios/dnscloak.png){ align=right }
-
-    **DNSCloak** is an open-source iOS client supporting [DNS-over-HTTPS](/dns/#dns-over-https-doh), [DNSCrypt](/dns/#dnscrypt), and [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy/wiki) options such as caching DNS responses, locally logging DNS queries, and custom block lists. Users can [add custom resolvers by DNS stamp](https://medium.com/privacyguides/adding-custom-dns-over-https-resolvers-to-dnscloak-20ff5845f4b5).
-
-    [Visit github.com](https://github.com/s-s/dnscloak/blob/master/README.md){ .md-button .md-button--primary } [Privacy Policy](https://drive.google.com/file/d/1050No_pU74CAWUS5-BwQWyO2x_aiMzWc/view){ .md-button }
-
-    **Downloads**
-    - [:fontawesome-brands-app-store-ios: App Store](https://apps.apple.com/app/id1452162351)
-    - [:fontawesome-brands-github: Source](https://github.com/s-s/dnscloak)
-
-### dnscrypt-proxy
-
-!!! recommendation
-
-    ![dnscrypt-proxy logo](/assets/img/dns/dnscrypt-proxy.svg){ align=right }
-
-    **dnscrypt-proxy** is a DNS proxy with support for [DNSCrypt](/dns/#dnscrypt), [DNS-over-HTTPS](/dns/#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS).
-
-    [Visit github.com](https://github.com/DNSCrypt/dnscrypt-proxy/wiki){ .md-button .md-button--primary } [Privacy Policy](https://www.libreoffice.org/about-us/privacy/privacy-policy-en/){ .md-button }
-
-    **Downloads**
-    - [:fontawesome-brands-github: Source](https://github.com/DNSCrypt/dnscrypt-proxy)
-
-!!! warning "The anonymized DNS feature does [**not**](/dns#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic."

docs/email-clients.en.md

@@ -1,21 +1,21 @@
 ---
-title: Email Clients
+title: "Email Clients"
 icon: material/email-open
 ---
-Our recommendation list contains email clients that support both [OpenPGP](/encryption/#openpgp) and strong authentication such as [Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth). OAuth allows you to use [Multi-Factor Authentication](/multi-factor-authentication) and prevent account theft.
+Our recommendation list contains email clients that support both [OpenPGP](encryption.md#openpgp) and strong authentication such as [Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth). OAuth allows you to use [Multi-Factor Authentication](multi-factor-authentication) and prevent account theft.
 
 ??? Attention "Email does not provide forward secrecy"
-    When using end-to-end encryption (E2EE) technology like [OpenPGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy), email will still have [some metadata](/email/#email-metadata-overview) that is not encrypted in the header of the email.
+    When using end-to-end encryption (E2EE) technology like [OpenPGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy), email will still have [some metadata](email.md#email-metadata-overview) that is not encrypted in the header of the email.
 
-    OpenPGP also does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed: [How do I protect my private keys?](/email/#email-encryption-overview). Consider using a medium that forward secrecy:
+    OpenPGP also does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed: [How do I protect my private keys?](email.md#email-encryption-overview). Consider using a medium that provides forward secrecy:
 
-    [Real-time Communication](/real-time-communication){ .md-button .md-button--primary }
+    [Real-time Communication](real-time-communication.md){ .md-button .md-button--primary }
 
 ### Thunderbird
 
 !!! recommendation
 
-    ![Thunderbird logo](/assets/img/email-clients/thunderbird.svg){ align=right }
+    ![Thunderbird logo](assets/img/email-clients/thunderbird.svg){ align=right }
 
     **Thunderbird** is a free, open source, cross-platform email, newsgroup, news feed, and chat (XMPP, IRC, Twitter) client developed by the Thunderbird community, and previously by the Mozilla Foundation.
 
@@ -32,12 +32,12 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Apple Mail logo](/assets/img/email-clients/applemail.png){ align=right }
+    ![Apple Mail logo](assets/img/email-clients/applemail.png){ align=right }
 
-    **Apple Mail** is included in macOS and can be extended to have OpenPGP support with [GPG Suite](/encryption/#gpg-suite), which adds the ability to send encrypted email.
+    **Apple Mail** is included in macOS and can be extended to have OpenPGP support with [GPG Suite](encryption/#gpg-suite), which adds the ability to send encrypted email.
 
     !!! note
-        For iOS devices we suggest [Canary Mail](/email-clients/#canary-mail) as it has PGP support which means you can send end-to-end encrypted email.
+        For iOS devices we suggest [Canary Mail](#canary-mail) as it has PGP support which means you can send end-to-end encrypted email.
 
     [Visit apple.com](https://support.apple.com/guide/mail/welcome/mac){ .md-button .md-button--primary } [Privacy Policy](https://www.apple.com/legal/privacy/en-ww/){ .md-button }
 
@@ -45,7 +45,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Evolution logo](/assets/img/email-clients/evolution.svg){ align=right }
+    ![Evolution logo](assets/img/email-clients/evolution.svg){ align=right }
 
     **Evolution** is a personal information management application that provides integrated mail, calendaring and address book functionality. Evolution has extensive [documentation](https://help.gnome.org/users/evolution/stable/) to help you get started.
 
@@ -59,7 +59,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Kontact logo](/assets/img/email-clients/kontact.svg){ align=right }
+    ![Kontact logo](assets/img/email-clients/kontact.svg){ align=right }
 
     **Kontact** is a personal information manager (PIM) application from the [KDE](https://kde.org) project. It provides a mail client, address book, organizer and RSS client.
 
@@ -74,7 +74,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Mailvelope logo](/assets/img/email-clients/mailvelope.svg){ align=right }
+    ![Mailvelope logo](assets/img/email-clients/mailvelope.svg){ align=right }
 
     **Mailvelope** is a browser extension that enables the exchange of encrypted emails following the OpenPGP encryption standard.
 
@@ -90,7 +90,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![K-9 Mail logo](/assets/img/email-clients/k9mail.svg){ align=right }
+    ![K-9 Mail logo](assets/img/email-clients/k9mail.svg){ align=right }
 
     **K-9 Mail** is an independent mail application that supports both POP3 and IMAP mailboxes, but only supports push mail for IMAP.
 
@@ -105,7 +105,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![FairEmail logo](/assets/img/email-clients/fairemail.svg){ align=right }
+    ![FairEmail logo](assets/img/email-clients/fairemail.svg){ align=right }
 
     **FairEmail** is a minimal, open source email app, using open standards (IMAP, SMTP, OpenPGP) with a low data and battery usage.
 
@@ -120,7 +120,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Canary Mail logo](/assets/img/email-clients/canarymail.svg){ align=right }
+    ![Canary Mail logo](assets/img/email-clients/canarymail.svg){ align=right }
 
     **Canary Mail** is a paid email client designed to make end-to-end encryption seamless with security features such as a biometric app lock.
 
@@ -138,15 +138,15 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 Canary Mail is closed source. We recommend it, due to the few choices there are for email clients on iOS that support [Pretty Good Privacy (PGP)](https://en.wikipedia.org/wiki/Pretty_Good_Privacy), end-to-end encryption (E2EE).
 
-### Neomutt
+### NeoMutt
 
 !!! recommendation
 
-    ![Neomutt logo](/assets/img/email-clients/mutt.svg){ align=right }
+    ![NeoMutt logo](assets/img/email-clients/mutt.svg){ align=right }
 
     NeoMutt is an open-source command line mail reader (or MUA) for Linux and BSD. It's a fork of [Mutt](https://en.wikipedia.org/wiki/Mutt_(email_client)) with added features.
-    
-    Neomut is a text-based client that has a steep learning curve. It is however, very customizable.
+
+    NeoMutt is a text-based client that has a steep learning curve. It is however, very customizable.
 
     [Visit neomutt.org](https://neomutt.org){ .md-button .md-button--primary }
 

docs/email.en.md

@@ -1,5 +1,5 @@
 ---
-title: Private Email Providers
+title: "Private Email Providers"
 icon: material/email
 ---
 
@@ -23,11 +23,11 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![ProtonMail logo](/assets/img/email/protonmail.svg){ align=right }
+    ![ProtonMail logo](assets/img/email/protonmail.svg){ align=right }
 
     **ProtonMail** is an email service with a focus on privacy, encryption, security, and ease of use. They have been in operation since **2013**. ProtonMail is based in Genève, Switzerland. Accounts start with 500 MB storage with their free plan.
 
-    Free accounts have some limitations, such as not being able to search body text and not having access to [ProtonMail Bridge](https://protonmail.com/bridge), which is required to use a [recommended desktop email client](/email-clients) (e.g. Thunderbird). Paid accounts are available starting at **€48/y** which include features like ProtonMail Bridge, additional storage, and custom domain support.
+    Free accounts have some limitations, such as not being able to search body text and not having access to [ProtonMail Bridge](https://protonmail.com/bridge), which is required to use a [recommended desktop email client](email-clients.md) (e.g. Thunderbird). Paid accounts are available starting at **€48/y** which include features like ProtonMail Bridge, additional storage, and custom domain support.
 
     **Free**
 
@@ -67,7 +67,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![Mailbox.org logo](/assets/img/email/mailboxorg.svg){ align=right }
+    ![Mailbox.org logo](assets/img/email/mailboxorg.svg){ align=right }
 
     **Mailbox.org** is an email service with a focus on being secure, ad-free, and privately powered by 100% eco-friendly energy. They have been in operation since 2014. Mailbox.org is based in Berlin, Germany. Accounts start with 2 GB of storage, which can be upgraded as needed.
 
@@ -91,7 +91,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
     Mailbox.org allows for encryption of incoming mail using their [encrypted mailbox](https://kb.mailbox.org/display/MBOKBEN/The+Encrypted+Mailbox). New messages that you receive will then be immediately encrypted with your public key.
 
-    However, [Open-Exchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox.org, [does not support](https://kb.mailbox.org/display/BMBOKBEN/Encryption+of+calendar+and+address+book) the encryption of your address book and calendar. A [standalone option](/calendar-contacts) may be more appropriate for that information.
+    However, [Open-Exchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox.org, [does not support](https://kb.mailbox.org/display/BMBOKBEN/Encryption+of+calendar+and+address+book) the encryption of your address book and calendar. A [standalone option](calendar-contacts.md) may be more appropriate for that information.
 
 ??? check "Email Encryption"
 
@@ -111,8 +111,8 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![Disroot logo](/assets/img/email/disroot.svg#only-light){ align=right }
-    ![Disroot logo](/assets/img/email/disroot-dark.svg#only-dark){ align=right }
+    ![Disroot logo](assets/img/email/disroot.svg#only-light){ align=right }
+    ![Disroot logo](assets/img/email/disroot-dark.svg#only-dark){ align=right }
 
     **Disroot** offers email amongst [other services](https://disroot.org/en/#services). The service is maintained by volunteers and its community. They have been in operation since 2015. Disroot is based in Amsterdam. Disroot is free and uses open source software such as Rainloop to provide service. Users support the service through donations and buying extra storage. The mailbox limit is 1 GB, but extra storage can be purchased 0.15€ per GB per month paid yearly.
 
@@ -136,7 +136,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
     Disroot uses full disk encryption. However, it doesn't appear to be "zero access", meaning it is technically possible for them to decrypt the data they have if it is not additionally encrypted with a tool like OpenPGP.
 
-    Disroot also uses the standard [CalDAV](https://en.wikipedia.org/wiki/CalDAV) and [CardDAV](https://en.wikipedia.org/wiki/CardDAV) protocols for calendars and contacts, which do not support E2EE. A [standalone option](/calendar-contacts) may be more appropriate.
+    Disroot also uses the standard [CalDAV](https://en.wikipedia.org/wiki/CalDAV) and [CardDAV](https://en.wikipedia.org/wiki/CardDAV) protocols for calendars and contacts, which do not support E2EE. A [standalone option](calendar-contacts.md) may be more appropriate.
 
 ??? check "Email Encryption"
 
@@ -154,8 +154,8 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![Tutanota logo](/assets/img/email/tutanota.svg#only-light){ align=right }
-    ![Tutanota logo](/assets/img/email/tutanota-dark.svg#only-dark){ align=right }
+    ![Tutanota logo](assets/img/email/tutanota.svg#only-light){ align=right }
+    ![Tutanota logo](assets/img/email/tutanota-dark.svg#only-dark){ align=right }
 
     **[Tutanota.com](https://tutanota.com)** is an email service with a focus on security and privacy through the use of encryption. Tutanota has been in operation since **2011** and is based in Hanover, Germany. Accounts start with 1GB storage with their free plan.
 
@@ -163,7 +163,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
     [Visit Tutanota.com](https://tutanota.com){ .md-button .md-button--primary }
 
-Tutanota [doesn't allow](https://tutanota.com/faq/#imap) the use of third-party [email clients](/email-clients). Tutanota has no plans pull email from [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) using the [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) protocol. [Email import](https://github.com/tutao/tutanota/issues/630) is currently not possible.
+Tutanota [doesn't allow](https://tutanota.com/faq/#imap) the use of third-party [email clients](email-clients.md). Tutanota has no plans pull email from [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) using the [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) protocol. [Email import](https://github.com/tutao/tutanota/issues/630) is currently not possible.
 
 Emails can be exported [individually or by bulk selection](https://tutanota.com/howto#generalMail). Tutanota does not allow for [subfolders](https://github.com/tutao/tutanota/issues/927) as you might expect with other email providers.
 
@@ -205,8 +205,8 @@ Tutanota is working on a [desktop client](https://tutanota.com/blog/posts/deskto
 
 !!! recommendation
 
-    ![StartMail logo](/assets/img/email/startmail.svg#only-light){ align=right }
-    ![StartMail logo](/assets/img/email/startmail-dark.svg#only-dark){ align=right }
+    ![StartMail logo](assets/img/email/startmail.svg#only-light){ align=right }
+    ![StartMail logo](assets/img/email/startmail-dark.svg#only-dark){ align=right }
 
     **StartMail** is an email service with a focus on security and privacy through the use of standard OpenPGP encryption. StartMail has been in operation since 2014 and is based in Boulevard 11, Zeist Netherlands. Accounts start with 10GB. They offer a 30-day trial.
 
@@ -230,7 +230,7 @@ Tutanota is working on a [desktop client](https://tutanota.com/blog/posts/deskto
 
     StartMail has [zero access encryption at rest](https://www.startmail.com/en/whitepaper/#_Toc458527835), using their "user vault" system. When a user logs in, the vault is opened, and the email is then moved to the vault out of the queue where it is decrypted by the corresponding private key.
 
-    StartMail supports importing [contacts](https://support.startmail.com/hc/en-us/articles/360006495557-Import-contacts) however, they are only accessible in the webmail and not through protocols such as [CalDAV](https://en.wikipedia.org/wiki/CalDAV). Contacts are also not stored using zero knowledge encryption, so a [standalone option](/calendar-contacts) may be more appropriate.
+    StartMail supports importing [contacts](https://support.startmail.com/hc/en-us/articles/360006495557-Import-contacts) however, they are only accessible in the webmail and not through protocols such as [CalDAV](https://en.wikipedia.org/wiki/CalDAV). Contacts are also not stored using zero knowledge encryption, so a [standalone option](calendar-contacts.md) may be more appropriate.
 
 ??? check "Email Encryption"
 
@@ -248,8 +248,8 @@ Tutanota is working on a [desktop client](https://tutanota.com/blog/posts/deskto
 
 !!! recommendation
 
-    ![CTemplar Logo](/assets/img/email/ctemplar.svg#only-light){ align=right }
-    ![CTemplar Logo](/assets/img/email/ctemplar-dark.svg#only-dark){ align=right }
+    ![CTemplar Logo](assets/img/email/ctemplar.svg#only-light){ align=right }
+    ![CTemplar Logo](assets/img/email/ctemplar-dark.svg#only-dark){ align=right }
 
     **CTemplar** is an email service with a focus on security and privacy through the use of standard OpenPGP encryption. CTemplar has been in operation since **2018** and is run from Iceland. Paid accounts start with 5GB. They offer free accounts by [invitation](https://ctemplar.com/email-creation-restriction/).
 
@@ -427,7 +427,7 @@ There is another standard that was popular with business called [S/MIME](https:/
 
 ### What software can I use to get E2EE?
 
-Email providers which allow you to use standard access protocols like [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) and [SMTP](https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol) can be used with any of the [email clients we recommend](/email-clients). This can be less secure as you are now relying on email providers to ensure that their encryption implementation works and has not been compromised in anyway.
+Email providers which allow you to use standard access protocols like [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) and [SMTP](https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol) can be used with any of the [email clients we recommend](email-clients.md). This can be less secure as you are now relying on email providers to ensure that their encryption implementation works and has not been compromised in anyway.
 
 ### How do I protect my private keys?
 
@@ -465,14 +465,14 @@ When emails travel between email providers an encrypted connection is negotiated
 
 !!! recommendation
 
-    ![AnonAddy logo](/assets/img/email/anonaddy.svg#only-light){ align=right }
-    ![AnonAddy logo](/assets/img/email/anonaddy-dark.svg#only-dark){ align=right }
+    ![AnonAddy logo](assets/img/email/anonaddy.svg#only-light){ align=right }
+    ![AnonAddy logo](assets/img/email/anonaddy-dark.svg#only-dark){ align=right }
 
     **[AnonAddy](https://anonaddy.com)** lets users create aliases that forward to their email address. Can be self-hosted. [Source code on GitHub](https://github.com/anonaddy/anonaddy). 
 
 !!! recommendation
 
-    ![Simplelogin logo](/assets/img/email/simplelogin.svg){ align=right }
+    ![Simplelogin logo](assets/img/email/simplelogin.svg){ align=right }
 
     **[SimpleLogin](https://simplelogin.io)** allows you to easily create aliases for your email. Can be self-hosted. [Source code on GitHub](https://github.com/simple-login/app).
 
@@ -484,13 +484,13 @@ Advanced users may consider setting up their own email server. Mailservers requi
 
 !!! recommendation
 
-    ![Mail-in-a-Box logo](/assets/img/email/mail-in-a-box.svg){ align=right }
+    ![Mail-in-a-Box logo](assets/img/email/mail-in-a-box.svg){ align=right }
 
     **[Mail-in-a-Box](https://mailinabox.email)** is an automated setup script for deploying a mail server on Ubuntu. Its goal is to make it easier for users to set up their own mail server.
 
 !!! recommendation
 
-    ![Mailcow logo](/assets/img/email/mailcow.svg){ align=right }
+    ![Mailcow logo](assets/img/email/mailcow.svg){ align=right }
 
     **[Mailcow](https://mailcow.email)** is a more advanced mail server perfect for those with a bit more Linux experience. It has everything you need in a Docker container: A mailserver with DKIM support, antivirus and spam monitoring, webmail and ActiveSync with SOGo, and web-based administration with 2FA support. **[Mailcow Dockerized docs](https://mailcow.github.io/mailcow-dockerized-docs/)**
 

docs/encryption.en.md

@@ -1,5 +1,5 @@
 ---
-title: Encryption Software
+title: "Encryption Software"
 icon: material/file-lock
 ---
 Encryption of data is the only way to control who can access it. If you are currently not using encryption software for your hard disk, emails, or files, you should pick an option here.
@@ -12,8 +12,8 @@ The options listed here are multi-platform and great for creating encrypted back
 
 !!! recommendation
 
-    ![VeraCrypt logo](/assets/img/encryption-software/veracrypt.svg#only-light){ align=right }
-    ![VeraCrypt logo](/assets/img/encryption-software/veracrypt-dark.svg#only-dark){ align=right }
+    ![VeraCrypt logo](assets/img/encryption-software/veracrypt.svg#only-light){ align=right }
+    ![VeraCrypt logo](assets/img/encryption-software/veracrypt-dark.svg#only-dark){ align=right }
 
     **VeraCrypt** is a source-available freeware utility used for on-the-fly encryption. It can create a virtual encrypted disk within a file, encrypt a partition, or encrypt the entire storage device with pre-boot authentication.
 
@@ -35,7 +35,7 @@ Truecrypt has been [audited a number of times](https://en.wikipedia.org/wiki/Tru
 
 !!! recommendation
 
-    ![Cryptomator logo](/assets/img/encryption-software/cryptomator.svg){ align=right }
+    ![Cryptomator logo](assets/img/encryption-software/cryptomator.svg){ align=right }
 
     **Cryptomator** makes it easy for you to upload files to the cloud in a virtual encrypted file system.
 
@@ -57,7 +57,7 @@ Some of the Cryptomator Crypto Libraries have been [audited](https://cryptomator
 
 !!! recommendation
 
-    ![Picocrypt logo](/assets/img/encryption-software/picocrypt.svg){ align=right }
+    ![Picocrypt logo](assets/img/encryption-software/picocrypt.svg){ align=right }
 
     **Picocrypt** is a small and simple encryption tool that provides modern encryption. Picocrypt uses the secure XChaCha20 cipher and the Argon2id key derivation function to provide a high level of security. It uses Go's standard x/crypto modules for its encryption features.
 
@@ -77,7 +77,7 @@ Modern operating systems include [disk encryption](https://en.wikipedia.org/wiki
 
 !!! recommendation
 
-    ![BitLocker logo](/assets/img/encryption-software/bitlocker.png){ align=right }
+    ![BitLocker logo](assets/img/encryption-software/bitlocker.png){ align=right }
 
     **BitLocker** is the full volume encryption solution bundled with Microsoft Windows. The main reason we recommend it is because of its [use of TPM](https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/how-windows-uses-the-tpm). [ElcomSoft](https://en.wikipedia.org/wiki/ElcomSoft), a forensics company, has written about it in [Understanding BitLocker TPM Protection](https://blog.elcomsoft.com/2021/01/understanding-BitLocker-tpm-protection/).
 
@@ -122,7 +122,7 @@ BitLocker is [only supported](https://support.microsoft.com/en-us/windows/turn-o
 
 !!! recommendation
 
-    ![FileVault logo](/assets/img/encryption-software/filevault.png){ align=right }
+    ![FileVault logo](assets/img/encryption-software/filevault.png){ align=right }
 
     **FileVault** is the on-the-fly volume encryption solution built into macOS. FileVault is recommended because it [leverages](https://support.apple.com/guide/security/volume-encryption-with-filevault-sec4c6dc1b6e/web) hardware security capabilities present on an Apple silicon SoC or T2 Security Chip.
 
@@ -134,7 +134,7 @@ We recommend storing a local recovery key in a secure place as opposed to utiliz
 
 !!! recommendation
 
-    ![LUKS logo](/assets/img/encryption-software/luks.png){ align=right }
+    ![LUKS logo](assets/img/encryption-software/luks.png){ align=right }
 
     **LUKS** is the default full disk encryption method for Linux. It can be used to encrypt full volumes, partitions, or create encrypted containers.
 
@@ -170,8 +170,8 @@ Browser-based encryption can be useful when you need to encrypt a file but canno
 
 !!! recommendation
 
-    ![hat.sh logo](/assets/img/encryption-software/hat-sh.png#only-light){ align=right }
-    ![hat.sh logo](/assets/img/encryption-software/hat-sh-dark.png#only-dark){ align=right }
+    ![hat.sh logo](assets/img/encryption-software/hat-sh.png#only-light){ align=right }
+    ![hat.sh logo](assets/img/encryption-software/hat-sh-dark.png#only-dark){ align=right }
 
     **Hat.sh** is a web application that provides secure client-side file encryption in your browser. It can also be self-hosted and is useful if you need to encrypt a file but cannot install any software on your device due to organizational policies.
 
@@ -188,7 +188,7 @@ Tools with command-line interfaces are useful for intergrating [shell scripts](h
 
 !!! recommendation
 
-    ![Kryptor logo](/assets/img/encryption-software/kryptor.png){ align=right }
+    ![Kryptor logo](assets/img/encryption-software/kryptor.png){ align=right }
 
     **Kryptor** is a free and open source file encryption and signing tool that makes use of modern and secure cryptographic algorithms. It aims to be a better version of [age](https://github.com/FiloSottile/age) and [Minisign](https://jedisct1.github.io/minisign/) to provide a simple, user friendly alternative to GPG.
 
@@ -204,7 +204,7 @@ Tools with command-line interfaces are useful for intergrating [shell scripts](h
 
 !!! recommendation
 
-    ![Tomb logo](/assets/img/encryption-software/tomb.png){ align=right }
+    ![Tomb logo](assets/img/encryption-software/tomb.png){ align=right }
 
     **Tomb** is an is a command-line shell wrapper for LUKS. It supports steganography via [third-party tools](https://github.com/dyne/Tomb#how-does-it-work).
 
@@ -231,7 +231,7 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! recommendation
 
-    ![GNU Privacy Guard logo](/assets/img/encryption-software/gnupg.svg){ align=right }
+    ![GNU Privacy Guard logo](assets/img/encryption-software/gnupg.svg){ align=right }
 
     **GnuPG** is a GPL-licensed alternative to the PGP suite of cryptographic software. GnuPG is compliant with [RFC 4880](https://tools.ietf.org/html/rfc4880), which is the current IETF specification of OpenPGP. The GnuPG project has been working on an [updated draft](https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/) in an attempt to modernize OpenPGP. GnuPG is a part of the Free Software Foundation's GNU software project and has received major [funding](https://gnupg.org/blog/20220102-a-new-future-for-gnupg.html) from the German government.
 
@@ -248,7 +248,7 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! recommendation
 
-    ![GPG4win logo](/assets/img/encryption-software/gpg4win.svg){ align=right }
+    ![GPG4win logo](assets/img/encryption-software/gpg4win.svg){ align=right }
 
     **GPG4win** is a package for Windows from [Intevation and g10 Code](https://gpg4win.org/impressum.html). It includes [various tools](https://gpg4win.org/about.html) that assist PGP users on Microsoft Windows. The project was initiated and originally [funded by](https://web.archive.org/web/20190425125223/https://joinup.ec.europa.eu/news/government-used-cryptography) Germany's Federal Office for Information Security (BSI) in 2005.
 
@@ -262,9 +262,9 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! recommendation
 
-    ![GPG Suite logo](/assets/img/encryption-software/gpgsuite.png){ align=right }
+    ![GPG Suite logo](assets/img/encryption-software/gpgsuite.png){ align=right }
 
-    **GPG Suite** provides OpenPGP support for [Apple Mail](/email-clients/#apple-mail) and macOS. GPGTools GmbH costs $24€ yearly for their support plan and includes a 30-day trial.
+    **GPG Suite** provides OpenPGP support for [Apple Mail](email-clients.md#apple-mail) and macOS. GPGTools GmbH costs $24€ yearly for their support plan and includes a 30-day trial.
 
     We recommend taking a look at their [First steps](https://gpgtools.tenderapp.com/kb/how-to/first-steps-where-do-i-start-where-do-i-begin-setup-gpgtools-create-a-new-key-your-first-encrypted-email) and [Knowledge base](https://gpgtools.tenderapp.com/kb) for support.
 
@@ -276,15 +276,15 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! note
 
-    We suggest [Canary Mail](/email-clients/#canary-mail) for using PGP with email on iOS devices.
+    We suggest [Canary Mail](email-clients/#canary-mail) for using PGP with email on iOS devices.
 
 ### OpenKeychain
 
 !!! recommendation
 
-    ![OpenKeychain logo](/assets/img/encryption-software/openkeychain.svg){ align=right }
+    ![OpenKeychain logo](assets/img/encryption-software/openkeychain.svg){ align=right }
 
-    **OpenKeychain** is an Android implementation of GnuPG. It's commonly required by mail clients such as [K-9 Mail](/email-clients/#k-9-mail) and [FairEmail](/email-clients/#fairemail) and other Android apps to provide encryption support. Cure53 completed a [security audit](https://www.openkeychain.org/openkeychain-3-6) of OpenKeychain 3.6 in October 2015. Technical details about the audit and OpenKeychain's solutions can be found [here](https://github.com/open-keychain/open-keychain/wiki/cure53-Security-Audit-2015).
+    **OpenKeychain** is an Android implementation of GnuPG. It's commonly required by mail clients such as [K-9 Mail](email-clients.md#k-9-mail) and [FairEmail](email-clients.md#fairemail) and other Android apps to provide encryption support. Cure53 completed a [security audit](https://www.openkeychain.org/openkeychain-3-6) of OpenKeychain 3.6 in October 2015. Technical details about the audit and OpenKeychain's solutions can be found [here](https://github.com/open-keychain/open-keychain/wiki/cure53-Security-Audit-2015).
 
     [Visit openkeychain.org](https://www.openkeychain.org){ .md-button .md-button--primary } [Privacy Policy](https://www.openkeychain.org/help/privacy-policy){ .md-button }
 

docs/file-sharing.en.md

@@ -1,5 +1,5 @@
 ---
-title: File Sharing and Sync
+title: "File Sharing and Sync"
 icon: material/share-variant
 ---
 Discover how to privately share your files between your devices, with your friends and family, or anonymously online.
@@ -10,7 +10,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![OnionShare logo](/assets/img/file-sharing-sync/onionshare.svg){ align=right }
+    ![OnionShare logo](assets/img/file-sharing-sync/onionshare.svg){ align=right }
 
     **OnionShare** is an open-source tool that lets you securely and anonymously share a file of any size. It works by starting a web server accessible as a Tor onion service, with an unguessable URL that you can share with the recipients to download or send files.
 
@@ -26,7 +26,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![Magic Wormhole logo](/assets/img/file-sharing-sync/magic_wormhole.png){ align=right }
+    ![Magic Wormhole logo](assets/img/file-sharing-sync/magic_wormhole.png){ align=right }
 
     Magic Wormhole is a package that provides a library and a command-line tool named wormhole, which makes it possible to get arbitrary-sized files and directories (or short pieces of text) from one computer to another. Their motto: "Get things from one computer to another, safely.
 
@@ -42,7 +42,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![FreedomBox logo](/assets/img/file-sharing-sync/freedombox.svg){ align=right }
+    ![FreedomBox logo](assets/img/file-sharing-sync/freedombox.svg){ align=right }
 
     **FreedomBox** is a operating system designed to be run on a [single-board computer (SBC)](https://en.wikipedia.org/wiki/Single-board_computer). The purpose is to make it easy to set up server applications that you might want to selfhost.
 
@@ -57,7 +57,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![Syncthing logo](/assets/img/file-sharing-sync/syncthing.svg){ align=right }
+    ![Syncthing logo](assets/img/file-sharing-sync/syncthing.svg){ align=right }
 
     **Syncthing** replaces proprietary sync and cloud services with something open, trustworthy, and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third-party, and how it is transmitted over the Internet.
 
@@ -73,7 +73,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![git-annex logo](/assets/img/file-sharing-sync/gitannex.svg){ align=right }
+    ![git-annex logo](assets/img/file-sharing-sync/gitannex.svg){ align=right }
 
     **git-annex** allows managing files with git, without checking the file contents into git. While that may seem paradoxical, it is useful when dealing with files larger than git can currently easily handle, whether due to limitations in memory, time, or disk space.
 

docs/index.en.md

@@ -1,5 +1,5 @@
 ---
-template: overrides/home.html
+template: overrides/home.en.html
 hide:
   - navigation
   - toc
@@ -47,5 +47,5 @@ It's important for a website like Privacy Guides to always stay up-to-date. We n
 
 **Privacy Guides** is a non-profit, socially motivated website that provides information for protecting your data security and privacy.
 
-We do not make money from recommending certain products, and we do not utilize affiliate links. [Learn more...](about.md)
+We do not make money from recommending certain products, and we do not utilize affiliate links. [Learn more :material-arrow-right:](about.md)
 </div>

docs/linux-desktop.en.md

@@ -1,5 +1,5 @@
 ---
-title: Linux
+title: "Linux"
 icon: fontawesome/brands/linux
 ---
 Linux distributions are commonly recommended for privacy protection and user freedom. Below are some suggestions with some general privacy and security improvements.
@@ -10,7 +10,7 @@ Linux distributions are commonly recommended for privacy protection and user fre
 
 !!! recommendation
 
-    ![Fedora logo](/assets/img/linux-desktop/fedora-workstation.svg){ align=right }
+    ![Fedora logo](assets/img/linux-desktop/fedora-workstation.svg){ align=right }
 
     **Fedora Workstation** is our recommended distribution for users new to Linux. Fedora generally adopts newer technologies before other distributions e.g., [Wayland](https://wayland.freedesktop.org/), [PipeWire](https://pipewire.org), and soon, [FS-Verity](https://fedoraproject.org/wiki/Changes/FsVerityRPM). These new technologies often come with improvements in security, privacy, and usability in general.
 
@@ -22,7 +22,7 @@ Fedora has a semi-[rolling release](https://en.wikipedia.org/wiki/Rolling_releas
 
 !!! recommendation
 
-    ![openSUSE Tumbleweed logo](/assets/img/linux-desktop/opensuse-tumbleweed.svg){ align=right }
+    ![openSUSE Tumbleweed logo](assets/img/linux-desktop/opensuse-tumbleweed.svg){ align=right }
 
     **openSUSE Tumbleweed** is a stable [rolling release](https://en.wikipedia.org/wiki/Rolling_release) distribution.
 
@@ -30,13 +30,13 @@ Fedora has a semi-[rolling release](https://en.wikipedia.org/wiki/Rolling_releas
 
     [Visit get.opensuse.org](https://get.opensuse.org/tumbleweed/){ .md-button .md-button--primary }
 
-Tumbleweed follows a rolling release model where each update is released as a snapshot of the distribution. When the user upgrades their system, a new snapshot is downloaded. Each snapshot is run through a series of automated tests by the [openSUSE Build Service](https://build.opensuse.org) to ensure its quality.
+Tumbleweed follows a rolling release model where each update is released as a snapshot of the distribution. When the user upgrades their system, a new snapshot is downloaded. Each snapshot is run through a series of automated tests by [openQA](https://openqa.opensuse.org) to ensure its quality.
 
 ### Arch Linux
 
 !!! recommendation
 
-    ![Arch logo](/assets/img/linux-desktop/archlinux.svg){ align=right }
+    ![Arch logo](assets/img/linux-desktop/archlinux.svg){ align=right }
 
     **Arch Linux** is a lightweight, do-it-yourself (DIY) distribution meaning that you only get what you install. For more information see their [FAQ](https://wiki.archlinux.org/title/Frequently_asked_questions).
 
@@ -44,7 +44,7 @@ Tumbleweed follows a rolling release model where each update is released as a sn
 
 Arch Linux has a rolling release cycle. There is no fixed release schedule and packages are updated very frequently.
 
-Being a DIY distribution, the user is [expected to setup and maintain](/linux-desktop/#arch-based-distributions) their system. Arch has an [official installer](https://wiki.archlinux.org/title/Archinstall) to make the installation process a little easier.
+Being a DIY distribution, the user is [expected to setup and maintain](#arch-based-distributions) their system. Arch has an [official installer](https://wiki.archlinux.org/title/Archinstall) to make the installation process a little easier.
 
 A large portion of [Arch Linux’s packages](https://reproducible.archlinux.org) are [reproducible](https://reproducible-builds.org).
 
@@ -54,7 +54,7 @@ A large portion of [Arch Linux’s packages](https://reproducible.archlinux.org)
 
 !!! recommendation
 
-    ![Fedora Silverblue logo](/assets/img/linux-desktop/fedora-silverblue.svg){ align=right }
+    ![Fedora Silverblue logo](assets/img/linux-desktop/fedora-silverblue.svg){ align=right }
 
     **Fedora Silverblue** and **Fedora Kinoite** are immutable variants of Fedora with a strong focus on container workflows. Silverblue comes with the [GNOME](https://www.gnome.org/) desktop environment while Kinoite comes with [KDE](https://kde.org/). Silverblue and Kinoite follow the same release schedule as Fedora Workstation, benefiting from the same fast updates and staying very close to upstream.
 
@@ -64,7 +64,7 @@ Silverblue (and Kinoite) differ from Fedora Workstation as they replace the [DNF
 
 After the update is complete the user will reboot the system into the new deployment. `rpm-ostree` keeps two deployments of the system so that a user can easily rollback if something breaks in the new deployment. There is also the option to pin more deployments as needed.
 
-[Flatpak](https://www.flatpak.org) is the primary package installation method on these distrbutions, as `rpm-ostree` is only meant to overlay packages that cannot stay inside of a container on top of the base image.
+[Flatpak](https://www.flatpak.org) is the primary package installation method on these distributions, as `rpm-ostree` is only meant to overlay packages that cannot stay inside of a container on top of the base image.
 
 As an alternative to Flatpaks, there is the option of [Toolbox](https://docs.fedoraproject.org/en-US/fedora-silverblue/toolbox/) to create [Podman](https://podman.io) containers with a shared home directory with the host operating system and mimic a traditional Fedora environment, which is a [useful feature](https://containertoolbx.org) for the discerning developer.
 
@@ -72,7 +72,7 @@ As an alternative to Flatpaks, there is the option of [Toolbox](https://docs.fed
 
 !!! recommendation
 
-    ![NixOS logo](/assets/img/linux-desktop/nixos.svg){ align=right }
+    ![NixOS logo](assets/img/linux-desktop/nixos.svg){ align=right }
 
     NixOS is an independent distribution based on the Nix package manager with a focus on reproducibility and reliability.
 
@@ -84,7 +84,7 @@ NixOS also provides atomic updates; first it downloads (or builds) the packages
 
 Nix the package manager uses a purely functional language - which is also called Nix - to define packages.
 
-[Nixpkgs](https://github.com/nixos/nixpkgs) (the main source of packages) are contained in a single Github repository. You can also define your own packages in the same language and then easily include them in your config.
+[Nixpkgs](https://github.com/nixos/nixpkgs) (the main source of packages) are contained in a single GitHub repository. You can also define your own packages in the same language and then easily include them in your config.
 
 Nix is a source-based package manager; if there’s no pre-built available in the binary cache, Nix will just build the package from source using its definition. It builds each package in a sandboxed *pure* environment, which is as independent of the host system as possible, thus making binaries reproducible.
 
@@ -94,7 +94,7 @@ Nix is a source-based package manager; if there’s no pre-built available in th
 
 !!! recommendation
 
-    ![Whonix logo](/assets/img/linux-desktop/whonix.svg){ align=right }
+    ![Whonix logo](assets/img/linux-desktop/whonix.svg){ align=right }
 
     **Whonix** is based on [Kicksecure](https://www.whonix.org/wiki/Kicksecure), a security-focused fork of Debian. It aims to provide privacy, security, and anonymity on the internet.
 
@@ -104,7 +104,7 @@ Whonix is meant to run as two virtual machines: a “Workstation” and a Tor
 
 Some of its features include Tor Stream Isolation, [keystroke anonymization](https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak), [encrypted swap](https://github.com/Whonix/swap-file-creator), and a hardened memory allocator.
 
-Future versions of Whonix will likely include [full system Apparmor policies](https://github.com/Whonix/apparmor-profile-everything) and a [sandbox app launcher](https://www.whonix.org/wiki/Sandbox-app-launcher) to fully confine all processes on the system.
+Future versions of Whonix will likely include [full system AppArmor policies](https://github.com/Whonix/apparmor-profile-everything) and a [sandbox app launcher](https://www.whonix.org/wiki/Sandbox-app-launcher) to fully confine all processes on the system.
 
 Whonix is best used [in conjunction with Qubes](https://www.whonix.org/wiki/Qubes/Why_use_Qubes_over_other_Virtualizers).
 
@@ -112,11 +112,11 @@ Whonix is best used [in conjunction with Qubes](https://www.whonix.org/wiki/Qube
 
 !!! recommendation
 
-    ![Tails logo](/assets/img/linux-desktop/tails.svg){ align=right }
+    ![Tails logo](assets/img/linux-desktop/tails.svg){ align=right }
 
     **Tails** is a live operating system based on Debian that routes all communications through Tor.
 
-    It can boot on almost any computer from a DVD, USB stick, or sdcard. It aims to preserve privacy and anonymity while circumventing censorship and leaving no trace of itself on the computer it is used on.
+    It can boot on almost any computer from a DVD, USB stick, or SD card. It aims to preserve privacy and anonymity while circumventing censorship and leaving no trace of itself on the computer it is used on.
 
     [Visit tails.boum.org](https://tails.boum.org/){ .md-button .md-button--primary }
 
@@ -215,7 +215,7 @@ We recommend using a desktop environment that supports the [Wayland](https://en.
 
 Fortunately, common environments such as [GNOME](https://www.gnome.org), [KDE](https://kde.org), and the window manager [Sway](https://swaywm.org) have support for Wayland. Some distributions like Fedora and Tumbleweed use it by default and some others may do so in the future as X11 is in [hard maintenance mode](https://www.phoronix.com/scan.php?page=news_item&px=X.Org-Maintenance-Mode-Quickly). If you’re using one of those environments it is as easy as selecting the “Wayland” session at the desktop display manager ([GDM](https://en.wikipedia.org/wiki/GNOME_Display_Manager), [SDDM](https://en.wikipedia.org/wiki/Simple_Desktop_Display_Manager)).
 
-We recommend **against** using desktop environments or window managers that do not have Wayland support such as Cinnamon (default on Linux Mint), Pantheon (default on Elementary OS), MATE, XFCE, and i3.
+We recommend **against** using desktop environments or window managers that do not have Wayland support such as Cinnamon (default on Linux Mint), Pantheon (default on Elementary OS), MATE, Xfce, and i3.
 
 ### Proprietary firmware (microcode updates)
 
@@ -239,7 +239,7 @@ There isn’t much point in randomizing the MAC address for Ethernet connections
 
 ### Other identifiers
 
-There are other system [identifiers](https://madaidans-insecurities.github.io/guides/linux-hardening.html#identifiers) which you may wish to be careful about. You should give this some thought to see if it applies to your [threat model](/threat-modeling):
+There are other system [identifiers](https://madaidans-insecurities.github.io/guides/linux-hardening.html#identifiers) which you may wish to be careful about. You should give this some thought to see if it applies to your [threat model](threat-modeling.md):
 
 - [10.1 Hostnames and usernames](https://madaidans-insecurities.github.io/guides/linux-hardening.html#hostnames)
 - [10.2 Time zones / Locales / Keymaps](https://madaidans-insecurities.github.io/guides/linux-hardening.html#timezones-locales-keymaps)
@@ -314,7 +314,7 @@ Red Hat develops [Podman](https://docs.podman.io/en/latest/) and secures it with
 
 Another option is [Kata containers](https://katacontainers.io/), where virtual machines masquerade as containers. Each Kata container has its own Linux kernel and is isolated from the host.
 
-These container technologies can be useful even for enthusiastic home users who may want to run certain web app software on their local area network (LAN) such as [vaultwarden](https://github.com/dani-garcia/vaultwarden) or images provided by [linuxserver.io](https://www.linuxserver.io) to increase privacy by decreasing dependence on various web services.
+These container technologies can be useful even for enthusiastic home users who may want to run certain web app software on their local area network (LAN) such as [Vaultwarden](https://github.com/dani-garcia/vaultwarden) or images provided by [linuxserver.io](https://www.linuxserver.io) to increase privacy by decreasing dependence on various web services.
 
 ## Additional hardening
 
@@ -346,7 +346,7 @@ Note that setting `kernel.unprivileged_userns_clone=0` will stop Flatpak, Snap (
 
 ### Linux-Hardened
 
-Some distributions like Arch Linux have the [linux-hardened](https://github.com/anthraxx/linux-hardened), kernel package. It includes [hardening patches](https://wiki.archlinux.org/title/security#Kernel_hardening) and more security-conscious defaults. Linux-Hardened has `kernel.unprivileged_userns_clone=0` disabled by default. See the [warning above](/linux-desktop/#kernel-hardening) about how this might impact you.
+Some distributions like Arch Linux have the [linux-hardened](https://github.com/anthraxx/linux-hardened), kernel package. It includes [hardening patches](https://wiki.archlinux.org/title/security#Kernel_hardening) and more security-conscious defaults. Linux-Hardened has `kernel.unprivileged_userns_clone=0` disabled by default. See the [warning above](#kernel-hardening) about how this might impact you.
 
 ### Simultaneous multithreading (SMT)
 
@@ -382,7 +382,7 @@ On systems where [`pam_faillock`](https://man7.org/linux/man-pages/man8/pam_tall
 
 To better protect your [USB](https://en.wikipedia.org/wiki/USB) ports from attacks such as [BadUSB](https://en.wikipedia.org/wiki/BadUSB) we recommend [USBGuard](https://github.com/USBGuard/usbguard). USBGuard has [documentation](https://github.com/USBGuard/usbguard#documentation) as does the [Arch Wiki](https://wiki.archlinux.org/title/USBGuard).
 
-Another alternative option if you’re using the [linux-hardened](/linux-desktop/#linux-hardened) is the [`deny_new_usb`](https://github.com/GrapheneOS/linux-hardened/commit/96dc427ab60d28129b36362e1577b6673b0ba5c4) sysctl. See [Preventing USB Attacks with `linux-hardened`](https://blog.lizzie.io/preventing-usb-attacks-with-linux-hardened.html).
+Another alternative option if you’re using the [linux-hardened](#linux-hardened) is the [`deny_new_usb`](https://github.com/GrapheneOS/linux-hardened/commit/96dc427ab60d28129b36362e1577b6673b0ba5c4) sysctl. See [Preventing USB Attacks with `linux-hardened`](https://blog.lizzie.io/preventing-usb-attacks-with-linux-hardened.html).
 
 ### Secure Boot
 

docs/metadata-removal-tools.en.md

@@ -1,5 +1,5 @@
 ---
-title: Metadata Removal Tools
+title: "Metadata Removal Tools"
 icon: material/tag-remove
 ---
 When sharing files, be sure to remove associated metadata. Image files commonly include [EXIF](https://en.wikipedia.org/wiki/Exif) data. Photos sometimes even include [GPS](https://en.wikipedia.org/wiki/Global_Positioning_System) coordinates in the file metadata.
@@ -10,7 +10,7 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![MAT2 logo](/assets/img/metadata-removal/mat2.svg){ align=right }
+    ![MAT2 logo](assets/img/metadata-removal/mat2.svg){ align=right }
 
     **MAT2** is free software, which allows the metadata to be removed from image, audio, torrent, and document file types. It provides both a command line tool and a graphical user interface via an [extension for Nautilus](https://0xacab.org/jvoisin/mat2/-/tree/master/nautilus), the default file manager of [GNOME](https://www.gnome.org), and [Dolphin](https://0xacab.org/jvoisin/mat2/-/tree/master/dolphin), the default file manager of [KDE](https://kde.org).
 
@@ -29,9 +29,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![ExifCleaner logo](/assets/img/metadata-removal/exifcleaner.svg){ align=right }
+    ![ExifCleaner logo](assets/img/metadata-removal/exifcleaner.svg){ align=right }
 
-    **ExifCleaner** is a freeware, open source graphical app that uses [ExifTool](https://exiftool.org) to remove [EXIF](https://en.wikipedia.org/wiki/Exif) metadata from images, videos, and PDF documents using a simple drag and drop interface. It supports multi-core batch processing and dark mode.
+    **ExifCleaner** is a freeware, open source graphical app that uses [ExifTool](https://exiftool.org) to remove EXIF metadata from images, videos, and PDF documents using a simple drag and drop interface. It supports multi-core batch processing and dark mode.
 
     [Visit exifcleaner.com](https://exifcleaner.com){ .md-button .md-button--primary }
 
@@ -47,9 +47,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![Scrambled Exif logo](/assets/img/metadata-removal/scrambled-exif.svg){ align=right }
+    ![Scrambled Exif logo](assets/img/metadata-removal/scrambled-exif.svg){ align=right }
 
-    **Scrambled Exif** is a metadata removal tool for Android. It can remove [EXIF](https://en.wikipedia.org/wiki/Exif) data for many file formats and has been translated into [many](https://gitlab.com/juanitobananas/scrambled-exif/-/tree/master/app/src/main/res) languages.
+    **Scrambled Exif** is a metadata removal tool for Android. It can remove EXIF data for many file formats and has been translated into [many](https://gitlab.com/juanitobananas/scrambled-exif/-/tree/master/app/src/main/res) languages.
 
     [Visit gitlab.com](https://gitlab.com/juanitobananas/scrambled-exif){ .md-button .md-button--primary }
 
@@ -66,9 +66,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![Imagepipe logo](/assets/img/metadata-removal/imagepipe.svg){ align=right }
+    ![Imagepipe logo](assets/img/metadata-removal/imagepipe.svg){ align=right }
 
-    **Imagepipe** is a a paint app for Android that can be used to redact photos and also delete [EXIF](https://en.wikipedia.org/wiki/Exif) metadata. It has been translated into [many](https://codeberg.org/Starfish/Imagepipe#translations) languages.
+    **Imagepipe** is a a paint app for Android that can be used to redact photos and also delete EXIF metadata. It has been translated into [many](https://codeberg.org/Starfish/Imagepipe#translations) languages.
 
     [Visit codeberg.org](https://codeberg.org/Starfish/Imagepipe){ .md-button .md-button--primary }
 
@@ -84,7 +84,7 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![Metapho logo](/assets/img/metadata-removal/metapho.jpg){ align=right }
+    ![Metapho logo](assets/img/metadata-removal/metapho.jpg){ align=right }
 
     Metapho is a simple and clean viewer for photo metadata such as date, file name, size, camera model, shutter speed, and location.
 
@@ -99,9 +99,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![ExifTool logo](/assets/img/metadata-removal/exiftool.png){ align=right }
+    ![ExifTool logo](assets/img/metadata-removal/exiftool.png){ align=right }
 
-    **ExifTool** is the [original](https://en.wikipedia.org/wiki/ExifTool) perl library and command-line application for reading, writing, and editing meta information (EXIF, IPTC, XMP, and more) in a wide variety of file formats (JPEG, TIFF, PNG, PDF, RAW, and more).
+    **ExifTool** is the original perl library and command-line application for reading, writing, and editing meta information (EXIF, IPTC, XMP, and more) in a wide variety of file formats (JPEG, TIFF, PNG, PDF, RAW, and more).
 
     It's often a component of other EXIF removal applications and is in most Linux distribution repositories.
 

docs/multi-factor-authentication.en.md

@@ -1,5 +1,5 @@
 ---
-title: Multi-Factor Authenticator Recommendations
+title: "Multi-Factor Authenticators"
 icon: 'material/two-factor-authentication'
 ---
 ## Hardware Security Keys
@@ -8,9 +8,9 @@ icon: 'material/two-factor-authentication'
 
 !!! recommendation
 
-    ![YubiKeys](/assets/img/multi-factor-authentication/yubikey.png)
+    ![YubiKeys](assets/img/multi-factor-authentication/yubikey.png)
 
-    The **YubiKeys** are among the most popular security keys. Some YubiKey models have a wide range of features such as: [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 WebAuthn](https://en.wikipedia.org/wiki/WebAuthn), [Yubico OTP](https://developers.yubico.com/OTP/), [PIV](https://en.wikipedia.org/wiki/FIPS_201), [OpenPGP](https://developers.yubico.com/PGP/), [TOTP and HOTP](https://developers.yubico.com/OATH/) authentication.
+    The **YubiKeys** are among the most popular security keys. Some YubiKey models have a wide range of features such as: [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](security/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](security/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP/), [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
 
     One of the benefits of the YubiKey is that one key can do almost everything (YubiKey 5), you could expect from a hardware security key. We do encourage you to take the [quiz](https://www.yubico.com/quiz/) before purchasing in order to make sure you make the right choice.
 
@@ -29,9 +29,9 @@ For models which support HOTP and TOTP, there are 2 slots in the OTP interface w
 
 !!! recommendation
 
-    ![Nitrokey](/assets/img/multi-factor-authentication/nitrokey.jpg){ align=right }
+    ![Nitrokey](assets/img/multi-factor-authentication/nitrokey.jpg){ align=right }
 
-    **Nitrokey** has a security key capable of [FIDO2 WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) called the **Nitrokey FIDO2**. For PGP support, you need to purchase one of their other keys such as the **Nitrokey Start**, **Nitrokey Pro 2** or the **Nitrokey Storage 2**.
+    **Nitrokey** has a security key capable of [FIDO2 and WebAuthn](security/multi-factor-authentication.md#fido-fast-identity-online) called the **Nitrokey FIDO2**. For PGP support, you need to purchase one of their other keys such as the **Nitrokey Start**, **Nitrokey Pro 2** or the **Nitrokey Storage 2**.
 
     [Visit nitrokey.com](https://www.nitrokey.com){ .md-button .md-button--primary } [Privacy Policy](https://www.nitrokey.com/data-privacy-policy){ .md-button }
 
@@ -67,7 +67,7 @@ We highly recommend that you use mobile TOTP apps instead of desktop alternative
 
 !!! recommendation
 
-    ![Aegis logo](/assets/img/multi-factor-authentication/aegis.png){ align=right }
+    ![Aegis logo](assets/img/multi-factor-authentication/aegis.png){ align=right }
 
     **Aegis Authenticator** is a free, secure and open source app to manage your 2-step verification tokens for your online services.
 
@@ -82,7 +82,7 @@ We highly recommend that you use mobile TOTP apps instead of desktop alternative
 
 !!! recommendation
 
-    ![Raivo OTP logo](/assets/img/multi-factor-authentication/raivo-otp.png){ align=right }
+    ![Raivo OTP logo](assets/img/multi-factor-authentication/raivo-otp.png){ align=right }
 
     **Raivo OTP** is a native, lightweight and secure time-based (TOTP) & counter-based (HOTP) password client for iOS. Raivo OTP offers optional iCloud backup & sync. Raivo OTP is also available for macOS in the form of a status bar application, however the Mac app does not work independently of the iOS app.
 

docs/news-aggregators.en.md

@@ -1,5 +1,5 @@
 ---
-title: News Aggregators
+title: "News Aggregators"
 icon: octicons/rss-24
 ---
 
@@ -11,9 +11,9 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Fluent Reader logo](/assets/img/news-aggregators/fluent-reader.svg){ align=right }
+    ![Fluent Reader logo](assets/img/news-aggregators/fluent-reader.svg){ align=right }
 
-    **Fluent Reader** is a secure cross-platform news aggregator that has useful privacy features such as deletion of cookies on exit, strict [content security policies (CSP)](https://en.wikipedia.org/wiki/Content_Security_Policy) and proxy support, meaning you can use it over [Tor](/self-contained-networks/#tor).
+    **Fluent Reader** is a secure cross-platform news aggregator that has useful privacy features such as deletion of cookies on exit, strict [content security policies (CSP)](https://en.wikipedia.org/wiki/Content_Security_Policy) and proxy support, meaning you can use it over [Tor](self-contained-networks.md#tor).
 
     [Visit hyliu.me](https://hyliu.me/fluent-reader){ .md-button .md-button--primary } [Privacy Policy](https://github.com/yang991178/fluent-reader/wiki/Privacy){ .md-button }
 
@@ -26,7 +26,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![GNOME Feeds logo](/assets/img/news-aggregators/gfeeds.svg){ align=right }
+    ![GNOME Feeds logo](assets/img/news-aggregators/gfeeds.svg){ align=right }
 
     **GNOME Feeds** is an [RSS](https://en.wikipedia.org/wiki/RSS) and [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)) news reader for [GNOME](https://www.gnome.org). It has a simple interface and is quite fast.
 
@@ -41,7 +41,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Akregator logo](/assets/img/news-aggregators/akregator.svg){ align=right }
+    ![Akregator logo](assets/img/news-aggregators/akregator.svg){ align=right }
 
     **Akregator** is a news feed reader that is a part of the [KDE](https://kde.org) project. It comes with a fast search, advanced archiving functionality and an internal browser for easy news reading.
 
@@ -55,7 +55,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Handy News Reader logo](/assets/img/news-aggregators/handy-news-reader.svg){ align=right }
+    ![Handy News Reader logo](assets/img/news-aggregators/handy-news-reader.svg){ align=right }
 
     **Handy News Reader** is a fork of [Flym](https://github.com/FredJul/Flym) that has many [features](https://github.com/yanus171/Handy-News-Reader#features) and works well with folders of RSS feeds. It supports [RSS](https://en.wikipedia.org/wiki/RSS), [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)) and [RDF](https://en.wikipedia.org/wiki/RDF%2FXML).
 
@@ -70,7 +70,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![NetNewsWire logo](/assets/img/news-aggregators/netnewswire.png){ align=right }
+    ![NetNewsWire logo](assets/img/news-aggregators/netnewswire.png){ align=right }
 
     **NetNewsWire** a free and open-source feed reader for macOS and iOS with a focus on a native design and feature set. It supports the typical feed formats alongside built-in support for Twitter and Reddit feeds.
 
@@ -85,8 +85,8 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Miniflux logo](/assets/img/news-aggregators/miniflux.svg#only-light){ align=right }
-    ![Miniflux logo](/assets/img/news-aggregators/miniflux-dark.svg#only-dark){ align=right }
+    ![Miniflux logo](assets/img/news-aggregators/miniflux.svg#only-light){ align=right }
+    ![Miniflux logo](assets/img/news-aggregators/miniflux-dark.svg#only-dark){ align=right }
 
     **Miniflux** is a web-based news aggregator that you can self-host. It supports [RSS](https://en.wikipedia.org/wiki/RSS), [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)), [RDF](https://en.wikipedia.org/wiki/RDF%2FXML) and [JSON Feed](https://en.wikipedia.org/wiki/JSON_Feed).
 
@@ -99,7 +99,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Newsboat logo](/assets/img/news-aggregators/newsboat.svg){ align=right }
+    ![Newsboat logo](assets/img/news-aggregators/newsboat.svg){ align=right }
 
     **Newsboat** is an RSS/Atom feed reader for the text console. It's an actively maintained fork of [Newsbeuter](https://en.wikipedia.org/wiki/Newsbeuter). It is very lightweight, and ideal for use over [Secure Shell](https://en.wikipedia.org/wiki/Secure_Shell).
 
@@ -112,7 +112,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 Some social media services also support RSS although it's not often advertised.
 
-### Youtube
+### YouTube
 
 You can subscribe YouTube channels without logging in and associating usage information with your Google Account. To subscribe to a YouTube channel with an RSS client, first look for your [channel code](https://support.google.com/youtube/answer/6180214), replace `channel_id` below:
 

docs/notebooks.en.md

@@ -1,5 +1,5 @@
 ---
-title: Notebooks
+title: "Notebooks"
 icon: material/notebook-edit-outline
 ---
 
@@ -13,7 +13,7 @@ If you are currently using an application like Evernote, Google Keep, or Microso
 
 !!! recommendation
 
-    ![Joplin logo](/assets/img/notebooks/joplin.svg){ align=right }
+    ![Joplin logo](assets/img/notebooks/joplin.svg){ align=right }
 
     **Joplin** is a free, open-source, and fully-featured note-taking and to-do application which can handle a large number of markdown notes organized into notebooks and tags. It offers end-to-end encryption and can sync through Nextcloud, Dropbox, and more. It also offers easy import from Evernote and plain-text notes.
 
@@ -38,7 +38,7 @@ If you are currently using an application like Evernote, Google Keep, or Microso
 
 !!! recommendation
 
-    ![Standard Notes logo](/assets/img/notebooks/standard-notes.svg){ align=right }
+    ![Standard Notes logo](assets/img/notebooks/standard-notes.svg){ align=right }
 
     Standard Notes is a simple and private notes app that makes your notes easy and available everywhere you are. It features end-to-end encryption on every platform, and a powerful desktop experience with themes and custom editors. It has also been [independently audited (PDF)](https://s3.amazonaws.com/standard-notes/security/Report-SN-Audit.pdf).
 

docs/passwords.en.md

@@ -1,5 +1,5 @@
 ---
-title: Password Managers
+title: "Password Managers"
 icon: material/form-textbox-password
 ---
 Stay safe and secure online with an encrypted and open-source password manager.
@@ -7,8 +7,8 @@ Stay safe and secure online with an encrypted and open-source password manager.
 ## Password Best Practices
 
 - Always use unique passwords. Don't make yourself a victim of "[credential stuffing](https://en.wikipedia.org/wiki/Credential_stuffing)".
-- Store an exported backup of your passwords in an [encrypted container](/encryption) on another storage device. This can be useful if something happens to your device or the service you are using.
-- If possible, store [Time-based one-time password (TOTP)](https://en.wikipedia.org/wiki/Time-based_one-time_password) tokens in a separate [TOTP app](/security/multi-factor-authentication/#authenticator-apps) and not your password manager. TOTP codes are generated from a "[shared secret](https://en.wikipedia.org/wiki/Time-based_one-time_password#Security)". If the secret is obtained by an adversary they can generate TOTP values. Typically, mobile platforms have better app isolation and more secure methods for storing sensitive credentials.
+- Store an exported backup of your passwords in an [encrypted container](encryption.md) on another storage device. This can be useful if something happens to your device or the service you are using.
+- If possible, store [Time-based one-time password (TOTP)](https://en.wikipedia.org/wiki/Time-based_one-time_password) tokens in a separate [TOTP app](security/multi-factor-authentication.md#authenticator-apps) and not your password manager. TOTP codes are generated from a "[shared secret](https://en.wikipedia.org/wiki/Time-based_one-time_password#Security)". If the secret is obtained by an adversary they can generate TOTP values. Typically, mobile platforms have better app isolation and more secure methods for storing sensitive credentials.
 
 ## Local Password Managers
 
@@ -18,7 +18,7 @@ These password managers store the password database locally.
 
 !!! recommendation
 
-    ![KeepassXC logo](/assets/img/password-management/keepassxc.svg){ align=right }
+    ![KeepassXC logo](assets/img/password-management/keepassxc.svg){ align=right }
 
     **KeePassXC** is a community fork of KeePassX, a native cross-platform port of KeePass Password Safe, with the goal to extend and improve it with new features and bugfixes to provide a feature-rich, fully cross-platform and modern open-source password manager.
 
@@ -41,7 +41,7 @@ These password managers store the password database locally.
 
 !!! recommendation
 
-    ![KeepassDX logo](/assets/img/password-management/keepassdx.svg){ align=right }
+    ![KeepassDX logo](assets/img/password-management/keepassdx.svg){ align=right }
 
     **KeepassDX** is a lightweight password manager for Android, allows editing encrypted data in a single file in KeePass format and can fill in the forms in a secure way. [Contributor Pro](https://play.google.com/store/apps/details?id=com.kunzisoft.keepass.pro) allows unlocking cosmetic content and non-standard protocol features, but more importantly, it helps and encourages development.
 
@@ -62,7 +62,7 @@ These password managers sync up to a cloud server that may be self-hostable.
 
 !!! recommendation
 
-    ![Bitwarden logo](/assets/img/password-management/bitwarden.svg){ align=right }
+    ![Bitwarden logo](assets/img/password-management/bitwarden.svg){ align=right }
 
     **Bitwarden** is a free and open-source password manager. It aims to solve password management problems for individuals, teams, and business organizations. Bitwarden is among the easiest and safest solutions to store all of your logins and passwords while conveniently keeping them synced between all of your devices. If you don't want to use the Bitwarden cloud, you can easily host your own Bitwarden server.
 
@@ -85,9 +85,9 @@ These password managers sync up to a cloud server that may be self-hostable.
 
 !!! recommendation
 
-    ![Psono logo](/assets/img/password-management/psono.svg){ align=right }
+    ![Psono logo](assets/img/password-management/psono.svg){ align=right }
 
-    **Psono** is a free and open source password manager from Germany, with a focus on password management for teams. It can be [self-hosted](/password-management/#password-management-servers). Psono supports secure sharing of passwords, files, bookmarks, and emails. All secrets are protected by a master password.
+    **Psono** is a free and open source password manager from Germany, with a focus on password management for teams. It can be [self-hosted](#password-management-servers). Psono supports secure sharing of passwords, files, bookmarks, and emails. All secrets are protected by a master password.
 
     [Visit psono.com](https://psono.com){ .md-button .md-button--primary } [Privacy Policy](https://psono.com/privacy-policy){ .md-button }
 
@@ -107,8 +107,8 @@ These products are self-hostable synchronization for cloud based password manage
 
 !!! recommendation
 
-    ![Vaultwarden logo](/assets/img/password-management/vaultwarden.svg#only-light){ align=right }
-    ![Vaultwarden logo](/assets/img/password-management/vaultwarden-dark.svg#only-dark){ align=right }
+    ![Vaultwarden logo](assets/img/password-management/vaultwarden.svg#only-light){ align=right }
+    ![Vaultwarden logo](assets/img/password-management/vaultwarden-dark.svg#only-dark){ align=right }
 
     **Vaultwarden** is an alternative implementation of the Bitwarden server API written in Rust and compatible with upstream Bitwarden clients, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal.
 
@@ -122,7 +122,7 @@ These products are self-hostable synchronization for cloud based password manage
 
 !!! recommendation
 
-    ![Psono Server logo](/assets/img/password-management/psono.svg){ align=right }
+    ![Psono Server logo](assets/img/password-management/psono.svg){ align=right }
 
     Psono provides [extensive documentation](https://doc.psono.com/) for their product. The [web-client](https://doc.psono.com/admin/installation/install-webclient.html#installation-with-docker) for Psono can be self hosted; alternatively, you can choose the the full [Community Edition](https://doc.psono.com/admin/installation/install-server-ce.html) or the [Enterprise Edition](https://doc.psono.com/admin/installation/install-server-ee.html) with additional features.
 
@@ -140,7 +140,7 @@ These products are minimal password managers that can be used within scripting a
 
 !!! recommendation
 
-    ![gopass logo](/assets/img/password-management/gopass.svg){ align=right }
+    ![gopass logo](assets/img/password-management/gopass.svg){ align=right }
 
     **gopass** is a password manager for the command line written in Go. It works on all major desktop and server operating systems (Linux, MacOS, BSD, Windows).
 

docs/productivity.en.md

@@ -1,5 +1,5 @@
 ---
-title: Productivity Tools
+title: "Productivity Tools"
 icon: material/file-sign
 ---
 Get working and collaborating without sharing your documents with a middleman or trusting a cloud provider.
@@ -10,7 +10,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![LibreOffice logo](/assets/img/productivity/libreoffice.svg){ align=right }
+    ![LibreOffice logo](assets/img/productivity/libreoffice.svg){ align=right }
 
     **LibreOffice** is a free and open-source office suite with extensive functionality.
 
@@ -32,7 +32,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![OnlyOffice logo](/assets/img/productivity/onlyoffice.svg){ align=right }
+    ![OnlyOffice logo](assets/img/productivity/onlyoffice.svg){ align=right }
 
     **OnlyOffice** is alternative, it is free and open-source office suite with extensive functionality.
 
@@ -53,7 +53,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![Framadate logo](/assets/img/productivity/framadate.svg){ align=right }
+    ![Framadate logo](assets/img/productivity/framadate.svg){ align=right }
 
     **Framadate** is a free and open-source online service for planning an appointment or making a decision quickly and easily. No registration is required.
 
@@ -68,7 +68,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![PrivateBin logo](/assets/img/productivity/privatebin.svg){ align=right }
+    ![PrivateBin logo](assets/img/productivity/privatebin.svg){ align=right }
 
     **PrivateBin** is a minimalist, open-source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256-bit AES. It is the improved version of ZeroBin.
 
@@ -83,7 +83,7 @@ Do note that PrivateBin uses JavaScript to handle encryption, so you must trust
 
 !!! recommendation
 
-    ![CryptPad logo](/assets/img/productivity/cryptpad.svg){ align=right }
+    ![CryptPad logo](assets/img/productivity/cryptpad.svg){ align=right }
 
     **CryptPad** is a private-by-design alternative to popular office tools. All content is end-to-end encrypted. Do note that it uses JavaScript to handle encryption, so you must trust the provider to the extent that they do not inject any malicious JavaScript to get your private key. Consider self-hosting to mitigate this threat.
 
@@ -98,8 +98,8 @@ Do note that PrivateBin uses JavaScript to handle encryption, so you must trust
 
 !!! recommendation
 
-    ![Write.as logo](/assets/img/productivity/writeas.svg#only-light){ align=right }
-    ![Write.as logo](/assets/img/productivity/writeas-dark.svg#only-dark){ align=right }
+    ![Write.as logo](assets/img/productivity/writeas.svg#only-light){ align=right }
+    ![Write.as logo](assets/img/productivity/writeas-dark.svg#only-dark){ align=right }
 
     **Write.as** is a cross-platform, privacy-oriented blogging platform. It's anonymous by default, letting you publish without signing up. If you create an account, it doesn't require any personal information. No ads, distraction-free, and built on a sustainable business model.
 
@@ -120,7 +120,7 @@ Do note that PrivateBin uses JavaScript to handle encryption, so you must trust
 
 !!! recommendation
 
-    ![VSCodium logo](/assets/img/productivity/vscodium.svg){ align=right }
+    ![VSCodium logo](assets/img/productivity/vscodium.svg){ align=right }
 
     **VSCodium** is a free and open-source project featuring binaries of [Visual Studio Code](https://code.visualstudio.com) without Microsoft's branding/telemetry/licensing.
 

docs/qubes.en.md

@@ -1,5 +1,5 @@
 ---
-title: Qubes OS
+title: "Qubes OS"
 icon: pg/qubes-os
 ---
 Qubes OS is a distribution of Linux that uses [Xen](https://en.wikipedia.org/wiki/Xen) to provide app isolation.
@@ -8,7 +8,7 @@ Qubes OS is a distribution of Linux that uses [Xen](https://en.wikipedia.org/wik
 
 !!! recommendation
 
-    ![Qubes OS logo](/assets/img/qubes/qubes_os.svg){ align=right }
+    ![Qubes OS logo](assets/img/qubes/qubes_os.svg){ align=right }
 
     **Qubes** is an open-source operating system designed to provide strong security for desktop computing. Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and utilize most of the Linux drivers.
 

docs/real-time-communication.en.md

@@ -1,5 +1,5 @@
 ---
-title: Real-Time Communication Tools
+title: "Real-Time Communication"
 icon: material/chat-processing
 ---
 ## Encrypted Instant Messengers
@@ -8,7 +8,7 @@ icon: material/chat-processing
 
 !!! recommendation
 
-    ![Signal logo](/assets/img/messengers/signal.svg){ align=right }
+    ![Signal logo](assets/img/messengers/signal.svg){ align=right }
 
     **Signal** is a mobile app developed by Signal Messenger LLC. The app provides instant messaging, as well as voice and video calling.
 
@@ -36,7 +36,7 @@ The protocol was independently [audited](https://eprint.iacr.org/2016/1013.pdf)
 
 !!! recommendation
 
-    ![Element logo](/assets/img/messengers/element.svg){ align=right }
+    ![Element logo](assets/img/messengers/element.svg){ align=right }
 
     **Element** is the reference client for the [Matrix](https://matrix.org/docs/guides/introduction) protocol, an [open standard](https://matrix.org/docs/spec) for secure decentralized real-time communication.
 
@@ -57,7 +57,7 @@ Profile pictures, reactions, and nicknames are not encrypted.
 
 Group voice and video calls are [not](https://github.com/vector-im/element-web/issues/12878) E2EE, and use Jitsi, but this is expected to change with [Native Group VoIP Signalling](https://github.com/matrix-org/matrix-doc/pull/3401). Group calls have [no authentication](https://github.com/vector-im/element-web/issues/13074) currently, meaning that non room participants can also join the calls. We recommend that you do not use this feature for private meetings.
 
-When using [element-web](https://github.com/vector-im/element-web), you must trust the server hosting the Element client. If your [threat model](/threat-modeling) requires stronger protection, then use a desktop or mobile client instead.
+When using [element-web](https://github.com/vector-im/element-web), you must trust the server hosting the Element client. If your [threat model](threat-modeling.md) requires stronger protection, then use a desktop or mobile client instead.
 
 The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last) in 2016. The specification for the Matrix protocol can be found in their [documentation](https://spec.matrix.org/latest/). The [Olm](https://matrix.org/docs/projects/other/olm) cryptographic ratchet used by Matrix is an implementation of Signal’s [Double Ratchet algorithm](https://signal.org/docs/specifications/doubleratchet/).
 
@@ -65,7 +65,7 @@ The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matr
 
 !!! recommendation
 
-    ![Briar logo](/assets/img/messengers/briar.svg){ align=right }
+    ![Briar logo](assets/img/messengers/briar.svg){ align=right }
 
     **Briar** is an encrypted instant messenger that [connects](https://briarproject.org/how-it-works/) to other clients using the Tor Network. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar’s local mesh mode can be useful when internet availability is a problem.
 
@@ -88,7 +88,7 @@ Briar supports perfect forward secrecy by using the Bramble [Handshake](https://
 
 !!! recommendation
 
-    ![Session logo](/assets/img/messengers/session.svg){ align=right }
+    ![Session logo](assets/img/messengers/session.svg){ align=right }
 
     **Session** is an encrypted instant messenger that uses three random [service nodes](https://getsession.org/blog/onion-requests-session-new-message-routing-solution) to route messages anonymously on the [Oxen Network](https://oxen.io).
 
@@ -116,7 +116,7 @@ There are several network architectures commonly used to relay messages between
 
 ### Centralized Networks
 
-![Centralized networks diagram](/assets/img/layout/network-centralized.svg){ align=left }
+![Centralized networks diagram](assets/img/layout/network-centralized.svg){ align=left }
 
 Centralized messengers are those where all participants are on the same server or network of servers controlled by the same organization.
 
@@ -139,7 +139,7 @@ Some self-hosted messengers allow you to set up your own server. Self-hosting ca
 
 ### Federated Networks
 
-![Federated networks diagram](/assets/img/layout/network-decentralized.svg){ align=left }
+![Federated networks diagram](assets/img/layout/network-decentralized.svg){ align=left }
 
 Federated messengers use multiple, independent, decentralized servers that are able to talk to each other (email is one example of a federated service). Federation allows system administrators to control their own server and still be a part of the larger communications network.
 
@@ -162,7 +162,7 @@ When self-hosted, users of a federated server can discover and communicate with
 
 ### Peer-to-Peer (P2P) Networks
 
-![P2P diagram](/assets/img/layout/network-distributed.svg){ align=left }
+![P2P diagram](assets/img/layout/network-distributed.svg){ align=left }
 
 [P2P](https://en.wikipedia.org/wiki/Peer-to-peer) messengers connect to a [distributed network](https://en.wikipedia.org/wiki/Distributed_networking) of nodes to relay a message to the recepient without a third-party server.
 
@@ -183,11 +183,11 @@ P2P networks do not use servers, as users communicate directly between each othe
 - Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online.
 - Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network to learn about who is online.
 - Some common messenger features may not be implemented or incompletely, such as message deletion.
-- Your [IP address](https://en.wikipedia.org/wiki/IP_address) and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a [VPN](/vpn) or [self contained network](/self-contained-networks), such as [Tor](https://www.torproject.org) or [I2P](https://geti2p.net/). Many countries have some form of mass surveillance and/or metadata retention.
+- Your [IP address](https://en.wikipedia.org/wiki/IP_address) and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a [VPN](vpn.md) or [self contained network](self-contained-networks.md), such as [Tor](https://www.torproject.org) or [I2P](https://geti2p.net/). Many countries have some form of mass surveillance and/or metadata retention.
 
 ### Anonymous Routing
 
-![Anonymous routing diagram](/assets/img/layout/network-anonymous-routing.svg){ align=left }
+![Anonymous routing diagram](assets/img/layout/network-anonymous-routing.svg){ align=left }
 
 A messenger using [anonymous routing](https://doi.org/10.1007/978-1-4419-5906-5_628) hides either the identity of the sender, the receiver, or evidence that they have been communicating. Ideally, a messenger should hide all three.
 

docs/router.en.md

@@ -1,5 +1,5 @@
 ---
-title: Router Firmware
+title: "Router Firmware"
 icon: material/router-wireless
 ---
 Below are a few alternative operating systems, that can be used on routers, Wi-Fi access points etc.
@@ -11,8 +11,8 @@ Below are a few alternative operating systems, that can be used on routers, Wi-F
 
 !!! recommendation
 
-    ![OpenWrt logo](/assets/img/router/openwrt.svg#only-light){ align=right }
-    ![OpenWrt logo](/assets/img/router/openwrt-dark.svg#only-dark){ align=right }
+    ![OpenWrt logo](assets/img/router/openwrt.svg#only-light){ align=right }
+    ![OpenWrt logo](assets/img/router/openwrt-dark.svg#only-dark){ align=right }
 
     **OpenWrt** is an operating system (in particular, an embedded operating system) based on the Linux kernel, primarily used on embedded devices to route network traffic. The main components are the Linux kernel, util-linux, uClibc, and BusyBox. All components have been optimized for size, to be small enough for fitting into the limited storage and memory available in home routers.
 
@@ -25,8 +25,8 @@ Below are a few alternative operating systems, that can be used on routers, Wi-F
 
 !!! recommendation
 
-    ![pfSense logo](/assets/img/router/pfsense.svg#only-light){ align=right }
-    ![pfSense logo](/assets/img/router/pfsense-dark.svg#only-dark){ align=right }
+    ![pfSense logo](assets/img/router/pfsense.svg#only-light){ align=right }
+    ![pfSense logo](assets/img/router/pfsense-dark.svg#only-dark){ align=right }
 
     pfSense is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a computer to make a dedicated firewall/router for a network and is noted for its reliability and offering features often only found in expensive commercial firewalls. pfSense is commonly deployed as a perimeter firewall, router, wireless access point, DHCP server, DNS server, and VPN endpoint.
 

docs/search-engines.en.md

@@ -1,18 +1,18 @@
 ---
-title: Search Engines
+title: "Search Engines"
 icon: material/search-web
 ---
 Use a search engine that doesn't build an advertising profile based on your searches.
 
 The recommendations here are based on the merits of each service's privacy policy. There is **no guarantee** that these privacy policies are honored.
 
-Consider using a [VPN](/vpn) or [Tor](https://www.torproject.org/) if your threat model requires hiding your IP address from the search provider.
+Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org/) if your threat model requires hiding your IP address from the search provider.
 
 ### DuckDuckGo
 
 !!! recommendation
 
-    ![DuckDuckGo logo](/assets/img/search-engines/duckduckgo.svg){ align=right }
+    ![DuckDuckGo logo](assets/img/search-engines/duckduckgo.svg){ align=right }
 
     **DuckDuckGo** is a popular search engine and is the default for the Tor Browser.
 
@@ -30,9 +30,9 @@ DuckDuckGo has a [lite](https://duckduckgo.com/lite) and [html](https://duckduck
 
 !!! recommendation
 
-    ![Startpage logo](/assets/img/search-engines/startpage.svg){ align=right }
+    ![Startpage logo](assets/img/search-engines/startpage.svg){ align=right }
 
-    **Startpage** is a search engine that provides Google search results. It is a very convenient way to get Google search results without experiencing dark patterns such as difficult captchas or being refused access because you used a [VPN](/vpn) or [Tor](https://www.torproject.org/download/).
+    **Startpage** is a search engine that provides Google search results. It is a very convenient way to get Google search results without experiencing dark patterns such as difficult captchas or being refused access because you used a [VPN](vpn.md) or [Tor](https://www.torproject.org/download/).
 
     [Visit startpage.com](https://www.startpage.com){ .md-button .md-button--primary } [Privacy Policy](https://www.startpage.com/en/privacy-policy){ .md-button }
 
@@ -46,7 +46,7 @@ Startpage's majority shareholder is System1 who is an adtech company. We don't t
 
 !!! recommendation
 
-    ![Mojeek logo](/assets/img/search-engines/mojeek.svg){ align=right }
+    ![Mojeek logo](assets/img/search-engines/mojeek.svg){ align=right }
 
     **Mojeek** is another privacy friendly search engine. They use their own crawler to provide search data.
 
@@ -60,11 +60,14 @@ Startpage's majority shareholder is System1 who is an adtech company. We don't t
 
 !!! recommendation
 
-    ![Searx logo](/assets/img/search-engines/searx.svg){ align=right }
+    ![Searx logo](assets/img/search-engines/searx.svg){ align=right }
 
-    **Searx** is an [open-source](https://github.com/asciimoo/searx), self-hostable, metasearch engine, aggregating the results of other search engines while not storing information about its users. There is a [list of public instances](https://searx.space/).
+    **Searx** is an open-source, self-hostable, metasearch engine, aggregating the results of other search engines while not storing information about its users. There is a [list of public instances](https://searx.space/).
 
-    [Visit searx.me](https://searx.me){ .md-button .md-button--primary } [:pg-tor:](http://searxspbitokayvkhzhsnljde7rqmn7rvoga6e4waeub3h7ug3nghoad.onion){ .md-button }
+    [Visit searx.github.io](https://searx.github.io/searx){ .md-button .md-button--primary } [:pg-tor:](http://searxspbitokayvkhzhsnljde7rqmn7rvoga6e4waeub3h7ug3nghoad.onion){ .md-button }
+
+    **Downloads**
+    - [:fontawesome-brands-github: Source](https://github.com/asciimoo/searx)
 
 Searx is a proxy between the user and the search engines it aggregates from. Your search queries will still be sent to the search engines that Searx gets its results from.
 

docs/security/multi-factor-authentication.en.md

@@ -0,0 +1,166 @@
+---
+title: "Multi-factor Authentication"
+icon: 'material/two-factor-authentication'
+---
+**Multi-factor authentication** (MFA, or 2FA) is a security mechanism that requires additional steps beyond entering your username (or email) and password. The most common method is time limited codes you might receive from an SMS or app.
+
+Normally, if a hacker (or adversary) is able to figure out your password then they’d gain access to the account that password belongs to. An account with MFA forces the hacker to have both the password (something you *know*) and a device that you own (something you *have*), like your phone.
+
+MFA methods vary in security, but are based on the premise that the more difficult it is for an attacker to gain access to your MFA method, the better. Examples of MFA methods (from weakest to strongest) include [SMS, Email codes](#sms-or-email-mfa), app push notifications, [Time-based One-time Passwords (TOTP)](#time-based-one-time-password-totp), [Yubico OTP](#yubico-otp), and [FIDO (Fast IDentity Online)](#fido-fast-identity-online).
+
+## MFA Method Comparison
+
+### SMS or Email MFA
+
+Receiving codes either from [**SMS**](https://en.wikipedia.org/wiki/One-time_password#SMS) or **email** are one of the weaker ways to secure your accounts with MFA. Obtaining a code by email or SMS takes away from the "something you *have*" idea, because there are a variety of ways a hacker could [take over your phone number](https://en.wikipedia.org/wiki/SIM_swap_scam) or gain access to your email without having physical access to any of your devices at all. If an unauthorized person gained access to your email, they would be able to use that access to both reset your password and receive the authentication code, giving them full access to your account.
+
+### Push Notifications
+
+**Push notifications** take the form of a message being sent to an app on your phone asking you to confirm new account logins. This method is a lot better than SMS or email, since an attacker typically wouldn't be able to get these push notifications without having an already logged-in device, which means they would need to compromise one of your other devices first.
+
+We all make mistakes, and there is the risk that a user may accept the login attempt by accident. Push notification login authorizations are typically sent to *all* your devices at once, widening the availability of the MFA code if you have many devices.
+
+The security of push notification MFA is dependent on both the quality of the app, the server component and the trust of the developer who produces it. Installing an app may also require you to accept invasive privileges that grant access to other data on your device. An individual app also requires that you have a specific app for each service which may not require a password to open, unlike a good [Time-based One-time Password (TOTP)](#time-based-one-time-password-totp) app.
+
+### Time-based One-time Password (TOTP)
+
+**TOTP** is one of the most commons form of MFA available. When a user sets up TOTP they are generally required to scan a [QR Code](https://en.wikipedia.org/wiki/QR_code) which establishes a "[shared secret](https://en.wikipedia.org/wiki/Shared_secret)" with the service that they intend to use. The shared secret is secured inside of the authenticator app's data, and is sometimes protected by a password.
+
+The time-limited code is then derived from the shared secret and the current time. As the code is only valid for a short time, without access to the shared secret an adversary cannot generate new codes.
+
+If you have a hardware security key with TOTP support (such as a YubiKey with [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/)), we recommend that you store your "shared secrets" on the hardware. Hardware such as the YubiKey was developed with the intention of making the "shared secret" difficult to extract and copy. A YubiKey is also not connected to the Internet, unlike a phone with a TOTP app.
+
+Unlike [WebAuthn](#fido-fast-identity-online), TOTP offers no protection against [phishing](https://en.wikipedia.org/wiki/Phishing) or reuse attacks. If an adversary obtains a valid code from you they may use it as many times as they like until it expires (generally 60 seconds).
+
+An adversary could set up a website to imitate an official service in an attempt to trick you into giving out your username, password and current TOTP code. If the adversary then uses those recorded credentials they may be able to log into the real service and hijack the account.
+
+Although not perfect, TOTP is secure enough for most people, and when [hardware security keys](/multi-factor-authentication/#hardware-security-keys) are not supported [authenticator apps](/multi-factor-authentication/#authenticator-apps) are still a good option.
+
+### Hardware security keys
+
+The YubiKey stores data on a tamper-resistant solid-state chip which is [impossible to access](https://security.stackexchange.com/a/245772) non-destructively without a expensive processes and a forensics laboratory.
+
+These keys are generally multi-function and provide a number of methods to authenticate. Below are the most common ones.
+
+#### Yubico OTP
+
+Yubico OTP is an authentication protocol typically implemented in hardware security keys. When a user decides to use Yubico OTP, the key will generate a public ID, private ID, and a Secret Key which is then uploaded to the Yubico OTP server.
+
+When logging into a website, all a user needs to do is to physically touch the security key. The security key will emulate a keyboard and print out a one-time password into the password field.
+
+The service will then forward the one-time password to the Yubico OTP server for validation. A counter is incremented both on the key and Yubico's validation server. The OTP can only only be used once, and when a successful authentication occurs the counter is increased which prevents reuse of the OTP. Yubico provides a [detailed document](https://developers.yubico.com/OTP/OTPs_Explained.html) about the process.
+
+<figure markdown>
+  ![Yubico OTP](../assets/img/multi-factor-authentication/yubico-otp.png)
+</figure>
+
+There are some benefits and disadvantages to using Yubico OTP when compared to [TOTP](#time-based-one-time-password-totp).
+
+The Yubico validation server is a cloud based service, and users place trust in Yubico that they are storing data securely and not profiling users. The public ID associated with Yubico OTP is reused on every website and could be another avenue for third parties to profile the user. Like [TOTP](#time-based-one-time-password-totp), Yubico OTP does not provide phishing resistance.
+
+If your threat model requires you to have different identities on different websites, **do not** use Yubico OTP with the same hardware security key across those websites as public ID is unique to each security key.
+
+#### FIDO (Fast IDentity Online)
+
+[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) with the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
+
+U2F and FIDO2 refer to the [CTAP (Client to Authenticator Protocol)](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the "Relying Party", the website, you're trying to log in on.
+
+WebAuthn is the most secure and private form of second factor authentication. While the user experience is similar to Yubico OTP, the key does not print out a one-time password and validate with a third party server. Instead it uses [public key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) for authentication.
+
+<figure markdown>
+  ![FIDO](../assets/img/multi-factor-authentication/fido.png)
+</figure>
+
+When a user creates an account the public key is sent to the service, then when the user logs in, the service will require the user to "sign" some data with their private key. The benefit of this is that no password data is ever stored by the service, so there is nothing for an adversary to steal.
+
+This presentation discusses the history of password authentication, the pitfalls (such as password reuse), and discussion of FIDO2 and [WebAuthn](https://webauthn.guide) standards.
+
+<iframe width="100%" style="height:50vh"
+  src="https://www.youtube-nocookie.com/embed/aMo4ZlWznao"
+  title="How FIDO2 and WebAuthn Stop Account Takeovers"
+  frameborder="0"
+  allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
+  allowfullscreen>
+</iframe>
+
+FIDO2 and WebAuthn have superior security and privacy properties when compared to any MFA methods.
+
+Typically for web services it is used with WebAuthn which is a part of the [W3C recommendations](https://en.wikipedia.org/wiki/World_Wide_Web_Consortium#W3C_recommendation_(REC)). It uses public key authentication and is more secure than shared secrets used in Yubico OTP and TOTP methods, as it includes the origin name (usually, the domain name) during authentication. Attestation is provided to protect the user from phishing, as it helps them to determine that they are using the authentic service and not a fake copy.
+
+Unlike Yubico OTP, WebAuthn does not use any public ID, so the key is **not** identifiable across different websites. It also does not use any third party cloud server for authentication. All communication is completed between the key and the website the user is logging into. FIDO also uses a counter which is incremented upon use in order to prevent session reuse and cloned keys.
+
+If a website or service supports WebAuthn for the authentication, it is highly recommended that you use it over any other form of MFA.
+
+## General Recommendations
+
+We have these general recommendations:
+
+### Which method should I use?
+
+When configuring your MFA method, keep in mind that it is only as secure as your weakest authentication method you use. This means it is important that you only use the best MFA method available. For instance, if you are already using TOTP, you should disable email and SMS MFA. If you are already using FIDO2/WebAuthn, you should not be using Yubico OTP or TOTP on your account.
+
+### Backups
+
+You should always have backups for your MFA method. Hardware security keys can get lost, stolen, or simply stop working over time. It is recommended that you have a pair of hardware security keys with the same access to your accounts instead of just one.
+
+When using TOTP with an authenticator app, be sure to back up your recovery keys or the app itself, or copy the "shared secrets" to another instance of the app on a different phone or to an encrypted container (e.g [VeraCrypt](../encryption.md#veracrypt)).
+
+### Initial setup
+
+When buying a security key, it is important that you change the default credentials, setup password protection for the key, and enable touch confirmation if your key supports it. Products such as the [YubiKey](#yubico-otp) have multiple interfaces with separate credentials for each one of them, so you should go over each interface and set up protection as well.
+
+### Email and SMS
+
+If you have to use email for MFA, make sure that the email account itself is secured with a proper MFA method.
+
+If you use SMS MFA, use a carrier who will not switch your phone number to a new SIM card without account access, or use a dedicated VoIP number from a provider with similar security to avoid a [SIM swap](https://en.wikipedia.org/wiki/SIM_swap_scam) attack.
+
+[MFA tools we recommend](../multi-factor-authentication.md){ .md-button }
+
+## More places to setup MFA
+
+Beyond just securing your website logins, multi-factor authentication can be used to secure your local logins, SSH keys or even password databases as well.
+
+### Windows
+
+Yubico has a dedicated [Credential Provider](https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows) that adds Challenge-Response authentication for the username + password login flow for local Windows accounts. If you have a YubiKey with Challenge-Response authentication support, take a look at the [Yubico Login for Windows Configuration Guide](https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide), which will allow you to set up MFA on your Windows computer.
+
+### macOS
+
+macOS has [native support](https://support.apple.com/guide/deployment/intro-to-smart-card-integration-depd0b888248/web) for authentication with smart cards (PIV). If you have a smartcard or a hardware security key that supports the PIV interface such as the YubiKey, we recommend that you follow your smartcard/hardware security vendor's documentation and set up second factor authentication for your macOS computer.
+
+Yubico have a guide [Using Your YubiKey as a Smart Card in macOS](https://support.yubico.com/hc/en-us/articles/360016649059) which can help you set up your YubiKey on macOS.
+
+After your smartcard/security key is set up, we recommend running this command in the Terminal:
+
+```text
+sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES
+```
+
+The command will prevent an adversary from bypassing MFA when the computer boots.
+
+### Linux
+
+!!! warning
+    If the [hostname](https://en.wikipedia.org/wiki/Hostname) of your system changes (such as due to DHCP), you would be unable to login. It is vital that you setup a proper hostname for your computer before following this guide.
+
+The `pam_u2f` module on Linux can provide two factor authentication for user login on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as "apt-get"—and package names may however differ. This guide does **not** apply to Qubes OS.
+
+### Qubes OS
+
+Qubes OS has support for Challenge-Response authentication with YubiKeys. If you have a YubiKey with Challenge-Response authentication support, take a look at the Qubes OS [YubiKey documentation](https://www.qubes-os.org/doc/yubikey/) if you want to set up MFA on Qubes OS.
+
+### SSH
+
+#### Hardware security keys
+
+SSH MFA could be set up using multiple different authentication methods that are popular with hardware security keys. We recommend that you check out Yubico's [documentation](https://developers.yubico.com/SSH/) on how to set this up.
+
+#### Time-based One-time Password (TOTP)
+
+SSH MFA can also be set up using TOTP. DigitalOcean has provided a tutorial [How To Set Up Multi-Factor Authentication for SSH on Ubuntu 20.04](https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04). Most things should be the same regardless of distribution, however the package manager commands—such as "apt-get"—and package names may differ.
+
+### KeePass (and KeePassXC)
+
+KeePass and KeePassXC databases can be secured using Challenge-Response or HOTP as a second factor authentication. Yubico has provided a document for KeePass [Using Your YubiKey with KeePass](https://support.yubico.com/hc/en-us/articles/360013779759-Using-Your-YubiKey-with-KeePass) and there is also one on the [KeePassXC](https://keepassxc.org/docs/#faq-yubikey-2fa) website.

docs/security/multi-factor-authentication.md

@@ -1,157 +0,0 @@
----
-title: Multi-factor Authentication
-description: "Using strong MFA can stop over 99% of unauthorized account accesses, and it's easy to set up on the services you already use."
-icon: 'material/two-factor-authentication'
----
-**Multi-factor authentication** (MFA, or 2FA) is a security mechanism that requires additional steps beyond entering your username (or email) and password. The most common method are time limited codes you might receive from an SMS or app.
-
-The idea behind MFA is that even if a hacker (or adversary) is able to figure out your password (something you *know*), they will still need a device you own like your phone (something you *have*) in order to generate the code needed to log in to your account. MFA methods vary in security based on this premise: The more difficult it is for an attacker to gain access to your MFA method, the better. Examples of MFA methods (from weakest to strongest) include [SMS codes](https://en.wikipedia.org/wiki/One-time_password#SMS), email codes, app push notifications, [Time-based One-time Passwords (TOTP)](https://en.wikipedia.org/wiki/Time-based_one-time_password), Yubico OTP, and [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) / [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor).
-
-## MFA Method Comparison
-
-### SMS or Email MFA
-
-Receiving codes either from **SMS** or **email** are one of the weaker ways to secure your accounts with MFA. Obtaining a code by email or SMS takes away from the "something you *have*" idea, because there are a variety of ways a hacker could [take over your phone number](https://en.wikipedia.org/wiki/SIM_swap_scam) or gain access to your email without having physical access to any of your devices at all. If an unauthorized person gained access to your email, they would be able to use that access to both reset your password and receive the authentication code, giving them full access to your account.
-
-### Push Notifications
-
-**Push Notifications** take the form of a message being sent to an app on your phone asking you to confirm new account logins. This method is a lot better than SMS or email, since an attacker typically wouldn't be able to get these push notifications without having an already logged-in device, which means they would need to compromise one of your other devices first.
-
-We all make mistakes, and there is the risk that a user may accept the login attempt by accident. Push notification login authorizations are typically sent to *all* your devices at once, widening the availability of the MFA code if you have many devices.
-
-The security of push notification MFA is dependent on both the quality of the app, the server component and the trust of the developer who produces it. Installing an app may also require you to accept invasive privileges that grant access to other data on your device. An individual app also requires that you have a specific app for each service which may not require a password to open unlike a good [Time-based One-time Password (TOTP)](#time-based-one-time-password-totp) app.
-
-### Time-based One-time Password (TOTP)
-
-**TOTP** is one of the most commons form of MFA available. When a user sets up TOTP they are generally required to scan a [QR Code](https://en.wikipedia.org/wiki/QR_code) which establishes a "shared secret" with the service that they intend to use. The shared secret is secured inside of the authenticator app's data, and is sometimes protected by a password.
-
-The time-limited code is then derived from the shared secret and the current time. As the code is only valid for a short time, without access to the shared secret an adversary cannot generate new codes.
-
-If you have a hardware security key with TOTP support (such as a YubiKey with [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/)), we recommend that you store your "shared secrets" on the hardware. Hardware such as the YubiKey was developed with making the "shared secret" difficult to extract and copy. A YubiKey is also not connected to the Internet, unlike a phone with a TOTP app.
-
-Unlike [FIDO2 / U2F](#fido2-u2f), TOTP offers no protection against [phishing](https://en.wikipedia.org/wiki/Phishing) or reuse attacks. If an adversary obtains a valid code from you they may use it as many times as they like until it expires (generally 60 seconds).
-
-An adversary could set up a website to imitate an official service in an attempt to trick you into giving out your username, password and current TOTP code. If the adversary then uses those recorded credentials they may be able to log into the real service and hijack the account.
-
-Although not perfect it is secure enough for most people, and when [Hardware Security Keys](#hardware-security-keys) are not supported TOTP with [Authenticator Apps](#authenticator-apps) are still a good option.
-
-### Hardware security keys
-
-The YubiKey stores data on a tamper-resistant solid-state chip which is [impossible to access](https://security.stackexchange.com/a/245772) non-destructively without a expensive processes and a forensics laboratory.
-
-As these keys are generally multi-function and provide a number of methods to authenticate we discuss below the most common ones.
-
-#### Yubico OTP
-
-Yubico OTP is an authentication protocol typically implemented in hardware security keys. When a user decides to use Yubico OTP, the key will generate a public ID, private ID, and a Secret Key which is then uploaded to the Yubico OTP server.
-
-When logging into a website all a user needs to do is to physically touch the security key. The security key will emulate a keyboard and print out a one-time password into the password field.
-
-The service will then forward the one-time password to the Yubico OTP server for validation. A counter is incremented both on the key and Yubico's validation server. The OTP can only only be used once and when a successful authentication occurs the counter is increased which prevents reuse of the OTP. Yubico does provide a [detailed document](https://developers.yubico.com/OTP/OTPs_Explained.html) about the process.
-
-<figure markdown>
-  ![Yubico OTP](/assets/img/multi-factor-authentication/yubico-otp.png)
-</figure>
-
-There are some benefits and disadvantages to using Yubico OTP when compared to [TOTP](#time-based-one-time-password-totp).
-
-The Yubico validation server is a cloud based service, and users do place trust in Yubico that they are storing data securely and not profiling users. The public ID associated with Yubico OTP is reused on every website and could be another avenue for third parties to profile the user. Like [TOTP](#time-based-one-time-password-totp), Yubico OTP does not provide phishing resistance.
-
-If your threat model requires you to have different identities on different websites, **do not** use Yubico OTP with the same hardware security key across those websites as public ID is unique to each security key.
-
-#### FIDO2 / U2F
-
-[FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) / [**U2F**](https://en.wikipedia.org/wiki/Universal_2nd_Factor) is the most secure and private form of second factor authentication. While the user experience is similar to Yubico OTP, the key does not print out a one-time password and validate with a third party server. Instead FIDO2 (and U2F) use [public key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) for authentication.
-
-When a user creates an account the public key is sent to the service. When the user logs in the service will require the user to "sign" some data with their private key. The benefit of this is that no password data is ever stored by the service, so there is nothing for an adversary to steal.
-
-This presentation discusses the history of password authentication, the pitfalls (such as password reuse), and discussion of FIDO2 and [WebAuthn](https://webauthn.guide) standards.
-
-<iframe width="100%" style="height:50vh"
-  src="https://www.youtube-nocookie.com/embed/aMo4ZlWznao"
-  title="How FIDO2 and WebAuthn Stop Account Takeovers"
-  frameborder="0"
-  allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
-  allowfullscreen>
-</iframe>
-
-FIDO2 / U2F has superior security and privacy properties when compared to any MFA methods.
-
-Typically for web services it is used with [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) which is a part of the [W3C recommendations](https://en.wikipedia.org/wiki/World_Wide_Web_Consortium#W3C_recommendation_(REC)). It uses public key authentication and is more secure than shared secrets used in Yubico OTP and TOTP methods, as it includes the origin name (usually, the domain name) during authentication. Attestation is provided to protect the user from phishing as it helps them to determine that they are using the authentic service and not a fake copy.
-
-WebAuthn does not use any public ID, so the key is **not** identifiable across different websites like Yubico OTP. It also does not use any third party cloud server for authentication. All communication is completed between the key and the website the user is logging into. FIDO2 / U2F also uses a counter which is incremented upon use in order to prevent session reuse.
-
-If a website or service supports FIDO2 / U2F for the authentication, it is highly recommended that you use it over any other form of MFA.
-
-## General Recommendations
-
-We have these general recommendations:
-
-### Which method to use?
-
-When configuring your MFA method, keep in mind that it is only as secure as your weakest authentication method you use. This means it is important that you only use the best MFA method available. For instance, if you are already using TOTP, you should disable email and SMS MFA. If you are already using FIDO2 / U2F, you should not be using Yubico OTP or TOTP on your account.
-
-### Backups
-
-You should always have backups for your MFA method. Hardware security keys can get lost, stolen, or simply stop working over time. It is recommended that you have a pair of hardware security keys with the same access to your accounts instead of just one.
-
-When using TOTP with an authenticator app, be sure to back up your recovery keys, the app itself, or copy the "shared secrets" to another instance of the app on a different phone or into an encrypted container (e.g. [VeraCrypt](/encryption/#veracrypt)).
-
-### Initial setup
-
-When buying a security key, it is important that you change the default credentials, setup password protection for the key, and enable touch confirmation if your key supports such feature. Products such as the [YubiKey](#yubikey) have multiple interfaces with seperate credentials for each one of them, so you should go over each interface and set up protection as well.
-
-### Email and SMS
-
-If you have to use email for MFA, make sure that the email account itself is secured with a proper MFA method.
-
-If you use SMS MFA, use a carrier who will not switch your phone number to a new SIM card without account access or use a dedicated VOIP number from a provider with similar security to avoid a [SIM swap](https://en.wikipedia.org/wiki/SIM_swap_scam) attack.
-
-[MFA tools we recommend](../multi-factor-authentication.md){ .md-button }
-
-## More places to setup MFA
-
-Beyond just securing your website logins, multi-factor authentication can be used to secure your local logins, ssh keys or even password databases as well.
-
-### Windows
-
-Yubico has a dedicated [Credential Provider](https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows) that adds Challenge-Response authentication for the username + password login flow for local Windows accounts. If you have a YubiKey with Challenge-Response authentication support, take a look at the [Yubico Login for Windows Configuration Guide](https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide), which will allow you to set up MFA on your Windows computer.
-
-### macOS
-
-macOS has [native support](https://support.apple.com/guide/deployment/intro-to-smart-card-integration-depd0b888248/web) for authentication with smart cards (PIV). If you have a smartcard or a hardware security key that supports the PIV interface such as the YubiKey, we recommend that you follow your smartcard/hardware security vendor's documentation and set up second factor authentication for your macOS computer.
-
-Yubico have a guide [Using Your YubiKey as a Smart Card in macOS](https://support.yubico.com/hc/en-us/articles/360016649059) which can help you set up your YubiKey on macOS.
-
-After your smartcard/security key is set up, we recommend running this command in the Terminal:
-
-```text
-sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES
-```
-
-The command will prevent an adversary from bypassing MFA when the computer boots.
-
-### Linux
-
-!!! warning
-    If the [hostname](https://en.wikipedia.org/wiki/Hostname) of your system changes (such as due to DHCP), you would be unable to login. It is vital that you setup a proper hostname for your computer before following this guide.
-
-The `pam_u2f` module on Linux can provide two factor authentication for user login on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands such as "apt-get" and package names may however differ. This guide does **not** apply to Qubes OS.
-
-### Qubes OS
-
-Qubes OS has support for Challenge-Response authentication with YubiKeys. If you have a YubiKey with Challenge-Response authentication support, take a look at the Qubes OS' [YubiKey documentation](https://www.qubes-os.org/doc/yubikey/) if you want to set up MFA on Qubes OS.
-
-### SSH
-
-#### Hardware security keys
-
-SSH MFA could be set up using multiple different authentication methods that are popular with hardware security keys. We recommend that you check out Yubico's [documentation](https://developers.yubico.com/SSH/) on how to set this up.
-
-#### Time-based One-time Password (TOTP)
-
-SSH MFA can also be set up using TOTP and DigitalOcean has provided a tutorial [How To Set Up Multi-Factor Authentication for SSH on Ubuntu 20.04](https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04). Most things should be the same regardless of distribution, however the package manager commands such as "apt-get" and package names may differ.
-
-### KeePass (and KeePassXC)
-
-KeePass and KeePassXC databases can be secured using Challenge-Response or HOTP as a second factor authentication. Yubico has provided a documennt for KeePass [Using Your YubiKey with KeePass](https://support.yubico.com/hc/en-us/articles/360013779759-Using-Your-YubiKey-with-KeePass) and there is also one on the [KeePassXC](https://keepassxc.org/docs/#faq-yubikey-2fa) website.

docs/self-contained-networks.en.md

@@ -1,5 +1,5 @@
 ---
-title: Self-Contained Networks
+title: "Self-Contained Networks"
 icon: material/security-network
 ---
 If you are currently browsing clearnet and want to access the dark web, this section is for you.
@@ -10,7 +10,7 @@ If you are currently browsing clearnet and want to access the dark web, this sec
 
 !!! recommendation
 
-    ![Tor logo](./assets/img/self-contained-networks/tor.svg){ align=right }
+    ![Tor logo](assets/img/self-contained-networks/tor.svg){ align=right }
 
     The Tor network is a group of volunteer-operated servers that allows people to improve their privacy and security on the Internet. Tor's users employ this network by connecting through a series of virtual tunnels rather than making a direct connection, thus allowing both organizations and individuals to share information over public networks without compromising their privacy. Tor is an effective censorship circumvention tool.
 
@@ -32,8 +32,8 @@ If you are currently browsing clearnet and want to access the dark web, this sec
 
 !!! recommendation
 
-    ![I2P logo](./assets/img/self-contained-networks/i2p.svg#only-light){ align=right }
-    ![I2P logo](./assets/img/self-contained-networks/i2p-dark.svg#only-dark){ align=right }
+    ![I2P logo](assets/img/self-contained-networks/i2p.svg#only-light){ align=right }
+    ![I2P logo](assets/img/self-contained-networks/i2p-dark.svg#only-dark){ align=right }
 
     The Invisible Internet Project (I2P) is a computer network layer that allows applications to send messages to each other pseudonymously and securely. Uses include anonymous Web surfing, chatting, blogging, and file transfers. The software that implements this layer is called an I2P router and a computer running I2P is called an I2P node. The software is free and open-source and is published under multiple licenses.
 
@@ -55,7 +55,7 @@ If you are currently browsing clearnet and want to access the dark web, this sec
 
 !!! recommendation
 
-    ![Freenet logo](./assets/img/self-contained-networks/freenet.svg){ align=right }
+    ![Freenet logo](assets/img/self-contained-networks/freenet.svg){ align=right }
 
     Freenet is a peer-to-peer platform for censorship-resistant communication. It uses a decentralized distributed data store to keep and deliver information, and has a suite of free software for publishing and communicating on the Web without fear of censorship. Both Freenet and some of its associated tools were originally designed by Ian Clarke, who defined Freenet's goal as providing freedom of speech on the Internet with strong anonymity protection.
 

docs/setup/integrating-metadata-removal.en.md

@@ -1,23 +1,22 @@
 ---
-title: Integrating Metadata Removal
-description: "Guides for integrating metadata removal solutions in a native fashion."
+title: "Integrating Metadata Removal"
 icon: 'material/data-matrix-remove'
 ---
 
-When sharing files, it's important to remove associated metadata. Image files commonly include [EXIF](https://en.wikipedia.org/wiki/Exif) data, and sometimes photos even include GPS coordinates within its metadata.
+When sharing files, it's important to remove associated metadata. Image files commonly include [Exif](https://en.wikipedia.org/wiki/Exif) data, and sometimes photos even include GPS coordinates within its metadata.
 
 While there are plenty of metadata removal tools, they typically aren't convenient to use. The guides featured here aim to detail how to integrate metadata removal tools in a simple fashion by utilizing easy-to-access system features.
 
 !!! tip "Related"
-    For a list of the metadata removal tools that we recommend, visit our [metadata removal tools](/metadata-removal-tools/) page.
+    For a list of the metadata removal tools that we recommend, visit our [metadata removal tools](../metadata-removal-tools.md) page.
 
 ## macOS
 
-This guide uses the [Shortcuts](https://support.apple.com/guide/shortcuts-mac/intro-to-shortcuts-apdf22b0444c/mac) app to add an ExifTool script to the *Quick Actions* context menu within Finder. Shortcuts is developed by Apple and bundled in with macOS by default.
+This guide uses the [Shortcuts](https://support.apple.com/guide/shortcuts-mac/intro-to-shortcuts-apdf22b0444c/mac) app to add an [ExifTool](../metadata-removal-tools.md#exiftool) script to the *Quick Actions* context menu within Finder. Shortcuts is developed by Apple and bundled in with macOS by default.
 
 Shortcuts is quite intuitive to work with, so if you don't like the behavior demoed here then experiment with your own solution. For example, you could set the shortcut to take a clipboard input instead. The sky's the limit.
 
-![ExifTool Quick Action](/assets/img/integrating-metadata-removal/preview-macos.png)
+![ExifTool Quick Action](../assets/img/integrating-metadata-removal/preview-macos.png)
 
 ### Prerequisites
 
@@ -27,7 +26,7 @@ Shortcuts is quite intuitive to work with, so if you don't like the behavior dem
     /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
     ```
 
-2. [ExifTool](/metadata-removal-tools/#exiftool): a tool for viewing and manipulating image, audio, video, and PDF metadata.
+2. ExifTool is a tool for viewing and manipulating image, audio, video, and PDF metadata.
 
     ```bash
     brew install exiftool
@@ -64,7 +63,7 @@ Shortcuts is quite intuitive to work with, so if you don't like the behavior dem
     done
     ```
 
-![macOS metadata removal shortcut](/assets/img/integrating-metadata-removal/shortcut-macos.png)
+![macOS metadata removal shortcut](../assets/img/integrating-metadata-removal/shortcut-macos.png)
 
 !!! tip "Worth Mentioning"
     The open source [ImageOptim](https://imageoptim.com/mac) app integrates into Finder's *Services* context menu by default. While it is primarily an image optimization app, it also removes metadata.
@@ -81,11 +80,11 @@ Shortcuts is quite intuitive to work with, so if you don't like the behavior dem
 [Shortcuts](https://support.apple.com/guide/shortcuts/welcome/ios) can be made accessible through the system Share Sheet, making accessing those shortcuts very convenient. This guide will show you how to build a metadata removal shortcut and integrate it into the system *Share Sheet*.
 
 !!! attention
-    This method of metadata removal is not as comprehensive at removing metadata as utilities like [ExifTool](/metadata-removal-tools/#exiftool) and [mat2](/metadata-removal-tools/#mat2) are.
+    This method of metadata removal is not as comprehensive at removing metadata as utilities like [ExifTool](../metadata-removal-tools.md#exiftool) and [mat2](../metadata-removal-tools.md#mat2) are.
 
 The lack of *good* metadata removal apps on the App Store is what makes this solution worthwhile.
 
-![Don't preserve metadata shortcut](/assets/img/integrating-metadata-removal/preview-ios.png)
+![Don't preserve metadata shortcut](../assets/img/integrating-metadata-removal/preview-ios.png)
 
 ### Prerequisites
 
@@ -113,7 +112,7 @@ The lack of *good* metadata removal apps on the App Store is what makes this sol
 
 10. Make sure that you uncheck **preserve metadata**
 
-![iOS/iPadOS metadata removal shortcut](/assets/img/integrating-metadata-removal/shortcut-ios.png)
+![iOS/iPadOS metadata removal shortcut](../assets/img/integrating-metadata-removal/shortcut-ios.png)
 
 ### Enabling & using the Shortcut
 
@@ -122,13 +121,13 @@ The lack of *good* metadata removal apps on the App Store is what makes this sol
 
 ## Windows
 
-Windows allows users to place files in a **SendTo** folder which then appear in the *Send to* context menu. This guide will show you how to add an ExifTool batch script to this menu.
+Windows allows users to place files in a **SendTo** folder which then appear in the *Send to* context menu. This guide will show you how to add an [ExifTool](../metadata-removal-tools.md#exiftool) batch script to this menu.
 
-![Send to metadata removal shortcut](/assets/img/integrating-metadata-removal/preview-windows.jpg)
+![Send to metadata removal shortcut](../assets/img/integrating-metadata-removal/preview-windows.jpg)
 
 ### Prerequisites
 
-1. [ExifTool](/metadata-removal-tools/#exiftool): a tool for viewing and manipulating image, audio, video, and PDF metadata. We suggest you read the [Installation instructions](https://exiftool.org/install.html#Windows) on the official website.
+1. ExifTool is a tool for viewing and manipulating image, audio, video, and PDF metadata. We suggest you read the [Installation instructions](https://exiftool.org/install.html#Windows) on the official website.
 
 !!! note
     You can check if ExifTool is present in your [PATH](https://www.computerhope.com/issues/ch000549.htm) by running `exiftool -ver` in Command Prompt. You should see a version number.
@@ -161,4 +160,4 @@ Windows allows users to place files in a **SendTo** folder which then appear in
 
 ### Using the shortcut
 
-1. Right click a supported file and choose **ExifTool.bat** within the *Send to* context menu
+1. Right click a supported file and choose **ExifTool.bat** within the *Send to* context menu.

docs/social-networks.md

@@ -1,99 +0,0 @@
----
-title: Social Networks
-icon: material/account-supervisor-circle-outline
----
-Find a social network that doesn’t pry into your data or monetize your profile.
-
-## Decentralized Social Networks
-
-### Mastodon (Twitter Alternative)
-
-!!! recommendation
-
-    ![Mastodon logo](/assets/img/social-networks/mastodon.svg){ align=right }
-
-    Mastodon is a social network based on open web protocols and free, open-source software. It is decentralized like email, users can exist on different servers or even different platforms but still communicate with each other. It also has the most users, and the most diverse (in terms of interests) users, it looks good, and it is easy to setup yourself.
-
-    [Visit joinmastodon.org](https://joinmastodon.org){ .md-button .md-button--primary } [Privacy Policy](https://joinmastodon.org/privacy-policy){ .md-button }
-
-    **Downloads**
-    - [:fontawesome-brands-app-store-ios: App Store](https://apps.apple.com/us/app/mastodon-for-iphone/id1571998974)
-    - [:fontawesome-regular-circle-down: All other apps](https://joinmastodon.org/apps)
-    - [:fontawesome-brands-github: Source](https://github.com/mastodon)
-
-### diaspora\* (Google+ Alternative)
-
-!!! recommendation
-
-    ![diaspora* logo](/assets/img/social-networks/diaspora.svg){ align=right }
-
-    diaspora\* is based on three key philosophies: Decentralization, Freedom, and Privacy. It is intended to address privacy concerns related to centralized social networks by allowing users set up their own server (or "pod") to host content. Pods can then interact to share status updates, photographs, and other social data.
-
-    [Visit diasporafoundation.org](https://diasporafoundation.org){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-regular-circle-down: All apps](https://wiki.diasporafoundation.org/Tools_to_use_with_Diaspora)
-    - [:fontawesome-brands-github: Source](https://github.com/diaspora)
-
-### Friendica (Facebook Alternative)
-
-!!! recommendation
-
-    ![Frendica logo](/assets/img/social-networks/friendica.svg){ align=right }
-
-    **Friendica** has an emphasis on extensive privacy settings and easy server installation. It aims to federate with as many other social networks as possible. Currently, Friendica users can integrate contacts from Facebook, Twitter, Diaspora, GNU social, App.net, Pump.io and other services in their social streams.
-
-    [Visit friendi.ca](https://friendi.ca){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-regular-circle-down: All apps](https://friendi.ca/resources/mobile-clients/)
-    - [:fontawesome-brands-github: Source](https://github.com/friendica)
-
-### PixelFed (Instagram Alternative)
-
-!!! recommendation
-
-    ![PixelFed logo](/assets/img/social-networks/pixelfed.svg){ align=right }
-
-    **PixelFed** is a free and ethical photo sharing platform, powered by ActivityPub federation. Pixelfed is an open-source, federated platform. You can run your own instance or join an [existing one](https://fediverse.party/en/pixelfed).
-
-    [Visit pixelfed.org](https://pixelfed.org){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-brands-github: Source](https://github.com/pixelfed)
-
-### Pleroma (Twitter Alternative)
-
-!!! recommendation
-
-    ![Pleroma logo](/assets/img/social-networks/pleroma.svg){ align=right }
-
-    **Pleroma** is a free, federated social networking server built on open protocols. It is compatible with Mastodon and many other ActivityPub and OStatus implementations.
-
-    [Visit pleroma.social](https://pleroma.social){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-regular-circle-down: All apps](https://docs-develop.pleroma.social/backend/clients/)
-    - [:fontawesome-brands-gitlab: Source](https://git.pleroma.social/pleroma)
-
-### Movim
-
-!!! recommendation
-
-    ![Movim logo](/assets/img/social-networks/movim.svg){ align=right }
-
-    **Movim** is a federated social platform that relies on the XMPP standard and therefore allows you to exchange with many other clients on all devices.
-
-    **Downloads**
-    - [:fontawesome-brands-github: Source](https://github.com/movim)
-
-## Related Information
-
-- [JustDeleteMe](https://justdeleteme.xyz) - A directory of direct links to delete your account from web services.
-- [Forget](https://forget.codl.fr) - A service that automatically deletes your old posts on Twitter and Mastodon that everyone has forgotten about.
-
-## Facebook Related
-
-- [How do I permanently delete my Facebook account?](https://www.facebook.com/help/224562897555674)
-- [Facebook Container by Mozilla](https://addons.mozilla.org/firefox/addon/facebook-container)
-- [Stop using Facebook](https://web.archive.org/web/20190510075433/https://www.stopusingfacebook.co/) - A curated list of reasons to stop using Facebook and how to do it.

docs/social-news-aggregator.md

@@ -1,57 +0,0 @@
----
-title: Social News Aggregator
-icon: material/newspaper-variant-outline
----
-Stay up-to-date with privacy-respecting online bulletin boards.
-
-### Tildes
-
-!!! recommendation
-
-    ![Tildes logo](/assets/img/social-media-aggregator/tildes.svg){ align=right }
-
-    **Tildes** is a web-based self-hostable online bulletin board. It is licensed under [AGPLv3](https://gitlab.com/tildes/tildes/blob/master/LICENSE).
-
-    [Visit tildes.net](https://tildes.net){ .md-button .md-button--primary } [Privacy Policy](https://docs.tildes.net/policies/privacy-policy){ .md-button }
-
-    **Downloads**
-    - [:fontawesome-brands-gitlab: Source](hhttps://gitlab.com/tildes)
-
-### Lemmy
-
-!!! recommendation
-
-    ![Lemmy logo](/assets/img/social-media-aggregator/lemmy.svg){ align=right }
-
-    **Lemmy** is an [AGPL](https://github.com/dessalines/lemmy/blob/master/LICENSE)-licensed self-hostable link aggregator and discussion network designed to serve as an alternative to Reddit within the ActivityPub [Fediverse](https://www.wikipedia.org/wiki/Fediverse).
-
-    [Visit lemmy.ml](https://lemmy.ml){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-brands-github: Source](https://github.com/LemmyNet)
-
-### Postmill
-
-!!! recommendation
-
-    ![Postmill logo](/assets/img/social-media-aggregator/postmill.png){ align=right }
-
-    **Postmill** is a free, web-based, social link aggregator with voting and nested comments.
-
-    [Visit postmill.xyz](https://postmill.xyz){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-brands-gitlab: Source](https://gitlab.com/postmill)
-
-### Freepost
-
-!!! recommendation
-
-    ![Freepost logo](/assets/img/social-media-aggregator/freepost.svg){ align=right }
-
-    **Freepost** is a free and open-source discussion board based on free software and free culture with a highly motivated community.
-
-    [Visit freepo.st](https://freepo.st){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-brands-git: Source](https://notabug.org/zPlus/freepost)

docs/stylesheets/extra.css

@@ -145,3 +145,8 @@ h1, h2, h3, .md-header__topic {
 .md-nav__link svg {
     width: 22px;
 }
+
+/* Unsticky sidebar without JS */
+.no-js .md-sidebar {
+    align-self: auto;
+}

docs/technology/dns.en.md

@@ -52,7 +52,7 @@ Below, we discuss and provide a tutorial to prove what an outside observer may s
         tshark -r /tmp/dns.pcap
         ```
 
-If you run the Wireguard command above, the top pane shows the "[frames](https://en.wikipedia.org/wiki/Ethernet_frame)", and the bottom pane shows all the data about the selected frame. Enterprise filtering and monitoring solutions (such as those purchased by governments) can do the process automatically, without human interaction, and can aggregate those frames to produce statistical data useful to the network observer.
+If you run the Wireshark command above, the top pane shows the "[frames](https://en.wikipedia.org/wiki/Ethernet_frame)", and the bottom pane shows all the data about the selected frame. Enterprise filtering and monitoring solutions (such as those purchased by governments) can do the process automatically, without human interaction, and can aggregate those frames to produce statistical data useful to the network observer.
 
 | No. | Time     | Source    | Destination | Protocol | Length | Info                                                                   |
 |-----|----------|-----------|-------------|----------|--------|------------------------------------------------------------------------|
@@ -109,7 +109,7 @@ We can see the [connection establishment](https://en.wikipedia.org/wiki/Transmis
 
 ## Why **shouldn't** I use encrypted DNS?
 
-In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](/threat-modeling/). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](https://torproject.org) or a [VPN](/vpn) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity.
+In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](../threat-modeling.md). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](https://torproject.org) or a [VPN](vpn) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity.
 
 When we do a DNS lookup, it's generally because we want to access a resource. Below, we will discuss some of the methods that may disclose your browsing activities even when using encrypted DNS:
 
@@ -117,7 +117,7 @@ When we do a DNS lookup, it's generally because we want to access a resource. Be
 
 The simplest way to determine browsing activity might be to look at the IP addresses your devices are accessing. For example, if the observer knows that `privacyguides.org` is at `198.98.54.105`, and your device is requesting data from `198.98.54.105`, there is a good chance you're visiting Privacy Guides.
 
-This method is only useful when the IP address belongs to a server that only hosts few websites. It's also not very useful if the site is hosted on a shared platform, (e.g. Github Pages, Cloudflare Pages, Netlify, Wordpress, Blogger, etc). It also isn't very useful if the server is hosted behind a [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy), which is very common on the modern Internet.
+This method is only useful when the IP address belongs to a server that only hosts few websites. It's also not very useful if the site is hosted on a shared platform, (e.g. Github Pages, Cloudflare Pages, Netlify, WordPress, Blogger, etc). It also isn't very useful if the server is hosted behind a [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy), which is very common on the modern Internet.
 
 ### Server Name Indication (SNI)
 
@@ -281,7 +281,7 @@ Encrypted DNS with a 3rd party should only be used to get around redirects and b
 
 ## What is DNSSEC and when is it used?
 
-[Domain Name System Security Extensions (DNSSEC)](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) is used to provide authenticity to the records being fetched from upstream DNS servers. It doesn't provide confidentiality, for that we use one of the [encrypted DNS](/dns#what-is-encrypted-dns) protocols discussed above.
+[Domain Name System Security Extensions (DNSSEC)](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) is used to provide authenticity to the records being fetched from upstream DNS servers. It doesn't provide confidentiality, for that we use one of the [encrypted DNS](#what-is-encrypted-dns) protocols discussed above.
 
 ## What is QNAME minimization?
 

docs/threat-modeling.en.md

@@ -1,6 +1,5 @@
 ---
-layout: evergreen
-title: What are threat models?
+title: "Threat Modeling"
 icon: 'material/target-account'
 ---
 

docs/tools.en.md

@@ -0,0 +1,391 @@
+---
+title: "Privacy Tools"
+icon: material/tools
+hide:
+  - toc
+---
+
+If you're looking for a specific solution to something, these are the hardware and software tools we recommend in a variety of categories. Our recommended privacy tools are primarily chosen based on security features, with additional emphasis on decentralized and open-source tools. They are applicable to a variety of threat models ranging from protection against global mass surveillance programs and avoiding big tech companies to mitigating attacks, but only you can determine what will work best for your use case.
+
+If you want assistance figuring out the best privacy tools and alternative programs for your workload/use-case, start a discussion in our [Reddit](https://www.reddit.com/r/privacyguides) or [Matrix](https://matrix.to/#/#privacyguides:matrix.org) communities!
+
+For your convenience, everything we recommend is listed below with a link to the project's homepage. For more details about each project, why they were chosen, and additional tips or tricks we recommend, click the "Learn more" link in each section.
+
+## Web Browsers
+
+<div class="grid cards" markdown>
+
+- ![Tor Browser logo](assets/img/browsers/tor.svg){ .twemoji } [Tor Browser](https://www.torproject.org/)
+- ![Firefox logo](assets/img/browsers/firefox.svg){ .twemoji } [Firefox (Desktop)](https://firefox.com/)
+- ![Bromite logo](assets/img/browsers/bromite.svg){ .twemoji } [Bromite (Android)](https://www.bromite.org/)
+- ![Safari logo](assets/img/browsers/safari.svg){ .twemoji } [Safari (iOS)](https://www.apple.com/safari/)
+
+</div>
+
+**Additional Resources:**
+
+<div class="grid cards annotate" markdown>
+
+- ![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ .twemoji } [uBlock Origin](https://github.com/gorhill/uBlock)
+- ![AdGuard logo](assets/img/browsers/adguard.svg){ .twemoji } [AdGuard for Safari](https://adguard.com/en/adguard-safari/overview.html)
+- ![ToS;DR logo](assets/img/browsers/terms_of_service_didnt_read.svg){ .twemoji } [Terms of Service; Didn't Read](https://tosdr.org/) (1)
+
+</div>
+
+1. We do not recommend installing ToS;DR as a browser extension. The same information is provided on their website.
+
+[Learn more :material-arrow-right:](browsers.md)
+
+## Operating Systems
+
+### Android
+
+<div class="grid cards" markdown>
+
+- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji } [GrapheneOS](https://grapheneos.org/)
+- ![CalyxOS logo](assets/img/android/calyxos.svg){ .twemoji } [CalyxOS](https://calyxos.org/)
+- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji } [DivestOS](https://divestos.org/)
+
+</div>
+
+**Android Apps:**
+
+<div class="grid cards" markdown>
+
+- ![Droid-ify logo](assets/img/android/droid-ify.png){ .twemoji } [Droid-ify (F-Droid Client)](https://github.com/Iamlooker/Droid-ify)
+- ![Orbot logo](assets/img/android/orbot.svg){ .twemoji } [Orbot (Tor Proxy)](https://orbot.app/)
+- ![Shelter logo](assets/img/android/shelter.svg){ .twemoji } [Shelter (Work Profiles)](https://gitea.angry.im/PeterCxy/Shelter)
+- ![Auditor logo](assets/img/android/auditor.svg#only-light){ .twemoji }![GrapheneOS logo](assets/img/android/auditor-dark.svg#only-dark){ .twemoji } [Auditor (Supported Devices)](https://attestation.app/)
+- ![Secure Camera logo](assets/img/android/secure_camera.svg#only-light){ .twemoji }![Secure Camera logo](assets/img/android/secure_camera-dark.svg#only-dark){ .twemoji } [Secure Camera](https://github.com/GrapheneOS/Camera)
+- ![Secure PDF Viewer logo](assets/img/android/secure_pdf_viewer.svg#only-light){ .twemoji }![GrapheneOS logo](assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ .twemoji } [Secure PDF Viewer](https://github.com/GrapheneOS/PdfViewer)
+- ![PrivacyBlur logo](assets/img/android/privacyblur.svg){ .twemoji } [PrivacyBlur](https://privacyblur.app/)
+
+</div>
+
+[Learn more :material-arrow-right:](android.md)
+
+### Linux
+
+<div class="grid cards annotate" markdown>
+
+- ![Fedora logo](assets/img/linux-desktop/fedora-workstation.svg){ .twemoji } [Fedora Workstation](https://getfedora.org/)
+- ![openSUSE Tumbleweed logo](assets/img/linux-desktop/opensuse-tumbleweed.svg){ .twemoji } [OpenSUSE Tumbleweed](https://get.opensuse.org/tumbleweed/)
+- ![Arch logo](assets/img/linux-desktop/archlinux.svg){ .twemoji } [Arch Linux](https://archlinux.org/)
+- ![Fedora Silverblue logo](assets/img/linux-desktop/fedora-silverblue.svg){ .twemoji } [Fedora Silverblue & Kinoite](https://silverblue.fedoraproject.org/)
+- ![nixOS logo](assets/img/linux-desktop/nixos.svg){ .twemoji } [NixOS](https://nixos.org/)
+- ![Whonix logo](assets/img/linux-desktop/whonix.svg){ .twemoji } [Whonix (Tor)](https://www.whonix.org/)
+- ![Tails logo](assets/img/linux-desktop/tails.svg){ .twemoji } [Tails (Live Boot)](https://tails.boum.org/)
+- ![Qubes OS logo](assets/img/qubes/qubes_os.svg){ .twemoji } [Qubes OS (Xen VM Distribution)](https://www.qubes-os.org/) (1)
+
+</div>
+
+1. Qubes uses Xen to provide strong sandboxing between multiple Linux virtual machine installations, and can run most Linux applications. [Learn more about Qubes...](qubes.md)
+
+[Learn more :material-arrow-right:](linux-desktop.md)
+
+### Router Firmware
+
+<div class="grid cards" markdown>
+
+- ![OpenWrt logo](assets/img/router/openwrt.svg#only-light){ .twemoji }![OpenWrt logo](assets/img/router/openwrt-dark.svg#only-dark){ .twemoji } [OpenWrt](https://openwrt.org/)
+- ![pfSense logo](assets/img/router/pfsense.svg#only-light){ .twemoji }![pfSense logo](assets/img/router/pfsense-dark.svg#only-dark){ .twemoji } [pfSense](https://www.pfsense.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](router.md)
+
+## Service Providers
+
+### Cloud Storage
+
+<div class="grid cards" markdown>
+
+- ![Nextcloud logo](assets/img/cloud/nextcloud.svg){ .twemoji } [Nextcloud (Self-Hostable)](https://nextcloud.com/)
+- ![Proton Drive logo](assets/img/cloud/protondrive.svg){ .twemoji } [Proton Drive](https://drive.protonmail.com/)
+- ![Cryptee logo](assets/img/cloud/cryptee.svg#only-light){ .twemoji }![Cryptee logo](assets/img/cloud/cryptee-dark.svg#only-dark){ .twemoji } [Cryptee](https://crypt.ee/)
+- ![Tahoe-LAFS logo](assets/img/cloud/tahoe-lafs.svg#only-light){ .twemoji }![Tahoe-LAFS logo](assets/img/cloud/tahoe-lafs-dark.svg#only-dark){ .twemoji } [Tahoe-LAFS (Advanced)](https://www.tahoe-lafs.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](cloud.md)
+
+### DNS
+
+We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers based on a variety of criteria, such as [MullvadDNS](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) and [Quad9](https://quad9.net/) amongst others. We recommend for you to read our pages on DNS before choosing a provider. In many cases, using an alternative DNS provider is not recommended.
+<br>
+<br>
+[Learn more :material-arrow-right:](dns.md)
+
+### Email
+
+<div class="grid cards" markdown>
+
+- ![ProtonMail logo](assets/img/email/mini/protonmail.svg){ .twemoji } [ProtonMail](https://protonmail.com/)
+- ![Mailbox.org logo](assets/img/email/mini/mailboxorg.svg){ .twemoji } [Mailbox.org](https://mailbox.org/)
+- ![Disroot logo](assets/img/email/mini/disroot.svg#only-light){ .twemoji }![Disroot logo](assets/img/email/mini/disroot-dark.svg#only-dark){ .twemoji } [Disroot](https://disroot.org/)
+- ![Tutanota logo](assets/img/email/mini/tutanota.svg){ .twemoji } [Tutanota](https://tutanota.com/)
+- ![StartMail logo](assets/img/email/mini/startmail.svg#only-light){ .twemoji }![StartMail logo](assets/img/email/mini/startmail-dark.svg#only-dark){ .twemoji } [StartMail](https://startmail.com/)
+- ![CTemplar logo](assets/img/email/mini/ctemplar.svg#only-light){ .twemoji }![CTemplar logo](assets/img/email/mini/ctemplar-dark.svg#only-dark){ .twemoji } [CTemplar](https://ctemplar.com/)
+
+</div>
+
+**Email Cloaking Services:**
+
+<div class="grid cards" markdown>
+
+- ![AnonAddy logo](assets/img/email/mini/anonaddy.svg#only-light){ .twemoji }![AnonAddy logo](assets/img/email/mini/anonaddy-dark.svg#only-dark){ .twemoji } [AnonAddy](https://anonaddy.com/)
+- ![SimpleLogin logo](assets/img/email/mini/simplelogin.svg){ .twemoji } [SimpleLogin](https://simplelogin.io/)
+
+</div>
+
+**Self-Hosting Email:**
+
+<div class="grid cards" markdown>
+
+- ![Mail-in-a-Box logo](assets/img/email/mail-in-a-box.svg){ .twemoji } [Mail-in-a-Box](https://mailinabox.email/)
+- ![mailcow logo](assets/img/email/mailcow.svg){ .twemoji } [mailcow](https://mailcow.email/)
+
+</div>
+
+[Learn more :material-arrow-right:](email.md)
+
+### Search Engines
+
+<div class="grid cards" markdown>
+
+- ![DuckDuckGo logo](assets/img/search-engines/duckduckgo.svg){ .twemoji } [DuckDuckGo](https://duckduckgo.com/)
+- ![Startpage logo](assets/img/search-engines/startpage.svg){ .twemoji } [Startpage](https://www.startpage.com/)
+- ![Mojeek logo](assets/img/search-engines//mini/mojeek.svg){ .twemoji } [Mojeek](https://www.mojeek.com/)
+- ![Searx logo](assets/img/search-engines/searx.svg){ .twemoji } [Searx](https://searx.me/)
+
+</div>
+
+[Learn more :material-arrow-right:](search-engines.md)
+
+### VPN Providers
+
+??? danger "VPNs do not provide anonymity"
+
+    Using a VPN will **not** keep your browsing habits anonymous, nor will it add additional security to non-secure (HTTP) traffic.
+
+    If you are looking for **anonymity**, you should use the Tor Browser **instead** of a VPN.
+
+    If you're looking for added **security**, you should always ensure you're connecting to websites using [HTTPS](https://en.wikipedia.org/wiki/HTTPS). A VPN is not a replacement for good security practices.
+
+    [Learn more :material-arrow-right:](vpn.md)
+
+<div class="grid cards" markdown>
+
+- ![Mullvad logo](assets/img/vpn/mini/mullvad.svg){ .twemoji } [Mullvad](https://mullvad.net/)
+- ![ProtonVPN logo](assets/img/vpn/mini/protonvpn.svg){ .twemoji } [ProtonVPN](https://protonvpn.com/)
+- ![IVPN logo](assets/img/vpn/mini/ivpn.svg){ .twemoji } [IVPN](https://www.ivpn.net/)
+
+</div>
+
+[Learn more :material-arrow-right:](vpn.md)
+
+## Software
+
+### Calendar/Contacts Sync
+
+<div class="grid cards" markdown>
+
+- ![Tutanota logo](assets/img/calendar-contacts/tutanota.svg){ .twemoji } [Tutanota (SaaS)](https://tutanota.com/calendar)
+- ![Proton Calendar logo](assets/img/calendar-contacts/proton-calendar.svg){ .twemoji } [Proton Calendar (SaaS)](https://calendar.protonmail.com/)
+- ![EteSync logo](assets/img/calendar-contacts/etesync.svg){ .twemoji } [EteSync](https://www.etesync.com/)
+- ![Tutanota logo](assets/img/calendar-contacts/nextcloud.svg){ .twemoji } [Nextcloud](https://nextcloud.com/)
+- ![DecSync CC logo](assets/img/calendar-contacts/decsync.svg){ .twemoji } [DecSync CC](https://github.com/39aldo39/DecSync)
+
+</div>
+
+[Learn more :material-arrow-right:](calendar-contacts.md)
+
+### Notebooks
+
+<div class="grid cards" markdown>
+
+- ![Joplin logo](assets/img/notebooks/joplin.svg){ .twemoji } [Joplin](https://joplinapp.org/)
+- ![Standard Notes logo](assets/img/notebooks/standard-notes.svg){ .twemoji } [Standard Notes](https://standardnotes.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](notebooks.md)
+
+### Email Clients
+
+<div class="grid cards" markdown>
+
+- ![Thunderbird logo](assets/img/email-clients/thunderbird.svg){ .twemoji } [Thunderbird](https://www.thunderbird.net/)
+- ![Apple Mail logo](assets/img/email-clients/applemail.png){ .twemoji } [Apple Mail](https://support.apple.com/guide/mail/welcome/mac)
+- ![GNOME Evolution logo](assets/img/email-clients/evolution.svg){ .twemoji } [GNOME Evolution (Linux)](https://wiki.gnome.org/Apps/Evolution)
+- ![Kontact logo](assets/img/email-clients/kontact.svg){ .twemoji } [Kontact (Linux)](https://kontact.kde.org/)
+- ![Mailvelope logo](assets/img/email-clients/mailvelope.svg){ .twemoji } [Mailvelope (PGP in standard webmail)](https://www.mailvelope.com/)
+- ![K-9 Mail logo](assets/img/email-clients/k9mail.svg){ .twemoji } [K-9 Mail (Android)](https://k9mail.app/)
+- ![FairEmail logo](assets/img/email-clients/fairemail.svg){ .twemoji } [FairEmail (Android)](https://email.faircode.eu/)
+- ![Canary Mail logo](assets/img/email-clients/canarymail.svg){ .twemoji } [Canary Mail (iOS)](https://canarymail.io/)
+- ![NeoMutt logo](assets/img/email-clients/mutt.svg){ .twemoji } [NeoMutt (CLI)](https://neomutt.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](email-clients.md)
+
+### Encryption Tools
+
+??? info "Operating System Disk Encryption"
+
+    For encrypting your operating system drive, we typically recommend using whichever encryption tool your operating system provides, whether that is **BitLocker** on Windows, **FileVault** on macOS, or **LUKS** on Linux. These tools are available out of the box and typically utilize hardware encryption elements such as a TPM that other full-disk encryption software like VeraCrypt will not. VeraCrypt is still suitable for non-operating system disks such as external drives, especially drives that may be accessed from multiple operating systems.
+
+    [Learn more :material-arrow-right:](encryption.md##operating-system-included-full-disk-encryption-fde)
+
+<div class="grid cards" markdown>
+
+- ![VeraCrypt logo](assets/img/encryption-software/veracrypt.svg#only-light){ .twemoji }![VeraCrypt logo](assets/img/encryption-software/veracrypt-dark.svg#only-dark){ .twemoji } [VeraCrypt (FDE)](https://veracrypt.fr/)
+- ![Cryptomator logo](assets/img/encryption-software/cryptomator.svg){ .twemoji } [Cryptomator](https://cryptomator.org/)
+- ![Picocrypt logo](assets/img/encryption-software/picocrypt.svg){ .twemoji } [Picocrypt](https://evansu.cc/picocrypt)
+- ![Hat.sh logo](assets/img/encryption-software/hat-sh.png#only-light){ .twemoji }![Hat.sh logo](assets/img/encryption-software/hat-sh-dark.png#only-dark){ .twemoji } [Hat.sh (Browser-based)](https://hat.sh/)
+- ![Kryptor logo](assets/img/encryption-software/kryptor.png){ .twemoji } [Kryptor](https://www.kryptor.co.uk/)
+- ![Tomb logo](assets/img/encryption-software/tomb.png){ .twemoji } [Tomb](https://www.dyne.org/software/tomb)
+
+</div>
+
+**OpenPGP Clients:**
+
+<div class="grid cards" markdown>
+
+- ![GnuPG logo](assets/img/encryption-software/gnupg.svg){ .twemoji } [GnuPG](https://gnupg.org)
+- ![GPG4Win logo](assets/img/encryption-software/gpg4win.svg){ .twemoji } [GPG4Win (Windows)](https://gpg4win.org)
+- ![GPG Suite logo](assets/img/encryption-software/gpgsuite.png){ .twemoji } [GPG Suite (macOS)](https://gpgtools.org)
+- ![OpenKeychain logo](assets/img/encryption-software/openkeychain.svg){ .twemoji } [OpenKeychain](https://www.openkeychain.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](encryption.md)
+
+### File Sharing
+
+<div class="grid cards" markdown>
+
+- ![OnionShare logo](assets/img/file-sharing-sync/onionshare.svg){ .twemoji } [OnionShare](https://onionshare.org/)
+- ![Magic Wormhole logo](assets/img/file-sharing-sync/magic_wormhole.png){ .twemoji } [Magic Wormhole](https://magic-wormhole.readthedocs.io/)
+- ![FreedomBox logo](assets/img/file-sharing-sync/freedombox.svg){ .twemoji } [FreedomBox](https://freedombox.org/)
+- ![Syncthing logo](assets/img/file-sharing-sync/syncthing.svg){ .twemoji } [Syncthing](https://syncthing.net/)
+- ![git-annex logo](assets/img/file-sharing-sync/gitannex.svg){ .twemoji } [git-annex](https://git-annex.branchable.com/)
+
+</div>
+
+[Learn more :material-arrow-right:](file-sharing.md)
+
+### Metadata Removal Tools
+
+<div class="grid cards" markdown>
+
+- ![MAT2 logo](assets/img/metadata-removal/mat2.svg){ .twemoji } [MAT2](https://0xacab.org/jvoisin/mat2)
+- ![ExifCleaner logo](assets/img/metadata-removal/exifcleaner.svg){ .twemoji } [ExifCleaner](https://exifcleaner.com/)
+- ![Scrambled Exif logo](assets/img/metadata-removal/scrambled-exif.svg){ .twemoji } [Scrambled Exif (Android)](https://gitlab.com/juanitobananas/scrambled-exif)
+- ![Imagepipe logo](assets/img/metadata-removal/imagepipe.svg){ .twemoji } [Imagepipe (Android)](https://codeberg.org/Starfish/Imagepipe)
+- ![Metapho logo](assets/img/metadata-removal/metapho.jpg){ .twemoji } [Metapho (iOS)](https://zininworks.com/metapho)
+- ![ExifTool logo](assets/img/metadata-removal/exiftool.png){ .twemoji } [ExifTool (CLI)](https://exiftool.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](metadata-removal-tools.md)
+
+### Multi-Factor Authentication Tools
+
+<div class="grid cards" markdown>
+
+- ![YubiKeys](assets/img/multi-factor-authentication/yubikey.png){ .twemoji } [YubiKey](https://www.yubico.com/)
+- ![Nitrokey](assets/img/multi-factor-authentication/nitrokey.jpg){ .twemoji } [Nitrokey](https://www.nitrokey.com/)
+- ![Aegis logo](assets/img/multi-factor-authentication/aegis.png){ .twemoji } [Aegis Authenticator](https://getaegis.app/)
+- ![Raivo OTP logo](assets/img/multi-factor-authentication/raivo-otp.png){ .twemoji } [Raivo OTP](https://github.com/raivo-otp/ios-application)
+
+</div>
+
+[Learn more :material-arrow-right:](multi-factor-authentication.md)
+
+### Password Managers
+
+<div class="grid cards" markdown>
+
+- ![KeePassXC logo](assets/img/password-management/keepassxc.svg){ .twemoji } [KeePassXC](https://keepassxc.org/)
+- ![KeePassDX logo](assets/img/password-management/keepassdx.svg){ .twemoji } [KeePassDX (Android)](https://www.keepassdx.com/)
+- ![Bitwarden logo](assets/img/password-management/bitwarden.svg){ .twemoji } [Bitwarden](https://bitwarden.com/)
+- ![Psono logo](assets/img/password-management/psono.svg){ .twemoji } [Psono](https://psono.com/)
+- ![gopass logo](assets/img/password-management/gopass.svg){ .twemoji } [gopass](https://www.gopass.pw/)
+- ![Vaultwarden logo](assets/img/password-management/vaultwarden.svg#only-light){ .twemoji }![Vaultwarden logo](assets/img/password-management/vaultwarden-dark.svg#only-dark){ .twemoji } [Vaultwarden (Bitwarden Server)](https://github.com/dani-garcia/vaultwarden)
+
+</div>
+
+[Learn more :material-arrow-right:](passwords.md)
+
+### Productivity Tools
+
+<div class="grid cards" markdown>
+
+- ![LibreOffice logo](assets/img/productivity/libreoffice.svg){ .twemoji } [LibreOffice](https://www.libreoffice.org/)
+- ![OnlyOffice logo](assets/img/productivity/onlyoffice.svg){ .twemoji } [OnlyOffice](https://www.onlyoffice.com/)
+- ![Framadate logo](assets/img/productivity/framadate.svg){ .twemoji } [Framadate (Appointment Planning)](https://framadate.org/)
+- ![PrivateBin logo](assets/img/productivity/privatebin.svg){ .twemoji } [PrivateBin (Pastebin)](https://privatebin.info/)
+- ![CryptPad logo](assets/img/productivity/cryptpad.svg){ .twemoji } [CryptPad](https://cryptpad.fr/)
+- ![Write.as logo](assets/img/productivity/writeas.svg#only-light){ .twemoji }![Write.as logo](assets/img/productivity/writeas-dark.svg#only-dark){ .twemoji } [Write.as (Blogging Platform)](https://write.as/)
+- ![VSCodium logo](assets/img/productivity/vscodium.svg){ .twemoji } [VSCodium (Source-Code Editor)](https://vscodium.com/)
+
+</div>
+
+[Learn more :material-arrow-right:](productivity.md)
+
+### Real-Time Communication
+
+<div class="grid cards" markdown>
+
+- ![Signal logo](assets/img/messengers/signal.svg){ .twemoji } [Signal](https://signal.org/)
+- ![Element logo](assets/img/messengers/element.svg){ .twemoji } [Element](https://element.io/)
+- ![Briar logo](assets/img/messengers/briar.svg){ .twemoji } [Briar (Android)](https://briarproject.org/)
+- ![Session logo](assets/img/messengers/session.svg){ .twemoji } [Session](https://getsession.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](real-time-communication.md)
+
+### News Aggregators
+
+<div class="grid cards" markdown>
+
+- ![Fluent Reader](assets/img/news-aggregators/fluent-reader.svg){ .twemoji } [Fluent Reader](https://hyliu.me/fluent-reader)
+- ![GNOME Feeds](assets/img/news-aggregators/gfeeds.svg){ .twemoji } [GNOME Feeds](https://gfeeds.gabmus.org)
+- ![Akregator](assets/img/news-aggregators/akregator.svg){ .twemoji } [Akregator](https://apps.kde.org/akregator)
+- ![Handy News Reader](assets/img/news-aggregators/handy-news-reader.svg){ .twemoji } [Handy News Reader](https://github.com/yanus171/Handy-News-Reader)
+- ![NetNewsWire](assets/img/news-aggregators/netnewswire.png){ .twemoji } [NetNewsWire](https://netnewswire.com)
+- ![Miniflux](assets/img/news-aggregators/miniflux.svg#only-light){ .twemoji }![Miniflux logo](assets/img/news-aggregators/miniflux-dark.svg#only-dark){ .twemoji } [Miniflux](https://miniflux.app)
+- ![Newsboat](assets/img/news-aggregators/newsboat.svg){ .twemoji } [Newsboat](https://newsboat.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](news-aggregators.md)
+
+### Self-Contained Networks
+
+<div class="grid cards" markdown>
+
+- ![Tor logo](./assets/img/self-contained-networks/tor.svg){ .twemoji } [Tor](https://www.torproject.org/)
+- ![I2P logo](./assets/img/self-contained-networks/i2p.svg#only-light){ .twemoji } ![I2P logo](./assets/img/self-contained-networks/i2p-dark.svg#only-dark){ .twemoji } [I2P](https://geti2p.net/)
+- ![Freenet logo](./assets/img/self-contained-networks/freenet.svg){ .twemoji } [Freenet](https://freenetproject.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](self-contained-networks.md)
+
+### Video Streaming Clients
+
+<div class="grid cards" markdown>
+
+- ![FreeTube logo](assets/img/video-streaming/freetube.svg){ .twemoji } [FreeTube (YouTube, Desktop)](https://freetubeapp.io/)
+- ![LBRY logo](assets/img/video-streaming/lbry.svg){ .twemoji } [LBRY](https://lbry.com/)
+- ![NewPipe logo](assets/img//video-streaming/newpipe.svg){ .twemoji } [NewPipe (YouTube, Android)](https://newpipe.net/)
+- ![NewPipe x SponsorBlock logo](assets/img/video-streaming/newpipe.svg){ .twemoji } [NewPipe x Sponsorblock](https://github.com/polymorphicshade/NewPipe)
+- ![Invidious logo](assets/img/video-streaming/invidious.svg#only-light){ .twemoji }![Invidious logo](assets/img/video-streaming/invidious-dark.svg#only-dark){ .twemoji } [Invidious (YouTube, Web)](https://invidious.io/)
+- ![Piped logo](assets/img/video-streaming/piped.svg){ .twemoji } [Piped (YouTube, Web)](https://piped.kavin.rocks/)
+
+</div>
+
+[Learn more :material-arrow-right:](video-streaming.md)

docs/tools.md

@@ -1,413 +0,0 @@
----
-title: Recommended Privacy Tools
-icon: material/tools
-hide:
-  - toc
----
-
-If you're looking for a specific solution to something, these are the hardware and software tools we recommend in a variety of categories. Our recommended privacy tools are primarily chosen based on security features, with additional emphasis on decentralized and open-source tools. They are applicable to a variety of threat models ranging from protection against global mass surveillance programs and avoiding big tech companies to mitigating attacks, but only you can determine what will work best for your use case.
-
-If you want assistance figuring out the best privacy tools and alternative programs for your workload/use-case, start a discussion in our [Reddit](https://www.reddit.com/r/privacyguides) or [Matrix](https://matrix.to/#/#privacyguides:matrix.org) communities!
-
-For your convenience, everything we recommend is listed below with a link to the project's homepage. For more details about each project, why they were chosen, and additional tips or tricks we recommend, click the "Learn more" link in each section.
-
-## Web Browsers
-
-<div class="grid cards" markdown>
-
-- ![Tor Browser logo](/assets/img/browsers/tor.svg){ .twemoji } [Tor Browser](https://www.torproject.org/)
-- ![Firefox logo](/assets/img/browsers/firefox.svg){ .twemoji } [Firefox (Desktop)](https://firefox.com/)
-- ![Bromite logo](/assets/img/browsers/bromite.svg){ .twemoji } [Bromite (Android)](https://www.bromite.org/)
-- ![Safari logo](/assets/img/browsers/safari.svg){ .twemoji } [Safari (iOS)](https://www.apple.com/safari/)
-
-</div>
-
-**Additional Resources:**
-
-<div class="grid cards" markdown>
-
-- ![uBlock Origin logo](/assets/img/browsers/ublock_origin.svg){ .twemoji } [uBlock Origin](https://github.com/gorhill/uBlock)
-- ![AdGuard logo](/assets/img/browsers/adguard.svg){ .twemoji } [AdGuard for Safari](https://adguard.com/en/adguard-safari/overview.html)
-- ![ToS;DR logo](/assets/img/browsers/terms_of_service_didnt_read.svg){ .twemoji } [Terms of Service; Didn't Read\*](https://tosdr.org/)
-
-</div>
-
-[Learn more...](browsers.md)
-
-\* We do not recommend installing ToS;DR as a browser extension. The same information is provided on their website.
-
-## Operating Systems
-
-### Android
-
-<div class="grid cards" markdown>
-
-- ![GrapheneOS logo](/assets/img/android/grapheneos.svg#only-light){ .twemoji }![GrapheneOS logo](/assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji } [GrapheneOS](https://grapheneos.org/)
-- ![CalyxOS logo](/assets/img/android/calyxos.svg){ .twemoji } [CalyxOS](https://calyxos.org/)
-- ![DivestOS logo](/assets/img/android/divestos.svg){ .twemoji } [DivestOS](https://divestos.org/)
-
-</div>
-
-**Android Apps:**
-
-<div class="grid cards" markdown>
-
-- ![Droid-ify logo](/assets/img/android/droid-ify.png){ .twemoji } [Droid-ify (F-Droid Client)](https://github.com/Iamlooker/Droid-ify)
-- ![Orbot logo](/assets/img/android/orbot.svg){ .twemoji } [Orbot (Tor Proxy)](https://orbot.app/)
-- ![Shelter logo](/assets/img/android/shelter.svg){ .twemoji } [Shelter (Work Profiles)](https://gitea.angry.im/PeterCxy/Shelter)
-- ![Auditor logo](/assets/img/android/auditor.svg#only-light){ .twemoji }![GrapheneOS logo](/assets/img/android/auditor-dark.svg#only-dark){ .twemoji } [Auditor (Supported Devices)](https://attestation.app/)
-- ![Secure Camera logo](/assets/img/android/secure_camera.svg#only-light){ .twemoji }![Secure Camera logo](/assets/img/android/secure_camera-dark.svg#only-dark){ .twemoji } [Secure Camera](https://github.com/GrapheneOS/Camera)
-- ![Secure PDF Viewer logo](/assets/img/android/secure_pdf_viewer.svg#only-light){ .twemoji }![GrapheneOS logo](/assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ .twemoji } [Secure PDF Viewer](https://github.com/GrapheneOS/PdfViewer)
-- ![PrivacyBlur logo](/assets/img/android/privacyblur.svg){ .twemoji } [PrivacyBlur](https://privacyblur.app/)
-
-</div>
-
-[Learn more...](android.md)
-
-### Linux
-
-<div class="grid cards" markdown>
-
-- ![Fedora logo](/assets/img/linux-desktop/fedora-workstation.svg){ .twemoji } [Fedora Workstation](https://getfedora.org/)
-- ![openSUSE Tumbleweed logo](/assets/img/linux-desktop/opensuse-tumbleweed.svg){ .twemoji } [OpenSUSE Tumbleweed](https://get.opensuse.org/tumbleweed/)
-- ![Arch logo](/assets/img/linux-desktop/archlinux.svg){ .twemoji } [Arch Linux](https://archlinux.org/)
-- ![Fedora Silverblue logo](/assets/img/linux-desktop/fedora-silverblue.svg){ .twemoji } [Fedora Silverblue & Kinoite](https://silverblue.fedoraproject.org/)
-- ![nixOS logo](/assets/img/linux-desktop/nixos.svg){ .twemoji } [NixOS](https://nixos.org/)
-- ![Whonix logo](/assets/img/linux-desktop/whonix.svg){ .twemoji } [Whonix (Tor)](https://www.whonix.org/)
-- ![Tails logo](/assets/img/linux-desktop/tails.svg){ .twemoji } [Tails (Live Boot)](https://tails.boum.org/)
-- ![Qubes OS logo](/assets/img/qubes/qubes_os.svg){ .twemoji } [Qubes OS (Xen VM Distribution)\*](https://www.qubes-os.org/)
-
-</div>
-
-[Learn more...](linux-desktop.md)
-
-\* Qubes uses Xen to provide strong sandboxing between multiple Linux virtual machine installations, and can run most Linux applications. [Learn more about Qubes...](qubes.md)
-
-### Router Firmware
-
-<div class="grid cards" markdown>
-
-- ![OpenWrt logo](/assets/img/router/openwrt.svg#only-light){ .twemoji }![OpenWrt logo](/assets/img/router/openwrt-dark.svg#only-dark){ .twemoji } [OpenWrt](https://openwrt.org/)
-- ![pfSense logo](/assets/img/router/pfsense.svg#only-light){ .twemoji }![pfSense logo](/assets/img/router/pfsense-dark.svg#only-dark){ .twemoji } [pfSense](https://www.pfsense.org/)
-
-</div>
-
-[Learn more...](router.md)
-
-## Service Providers
-
-### Cloud Storage
-
-<div class="grid cards" markdown>
-
-- ![Nextcloud logo](/assets/img/cloud/nextcloud.svg){ .twemoji } [Nextcloud (Self-Hostable)](https://nextcloud.com/)
-- ![Proton Drive logo](/assets/img/cloud/protondrive.svg){ .twemoji } [Proton Drive](https://drive.protonmail.com/)
-- ![Cryptee logo](/assets/img/cloud/cryptee.svg#only-light){ .twemoji }![Cryptee logo](/assets/img/cloud/cryptee-dark.svg#only-dark){ .twemoji } [Cryptee](https://crypt.ee/)
-- ![Tahoe-LAFS logo](/assets/img/cloud/tahoe-lafs.svg#only-light){ .twemoji }![Tahoe-LAFS logo](/assets/img/cloud/tahoe-lafs-dark.svg#only-dark){ .twemoji } [Tahoe-LAFS (Advanced)](https://www.tahoe-lafs.org/)
-
-</div>
-
-[Learn more...](cloud.md)
-
-### DNS
-
-We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS servers based on a variety of criteria. Some no-logging choices include [MullvadDNS](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) and [Quad9](https://quad9.net/), but we recommend you read our full page on DNS before choosing a provider. In many cases using an alternative DNS provider is not recommended. [Learn more...](dns.md)
-
-### Email
-
-<div class="grid cards" markdown>
-
-- ![ProtonMail logo](/assets/img/email/mini/protonmail.svg){ .twemoji } [ProtonMail](https://protonmail.com/)
-- ![Mailbox.org logo](/assets/img/email/mini/mailboxorg.svg){ .twemoji } [Mailbox.org](https://mailbox.org/)
-- ![Disroot logo](/assets/img/email/mini/disroot.svg#only-light){ .twemoji }![Disroot logo](/assets/img/email/mini/disroot-dark.svg#only-dark){ .twemoji } [Disroot](https://disroot.org/)
-- ![Tutanota logo](/assets/img/email/mini/tutanota.svg){ .twemoji } [Tutanota](https://tutanota.com/)
-- ![StartMail logo](/assets/img/email/mini/startmail.svg#only-light){ .twemoji }![StartMail logo](/assets/img/email/mini/startmail-dark.svg#only-dark){ .twemoji } [StartMail](https://startmail.com/)
-- ![CTemplar logo](/assets/img/email/mini/ctemplar.svg#only-light){ .twemoji }![CTemplar logo](/assets/img/email/mini/ctemplar-dark.svg#only-dark){ .twemoji } [CTemplar](https://ctemplar.com/)
-
-</div>
-
-**Email Cloaking Services:**
-
-<div class="grid cards" markdown>
-
-- ![AnonAddy logo](/assets/img/email/mini/anonaddy.svg#only-light){ .twemoji }![AnonAddy logo](/assets/img/email/mini/anonaddy-dark.svg#only-dark){ .twemoji } [AnonAddy](https://anonaddy.com/)
-- ![SimpleLogin logo](/assets/img/email/mini/simplelogin.svg){ .twemoji } [SimpleLogin](https://simplelogin.io/)
-
-</div>
-
-**Self-Hosting Email:**
-
-<div class="grid cards" markdown>
-
-- ![Mail-in-a-Box logo](/assets/img/email/mail-in-a-box.svg){ .twemoji } [Mail-in-a-Box](https://mailinabox.email/)
-- ![mailcow logo](/assets/img/email/mailcow.svg){ .twemoji } [mailcow](https://mailcow.email/)
-
-</div>
-
-[Learn more...](email.md)
-
-### Search Engines
-
-<div class="grid cards" markdown>
-
-- ![DuckDuckGo logo](/assets/img/search-engines/duckduckgo.svg){ .twemoji } [DuckDuckGo](https://duckduckgo.com/)
-- ![Startpage logo](/assets/img/search-engines/startpage.svg){ .twemoji } [Startpage](https://www.startpage.com/)
-- ![Mojeek logo](/assets/img/search-engines//mini/mojeek.svg){ .twemoji } [Mojeek](https://www.mojeek.com/)
-- ![Searx logo](/assets/img/search-engines/searx.svg){ .twemoji } [Searx](https://searx.me/)
-
-</div>
-
-[Learn more...](search-engines.md)
-
-### Social Media
-
-<div class="grid cards" markdown>
-
-- ![Mastodon logo](/assets/img/social-networks/mastodon.svg){ .twemoji } [Mastodon](https://joinmastodon.org/)
-- ![diaspora logo](/assets/img/social-networks/diaspora.svg){ .twemoji } [diaspora\*](https://diasporafoundation.org/)
-- ![Friendica logo](/assets/img/social-networks/friendica.svg){ .twemoji } [Friendica](https://friendi.ca/)
-- ![PixelFed logo](/assets/img/social-networks/pixelfed.svg){ .twemoji } [PixelFed](https://pixelfed.org/)
-- ![Pleroma logo](/assets/img/social-networks/pleroma.svg){ .twemoji } [Pleroma](https://pleroma.social/)
-- ![Movim logo](/assets/img/social-networks/movim.svg){ .twemoji } [Movim](https://github.com/movim)
-
-</div>
-
-[Learn more...](social-networks.md)
-
-**News Aggregators:**
-
-<div class="grid cards" markdown>
-
-- ![Tildes logo](/assets/img/social-media-aggregator/tildes.svg){ .twemoji } [Tildes](https://tildes.net/)
-- ![Lemmy logo](/assets/img/social-media-aggregator/lemmy.svg){ .twemoji } [Lemmy](https://lemmy.ml/)
-- ![Postmill logo](/assets/img/social-media-aggregator/postmill.png){ .twemoji } [Postmill](https://postmill.xyz/)
-- ![Freepost logo](/assets/img/social-media-aggregator/freepost.svg){ .twemoji } [Freepost](https://freepo.st/)
-
-</div>
-
-[Learn more...](social-news-aggregator.md)
-
-### VPN Providers
-
-??? danger "VPNs do not provide anonymity"
-
-    Using a VPN will **not** keep your browsing habits anonymous, nor will it add additional security to non-secure (HTTP) traffic.
-
-    If you are looking for **anonymity**, you should use the Tor Browser **instead** of a VPN.
-
-    If you're looking for added **security**, you should always ensure you're connecting to websites using [HTTPS](https://en.wikipedia.org/wiki/HTTPS). A VPN is not a replacement for good security practices.
-
-    [Learn more](vpn.md)
-
-<div class="grid cards" markdown>
-
-- ![Mullvad logo](/assets/img/vpn/mini/mullvad.svg){ .twemoji } [Mullvad](https://mullvad.net/)
-- ![ProtonVPN logo](/assets/img/vpn/mini/protonvpn.svg){ .twemoji } [ProtonVPN](https://protonvpn.com/)
-- ![IVPN logo](/assets/img/vpn/mini/ivpn.svg){ .twemoji } [IVPN](https://www.ivpn.net/)
-
-</div>
-
-[Learn more...](vpn.md)
-
-## Software
-
-### Calendar/Contacts Sync
-
-<div class="grid cards" markdown>
-
-- ![Tutanota logo](/assets/img/calendar-contacts/tutanota.svg){ .twemoji } [Tutanota (SaaS)](https://tutanota.com/calendar)
-- ![Proton Calendar logo](/assets/img/calendar-contacts/proton-calendar.svg){ .twemoji } [Proton Calendar (SaaS)](https://calendar.protonmail.com/)
-- ![EteSync logo](/assets/img/calendar-contacts/etesync.svg){ .twemoji } [EteSync](https://www.etesync.com/)
-- ![Tutanota logo](/assets/img/calendar-contacts/nextcloud.svg){ .twemoji } [Nextcloud](https://nextcloud.com/)
-- ![DecSync CC logo](/assets/img/calendar-contacts/decsync.svg){ .twemoji } [DecSync](https://github.com/39aldo39/DecSync)
-
-</div>
-
-[Learn more...](calendar-contacts.md)
-
-### Notebooks
-
-<div class="grid cards" markdown>
-
-- ![Joplin logo](/assets/img/notebooks/joplin.svg){ .twemoji } [Joplin](https://joplinapp.org/)
-- ![Standard Notes logo](/assets/img/notebooks/standard-notes.svg){ .twemoji } [Standard Notes](https://standardnotes.org/)
-
-</div>
-
-[Learn more...](notebooks.md)
-
-### Email Clients
-
-<div class="grid cards" markdown>
-
-- ![Thunderbird logo](/assets/img/email-clients/thunderbird.svg){ .twemoji } [Thunderbird](https://www.thunderbird.net/)
-- ![GNOME Evolution logo](/assets/img/email-clients/evolution.svg){ .twemoji } [GNOME Evolution (Linux)](https://wiki.gnome.org/Apps/Evolution)
-- ![Kontact logo](/assets/img/email-clients/kontact.svg){ .twemoji } [Kontact (Linux)](https://kontact.kde.org/)
-- ![Mailvelope logo](/assets/img/email-clients/mailvelope.svg){ .twemoji } [Mailvelope (PGP in standard webmail)](https://www.mailvelope.com/)
-- ![K-9 Mail logo](/assets/img/email-clients/k9mail.svg){ .twemoji } [K-9 Mail (Android)](https://k9mail.app/)
-- ![FairEmail logo](/assets/img/email-clients/fairemail.svg){ .twemoji } [FairEmail (Android)](https://email.faircode.eu/)
-- ![Canary Mail logo](/assets/img/email-clients/canarymail.svg){ .twemoji } [Canary Mail (iOS)](https://canarymail.io/)
-- ![NeoMutt logo](/assets/img/email-clients/mutt.svg){ .twemoji } [NeoMutt (CLI)](https://neomutt.org/)
-
-</div>
-
-[Learn more...](email-clients.md)
-
-### Encryption Tools
-
-??? info "Operating System Disk Encryption"
-
-    For encrypting your operating system drive, we typically recommend using whichever encryption tool your operating system provides, whether that is **BitLocker** on Windows, **FileVault** on macOS, or **LUKS** on Linux. These tools are available out of the box and typically utilize hardware encryption elements such as a TPM that other full-disk encryption software like VeraCrypt will not. VeraCrypt is still suitable for non-operating system disks such as external drives, especially drives that may be accessed from multiple operating systems.
-
-    [Learn more](encryption.md##operating-system-included-full-disk-encryption-fde)
-
-<div class="grid cards" markdown>
-
-- ![VeraCrypt logo](/assets/img/encryption-software/veracrypt.svg#only-light){ .twemoji }![VeraCrypt logo](/assets/img/encryption-software/veracrypt-dark.svg#only-dark){ .twemoji } [VeraCrypt (FDE)](https://veracrypt.fr/)
-- ![Cryptomator logo](/assets/img/encryption-software/cryptomator.svg){ .twemoji } [Cryptomator](https://cryptomator.org/)
-- ![Picocrypt logo](/assets/img/encryption-software/picocrypt.svg){ .twemoji } [Picocrypt](https://evansu.cc/picocrypt)
-- ![Hat.sh logo](/assets/img/encryption-software/hat-sh.png#only-light){ .twemoji }![Hat.sh logo](/assets/img/encryption-software/hat-sh-dark.png#only-dark){ .twemoji } [Hat.sh (Browser-based)](https://hat.sh/)
-- ![Kryptor logo](/assets/img/encryption-software/kryptor.png){ .twemoji } [Kryptor](https://www.kryptor.co.uk/)
-- ![Tomb logo](/assets/img/encryption-software/tomb.png){ .twemoji } [Tomb](https://www.dyne.org/software/tomb)
-
-</div>
-
-**OpenPGP Clients:**
-
-<div class="grid cards" markdown>
-
-- ![GnuPG logo](/assets/img/encryption-software/gnupg.svg){ .twemoji } [GnuPG](https://gnupg.org)
-- ![GPG4Win logo](/assets/img/encryption-software/gpg4win.svg){ .twemoji } [GPG4Win (Windows)](https://gpg4win.org)
-- ![GPG Suite logo](/assets/img/encryption-software/gpgsuite.png){ .twemoji } [GPG Suite (macOS)](https://gpgtools.org)
-- ![OpenKeychain logo](/assets/img/encryption-software/openkeychain.svg){ .twemoji } [OpenKeychain](https://www.openkeychain.org/)
-
-</div>
-
-[Learn more...](encryption.md)
-
-### File Sharing
-
-<div class="grid cards" markdown>
-
-- ![OnionShare logo](/assets/img/file-sharing-sync/onionshare.svg){ .twemoji } [OnionShare](https://onionshare.org/)
-- ![Magic Wormhole logo](/assets/img/file-sharing-sync/magic_wormhole.png){ .twemoji } [Magic Wormhole](https://magic-wormhole.readthedocs.io/)
-- ![FreedomBox logo](/assets/img/file-sharing-sync/freedombox.svg){ .twemoji } [FreedomBox](https://freedombox.org/)
-- ![Syncthing logo](/assets/img/file-sharing-sync/syncthing.svg){ .twemoji } [Syncthing](https://syncthing.net/)
-- ![git-annex logo](/assets/img/file-sharing-sync/gitannex.svg){ .twemoji } [git-annex](https://git-annex.branchable.com/)
-
-</div>
-
-[Learn more...](file-sharing.md)
-
-### Metadata Removal Tools
-
-<div class="grid cards" markdown>
-
-- ![MAT2 logo](/assets/img/metadata-removal/mat2.svg){ .twemoji } [MAT2](https://0xacab.org/jvoisin/mat2)
-- ![ExifCleaner logo](/assets/img/metadata-removal/exifcleaner.svg){ .twemoji } [ExifCleaner](https://exifcleaner.com/)
-- ![Scrambled Exif logo](/assets/img/metadata-removal/scrambled-exif.svg){ .twemoji } [Scrambled Exif (Android)](https://gitlab.com/juanitobananas/scrambled-exif)
-- ![Imagepipe logo](/assets/img/metadata-removal/imagepipe.svg){ .twemoji } [Imagepipe (Android)](https://codeberg.org/Starfish/Imagepipe)
-- ![Metapho logo](/assets/img/metadata-removal/metapho.jpg){ .twemoji } [Metapho (iOS)](https://zininworks.com/metapho)
-- ![ExifTool logo](/assets/img/metadata-removal/exiftool.png){ .twemoji } [ExifTool (CLI)](https://exiftool.org/)
-
-</div>
-
-[Learn more...](metadata-removal-tools.md)
-
-### Multi-Factor Authentication Tools
-
-<div class="grid cards" markdown>
-
-- ![YubiKeys](/assets/img/multi-factor-authentication/yubikey.png){ .twemoji } [YubiKey](https://www.yubico.com/)
-- ![Nitrokey](/assets/img/multi-factor-authentication/nitrokey.jpg){ .twemoji } [Nitrokey](https://www.nitrokey.com/)
-- ![Aegis logo](/assets/img/multi-factor-authentication/aegis.png){ .twemoji } [Aegis Authenticator](https://getaegis.app/)
-- ![Raivo OTP logo](/assets/img/multi-factor-authentication/raivo-otp.png){ .twemoji } [Raivo OTP](https://github.com/raivo-otp/ios-application)
-
-</div>
-
-[Learn more...](multi-factor-authentication.md)
-
-### Password Managers
-
-<div class="grid cards" markdown>
-
-- ![KeePassXC logo](/assets/img/password-management/keepassxc.svg){ .twemoji } [KeePassXC](https://keepassxc.org/)
-- ![KeePassDX logo](/assets/img/password-management/keepassdx.svg){ .twemoji } [KeePassDX (Android)](https://www.keepassdx.com/)
-- ![Bitwarden logo](/assets/img/password-management/bitwarden.svg){ .twemoji } [Bitwarden](https://bitwarden.com/)
-- ![Psono logo](/assets/img/password-management/psono.svg){ .twemoji } [Psono](https://psono.com/)
-- ![gopass logo](/assets/img/password-management/gopass.svg){ .twemoji } [gopass](https://www.gopass.pw/)
-- ![Vaultwarden logo](/assets/img/password-management/vaultwarden.svg#only-light){ .twemoji }![Vaultwarden logo](/assets/img/password-management/vaultwarden-dark.svg#only-dark){ .twemoji } [Vaultwarden (Bitwarden Server)](https://github.com/dani-garcia/vaultwarden)
-
-</div>
-
-[Learn more...](passwords.md)
-
-### Productivity Tools
-
-<div class="grid cards" markdown>
-
-- ![LibreOffice logo](/assets/img/productivity/libreoffice.svg){ .twemoji } [LibreOffice](https://www.libreoffice.org/)
-- ![OnlyOffice logo](/assets/img/productivity/onlyoffice.svg){ .twemoji } [OnlyOffice](https://www.onlyoffice.com/)
-- ![Framadate logo](/assets/img/productivity/framadate.svg){ .twemoji } [Framadate (Appointment Planning)](https://framadate.org/)
-- ![PrivateBin logo](/assets/img/productivity/privatebin.svg){ .twemoji } [PrivateBin (Pastebin)](https://privatebin.info/)
-- ![CryptPad logo](/assets/img/productivity/cryptpad.svg){ .twemoji } [CryptPad](https://cryptpad.fr/)
-- ![Write.as logo](/assets/img/productivity/writeas.svg#only-light){ .twemoji }![Write.as logo](/assets/img/productivity/writeas-dark.svg#only-dark){ .twemoji } [Write.as (Blogging Platform)](https://write.as/)
-- ![VSCodium logo](/assets/img/productivity/vscodium.svg){ .twemoji } [VSCodium (Source-Code Editor)](https://vscodium.com/)
-
-</div>
-
-[Learn more...](productivity.md)
-
-### Real-Time Communication
-
-<div class="grid cards" markdown>
-
-- ![Signal logo](/assets/img/messengers/signal.svg){ .twemoji } [Signal](https://signal.org/)
-- ![Element logo](/assets/img/messengers/element.svg){ .twemoji } [Element](https://element.io/)
-- ![Briar logo](/assets/img/messengers/briar.svg){ .twemoji } [Briar (Android)](https://briarproject.org/)
-- ![Session logo](/assets/img/messengers/session.svg){ .twemoji } [Session](https://getsession.org/)
-
-</div>
-
-### News Aggregators
-
-<div class="grid cards" markdown>
-
-- ![Fluent Reader](/assets/img/news-aggregators/fluent-reader.svg){ .twemoji } [Fluent Reader](https://hyliu.me/fluent-reader)
-- ![GNOME Feeds](/assets/img/news-aggregators/gfeeds.svg){ .twemoji } [GNOME Feeds](https://gfeeds.gabmus.org)
-- ![Akregator](/assets/img/news-aggregators/akregator.svg){ .twemoji } [Akregator](https://apps.kde.org/akregator)
-- ![Handy News Reader](/assets/img/news-aggregators/handy-news-reader.svg){ .twemoji } [Handy News Reader](https://github.com/yanus171/Handy-News-Reader)
-- ![NetNewsWire](/assets/img/news-aggregators/netnewswire.png){ .twemoji } [NetNewsWire](https://netnewswire.com)
-- ![Miniflux](/assets/img/news-aggregators/miniflux.svg#only-light){ .twemoji }![Miniflux logo](/assets/img/news-aggregators/miniflux-dark.svg#only-dark){ .twemoji } [Miniflux](https://miniflux.app)
-- ![Newsboat](/assets/img/news-aggregators/newsboat.svg){ .twemoji } [Newsboat](https://newsboat.org/)
-
-</div>
-
-[Learn more...](real-time-communication.md)
-
-### Self-Contained Networks
-
-<div class="grid cards" markdown>
-
-- ![Tor logo](./assets/img/self-contained-networks/tor.svg){ .twemoji } [Tor](https://www.torproject.org/)
-- ![I2P logo](./assets/img/self-contained-networks/i2p.svg#only-light){ .twemoji } ![I2P logo](./assets/img/self-contained-networks/i2p-dark.svg#only-dark){ .twemoji } [I2P](https://geti2p.net/)
-- ![Freenet logo](./assets/img/self-contained-networks/freenet.svg){ .twemoji } [Freenet](https://freenetproject.org/)
-
-</div>
-
-[Learn more...](self-contained-networks.md)
-
-### Video Streaming Clients
-
-<div class="grid cards" markdown>
-
-- ![FreeTube logo](/assets/img/video-streaming/freetube.svg){ .twemoji } [FreeTube (YouTube, Desktop)](https://freetubeapp.io/)
-- ![LBRY logo](/assets/img/video-streaming/lbry.svg){ .twemoji } [LBRY](https://lbry.com/)
-- ![NewPipe logo](/assets/img//video-streaming/newpipe.svg){ .twemoji } [NewPipe (YouTube, Android)](https://newpipe.net/)
-- ![NewPipe x SponsorBlock logo](/assets/img/video-streaming/newpipe.svg){ .twemoji } [NewPipe x Sponsorblock](https://github.com/polymorphicshade/NewPipe)
-- ![Invidious logo](/assets/img/video-streaming/invidious.svg#only-light){ .twemoji }![Invidious logo](/assets/img/video-streaming/invidious-dark.svg#only-dark){ .twemoji } [Invidious (YouTube, Web)](https://invidious.io/)
-- ![Piped logo](/assets/img/video-streaming/piped.svg){ .twemoji } [Piped (YouTube, Web)](https://piped.kavin.rocks/)
-
-</div>
-
-[Learn more...](video-streaming.md)

docs/video-streaming.en.md

@@ -1,8 +1,8 @@
 ---
-title: Video Streaming
+title: "Video Streaming"
 icon: material/video-wireless
 ---
-The primary threat when using a video streaming platform is that your streaming habits and subscription lists could be used to profile you. You should combine these tools with a [VPN](/vpn) or [Tor](https://www.torproject.org/) to make it harder to profile your usage.
+The primary threat when using a video streaming platform is that your streaming habits and subscription lists could be used to profile you. You should combine these tools with a [VPN](vpn.md) or [Tor](https://www.torproject.org/) to make it harder to profile your usage.
 
 ## Clients
 
@@ -10,11 +10,11 @@ The primary threat when using a video streaming platform is that your streaming
 
 !!! Warning
 
-    When using Freetube, your IP address is still known to YouTube, [Invidious](https://instances.invidious.io) and the SponsorBlock instances that you use. Consider using a [VPN](/vpn) or [Tor](https://www.torproject.org) if your [threat model](/threat-modeling.md) requires hiding your IP address.
+    When using FreeTube, your IP address is still known to YouTube, [Invidious](https://instances.invidious.io) and the SponsorBlock instances that you use. Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org) if your [threat model](threat-modeling.md) requires hiding your IP address.
 
 !!! recommendation
 
-    ![FreeTube logo](/assets/img/video-streaming/freetube.svg){ align=right }
+    ![FreeTube logo](assets/img/video-streaming/freetube.svg){ align=right }
 
     **FreeTube** is a free and open source desktop application for [YouTube](https://youtube.com). When using FreeTube, your subscription list and playlists are saved locally on your device.
 
@@ -37,7 +37,7 @@ The primary threat when using a video streaming platform is that your streaming
 
 !!! recommendation
 
-    ![LBRY logo](/assets/img/video-streaming/lbry.svg){ align=right }
+    ![LBRY logo](assets/img/video-streaming/lbry.svg){ align=right }
 
     **The LBRY network** is a decentralized video sharing network. It uses a [BitTorrent](https://wikipedia.org/wiki/BitTorrent)-like network to store the video content, and a [blockchain](https://wikipedia.org/wiki/Blockchain) to store the indexes for those videos. The main benefit of this design is censorship resistance.
 
@@ -53,7 +53,7 @@ The primary threat when using a video streaming platform is that your streaming
 
 !!! warning
 
-    While watching and hosting videos, your IP address is visible to the LBRY network. Consider using a [VPN](/vpn) or [Tor](https://www.torproject.org) if your [threat model](/threat-modeling) requires hiding your IP address.
+    While watching and hosting videos, your IP address is visible to the LBRY network. Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org) if your [threat model](threat-modeling) requires hiding your IP address.
 
 We recommend **against** synchronizing your wallet with LBRY Inc., as synchronizing encrypted wallets is not supported yet. If you synchronize your wallet with LBRY Inc., you have to trust them to not look at your subscription list, [LBC](https://lbry.com/faq/earn-credits) funds, or take control of your channel.
 
@@ -63,7 +63,7 @@ You can  disable *Save hosting data to help the LBRY network* option (⚙️ Set
 
 !!! recommendation
 
-    ![Newpipe logo](/assets/img//video-streaming/newpipe.svg){ align=right }
+    ![Newpipe logo](assets/img//video-streaming/newpipe.svg){ align=right }
 
     **NewPipe** is a free and open source Android application for [YouTube](https://youtube.com), [SoundCloud](https://soundcloud.com), [media.ccc.de](https://media.ccc.de), [FramaTube](https://framatube.org), and [Bandcamp](https://bandcamp.com).
 
@@ -83,7 +83,7 @@ You can  disable *Save hosting data to help the LBRY network* option (⚙️ Set
 
 !!! recommendation
 
-    ![NewPipe x SponsorBlock logo](/assets/img/video-streaming/newpipe.svg){ align=right }
+    ![NewPipe x SponsorBlock logo](assets/img/video-streaming/newpipe.svg){ align=right }
 
     **NewPipe x SponsorBlock** is a fork of [NewPipe](https://newpipe.net) with [SponsorBlock](https://sponsor.ajay.app) integrated to help you skip sponsored advertisements.
     It also has some experimental settings such as the ability to use the built-in player for local playback, an option to force fullscreen on landscape mode, and an option to disable error reporting prompts.
@@ -106,8 +106,8 @@ This fork is not endorsed by or affiliated with the upstream project. The NewPip
 
 !!! recommendation
 
-    ![Invidious logo](/assets/img/video-streaming/invidious.svg#only-light){ align=right }
-    ![Invidious logo](/assets/img/video-streaming/invidious-dark.svg#only-dark){ align=right }
+    ![Invidious logo](assets/img/video-streaming/invidious.svg#only-light){ align=right }
+    ![Invidious logo](assets/img/video-streaming/invidious-dark.svg#only-dark){ align=right }
 
     **Invidious** is a free and open source front end for YouTube that is also self-hostable. There are list of [public instances](https://instances.invidious.io). Some instances have [Tor](https://www.torproject.org) onion services support.
 
@@ -129,7 +129,7 @@ When you are using an Invidious instance, be sure to go read the Privacy Policy
 
 !!! recommendation
 
-    ![Piped logo](/assets/img/video-streaming/piped.svg){ align=right }
+    ![Piped logo](assets/img/video-streaming/piped.svg){ align=right }
 
     **Piped** is a free and open source front end for YouTube that is also self-hostable. Alternative instances can be selected from "Preferences".
 

docs/vpn.en.md

@@ -1,5 +1,5 @@
 ---
-title: VPN Services
+title: "VPN Services"
 icon: material/vpn
 ---
 
@@ -31,8 +31,8 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 !!! recommendation
 
-    ![Mullvad logo](/assets/img/vpn/mullvad.svg#only-light){ align=right }
-    ![Mullvad logo](/assets/img/vpn/mullvad-dark.svg#only-dark){ align=right }
+    ![Mullvad logo](assets/img/vpn/mullvad.svg#only-light){ align=right }
+    ![Mullvad logo](assets/img/vpn/mullvad-dark.svg#only-dark){ align=right }
 
     **Mullvad** is a fast and inexpensive VPN with a serious focus on transparency and security. They have been in operation since **2009**. Mullvad is based in Sweden and does not have a free trial.
 
@@ -92,7 +92,7 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 !!! recommendation
 
-    ![ProtonVPN logo](/assets/img/vpn/protonvpn.svg){ align=right }
+    ![ProtonVPN logo](assets/img/vpn/protonvpn.svg){ align=right }
 
     **ProtonVPN** is a strong contender in the VPN space, and they have been in operation since 2016. ProtonVPN is based in Switzerland and offers a limited free pricing tier, as well as premium options. They offer a further 14% discount for buying a 2 year subscription.
 
@@ -124,9 +124,9 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
     ProtonVPN [recommends](https://protonvpn.com/blog/wireguard/) the use of WireGuard with their service. On ProtonVPN's Windows, macOS, iOS, Android, ChromeOS, and Android TV apps, WireGuard is the default protocol; however, [support](https://protonvpn.com/support/how-to-change-vpn-protocols/) for the protocol is not present in their Linux app.
 
-??? missing "Remote Port Forwarding"
+??? warning "Remote Port Forwarding"
 
-    ProtonVPN does not currently support remote port forwarding, which may impact some applications. Especially Peer-to-Peer applications like Torrent clients.
+    ProtonVPN currently only supports remote [port forwarding](https://protonvpn.com/support/port-forwarding/) on Windows, which may impact some applications. Especially Peer-to-Peer applications like Torrent clients.
 
 ??? check "Mobile Clients"
 
@@ -140,7 +140,7 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 !!! recommendation
 
-    ![IVPN logo](/assets/img/vpn/ivpn.svg){ align=right }
+    ![IVPN logo](assets/img/vpn/ivpn.svg){ align=right }
 
     **IVPN** is another premium VPN provider, and they have been in operation since 2009. IVPN is based in Gibraltar.
 
@@ -288,7 +288,7 @@ Must not have any marketing which is irresponsible:
 
 Responsible marketing that is both educational and useful to the consumer could include:
 
-- An accurate comparison to when Tor or other [self-contained networks](/self-contained-networks) should be used.
+- An accurate comparison to when Tor or other [self-contained networks.md](self-contained-networks) should be used.
 - Availability of the VPN provider's website over a .onion [Hidden Service](https://en.wikipedia.org/wiki/.onion)
 
 ### Additional Functionality
@@ -346,7 +346,7 @@ For use cases like these, or if you have another compelling reason, the VPN prov
 ### Sources and Further Reading
 
 1. [VPN - a Very Precarious Narrative](https://schub.io/blog/2019/04/08/very-precarious-narrative.html) by Dennis Schubert
-2. [The self-contained networks](/self-contained-networks) recommended by Privacy Guides are able to replace a VPN that allows access to services on local area network
+2. [The self-contained networks](self-contained-networks.md) recommended by Privacy Guides are able to replace a VPN that allows access to services on local area network
 3. [Slicing Onions: Part 1 – Myth-busting Tor](https://medium.com/privacyguides/slicing-onions-part-1-myth-busting-tor-9ec188ae1904) by blacklight447
 4. [Slicing Onions: Part 2 – Onion recipes; VPN not required](https://web.archive.org/web/20210116140725/https://write.privacytools.io/my-thoughts-on-security/slicing-onions-part-2-onion-recipes-vpn-not-required) by blacklight447
 5. [IVPN Privacy Guides](https://www.ivpn.net/privacy-guides)

mkdocs.production.yml

@@ -1,10 +0,0 @@
-INHERIT: mkdocs.yml
-site_url: "https://www.privacyguides.org/"
-watch:
-  - theme
-  - mkdocs.yml
-plugins:
-  - search
-  - privacy:
-      externals_exclude:
-        - cdn.jsdelivr.net/npm/mathjax@3/* 

mkdocs.yml

@@ -1,3 +1,7 @@
+docs_dir: 'docs'
+site_url: "https://www.privacyguides.org/"
+site_dir: 'site'
+
 site_name: Privacy Guides
 site_description: |
   Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.
@@ -5,6 +9,7 @@ copyright: |
   <b>Privacy Guides</b> is a non-profit, socially motivated website that provides information for protecting your data security and privacy.<br>
   We do not make money from recommending certain products, and we do not utilize affiliate links.<br>
   This content was made available by the Privacy Guides team and contributors. <a href="https://github.com/privacyguides/privacyguides">Get involved</a>!
+
 extra:
   generator: false
   social:
@@ -20,53 +25,6 @@ repo_url: https://github.com/privacyguides/privacyguides.org
 repo_name: privacyguides.org
 edit_uri: edit/main/docs/
 
-nav:
-  - Home: 'index.md'
-  - 'Privacy Introduction':
-    - 'Threat Modeling': 'threat-modeling.md'
-    - 'Technology Basics':
-      - 'DNS': 'technology/dns.md'
-    - 'Security Basics':
-      - 'Multi-Factor Authentication': 'security/multi-factor-authentication.md'
-    - 'Setup Guides':
-      - 'Integrating Metadata Removal': 'setup/integrating-metadata-removal.md'
-  - 'Recommendations':
-    - 'Privacy Tools': 'tools.md'
-    - 'Browsers':
-      - 'Web Browsers': 'browsers.md'
-    - 'Operating Systems':
-      - 'Android': 'android.md'
-      - 'Linux Desktop': 'linux-desktop.md'
-      - 'Qubes OS': 'qubes.md'
-      - 'Router Firmware': 'router.md'
-    - 'Providers':
-      - 'Cloud Storage': 'cloud.md'
-      - 'DNS Servers': 'dns.md'
-      - 'Email Providers': 'email.md'
-      - 'Search Engines': 'search-engines.md'
-      - 'Social Networks': 'social-networks.md'
-      - 'Social News Aggregators': 'social-news-aggregator.md'
-      - 'VPN Providers': 'vpn.md'
-    - 'Software':
-      - 'Calendar/Contacts Sync': 'calendar-contacts.md'
-      - 'Digital Notebooks': 'notebooks.md'
-      - 'Email Clients': 'email-clients.md'
-      - 'Encryption Tools': 'encryption.md'
-      - 'File Sharing/Sync': 'file-sharing.md'
-      - 'Metadata Removal Tools': 'metadata-removal-tools.md'
-      - 'Multi-Factor Authenticators': 'multi-factor-authentication.md'
-      - 'Password Managers': 'passwords.md'
-      - 'Productivity Tools': 'productivity.md'
-      - 'Real-Time Communication': 'real-time-communication.md'
-      - 'News Aggregators': 'news-aggregators.md'
-      - 'Self-Contained Networks': 'self-contained-networks.md'
-      - 'Video Streaming': 'video-streaming.md'
-  - 'About Us':
-    - 'Privacy Guides': 'about.md'
-    - 'Notices': 'about/notices.md'
-    - 'Privacy Policy': 'about/privacy-policy.md'
-  - 'Blog': 'https://blog.privacyguides.org/'
-
 theme:
   name: material
   custom_dir: theme
@@ -96,7 +54,18 @@ watch:
   - theme
 
 plugins:
+  - i18n:
+      default_language: en
+      material_alternate: true
+      languages:
+        en:
+          name: English
+          build: false
   - tags
+  - search
+  - privacy:
+      externals_exclude:
+        - cdn.jsdelivr.net/npm/mathjax@3/* 
 extra_css:
   - stylesheets/extra.css
 markdown_extensions:
@@ -127,6 +96,57 @@ markdown_extensions:
           - theme/.icons
   - tables
   - footnotes
+  - toc:
+      permalink: true
 
 extra_javascript:
   - javascripts/mathjax.js
+
+nav:
+  - Home: 'index.md'
+  - 'Knowledge Base':
+    - 'The Basics':
+      - 'threat-modeling.md'
+      - 'technology/dns.md'
+      - 'security/multi-factor-authentication.md'
+    - 'Mobile Devices':
+      - 'android/overview.md'
+      - 'android/security.md'
+      - 'android/grapheneos-vs-calyxos.md'
+    - 'Advanced':
+      - 'setup/integrating-metadata-removal.md'
+  - 'Recommendations':
+    - 'tools.md'
+    - 'Browsers':
+      - 'browsers.md'
+    - 'Operating Systems':
+      - 'android.md'
+      - 'linux-desktop.md'
+      - 'qubes.md'
+      - 'router.md'
+    - 'Providers':
+      - 'cloud.md'
+      - 'dns.md'
+      - 'email.md'
+      - 'search-engines.md'
+      - 'vpn.md'
+    - 'Software':
+      - 'calendar-contacts.md'
+      - 'notebooks.md'
+      - 'email-clients.md'
+      - 'encryption.md'
+      - 'file-sharing.md'
+      - 'metadata-removal-tools.md'
+      - 'multi-factor-authentication.md'
+      - 'passwords.md'
+      - 'productivity.md'
+      - 'real-time-communication.md'
+      - 'news-aggregators.md'
+      - 'self-contained-networks.md'
+      - 'video-streaming.md'
+  - 'About Us':
+    - 'about.md'
+    - 'about/notices.md'
+    - 'about/privacy-policy.md'
+  - 'Discussions': 'https://github.com/orgs/privacyguides/discussions'
+  - 'Blog': 'https://blog.privacyguides.org/'

theme/.icons/pg/flathub.svg

@@ -1,4 +1,4 @@
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-<title>flathub</title>
-<path d="M4.233 22.284l-4.233-2.771v-9.036l15.974-10.456 0.703 0.48 15.282 10.019-0.044 8.998-8.466 5.54-0.169-0.102-7.319-4.784-7.495 4.883zM23.387 19.64l-0.022-3.742-6.942-4.545-0.296-0.166 0.010 7.583 7.058 4.607 0.213 0.007-0.022-3.742zM8.423 19.509l-0.001-3.788-7.119-4.656-0.16-0.056v7.529l7.238 4.75 0.042 0.011-0.001-3.788zM28.257 12.337l2.437-1.592-1.233-0.795-5.992-3.929-0.129 0.049-7.126 4.656 0.004 0.042 0.004 0.042 7.199 4.688 4.836-3.161zM12.036 13.17l3.456-2.255 0.206-0.189-7.191-4.707-0.21 0.118-6.994 4.572 0.171 0.171 6.908 4.534 0.199 0.012zM19.591 8.229l3.561-2.328 0-0.042 0-0.042-7.188-4.705-7.2 4.705 0.001 0.042 0.001 0.042 7.15 4.685 0.114-0.029z" />
-</svg>
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
+<title>flathub</title>
+<path d="M4.233 22.284l-4.233-2.771v-9.036l15.974-10.456 0.703 0.48 15.282 10.019-0.044 8.998-8.466 5.54-0.169-0.102-7.319-4.784-7.495 4.883zM23.387 19.64l-0.022-3.742-6.942-4.545-0.296-0.166 0.010 7.583 7.058 4.607 0.213 0.007-0.022-3.742zM8.423 19.509l-0.001-3.788-7.119-4.656-0.16-0.056v7.529l7.238 4.75 0.042 0.011-0.001-3.788zM28.257 12.337l2.437-1.592-1.233-0.795-5.992-3.929-0.129 0.049-7.126 4.656 0.004 0.042 0.004 0.042 7.199 4.688 4.836-3.161zM12.036 13.17l3.456-2.255 0.206-0.189-7.191-4.707-0.21 0.118-6.994 4.572 0.171 0.171 6.908 4.534 0.199 0.012zM19.591 8.229l3.561-2.328 0-0.042 0-0.042-7.188-4.705-7.2 4.705 0.001 0.042 0.001 0.042 7.15 4.685 0.114-0.029z" />
+</svg>

theme/overrides/home.en.html

@@ -10,8 +10,8 @@
       <div class="mdx-hero">
         <div class="mdx-hero__content">
           <h1>The guide to restoring your online privacy.</h1>
-          <p>{{ config.site_description }}</p>
-          <a href="{{ 'tools/' | url }}" title="Recommended privacy tools, services, and knowledge" class="md-button md-button--primary">
+          <p>Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.</p>
+          <a href="tools/" title="Recommended privacy tools, services, and knowledge" class="md-button md-button--primary">
             Recommended Tools
           </a>
           <a href="https://blog.privacyguides.org/" title="Blog posts from Privacy Guides contributors" class="md-button">