Reduce number of EXIF links (#1030)

Correct spelling of "separate" and "document"

Signed-off-by: Daniel Gray <dng@disroot.org>

.gitattributes

@@ -1,2 +1,14 @@
 # Auto detect text files and perform LF normalization
 * text=auto
+
+docs/** -linguist-documentation
+.git* text
+*.json text
+*.js text
+*.md text linguist-detectable
+*.{yml,yaml} text
+*.{htm,html} text diff=html
+
+*.svg text
+*.png binary
+*.{jpeg,jpg} binary

.github/ISSUE_TEMPLATE/2_Website_Issues.md

@@ -1,7 +1,6 @@
 ---
 name: "Website Issue"
 about: Report a bug with the website. (NO CONTENT ISSUES)
-title: "Website Issue | "
 ---
 
 <!--

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,3 @@
-blank_issues_enabled: false
 contact_links:
   - name: Suggest a New Provider or Software
     url: https://github.com/privacyguides/privacyguides.org/discussions/new
@@ -9,3 +8,6 @@ contact_links:
   - name: Share an Idea
     url: https://github.com/privacyguides/privacyguides.org/discussions/new
     about: Suggest a new feature/section/page or anything else for the website.
+  - name: Report a Translation Issue
+    url: https://crowdin.com/project/privacyguides/discussions
+    about: Please report an issue with website translations on Crowdin.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,4 @@
-<!-- Submitting a PR? Awesome!! -->
-
-## Description
+<!-- Please use a descriptive title for your PR, it will be included in our changelog -->
 
 Resolves: # <!-- Did you solve an open GitHub issue? Put the number here so we mark it complete! -->
 

.github/workflows/build.yml

@@ -1,46 +0,0 @@
-name: Build Website
-on:
-  pull_request:
-    branches:
-      - main
-
-env:
-  PYTHON_VERSION: 3.x
-
-jobs:
-  build:
-    name: Build website
-    runs-on: ubuntu-latest
-    steps:
-
-      - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Set up Python runtime
-        uses: actions/setup-python@v3
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-      
-      - name: Cache files
-        uses: actions/cache@v3.0.1
-        with:
-          key: ${{ github.ref }}
-          path: .cache
-
-      - name: Install Python dependencies
-        run: |
-          pip install mkdocs
-          pip install mkdocs-material
-
-      - name: Build website
-        run: |
-          mkdocs build
-          mv .well-known site/
-          tar cvf site.tar site
-          mkdocs --version
-
-      - name: Package website
-        uses: actions/upload-artifact@v3
-        with:
-          name: generated-site
-          path: site.tar

.github/workflows/crowdin.yml

@@ -0,0 +1,27 @@
+name: Crowdin Upload
+
+on:
+  push:
+    branches: [ main ]
+
+jobs:
+  synchronize-with-crowdin:
+    runs-on: ubuntu-latest
+
+    steps:
+
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    - name: crowdin action
+      uses: crowdin/github-action@1.4.8
+      with:
+        upload_sources: true
+        upload_sources_args: '--auto-update --delete-obsolete'
+        upload_translations: false
+        download_translations: false
+        config: crowdin.yml
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+        CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

.github/workflows/deploy.yml

@@ -1,5 +1,6 @@
 name: Deploy Website
 on:
+  workflow_dispatch:
   release:
     types: [published]
 
@@ -21,7 +22,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
       
       - name: Cache files
-        uses: actions/cache@v3.0.1
+        uses: actions/cache@v3.0.2
         with:
           key: ${{ github.ref }}
           path: .cache
@@ -29,6 +30,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           pip install 'mkdocs>=1.3.0'
+          pip install mkdocs-static-i18n
 
       - name: Install mkdocs-material Insiders build
         if: github.event.repository.fork == false
@@ -40,7 +42,7 @@ jobs:
 
       - name: Build website
         run: |
-          mkdocs build --config-file mkdocs.production.yml
+          mkdocs build
           mv .well-known site/
           tar cvf site.tar site
           mkdocs --version

CHANGELOG.md

@@ -1,15 +0,0 @@
-# Privacy Guides Changelog
-
-<!-- Add the date and any new changes to the TOP of this file, below this line. -->
-
-## 2022-04-11
-
-- Added changelog
-- Switched to release-based deployments ([#987](https://github.com/privacyguides/privacyguides.org/pull/987))
-- Removed blog from repo, moved to [blog.privacyguides.org](https://blog.privacyguides.org) ([#985](https://github.com/privacyguides/privacyguides.org/pull/985))
-- Add RSS page ([#895](https://github.com/privacyguides/privacyguides.org/pull/895/))
-- MFA/YubiKey clarifications ([#972](https://github.com/privacyguides/privacyguides.org/pull/972))
-
----
-
-*Massive thanks to [u/SnowCatFalcon](https://www.reddit.com/user/SnowCatFalcon/) for publishing [changelogs on our Subreddit](https://www.reddit.com/r/PrivacyGuides/comments/tu2dvw/privacy_guides_changelogs_march_2022/) before we added this file.*

Pipfile

@@ -6,6 +6,7 @@ name = "pypi"
 [packages]
 mkdocs = "*"
 mkdocs-material = {path = "./mkdocs-material"}
+mkdocs-static-i18n = "*"
 
 [dev-packages]
 scour = "*"

Pipfile.lock

@@ -1,7 +1,7 @@
 {
     "_meta": {
         "hash": {
-            "sha256": "18f7bfb9a1d405016b6c63e1253e974e974d3e67b8e8a6b98d132ac1e780c822"
+            "sha256": "57e0161a7d6dbb050b1a0ab71eaaf145b951010f8a3054dfab1c5f24d4a293cf"
         },
         "pipfile-spec": 6,
         "requires": {
@@ -305,6 +305,13 @@
             "markers": "python_version >= '3.6'",
             "version": "==1.0.3"
         },
+        "mkdocs-static-i18n": {
+            "hashes": [
+                "sha256:0d97df64b5be7b34dc112d4ccfba28352b9fccd1b7a3babf229f30d25f6ebb36"
+            ],
+            "index": "pypi",
+            "version": "==0.44"
+        },
         "packaging": {
             "hashes": [
                 "sha256:dd47c42927d89ab911e606518907cc2d3a1f38bbd026385970643f9c5b8ecfeb",

README.md

@@ -34,6 +34,9 @@
   </a>
   <a href="https://github.com/privacyguides/privacyguides.org/pulls?q=is%3Apr+is%3Aclosed">
     <img src="https://img.shields.io/github/issues-pr-closed-raw/privacyguides/privacyguides.org">
+  </a>
+  <a href="https://crowdin.com/project/privacyguides">
+    <img src="https://badges.crowdin.net/privacyguides/localized.svg">
   </a></p>
 </div>
 
@@ -47,23 +50,13 @@ Our current list of team members can be found [here](https://github.com/orgs/pri
 
 - 💬 [Start a discussion or suggest an idea](https://github.com/privacyguides/privacyguides.org/discussions)
 - 💖 [Sponsor the project](https://github.com/sponsors/privacyguides)
+- 🈴 [Help translate the site](https://crwd.in/privacyguides) [[Matrix chat](https://matrix.to/#/#pg-i18n:aragon.sh)]
 - 📝 Edit the site, everything's accessible in this repo
   - Browse our [open issues](https://github.com/privacyguides/privacyguides.org/issues) to see what needs to be updated
-  - When making more significant (than simple typo fixes, etc.) changes, update the [changelog](/CHANGELOG.md)
   - View some contribution tips on our [contributor's wiki](https://github.com/privacyguides/privacyguides.org/wiki)
 
 ## Developing
 
-1. Clone this repository: `git clone https://github.com/privacyguides/privacyguides.org`
-2. Install [Python 3.6+](https://www.python.org/downloads/)
-3. Install [mkdocs-material](https://squidfunk.github.io/mkdocs-material/getting-started/): `pip install mkdocs-material`
-4. Serve the site locally: `mkdocs serve`
-    - The site will be available at `http://localhost:8000/`.
-  
-Your local site will appear slightly different, because the production version of the website uses a private/custom build of mkdocs-material with additional features.
-
-Team members with access to [mkdocs-material-insiders](https://github.com/privacyguides/mkdocs-material-insiders) should instead:
-
 1. Clone this repository and submodules: `git clone --recurse-submodules https://github.com/privacyguides/privacyguides.org`
 2. Install [Python 3.6+](https://www.python.org/downloads/)
 3. Install **pipenv**: `pip install pipenv`
@@ -73,3 +66,17 @@ Team members with access to [mkdocs-material-insiders](https://github.com/privac
     - The site will be available at `http://localhost:8000`
     - You can build the site locally with `mkdocs build --config-file mkdocs.production.yml`
     - This version of the site should be identical to the live, production version
+
+## Releasing
+
+1. Create a new tag: `git tag -s v2.X.X -m 'Some message'`
+    - [View existing tags](https://github.com/privacyguides/privacyguides.org/tags)
+    - Tag [numbering](https://semver.org/): Increment the MINOR (2nd) number when making significant changes (adding/deleting pages, etc.), increment the PATCH (3rd) number when making minor changes (typos, bug fixes). Probably leave the MAJOR number at 2 until a massive redesign (v1 -> v2 was the Jekyll to MkDocs transition).
+2. Push the tag to GitHub: `git push --tags`
+3. [Create a new release](https://github.com/privacyguides/privacyguides.org/releases/new) selecting the new tag
+    - Title the release the same as the tag version number without the `v`, i.e. `2.X.X`
+      - For more significant releases, add a **short** title, for example [2.3.0 - Localization Support](https://github.com/privacyguides/privacyguides.org/releases/tag/v2.3.0) or [2.2.0 - Removing Social Networks](https://github.com/privacyguides/privacyguides.org/releases/tag/v2.2.0)
+    - GitHub should let you auto-generate release notes based on PR titles
+      - Mark more significant changes in bold, see [2.3.0](https://github.com/privacyguides/privacyguides.org/releases/tag/v2.3.0) for example
+4. Publish release, it will be deployed to the live site automatically
+    - When publishing more significant releases (generally any with a MINOR version increment) check the "Create a discussion for this release" box to post an announcement

crowdin.yml

@@ -0,0 +1,14 @@
+project_id_env: CROWDIN_PROJECT_ID
+api_token_env: CROWDIN_PERSONAL_TOKEN
+"preserve_hierarchy": true
+files:
+- source: "/docs/**/*.en.*"
+  translation: "/docs/**/%file_name%.%locale_with_underscore%.%file_extension%"
+  translation_replace:
+    "en.": ""
+  update_option: update_as_unapproved
+- source: "/theme/overrides/*.en.html"
+  translation: "/theme/overrides/%file_name%.%locale_with_underscore%.html"
+  translation_replace:
+    "en.": ""
+  update_option: update_as_unapproved

docs/about/notices.en.md

@@ -1,8 +1,5 @@
 ---
-layout: page
-permalink: /terms-and-notices/
 title: "Notices and Disclaimers"
-description: "Privacy Guides is provided with good intentions on an "as-is" basis, without warranty, and disclaiming liability for damages."
 icon: material/message-alert
 hide:
     - toc
@@ -30,7 +27,7 @@ Portions of this notice itself were adopted from [opensource.guide](https://gith
 
 This means that you can use the human-readable content in this repository for your own project, per the terms outlined in the CC0 1.0 Universal text. You **may not** use the Privacy Guides branding in your own project without express approval from this project. Privacy Guides's brand trademarks include the "Privacy Guides" wordmark and shield logo.
 
-We believe that the logos and other images in `assets` obtained from third-party providers are either in the public domain or **fair use**. In a nutshell, legal [fair use doctrine](https://en.wikipedia.org/wiki/Fair_use) allows the use of copyrighted image in order to identify the subject matter for purposes of public comment. However, these logos and other images may still be subject to trademark laws in one or more jurisdictions. Before using this content, please ensure that it is used to identify the entity or organization that owns the trademark and that you have the right to use it under the laws which apply in the circumstances of your intended use. *When copying content from this website, you are solely responsible for ensuring that you do not infringe someone else's trademark or copyright.*
+We believe that the logos and other images in `assets` obtained from third-party providers are either in the public domain or **fair use**. In a nutshell, legal [fair use doctrine](https://en.wikipedia.org/wiki/Fair_use) allows the use of copyrighted images in order to identify the subject matter for purposes of public comment. However, these logos and other images may still be subject to trademark laws in one or more jurisdictions. Before using this content, please ensure that it is used to identify the entity or organization that owns the trademark and that you have the right to use it under the laws which apply in the circumstances of your intended use. *When copying content from this website, you are solely responsible for ensuring that you do not infringe someone else's trademark or copyright.*
 
 When you contribute to this repository you are doing so under the above licenses.
 

docs/about/privacy-policy.en.md

@@ -1,8 +1,5 @@
 ---
-layout: page
-permalink: /privacy-policy/
 title: "Privacy Policy"
-description: "This Privacy Statement explains what information Privacy Guides and its related entities collect about its users, what we do with that information, and how we handle the content you place in our products and services."
 icon: material/file-search
 ---
 
@@ -101,6 +98,6 @@ For complaints under GDPR more generally, European Union users may lodge complai
 
 This version of our privacy statement took effect April 4th, 2022.
 
-We will post any new versions of this statement [here](/about/privacy-policy). We may change how we announce changes in future versions of this document. In the meantime we may update our contact information at any time without announcing a change. Please refer to the [Privacy Policy](/about/privacy-policy) for the latest contact information at any time.
+We will post any new versions of this statement [here](privacy-policy.en.md). We may change how we announce changes in future versions of this document. In the meantime we may update our contact information at any time without announcing a change. Please refer to the [Privacy Policy](privacy-policy.en.md) for the latest contact information at any time.
 
-A full revision [history](https://github.com/privacyguides/privacyguides.org/commits/main/docs/about/privacy-policy.md) of this page can be found on GitHub.
+A full revision [history](https://github.com/privacyguides/privacyguides.org/commits/main/docs/about/privacy-policy.en.md) of this page can be found on GitHub.

docs/android.en.md

@@ -12,8 +12,8 @@ The main privacy concern with most Android devices is that they usually include
 
 !!! recommendation
 
-    ![GrapheneOS logo](/assets/img/android/grapheneos.svg#only-light){ align=right }
-    ![GrapheneOS logo](/assets/img/android/grapheneos-dark.svg#only-dark){ align=right }
+    ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ align=right }
+    ![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ align=right }
 
     **GrapheneOS** is the best choice when it comes to privacy and security.
 
@@ -21,7 +21,7 @@ The main privacy concern with most Android devices is that they usually include
 
     [Visit grapheneos.org](https://grapheneos.org/){ .md-button .md-button--primary } [Privacy Policy](https://grapheneos.org/faq#privacy-policy){ .md-button }
 
-Notably, GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play). Google Play Services can be run fully sandboxed like a regular user app and contained in a work profile or user [profile](/android/#android-security-privacy) of your choice. This means that you can run apps dependant on Play Services, such as those that require push notifications using Google's [Firebase Cloud Messaging](https://firebase.google.com/docs/cloud-messaging/) service. GrapheneOS allows you to take advantage of most [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) whilst having full user control over their permissions and access.
+Notably, GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play). Google Play Services can be run fully sandboxed like a regular user app and contained in a work profile or user [profile](#android-security-privacy) of your choice. This means that you can run apps dependant on Play Services, such as those that require push notifications using Google's [Firebase Cloud Messaging](https://firebase.google.com/docs/cloud-messaging/) service. GrapheneOS allows you to take advantage of most [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) whilst having full user control over their permissions and access.
 
 Currently, only [Pixel phones](https://grapheneos.org/faq#device-support) meet its hardware security requirement and are supported.
 
@@ -33,7 +33,7 @@ Currently, only [Pixel phones](https://grapheneos.org/faq#device-support) meet i
 
 !!! recommendation
 
-    ![CalyxOS logo](/assets/img/android/calyxos.svg){ align=right }
+    ![CalyxOS logo](assets/img/android/calyxos.svg){ align=right }
 
     **CalyxOS** is a decent alternative to GrapheneOS.
 
@@ -53,7 +53,7 @@ Currently, CalyxOS only supports [Pixel phones](https://calyxos.org/docs/guide/d
 
 !!! recommendation
 
-    ![DivestOS logo](/assets/img/android/divestos.svg){ align=right }
+    ![DivestOS logo](assets/img/android/divestos.svg){ align=right }
 
     **DivestOS** is a [soft-fork](https://en.wikipedia.org/wiki/Fork_(software_development)#Forking_of_free_and_open-source_software) of [LineageOS](https://lineageos.org/).
     DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
@@ -64,7 +64,7 @@ DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki
 
 DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747/) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled.
 
-DivestOS 16.0, 17.1, and 18.1 implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](/android/#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and 18.1 feature GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, and [`ptrace_scope`](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features). All branches additionally have various miscellaneous patches courtesy of GrapheneOS.
+DivestOS 16.0, 17.1, and 18.1 implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and 18.1 feature GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, and [`ptrace_scope`](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features). All branches additionally have various miscellaneous patches courtesy of GrapheneOS.
 
 !!! attention
 
@@ -112,7 +112,7 @@ Modern Android devices have global toggles for disabling [Bluetooth](https://en.
 
 !!! recommendation
 
-    ![Orbot logo](/assets/img/android/orbot.svg){ align=right }
+    ![Orbot logo](assets/img/android/orbot.svg){ align=right }
 
     **Orbot** is a free proxy app that routes your connections through the Tor Network.
 
@@ -138,7 +138,7 @@ For resistance against traffic analysis attacks, consider enabling *Isolate Dest
 
 !!! recommendation
 
-    ![Shelter logo](/assets/img/android/shelter.svg){ align=right }
+    ![Shelter logo](assets/img/android/shelter.svg){ align=right }
 
     **Shelter** is an app that helps you leverage the Android work profile to isolate other apps.
 
@@ -164,8 +164,8 @@ For resistance against traffic analysis attacks, consider enabling *Isolate Dest
 
 !!! recommendation
 
-    ![Auditor logo](/assets/img/android/auditor.svg#only-light){ align=right }
-    ![Auditor logo](/assets/img/android/auditor-dark.svg#only-dark){ align=right }
+    ![Auditor logo](assets/img/android/auditor.svg#only-light){ align=right }
+    ![Auditor logo](assets/img/android/auditor-dark.svg#only-dark){ align=right }
 
     **Auditor** is an app which leverages hardware security features to provide device integrity monitoring for [supported devices](https://attestation.app/about#device-support). Currently it works with GrapheneOS and the device's stock operating system.
 
@@ -185,15 +185,15 @@ Auditor performs attestation and intrusion detection by:
 
 No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring.
 
-If your [threat model](/threat-modeling/) requires privacy you could consider using Orbot or a VPN to hide your IP address from the attestation service.
+If your [threat model](threat-modeling.md) requires privacy you could consider using Orbot or a VPN to hide your IP address from the attestation service.
 To make sure that your hardware and operating system is genuine, [perform local attestation](https://grapheneos.org/install/web#verifying-installation) immediately after the device has been installed and prior to any internet connection.
 
 ### Secure Camera
 
 !!! recommendation
 
-    ![Secure camera logo](/assets/img/android/secure_camera.svg#only-light){ align=right }
-    ![Secure camera logo](/assets/img/android/secure_camera-dark.svg#only-dark){ align=right }
+    ![Secure camera logo](assets/img/android/secure_camera.svg#only-light){ align=right }
+    ![Secure camera logo](assets/img/android/secure_camera-dark.svg#only-dark){ align=right }
 
       **Secure Camera** is an camera app focused on privacy and security which can capture images, videos, and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices.
 
@@ -219,8 +219,8 @@ Main privacy features include:
 
 !!! recommendation
 
-    ![Secure PDF Viewer logo](/assets/img/android/secure_pdf_viewer.svg#only-light){ align=right }
-    ![Secure PDF Viewer logo](/assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ align=right }
+    ![Secure PDF Viewer logo](assets/img/android/secure_pdf_viewer.svg#only-light){ align=right }
+    ![Secure PDF Viewer logo](assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ align=right }
 
     **Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [webview](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files.
 
@@ -236,7 +236,7 @@ Main privacy features include:
 
 !!! recommendation
 
-    ![PrivacyBlur logo](/assets/img/android/privacyblur.svg){ align=right }
+    ![PrivacyBlur logo](assets/img/android/privacyblur.svg){ align=right }
 
     **PrivacyBlur** is a free app which can blur sensitive portions of pictures before sharing them online.
 
@@ -257,7 +257,7 @@ Main privacy features include:
 
 [Rooting](https://en.wikipedia.org/wiki/Rooting_(Android)) Android phones can decrease security significantly as it weakens the complete [Android security model](https://en.wikipedia.org/wiki/Android_(operating_system)#Security_and_privacy). This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful [Verified Boot](https://source.android.com/security/verifiedboot). Apps that require root will also modify the system partition meaning that Verified Boot would have to remain disabled. Having root exposed directly in the user interface also increases the [attack surface](https://en.wikipedia.org/wiki/Attack_surface) of your device and may assist in [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation) vulnerabilities and [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) policy bypasses.
 
-Adblockers (AdAway) which modify the [hosts file](https://en.wikipedia.org/wiki/Hosts_(file)) and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest encrypted [DNS](/dns) or [VPN](/vpn) server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.
+Adblockers (AdAway) which modify the [hosts file](https://en.wikipedia.org/wiki/Hosts_(file)) and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest encrypted [DNS](dns.md) or [VPN](vpn.md) server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.
 
 AFWall+ works based on the [packet filtering](https://en.wikipedia.org/wiki/Firewall_(computing)#Packet_filter) approach and may be bypassable in some situations.
 
@@ -279,7 +279,7 @@ It's important to not use an [end-of-life](https://endoflife.date/android) versi
 
 [Permissions on Android](https://developer.android.com/guide/topics/permissions/overview) grant users control over what apps are allowed to access. Google regularly makes [improvements](https://developer.android.com/about/versions/11/privacy/permissions) on the permission system in each successive version. All user installed apps are strictly [sandboxed](https://source.android.com/security/app-sandbox), therefore there is no need to install any antivirus apps. The savings you make from not purchasing or subscribing to security apps is better spent on paying for a supported device in the future.
 
-Should you want to run an app that you're unsure about, consider using a user or work [profile](/android/#android-security-privacy).
+Should you want to run an app that you're unsure about, consider using a user or work [profile](android/#android-security-privacy).
 
 ### Advanced Protection Program
 
@@ -362,7 +362,7 @@ We have these general tips:
 - Check if an app is available on the [IzzyOnDroid](https://apt.izzysoft.de/fdroid/) repository. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. We recommend that you download the GitHub builds and install them manually first, then use IzzyOnDroid for any subsequent updates. This will ensure that the signature of the applications you get from IzzyOnDroid matches that of the developer and the packages have not been tampered with.
 - Check if there are any differences between the F-Droid version and the Google Play Store version. Some applications like [IVPN](https://www.ivpn.net/) do not include certain features (eg [AntiTracker](https://www.ivpn.net/knowledgebase/general/antitracker-faq/)) in their Google Play Store build out of fear of censorship by Google.
 
-Evaluate whether the additional features in the F-Droid build are worth the slower updates. Also think about whether faster updates from the Google Play Store are worth the potential privacy issues in your [threat model](/threat-modeling/).
+Evaluate whether the additional features in the F-Droid build are worth the slower updates. Also think about whether faster updates from the Google Play Store are worth the potential privacy issues in your [threat model](threat-modeling.md).
 
 #### Droid-ify
 
@@ -386,9 +386,9 @@ To mitigate these problems, we recommend [Droid-ify](https://github.com/Iamlooke
 
 ### Profiles
 
-CalyxOS includes a device controller app so there is no need to install a third party app like [Shelter](/android/#recommended-apps). GrapheneOS plans to introduce nested profile support with better isolation in the future.
+CalyxOS includes a device controller app so there is no need to install a third party app like [Shelter](#recommended-apps). GrapheneOS plans to introduce nested profile support with better isolation in the future.
 
-GrapheneOS extends the [user profile](/android/#android-security-privacy) feature allowing a user to press an "End Session" button. This button clears the encryption key from memory. There are plans to add a [cross profile notifications system](https://github.com/GrapheneOS/os-issue-tracker/issues/88) in the future.
+GrapheneOS extends the [user profile](#android-security-privacy) feature allowing a user to press an "End Session" button. This button clears the encryption key from memory. There are plans to add a [cross profile notifications system](https://github.com/GrapheneOS/os-issue-tracker/issues/88) in the future.
 
 ### Sandboxed Google Play vs Privileged MicroG
 
@@ -404,7 +404,7 @@ From a usability point of view, Sandboxed Google Play also works well with far m
 
 Android 12 comes with special support for seamless app updates with [third party app stores](https://android-developers.googleblog.com/2020/09/listening-to-developer-feedback-to.html). The popular Free and Open Source Software (FOSS) repository [F-Droid](https://f-droid.org) doesn't implement this feature and requires a [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged) to be included with the Android distribution in order to have unattended app installation.
 
-GrapheneOS doesn't compromise on security; therefore, they do not include the F-Droid extension. Users have to confirm all updates manually if they want to use F-Droid. Alternatively, they can use the Droid-ify client which does support seamless app updates in Android 12. GrapheneOS officially recommends [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play) instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like [NewPipe](/video-streaming)).
+GrapheneOS doesn't compromise on security; therefore, they do not include the F-Droid extension. Users have to confirm all updates manually if they want to use F-Droid. Alternatively, they can use the Droid-ify client which does support seamless app updates in Android 12. GrapheneOS officially recommends [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play) instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like [NewPipe](video-streaming.md)).
 
 CalyxOS includes the [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged), which may lower device security. Seamless app updates should be possible with [Aurora Store](https://auroraoss.com) in Android 12.
 

docs/assets/img/dns/dns-dark.svg

@@ -1,166 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
- "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<!-- Generated by graphviz version 2.48.0 (0)
- -->
-<!-- Title: DNS Pages: 1 -->
-<svg width="630pt" height="935pt"
- viewBox="0.00 0.00 630.00 935.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(36 899)">
-<title>DNS</title>
-<!-- Start -->
-<g id="node1" class="node">
-<title>Start</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M89,-863C89,-863 55,-863 55,-863 49,-863 43,-857 43,-851 43,-851 43,-839 43,-839 43,-833 49,-827 55,-827 55,-827 89,-827 89,-827 95,-827 101,-833 101,-839 101,-839 101,-851 101,-851 101,-857 95,-863 89,-863"/>
-<text text-anchor="middle" x="72" y="-841.3" font-family="monospace" font-size="14.00">Start</text>
-</g>
-<!-- anonymous -->
-<g id="node3" class="node">
-<title>anonymous</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-791 0,-733.5 72,-676 144,-733.5 72,-791"/>
-<text text-anchor="middle" x="72" y="-737.3" font-family="monospace" font-size="14.00">Trying to be</text>
-<text text-anchor="middle" x="72" y="-722.3" font-family="monospace" font-size="14.00"> anonymous?</text>
-</g>
-<!-- Start&#45;&gt;anonymous -->
-<g id="edge1" class="edge">
-<title>Start&#45;&gt;anonymous</title>
-<path fill="none" stroke="white" d="M72,-826.59C72,-826.59 72,-801.45 72,-801.45"/>
-<polygon fill="white" stroke="white" points="72,-791.45 76.5,-801.45 72,-796.45 72,-801.45 72,-801.45 72,-801.45 72,-796.45 67.5,-801.45 72,-791.45 72,-791.45"/>
-</g>
-<!-- nothing -->
-<g id="node2" class="node">
-<title>nothing</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M249.5,-36C249.5,-36 174.5,-36 174.5,-36 168.5,-36 162.5,-30 162.5,-24 162.5,-24 162.5,-12 162.5,-12 162.5,-6 168.5,0 174.5,0 174.5,0 249.5,0 249.5,0 255.5,0 261.5,-6 261.5,-12 261.5,-12 261.5,-24 261.5,-24 261.5,-30 255.5,-36 249.5,-36"/>
-<text text-anchor="middle" x="212" y="-14.3" font-family="monospace" font-size="14.00">Do nothing</text>
-</g>
-<!-- censorship -->
-<g id="node4" class="node">
-<title>censorship</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-640 0,-582.5 72,-525 144,-582.5 72,-640"/>
-<text text-anchor="middle" x="72" y="-586.3" font-family="monospace" font-size="14.00">Avoiding</text>
-<text text-anchor="middle" x="72" y="-571.3" font-family="monospace" font-size="14.00"> censorship?</text>
-</g>
-<!-- anonymous&#45;&gt;censorship -->
-<g id="edge3" class="edge">
-<title>anonymous&#45;&gt;censorship</title>
-<path fill="none" stroke="white" d="M72,-675.98C72,-675.98 72,-650.11 72,-650.11"/>
-<polygon fill="white" stroke="white" points="72,-640.11 76.5,-650.11 72,-645.11 72,-650.11 72,-650.11 72,-650.11 72,-645.11 67.5,-650.11 72,-640.11 72,-640.11"/>
-<text text-anchor="middle" x="63.5" y="-651.85" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- tor -->
-<g id="node8" class="node">
-<title>tor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-697.5C300,-697.5 406,-697.5 406,-697.5 412,-697.5 418,-703.5 418,-709.5 418,-709.5 418,-757.5 418,-757.5 418,-763.5 412,-769.5 406,-769.5 406,-769.5 300,-769.5 300,-769.5 294,-769.5 288,-763.5 288,-757.5 288,-757.5 288,-709.5 288,-709.5 288,-703.5 294,-697.5 300,-697.5"/>
-<text text-anchor="middle" x="353" y="-729.8" font-family="monospace" font-size="14.00">Use Tor</text>
-</g>
-<!-- anonymous&#45;&gt;tor -->
-<g id="edge2" class="edge">
-<title>anonymous&#45;&gt;tor</title>
-<path fill="none" stroke="white" d="M143.64,-733C143.64,-733 277.75,-733 277.75,-733"/>
-<polygon fill="white" stroke="white" points="287.75,-733 277.75,-737.5 282.75,-733 277.75,-733 277.75,-733 277.75,-733 282.75,-733 277.75,-728.5 287.75,-733 287.75,-733"/>
-<text text-anchor="middle" x="198.19" y="-736.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- privacy -->
-<g id="node5" class="node">
-<title>privacy</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-489 140,-431.5 212,-374 284,-431.5 212,-489"/>
-<text text-anchor="middle" x="212" y="-435.3" font-family="monospace" font-size="14.00">Want privacy</text>
-<text text-anchor="middle" x="212" y="-420.3" font-family="monospace" font-size="14.00"> from ISP?</text>
-</g>
-<!-- censorship&#45;&gt;privacy -->
-<g id="edge5" class="edge">
-<title>censorship&#45;&gt;privacy</title>
-<path fill="none" stroke="white" d="M84.7,-535C115.31,-535 190.67,-535 190.67,-535 190.67,-535 190.67,-482.11 190.67,-482.11"/>
-<polygon fill="white" stroke="white" points="190.67,-472.11 195.17,-482.11 190.67,-477.11 190.67,-482.11 190.67,-482.11 190.67,-482.11 190.67,-477.11 186.17,-482.11 190.67,-472.11 190.67,-472.11"/>
-<text text-anchor="middle" x="155.63" y="-538.8" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- vpnOrTor -->
-<g id="node9" class="node">
-<title>vpnOrTor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-546.5C300,-546.5 406,-546.5 406,-546.5 412,-546.5 418,-552.5 418,-558.5 418,-558.5 418,-606.5 418,-606.5 418,-612.5 412,-618.5 406,-618.5 406,-618.5 300,-618.5 300,-618.5 294,-618.5 288,-612.5 288,-606.5 288,-606.5 288,-558.5 288,-558.5 288,-552.5 294,-546.5 300,-546.5"/>
-<text text-anchor="middle" x="353" y="-586.3" font-family="monospace" font-size="14.00">Use VPN</text>
-<text text-anchor="middle" x="353" y="-571.3" font-family="monospace" font-size="14.00"> or Tor</text>
-</g>
-<!-- censorship&#45;&gt;vpnOrTor -->
-<g id="edge4" class="edge">
-<title>censorship&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="white" d="M129.88,-594C129.88,-594 277.82,-594 277.82,-594"/>
-<polygon fill="white" stroke="white" points="287.82,-594 277.82,-598.5 282.82,-594 277.82,-594 277.82,-594 277.82,-594 282.82,-594 277.82,-589.5 287.82,-594 287.82,-594"/>
-<text text-anchor="middle" x="191.35" y="-597.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- obnoxious -->
-<g id="node6" class="node">
-<title>obnoxious</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-338 140,-280.5 212,-223 284,-280.5 212,-338"/>
-<text text-anchor="middle" x="212" y="-291.8" font-family="monospace" font-size="14.00">ISP makes</text>
-<text text-anchor="middle" x="212" y="-276.8" font-family="monospace" font-size="14.00"> obnoxious</text>
-<text text-anchor="middle" x="212" y="-261.8" font-family="monospace" font-size="14.00"> redirects?</text>
-</g>
-<!-- privacy&#45;&gt;obnoxious -->
-<g id="edge7" class="edge">
-<title>privacy&#45;&gt;obnoxious</title>
-<path fill="none" stroke="white" d="M212,-373.98C212,-373.98 212,-348.11 212,-348.11"/>
-<polygon fill="white" stroke="white" points="212,-338.11 216.5,-348.11 212,-343.11 212,-348.11 212,-348.11 212,-348.11 212,-343.11 207.5,-348.11 212,-338.11 212,-338.11"/>
-<text text-anchor="middle" x="203.5" y="-349.85" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- privacy&#45;&gt;vpnOrTor -->
-<g id="edge6" class="edge">
-<title>privacy&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="white" d="M237.33,-468.98C237.33,-510 237.33,-570 237.33,-570 237.33,-570 277.73,-570 277.73,-570"/>
-<polygon fill="white" stroke="white" points="287.73,-570 277.73,-574.5 282.73,-570 277.73,-570 277.73,-570 277.73,-570 282.73,-570 277.73,-565.5 287.73,-570 287.73,-570"/>
-<text text-anchor="middle" x="224.83" y="-543.49" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- ispDNS -->
-<g id="node7" class="node">
-<title>ispDNS</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-187 140,-129.5 212,-72 284,-129.5 212,-187"/>
-<text text-anchor="middle" x="212" y="-148.3" font-family="monospace" font-size="14.00">Does ISP</text>
-<text text-anchor="middle" x="212" y="-133.3" font-family="monospace" font-size="14.00"> support</text>
-<text text-anchor="middle" x="212" y="-118.3" font-family="monospace" font-size="14.00"> encrypted</text>
-<text text-anchor="middle" x="212" y="-103.3" font-family="monospace" font-size="14.00"> DNS?</text>
-</g>
-<!-- obnoxious&#45;&gt;ispDNS -->
-<g id="edge9" class="edge">
-<title>obnoxious&#45;&gt;ispDNS</title>
-<path fill="none" stroke="white" d="M212,-222.98C212,-222.98 212,-197.11 212,-197.11"/>
-<polygon fill="white" stroke="white" points="212,-187.11 216.5,-197.11 212,-192.11 212,-197.11 212,-197.11 212,-197.11 212,-192.11 207.5,-197.11 212,-187.11 212,-187.11"/>
-<text text-anchor="middle" x="203.5" y="-198.85" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- encryptedDNS -->
-<g id="node10" class="node">
-<title>encryptedDNS</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-244.5C440,-244.5 546,-244.5 546,-244.5 552,-244.5 558,-250.5 558,-256.5 558,-256.5 558,-304.5 558,-304.5 558,-310.5 552,-316.5 546,-316.5 546,-316.5 440,-316.5 440,-316.5 434,-316.5 428,-310.5 428,-304.5 428,-304.5 428,-256.5 428,-256.5 428,-250.5 434,-244.5 440,-244.5"/>
-<text text-anchor="middle" x="493" y="-291.8" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-276.8" font-family="monospace" font-size="14.00"> DNS with 3rd</text>
-<text text-anchor="middle" x="493" y="-261.8" font-family="monospace" font-size="14.00"> party</text>
-</g>
-<!-- obnoxious&#45;&gt;encryptedDNS -->
-<g id="edge8" class="edge">
-<title>obnoxious&#45;&gt;encryptedDNS</title>
-<path fill="none" stroke="white" d="M283.64,-280C283.64,-280 417.75,-280 417.75,-280"/>
-<polygon fill="white" stroke="white" points="427.75,-280 417.75,-284.5 422.75,-280 417.75,-280 417.75,-280 417.75,-280 422.75,-280 417.75,-275.5 427.75,-280 427.75,-280"/>
-<text text-anchor="middle" x="338.19" y="-283.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- ispDNS&#45;&gt;nothing -->
-<g id="edge11" class="edge">
-<title>ispDNS&#45;&gt;nothing</title>
-<path fill="none" stroke="white" d="M212,-71.79C212,-71.79 212,-46.13 212,-46.13"/>
-<polygon fill="white" stroke="white" points="212,-36.13 216.5,-46.13 212,-41.13 212,-46.13 212,-46.13 212,-46.13 212,-41.13 207.5,-46.13 212,-36.13 212,-36.13"/>
-<text text-anchor="middle" x="203.5" y="-47.76" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- useISP -->
-<g id="node11" class="node">
-<title>useISP</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-93.5C440,-93.5 546,-93.5 546,-93.5 552,-93.5 558,-99.5 558,-105.5 558,-105.5 558,-153.5 558,-153.5 558,-159.5 552,-165.5 546,-165.5 546,-165.5 440,-165.5 440,-165.5 434,-165.5 428,-159.5 428,-153.5 428,-153.5 428,-105.5 428,-105.5 428,-99.5 434,-93.5 440,-93.5"/>
-<text text-anchor="middle" x="493" y="-133.3" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-118.3" font-family="monospace" font-size="14.00"> DNS with ISP</text>
-</g>
-<!-- ispDNS&#45;&gt;useISP -->
-<g id="edge10" class="edge">
-<title>ispDNS&#45;&gt;useISP</title>
-<path fill="none" stroke="white" d="M283.64,-129C283.64,-129 417.75,-129 417.75,-129"/>
-<polygon fill="white" stroke="white" points="427.75,-129 417.75,-133.5 422.75,-129 417.75,-129 417.75,-129 417.75,-129 422.75,-129 417.75,-124.5 427.75,-129 427.75,-129"/>
-<text text-anchor="middle" x="338.19" y="-132.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-</g>
-</svg>

docs/assets/img/dns/dns.svg

@@ -1,166 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
- "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<!-- Generated by graphviz version 2.48.0 (0)
- -->
-<!-- Title: DNS Pages: 1 -->
-<svg width="630pt" height="935pt"
- viewBox="0.00 0.00 630.00 935.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(36 899)">
-<title>DNS</title>
-<!-- Start -->
-<g id="node1" class="node">
-<title>Start</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M89,-863C89,-863 55,-863 55,-863 49,-863 43,-857 43,-851 43,-851 43,-839 43,-839 43,-833 49,-827 55,-827 55,-827 89,-827 89,-827 95,-827 101,-833 101,-839 101,-839 101,-851 101,-851 101,-857 95,-863 89,-863"/>
-<text text-anchor="middle" x="72" y="-841.3" font-family="monospace" font-size="14.00">Start</text>
-</g>
-<!-- anonymous -->
-<g id="node3" class="node">
-<title>anonymous</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-791 0,-733.5 72,-676 144,-733.5 72,-791"/>
-<text text-anchor="middle" x="72" y="-737.3" font-family="monospace" font-size="14.00">Trying to be</text>
-<text text-anchor="middle" x="72" y="-722.3" font-family="monospace" font-size="14.00"> anonymous?</text>
-</g>
-<!-- Start&#45;&gt;anonymous -->
-<g id="edge1" class="edge">
-<title>Start&#45;&gt;anonymous</title>
-<path fill="none" stroke="black" d="M72,-826.59C72,-826.59 72,-801.45 72,-801.45"/>
-<polygon fill="black" stroke="black" points="72,-791.45 76.5,-801.45 72,-796.45 72,-801.45 72,-801.45 72,-801.45 72,-796.45 67.5,-801.45 72,-791.45 72,-791.45"/>
-</g>
-<!-- nothing -->
-<g id="node2" class="node">
-<title>nothing</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M249.5,-36C249.5,-36 174.5,-36 174.5,-36 168.5,-36 162.5,-30 162.5,-24 162.5,-24 162.5,-12 162.5,-12 162.5,-6 168.5,0 174.5,0 174.5,0 249.5,0 249.5,0 255.5,0 261.5,-6 261.5,-12 261.5,-12 261.5,-24 261.5,-24 261.5,-30 255.5,-36 249.5,-36"/>
-<text text-anchor="middle" x="212" y="-14.3" font-family="monospace" font-size="14.00">Do nothing</text>
-</g>
-<!-- censorship -->
-<g id="node4" class="node">
-<title>censorship</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-640 0,-582.5 72,-525 144,-582.5 72,-640"/>
-<text text-anchor="middle" x="72" y="-586.3" font-family="monospace" font-size="14.00">Avoiding</text>
-<text text-anchor="middle" x="72" y="-571.3" font-family="monospace" font-size="14.00"> censorship?</text>
-</g>
-<!-- anonymous&#45;&gt;censorship -->
-<g id="edge3" class="edge">
-<title>anonymous&#45;&gt;censorship</title>
-<path fill="none" stroke="black" d="M72,-675.98C72,-675.98 72,-650.11 72,-650.11"/>
-<polygon fill="black" stroke="black" points="72,-640.11 76.5,-650.11 72,-645.11 72,-650.11 72,-650.11 72,-650.11 72,-645.11 67.5,-650.11 72,-640.11 72,-640.11"/>
-<text text-anchor="middle" x="63.5" y="-651.85" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- tor -->
-<g id="node8" class="node">
-<title>tor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-697.5C300,-697.5 406,-697.5 406,-697.5 412,-697.5 418,-703.5 418,-709.5 418,-709.5 418,-757.5 418,-757.5 418,-763.5 412,-769.5 406,-769.5 406,-769.5 300,-769.5 300,-769.5 294,-769.5 288,-763.5 288,-757.5 288,-757.5 288,-709.5 288,-709.5 288,-703.5 294,-697.5 300,-697.5"/>
-<text text-anchor="middle" x="353" y="-729.8" font-family="monospace" font-size="14.00">Use Tor</text>
-</g>
-<!-- anonymous&#45;&gt;tor -->
-<g id="edge2" class="edge">
-<title>anonymous&#45;&gt;tor</title>
-<path fill="none" stroke="black" d="M143.64,-733C143.64,-733 277.75,-733 277.75,-733"/>
-<polygon fill="black" stroke="black" points="287.75,-733 277.75,-737.5 282.75,-733 277.75,-733 277.75,-733 277.75,-733 282.75,-733 277.75,-728.5 287.75,-733 287.75,-733"/>
-<text text-anchor="middle" x="198.19" y="-736.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- privacy -->
-<g id="node5" class="node">
-<title>privacy</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-489 140,-431.5 212,-374 284,-431.5 212,-489"/>
-<text text-anchor="middle" x="212" y="-435.3" font-family="monospace" font-size="14.00">Want privacy</text>
-<text text-anchor="middle" x="212" y="-420.3" font-family="monospace" font-size="14.00"> from ISP?</text>
-</g>
-<!-- censorship&#45;&gt;privacy -->
-<g id="edge5" class="edge">
-<title>censorship&#45;&gt;privacy</title>
-<path fill="none" stroke="black" d="M84.7,-535C115.31,-535 190.67,-535 190.67,-535 190.67,-535 190.67,-482.11 190.67,-482.11"/>
-<polygon fill="black" stroke="black" points="190.67,-472.11 195.17,-482.11 190.67,-477.11 190.67,-482.11 190.67,-482.11 190.67,-482.11 190.67,-477.11 186.17,-482.11 190.67,-472.11 190.67,-472.11"/>
-<text text-anchor="middle" x="155.63" y="-538.8" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- vpnOrTor -->
-<g id="node9" class="node">
-<title>vpnOrTor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-546.5C300,-546.5 406,-546.5 406,-546.5 412,-546.5 418,-552.5 418,-558.5 418,-558.5 418,-606.5 418,-606.5 418,-612.5 412,-618.5 406,-618.5 406,-618.5 300,-618.5 300,-618.5 294,-618.5 288,-612.5 288,-606.5 288,-606.5 288,-558.5 288,-558.5 288,-552.5 294,-546.5 300,-546.5"/>
-<text text-anchor="middle" x="353" y="-586.3" font-family="monospace" font-size="14.00">Use VPN</text>
-<text text-anchor="middle" x="353" y="-571.3" font-family="monospace" font-size="14.00"> or Tor</text>
-</g>
-<!-- censorship&#45;&gt;vpnOrTor -->
-<g id="edge4" class="edge">
-<title>censorship&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="black" d="M129.88,-594C129.88,-594 277.82,-594 277.82,-594"/>
-<polygon fill="black" stroke="black" points="287.82,-594 277.82,-598.5 282.82,-594 277.82,-594 277.82,-594 277.82,-594 282.82,-594 277.82,-589.5 287.82,-594 287.82,-594"/>
-<text text-anchor="middle" x="191.35" y="-597.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- obnoxious -->
-<g id="node6" class="node">
-<title>obnoxious</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-338 140,-280.5 212,-223 284,-280.5 212,-338"/>
-<text text-anchor="middle" x="212" y="-291.8" font-family="monospace" font-size="14.00">ISP makes</text>
-<text text-anchor="middle" x="212" y="-276.8" font-family="monospace" font-size="14.00"> obnoxious</text>
-<text text-anchor="middle" x="212" y="-261.8" font-family="monospace" font-size="14.00"> redirects?</text>
-</g>
-<!-- privacy&#45;&gt;obnoxious -->
-<g id="edge7" class="edge">
-<title>privacy&#45;&gt;obnoxious</title>
-<path fill="none" stroke="black" d="M212,-373.98C212,-373.98 212,-348.11 212,-348.11"/>
-<polygon fill="black" stroke="black" points="212,-338.11 216.5,-348.11 212,-343.11 212,-348.11 212,-348.11 212,-348.11 212,-343.11 207.5,-348.11 212,-338.11 212,-338.11"/>
-<text text-anchor="middle" x="203.5" y="-349.85" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- privacy&#45;&gt;vpnOrTor -->
-<g id="edge6" class="edge">
-<title>privacy&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="black" d="M237.33,-468.98C237.33,-510 237.33,-570 237.33,-570 237.33,-570 277.73,-570 277.73,-570"/>
-<polygon fill="black" stroke="black" points="287.73,-570 277.73,-574.5 282.73,-570 277.73,-570 277.73,-570 277.73,-570 282.73,-570 277.73,-565.5 287.73,-570 287.73,-570"/>
-<text text-anchor="middle" x="224.83" y="-543.49" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- ispDNS -->
-<g id="node7" class="node">
-<title>ispDNS</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-187 140,-129.5 212,-72 284,-129.5 212,-187"/>
-<text text-anchor="middle" x="212" y="-148.3" font-family="monospace" font-size="14.00">Does ISP</text>
-<text text-anchor="middle" x="212" y="-133.3" font-family="monospace" font-size="14.00"> support</text>
-<text text-anchor="middle" x="212" y="-118.3" font-family="monospace" font-size="14.00"> encrypted</text>
-<text text-anchor="middle" x="212" y="-103.3" font-family="monospace" font-size="14.00"> DNS?</text>
-</g>
-<!-- obnoxious&#45;&gt;ispDNS -->
-<g id="edge9" class="edge">
-<title>obnoxious&#45;&gt;ispDNS</title>
-<path fill="none" stroke="black" d="M212,-222.98C212,-222.98 212,-197.11 212,-197.11"/>
-<polygon fill="black" stroke="black" points="212,-187.11 216.5,-197.11 212,-192.11 212,-197.11 212,-197.11 212,-197.11 212,-192.11 207.5,-197.11 212,-187.11 212,-187.11"/>
-<text text-anchor="middle" x="203.5" y="-198.85" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- encryptedDNS -->
-<g id="node10" class="node">
-<title>encryptedDNS</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-244.5C440,-244.5 546,-244.5 546,-244.5 552,-244.5 558,-250.5 558,-256.5 558,-256.5 558,-304.5 558,-304.5 558,-310.5 552,-316.5 546,-316.5 546,-316.5 440,-316.5 440,-316.5 434,-316.5 428,-310.5 428,-304.5 428,-304.5 428,-256.5 428,-256.5 428,-250.5 434,-244.5 440,-244.5"/>
-<text text-anchor="middle" x="493" y="-291.8" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-276.8" font-family="monospace" font-size="14.00"> DNS with 3rd</text>
-<text text-anchor="middle" x="493" y="-261.8" font-family="monospace" font-size="14.00"> party</text>
-</g>
-<!-- obnoxious&#45;&gt;encryptedDNS -->
-<g id="edge8" class="edge">
-<title>obnoxious&#45;&gt;encryptedDNS</title>
-<path fill="none" stroke="black" d="M283.64,-280C283.64,-280 417.75,-280 417.75,-280"/>
-<polygon fill="black" stroke="black" points="427.75,-280 417.75,-284.5 422.75,-280 417.75,-280 417.75,-280 417.75,-280 422.75,-280 417.75,-275.5 427.75,-280 427.75,-280"/>
-<text text-anchor="middle" x="338.19" y="-283.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- ispDNS&#45;&gt;nothing -->
-<g id="edge11" class="edge">
-<title>ispDNS&#45;&gt;nothing</title>
-<path fill="none" stroke="black" d="M212,-71.79C212,-71.79 212,-46.13 212,-46.13"/>
-<polygon fill="black" stroke="black" points="212,-36.13 216.5,-46.13 212,-41.13 212,-46.13 212,-46.13 212,-46.13 212,-41.13 207.5,-46.13 212,-36.13 212,-36.13"/>
-<text text-anchor="middle" x="203.5" y="-47.76" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- useISP -->
-<g id="node11" class="node">
-<title>useISP</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-93.5C440,-93.5 546,-93.5 546,-93.5 552,-93.5 558,-99.5 558,-105.5 558,-105.5 558,-153.5 558,-153.5 558,-159.5 552,-165.5 546,-165.5 546,-165.5 440,-165.5 440,-165.5 434,-165.5 428,-159.5 428,-153.5 428,-153.5 428,-105.5 428,-105.5 428,-99.5 434,-93.5 440,-93.5"/>
-<text text-anchor="middle" x="493" y="-133.3" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-118.3" font-family="monospace" font-size="14.00"> DNS with ISP</text>
-</g>
-<!-- ispDNS&#45;&gt;useISP -->
-<g id="edge10" class="edge">
-<title>ispDNS&#45;&gt;useISP</title>
-<path fill="none" stroke="black" d="M283.64,-129C283.64,-129 417.75,-129 417.75,-129"/>
-<polygon fill="black" stroke="black" points="427.75,-129 417.75,-133.5 422.75,-129 417.75,-129 417.75,-129 417.75,-129 422.75,-129 417.75,-124.5 427.75,-129 427.75,-129"/>
-<text text-anchor="middle" x="338.19" y="-132.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-</g>
-</svg>

docs/assets/img/social-media-aggregator/freepost.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(.25 0 0 .25 26.227 -5.5792)"><path d="m30.557 85.535c0-9.0311-7.0959-18.062-17.74-18.062 0 0-7.0959 9.0311-7.0959 18.062 0 9.0311 7.0959 18.062 7.0959 18.062 10.644 0 17.74-9.0311 17.74-18.062z" style="fill:#775641;stroke-linejoin:round;stroke-width:.50032"/><path d="m23.762 85.819c0-7.1466-6.5632-13.107-14.304-13.107 0 0-3.7364 6.796-3.7364 13.32 0 6.5245 3.5955 11.731 3.5955 11.731 7.7409 0 14.445-4.7979 14.445-11.945z" style="fill:#f6eab7;stroke-linejoin:round;stroke-width:.36266"/><path d="m-104.91 85.535c0-9.0311 7.0959-18.062 17.74-18.062 0 0 7.0959 9.0311 7.0959 18.062 0 9.0311-7.0959 18.062-7.0959 18.062-10.644 0-17.74-9.0311-17.74-18.062z" style="fill:#775641;stroke-linejoin:round;stroke-width:.50032"/><path d="m-98.115 85.819c0-7.1466 6.5632-13.107 14.304-13.107 0 0 3.7364 6.796 3.7364 13.321 0 6.5245-3.5955 11.731-3.5955 11.731-7.7409 0-14.445-4.7979-14.445-11.945z" style="fill:#f6eab7;stroke-linejoin:round;stroke-width:.36266"/><path d="m-37.177 31.348c-25.158 0-50.316 9.5839-50.316 38.336 1.1924 6.4728 2.7731 11.683 4.6475 15.865-7.5968 3.7523-13.034 10.248-13.034 21.274 0 33.544 33.544 41.93 58.702 41.93s58.702-8.386 58.702-41.93c0-11.026-5.4368-17.521-13.034-21.274 1.8744-4.1813 3.4552-9.3917 4.6475-15.865 0-28.752-25.158-38.336-50.316-38.336z" style="fill:#775641"/><path d="m-55.239 42.637c-14.963-2e-6 -24.836 12.13-24.836 27.093 0.0068 6.4722 2.3304 12.728 6.5501 17.636-8.7707 4.271-15.581 10.809-15.581 20.747 0 24.836 26.771 33.867 51.929 33.867 25.158 0 51.929-9.0311 51.929-33.867 0-9.9374-6.8105-16.476-15.581-20.747 4.2197-4.9075 6.5432-11.163 6.5501-17.636 0-14.963-9.8723-27.093-24.836-27.093-9.0311 0-13.461 3.4642-18.062 6.7733-4.6083-3.3145-11.289-6.7733-18.062-6.7733z" style="fill:#f6eab7;stroke-linejoin:round;stroke-width:1.0285"/><ellipse cx="-54.11" cy="74.246" rx="5.6444" ry="9.0311" style="fill:#775641;stroke-linejoin:round;stroke-width:.89246"/><ellipse cx="-20.243" cy="74.246" rx="5.6444" ry="9.0311" style="fill:#775641;stroke-linejoin:round;stroke-width:.89246"/><path d="m-71.233 110.23c12.984 13.436 55.127 13.436 68.112 0 0 0-5.0706 4.6382-16.903 7.1405-11.833 2.5023-17.153 2.034-17.153 2.034s-5.3106 0.35654-16.366-2.034c-11.055-2.3905-17.69-7.1405-17.69-7.1405z" style="fill:#775641;stroke-linejoin:round;stroke-width:4.1379;stroke:#775641"/></g></svg>

docs/assets/img/social-media-aggregator/lemmy.svg

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<svg width="100%" height="100%" viewBox="0 0 128 128" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linecap:round;stroke-linejoin:round;">
-    <g id="Layer-1" serif:id="Layer 1" transform="matrix(0.7115,0,0,0.7115,-4.30398,-12.0468)">
-        <path id="white-border" d="M31.32,50.773C31.142,50.772 30.965,50.773 30.788,50.777C29.979,50.791 29.177,50.844 28.385,50.935C22.051,51.665 16.345,55.035 12.847,60.924C9.42,66.695 8.576,73.049 10.323,78.937C12.07,84.825 16.302,90.174 22.566,94.412C22.604,94.437 22.643,94.462 22.682,94.485C28.054,97.725 33.403,99.91 39.133,101.039C38.993,103.404 38.997,105.834 39.149,108.323C39.606,115.843 42.263,122.767 46.292,128.886L31.853,134.781C30.295,135.392 29.539,137.159 30.171,138.708C30.803,140.256 32.58,140.989 34.12,140.336L50.001,133.853C52.946,137.364 56.33,140.543 59.961,143.335C60.1,143.441 60.241,143.545 60.38,143.651L51.078,155.968C50.055,157.289 50.309,159.191 51.643,160.198C52.976,161.205 54.875,160.929 55.866,159.584L65.314,147.074C70.505,150.362 76.015,152.925 81.452,154.621C84.243,159.736 89.697,162.992 96,162.992C102.363,162.992 107.82,159.489 110.588,154.473C115.97,152.746 121.416,150.173 126.553,146.898L136.134,159.584C137.125,160.929 139.024,161.205 140.357,160.198C141.691,159.191 141.945,157.289 140.922,155.968L131.479,143.464C131.542,143.417 131.605,143.37 131.668,143.323C135.256,140.576 138.61,137.456 141.55,134.016L157.03,140.336C158.57,140.989 160.347,140.256 160.98,138.708C161.612,137.159 160.855,135.392 159.298,134.781L145.322,129.075C149.479,122.92 152.266,115.944 152.848,108.364C153.041,105.86 153.079,103.409 152.968,101.019C158.66,99.883 163.977,97.706 169.318,94.485C169.357,94.462 169.396,94.437 169.434,94.412C175.698,90.174 179.93,84.825 181.677,78.937C183.424,73.049 182.58,66.695 179.153,60.924C175.655,55.035 169.949,51.665 163.615,50.935C162.823,50.844 162.021,50.791 161.212,50.777C155.548,50.675 149.505,52.431 143.694,55.786C139.419,58.253 135.565,62.032 132.549,66.155C124.112,61.327 113.135,58.608 99.647,58.385C98.437,58.365 97.207,58.365 95.957,58.386C80.922,58.631 68.885,61.481 59.794,66.634C59.771,66.599 59.748,66.563 59.724,66.528C56.67,62.26 52.71,58.328 48.306,55.786C42.677,52.536 36.829,50.786 31.32,50.773L31.32,50.773Z" style="fill:none;fill-rule:nonzero;stroke:white;stroke-width:5.25px;"/>
-        <path id="ears" d="M134.41,68.056C137.277,64.049 141.041,60.348 145.006,58.059C157.506,50.843 170.698,51.83 176.896,62.265C183.101,72.712 179.706,84.294 167.963,92.237C161.971,95.85 156.163,98.035 149.732,98.902M57.59,68.056C54.722,64.049 50.959,60.348 46.994,58.059C34.494,50.843 21.302,51.83 15.104,62.265C8.899,72.712 12.294,84.294 24.037,92.237C30.029,95.85 35.837,98.035 42.268,98.902" style="fill:white;fill-rule:nonzero;stroke:black;stroke-width:5.25px;"/>
-        <path id="head" d="M150.231,108.163C152.388,80.076 135.11,60.372 96,61.01C56.89,61.649 40.071,80.256 41.769,108.163C43.39,134.803 74.919,154.364 95.792,154.364C116.664,154.364 148.189,134.762 150.231,108.163Z" style="fill:white;fill-rule:nonzero;stroke:black;stroke-width:5.25px;"/>
-        <path id="eyes" d="M114.469,120.804C114.469,125.138 117.976,128.651 122.302,128.651C126.629,128.651 130.136,125.138 130.136,120.804C130.136,116.471 126.629,112.958 122.302,112.958C117.976,112.958 114.469,116.471 114.469,120.804ZM61.864,120.804C61.864,125.178 65.403,128.723 69.77,128.723C74.136,128.723 77.676,125.178 77.676,120.804C77.676,116.431 74.136,112.885 69.77,112.885C65.403,112.885 61.864,116.431 61.864,120.804Z" style="fill-rule:nonzero;"/>
-        <path id="whiskers" d="M63.699,144.234L53.472,157.776M128.301,144.234L138.528,157.776M49.441,130.841L32.986,137.558M141.71,130.841L158.164,137.558" style="fill:none;fill-rule:nonzero;stroke:black;stroke-width:6px;stroke-linejoin:miter;"/>
-        <path id="nose" d="M96,133.704C87.401,133.704 81.913,139.675 82.099,147.036C82.299,155.007 88.186,160.368 96,160.368C103.814,160.368 109.885,154.181 109.902,147.036C109.919,139.673 104.6,133.704 96,133.704Z" style="fill:white;fill-rule:nonzero;stroke:black;stroke-width:5.25px;"/>
-    </g>
-</svg>

docs/assets/img/social-media-aggregator/tildes.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866" xmlns="http://www.w3.org/2000/svg"><g stroke-width=".33866"><rect x="-5.6458e-7" y="-5.6458e-7" width="33.866" height="33.866" fill="#002b36"/><rect x="-5.6458e-7" y="16.933" width="4.2333" height="4.2333" fill="#859900"/><rect x="4.2332" y="12.7" width="4.2333" height="4.2333" fill="#2aa198"/><rect x="8.4665" y="8.4665" width="4.2333" height="4.2333" fill="#268bd2"/><rect x="12.7" y="12.7" width="4.2333" height="4.2333" fill="#6c71c4"/><rect x="16.933" y="16.933" width="4.2333" height="4.2333" fill="#d33682"/><rect x="21.166" y="21.166" width="4.2333" height="4.2333" fill="#dc322f"/><rect x="25.399" y="16.933" width="4.2333" height="4.2333" fill="#cb4b16"/><rect x="29.633" y="12.7" width="4.2333" height="4.2333" fill="#b58900"/></g></svg>

docs/assets/img/social-networks/diaspora.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(2 0 0 2 0 -560.12)"><circle cx="8.4667" cy="288.53" r="8.4667" fill="#3e4142" stroke-width=".38887"/><path d="m6.1306 293.62c-0.61195-0.40183-1.8023-1.3484-1.8383-1.4618-0.0175-0.0552 0.11761-0.25886 0.87712-1.3223 0.59137-0.82801 0.98432-1.3965 0.98432-1.424 0-0.01-0.4186-0.15726-0.93021-0.32777-1.5987-0.53278-2.1871-0.75809-2.2228-0.85129-0.0085-0.0222 0.02478-0.17879 0.07399-0.34805 0.16758-0.57651 0.70469-2.1925 0.72869-2.1925 0.01317 0 0.69903 0.22409 1.5242 0.49799 0.82512 0.27389 1.5369 0.50097 1.5818 0.50462 0.08051 7e-3 0.08184 5e-3 0.09981-0.11496 0.02567-0.17145 0.06852-1.3039 0.06863-1.8139 5e-5 -0.23526 0.0073-0.65934 0.016121-0.94238l0.016029-0.51464h2.7084l0.01692 1.1613c0.01638 1.1246 0.04908 2.0391 0.07784 2.1766 0.0077 0.0367 0.02929 0.0669 0.04798 0.0669 0.018709 0 0.4419-0.13256 0.94045-0.29459 1.1784-0.38294 1.6299-0.52224 1.9278-0.5948 0.22766-0.0555 0.24515-0.0565 0.27379-0.0177 0.11772 0.15956 0.87772 2.4073 0.82859 2.4506-0.08778 0.0772-0.64949 0.28794-1.8198 0.68268-1.3815 0.46598-1.3376 0.45035-1.3376 0.47651 0 0.0359 0.24771 0.39668 0.9244 1.3466 0.34304 0.48151 0.69854 0.98791 0.78999 1.1253l0.16629 0.2498-0.07093 0.0743c-0.28961 0.30347-1.9257 1.5297-2.041 1.5297-0.05832 0-0.32962-0.32111-0.76323-0.90341-0.23554-0.31633-0.59006-0.79236-0.78783-1.0579-0.19776-0.26553-0.3985-0.52655-0.44609-0.58004l-0.08653-0.0973-0.08516 0.0973c-0.11446 0.13074-0.58016 0.74722-0.99206 1.3132-0.56457 0.77581-0.94676 1.2524-1.0043 1.2524-0.013449 0-0.12479-0.0659-0.24742-0.1464z" fill="#fff" stroke-width=".024319"/></g></svg>

docs/assets/img/social-networks/friendica.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128"><path fill="#ffc019" d="M23.04 2.56c-11.508.055-20.48 9.027-20.48 20.48v81.92c0 11.673 8.972 20.48 20.48 20.48h20.48V92.16h40.96l-.108-30.633-40.853.215V35.839h40.96V2.56H23.036Z"/><path fill="#1872a2" d="M104.96 125.441c11.508 0 20.59-8.916 20.48-20.48V23.042c.1-11.541-9.046-20.48-20.48-20.48H84.48v33.28H43.52v28.16h40.96v28.16H43.52v33.28h61.441Z"/><path fill="none" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width="5.12" d="M84.482 2.56v33.28h-40.96V64m40.96 0v28.16h-40.96v33.28"/><path fill="none" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width="5.12" d="M23.04 2.56h81.918c11.311 0 20.48 9.17 20.48 20.48v81.918c0 11.311-9.169 20.48-20.48 20.48H23.04c-11.31 0-20.48-9.169-20.48-20.48V23.04c0-11.31 9.17-20.48 20.48-20.48Z"/><path fill="none" d="M22.035 2.56h83.929c10.755 0 19.475 8.72 19.475 19.476v22.542c0 10.756-8.72 19.476-19.475 19.476h-83.93c-10.755 0-19.474-8.72-19.474-19.476V22.036C2.56 11.28 11.28 2.56 22.035 2.56ZM22.035 125.441h83.929c10.755 0 19.475-8.687 19.475-19.404V83.575c0-10.717-8.72-19.405-19.475-19.405h-83.93C11.28 64.17 2.56 72.858 2.56 83.575v22.462c0 10.717 8.72 19.404 19.475 19.404Z"/><linearGradient id="a" x1="58.714" x2="70.659" y1="-1.227" y2="37.471" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#fff" stop-opacity=".744"/><stop offset="1" stop-color="#fff" stop-opacity="0"/></linearGradient><filter id="b" width="128" height="128" x="0" y="0" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"><feGaussianBlur stdDeviation="1.22"/></filter><path fill="url(#a)" d="M19.92-1.227c-3.062 0-5.946.448-8.531 1.227h11.654C10.885 0 .926 9.43.07 21.371v1.205c0 6.97 8.852 12.582 19.85 12.582h88.16c10.998 0 19.85-5.611 19.85-12.582V21.32C127.05 9.403 117.104 0 104.963 0h11.65c-2.585-.778-5.47-1.226-8.532-1.226H19.92Z" filter="url(#b)"/><linearGradient id="c" x1="69.089" x2="57.65" y1="125.276" y2="93.395" gradientUnits="userSpaceOnUse"><stop offset="0" stop-opacity=".5"/><stop offset="1" stop-color="#818080" stop-opacity="0"/></linearGradient><filter id="d" width="128" height="128" x="0" y="0" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"><feGaussianBlur stdDeviation="1.457"/></filter><path fill="url(#c)" d="M21.566 97.022h85.002c9.673 0 17.515 6.325 17.515 14.127 0 7.802-7.842 14.127-17.515 14.127H21.566c-9.673 0-17.515-6.325-17.515-14.127 0-7.802 7.842-14.127 17.515-14.127Z" filter="url(#d)" opacity=".567"/></svg>

docs/assets/img/social-networks/mastodon.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg"><path d="m32.056 20.303c-0.46437 2.389-4.1591 5.0036-8.4025 5.5103-2.2128 0.26403-4.3914 0.50671-6.7145 0.40015-3.7993-0.17407-6.7972-0.90685-6.7972-0.90685 0 0.36986 0.02281 0.72202 0.06843 1.0514 0.49393 3.7495 3.7179 3.9741 6.7718 4.0788 3.0824 0.10546 5.827-0.75997 5.827-0.75997l0.12663 2.7866s-2.156 1.1577-5.9967 1.3707c-2.1179 0.11641-4.7476-0.05328-7.8104-0.86397-6.6428-1.7582-7.7853-8.8392-7.9601-16.024-0.05328-2.1332-0.02044-4.1447-0.02044-5.827 0-7.3468 4.8136-9.5002 4.8136-9.5002 2.4272-1.1147 6.5919-1.5834 10.922-1.6188h0.10638c4.3297 0.0354 8.4972 0.50415 10.924 1.6188 0 0 4.8134 2.1535 4.8134 9.5002 0 0 0.0604 5.4205-0.67129 9.1838" fill="#2b90d9" stroke-width=".14597"/><path d="m27.05 11.689v8.8957h-3.5243v-8.6343c0-1.8201-0.76581-2.7439-2.2976-2.7439-1.6936 0-2.5425 1.0959-2.5425 3.2628v4.726h-3.5035v-4.726c0-2.167-0.84901-3.2628-2.5427-3.2628-1.5318 0-2.2976 0.92382-2.2976 2.7439v8.6343h-3.5243v-8.8957c0-1.8181 0.46292-3.2628 1.3928-4.3317 0.95886-1.0689 2.2146-1.6168 3.7734-1.6168 1.8035 0 3.1692 0.69319 4.0723 2.0797l0.87784 1.4716 0.87802-1.4716c0.90284-1.3866 2.2686-2.0797 4.0723-2.0797 1.5586 0 2.8143 0.54794 3.7734 1.6168 0.92966 1.0689 1.3926 2.5136 1.3926 4.3317" fill="#fff" stroke-width=".14597"/></svg>

docs/assets/img/social-networks/movim.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><linearGradient id="linearGradient4049" x1="40" x2="200" y1="40" y2="200" gradientUnits="userSpaceOnUse"><stop style="stop-color:#345cca" offset="0"/><stop style="stop-color:#5d47c6" offset="1"/></linearGradient><linearGradient id="linearGradient4057" x1="125" x2="174.95" y1="65" y2="210.1" gradientUnits="userSpaceOnUse"><stop style="stop-color:#344394" offset="0"/><stop style="stop-color:#7c45df" offset="1"/></linearGradient><filter id="filter4029" x="-.14248" y="-.24435" width="1.285" height="1.4887"><feGaussianBlur stdDeviation="10.685972"/></filter></defs><g transform="matrix(.15187 0 0 .15187 -1.2909 -124.66)"><circle transform="translate(0 812.36)" cx="120" cy="120" r="110" style="fill:url(#linearGradient4049);stroke-width:3;stroke:url(#linearGradient4057)"/><path transform="matrix(.91667 0 0 .91667 3.3333 73.963)" d="m109.28 887.56c-20.51 0-37.137 16.627-37.137 37.137 0 1.594 0.10688 3.1707 0.30171 4.7118-0.29375-9e-3 -0.58624-0.0232-0.88201-0.0232-17.434-7e-5 -31.567 14.133-31.567 31.567 0 17.434 14.133 31.567 31.567 31.567h122.44c14.357 0 25.996-11.639 25.996-25.996 0-14.357-11.639-25.996-25.996-25.996-0.0468 0-0.093-2.5e-4 -0.13928 0 0.0334-0.64832 0.0696-1.293 0.0696-1.9497 0-20.51-16.627-37.137-37.137-37.137-5.7242 0-11.15 1.3077-15.992 3.6209-6.5596-10.507-18.221-17.501-31.52-17.501z" style="fill:#332949;filter:url(#filter4029);opacity:.45896"/><path d="m101.59 885.71c-18.232 0-33.011 14.78-33.011 33.011 0 1.4169 0.095 2.8184 0.26819 4.1883-0.26111-8e-3 -0.5211-0.0206-0.78401-0.0206-15.497-9e-5 -28.059 12.562-28.059 28.059 0 15.497 12.563 28.059 28.059 28.059h108.83c12.762 0 23.108-10.346 23.108-23.108 0-12.762-10.346-23.108-23.108-23.108-0.0416 0-0.0827-2.2e-4 -0.1238 0 0.0297-0.57629 0.0619-1.1493 0.0619-1.7331 0-18.231-14.78-33.011-33.011-33.011-5.0882 0-9.9111 1.1624-14.215 3.2186-5.8308-9.3396-16.197-15.556-28.018-15.556z" style="fill:#fff"/></g></svg>

docs/assets/img/social-networks/pleroma.svg

@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg width="128" height="128" version="1.1" viewBox="0 0 33.866 33.866" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(.1014 0 0 .1014 -9.0749 -9.0242)"><g fill="#fba457" stroke-width="0"><path transform="matrix(2.6094 0 0 2.6094 89.5 89)" d="m33.916 0a9.9641 9.9641 0 0 0-9.9648 9.9648v118.04h31.809v-128h-21.844z"/><path transform="matrix(2.6094 0 0 2.6094 89.5 89)" d="m71.855 0v64h22.229a9.9641 9.9641 0 0 0 9.9648-9.9648v-54.035h-32.193z"/><path transform="matrix(2.6094 0 0 2.6094 89.5 89)" d="m71.855 96.191v31.809h22.229a9.9641 9.9641 0 0 0 9.9648-9.9648v-21.844h-32.193z"/></g></g></svg>

docs/browsers.en.md

@@ -1,5 +1,5 @@
 ---
-title: Browser Recommendations
+title: "Web Browsers"
 icon: octicons/browser-16
 ---
 These are our current web browser recommendations and settings. We recommend keeping extensions to a minimum: they have privileged access within your browser, require you to trust the developer, can make you [stand out](https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint), and [weaken](https://groups.google.com/a/chromium.org/g/chromium-extensions/c/0ei-UCHNm34/m/lDaXwQhzBAAJ) site isolation.
@@ -12,7 +12,7 @@ These are our current web browser recommendations and settings. We recommend kee
 
 !!! recommendation
 
-    ![Tor Browser logo](/assets/img/browsers/tor.svg){ align=right }
+    ![Tor Browser logo](assets/img/browsers/tor.svg){ align=right }
 
     **Tor Browser** is the choice if you need anonymity. This browser provides you with access to the Tor Bridges and [Tor Network](https://en.wikipedia.org/wiki/Tor_(network)), along with extensions that can be automatically configured to fit its three security levels - *Standard*, *Safer* and *Safest*. We recommend that you do not change any of Tor Browser's default configurations outside of the standard security levels.
 
@@ -36,7 +36,7 @@ These are our current web browser recommendations and settings. We recommend kee
 
 !!! recommendation
 
-    ![Firefox logo](/assets/img/browsers/firefox.svg){ align=right }
+    ![Firefox logo](assets/img/browsers/firefox.svg){ align=right }
 
     **Firefox** provides strong privacy settings such as [Enhanced Tracking Protection](https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop), which can help block various [types of tracking](https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop#w_what-enhanced-tracking-protection-blocks).
 
@@ -99,7 +99,7 @@ The [Firefox sync](https://hacks.mozilla.org/2018/11/firefox-sync-privacy/) serv
 
 #### Extensions
 
-We generally do not recommend installing any extensions as they increase your [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [uBlock Origin](/browsers/#additional-resources) might be useful to you. The extension is also a 🏆️ [Recommended Extension](https://support.mozilla.org/kb/add-on-badges#w_recommended-extensions) by Mozilla.
+We generally do not recommend installing any extensions as they increase your [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [uBlock Origin](#additional-resources) might be useful to you. The extension is also a 🏆️ [Recommended Extension](https://support.mozilla.org/kb/add-on-badges#w_recommended-extensions) by Mozilla.
 
 #### Arkenfox (advanced)
 
@@ -115,7 +115,7 @@ On iOS, any app that can browse the web is [restricted](https://developer.apple.
 
 !!! recommendation
 
-    ![Bromite logo](/assets/img/browsers/bromite.svg){ align=right }
+    ![Bromite logo](assets/img/browsers/bromite.svg){ align=right }
 
     **Bromite** is a [Chromium](https://en.wikipedia.org/wiki/Chromium_(web_browser))-based browser with privacy and security enhancements, built-in ad blocking, and some fingerprinting randomization.
 
@@ -145,7 +145,7 @@ These options can be found in *Privacy and Security* ( ⁝ → ⚙️ Settings
 
 !!! recommendation
 
-    ![Safari logo](/assets/img/browsers/safari.svg){ align=right }
+    ![Safari logo](assets/img/browsers/safari.svg){ align=right }
 
     **Safari** is the default browser in iOS. It includes [privacy features](https://support.apple.com/guide/iphone/browse-the-web-privately-iphb01fc3c85/15.0/ios/15.0) such as Intelligent Tracking Protection, Privacy Report, isolated Private Browsing tabs, iCloud Private Relay, and automatic HTTPS upgrades.
 
@@ -197,7 +197,7 @@ If you use iCloud, we also recommend checking to ensure Safari's default downloa
 
 #### Extensions
 
-We generally do not recommend installing [any extensions](https://www.sentinelone.com/blog/inside-safari-extensions-malware-golden-key-user-data/) as they increase your browser's [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [AdGuard for Safari](/browsers/#additional-resources) might be useful to you.
+We generally do not recommend installing [any extensions](https://www.sentinelone.com/blog/inside-safari-extensions-malware-golden-key-user-data/) as they increase your browser's [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [AdGuard for Safari](#additional-resources) might be useful to you.
 
 ## Additional Resources
 
@@ -205,7 +205,7 @@ We generally do not recommend installing [any extensions](https://www.sentinelon
 
 !!! recommendation
 
-    ![uBlock Origin logo](/assets/img/browsers/ublock_origin.svg){ align=right }
+    ![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ align=right }
 
     **uBlock Origin** is a popular content blocker that could help you block ads, trackers, and fingerprinting scripts.
 
@@ -230,7 +230,7 @@ uBlock Origin also has different [blocking modes](https://github.com/gorhill/uBl
 
 !!! recommendation
 
-    ![AdGuard logo](/assets/img/browsers/adguard.svg){ align=right }
+    ![AdGuard logo](assets/img/browsers/adguard.svg){ align=right }
 
     **AdGuard for Safari** is a free and open-source content-blocking extension for Safari that uses the native [Content Blocker API](https://developer.apple.com/documentation/safariservices/creating_a_content_blocker). 
     
@@ -255,7 +255,7 @@ There is also [AdGuard for iOS](https://adguard.com/en/adguard-ios/overview.html
 
 !!! recommendation
 
-    ![Terms of Service; Didn't Read logo](/assets/img/browsers/terms_of_service_didnt_read.svg){ align=right }
+    ![Terms of Service; Didn't Read logo](assets/img/browsers/terms_of_service_didnt_read.svg){ align=right }
 
     **Terms of Service; Didn't Read** grades websites based on their terms of service agreements and privacy policies. It also gives short summaries of those agreements. The analyses and ratings are published transparently by a community of reviewers.
 

docs/calendar-contacts.en.md

@@ -1,19 +1,19 @@
 ---
-title: Calendar and Contact Sync Tools
+title: "Calendar and Contact Sync"
 icon: material/calendar
 ---
 Calendaring and contacts are some of the most sensitive data posess. Use only products that use end-to-end encryption (E2EE) at rest. This prevents a provider from reading your data.
 
 ## Software as a service (SaaS) only
 
-These products are included with an subscription to the respective [email providers](/email).
+These products are included with an subscription to the respective [email providers](email.md).
 
 ### Tutanota
 
 !!! recommendation
 
-    ![Tutanota logo](/assets/img/calendar-contacts/tutanota.svg#only-light){ align=right }
-    ![Tutanota logo](/assets/img/calendar-contacts/tutanota-dark.svg#only-dark){ align=right }
+    ![Tutanota logo](assets/img/calendar-contacts/tutanota.svg#only-light){ align=right }
+    ![Tutanota logo](assets/img/calendar-contacts/tutanota-dark.svg#only-dark){ align=right }
 
     **Tutanota** has an [encrypted calendar](https://tutanota.com/blog/posts/free-encrypted-calendar/) in their desktop and mobile clients.
 
@@ -33,7 +33,7 @@ These products are included with an subscription to the respective [email provid
 
 !!! recommendation
 
-    ![Proton Calendar logo](/assets/img/calendar-contacts/proton-calendar.svg){ align=right }
+    ![Proton Calendar logo](assets/img/calendar-contacts/proton-calendar.svg){ align=right }
 
     **Proton Calendar** is an calendar app that is available to ProtonMail users. All data stored within it is end-to-end encrypted when stored on ProtonMail's servers.
 
@@ -51,7 +51,7 @@ Some of these options are self-hostable, or able to be hosted by third party pro
 
 !!! recommendation
 
-    ![EteSync logo](/assets/img/calendar-contacts/etesync.svg){ align=right }
+    ![EteSync logo](assets/img/calendar-contacts/etesync.svg){ align=right }
 
     **EteSync** is a secure, end-to-end encrypted, and privacy-respecting cloud backup and synchronization software for your personal information (e.g. contacts and calendars). There are native clients for Android, iOS, and the web, and an adapter layer for most desktop clients.
 
@@ -70,7 +70,7 @@ Some of these options are self-hostable, or able to be hosted by third party pro
 
 !!! recommendation
 
-    ![Nextcloud logo](/assets/img/calendar-contacts/nextcloud.svg){ align=right }
+    ![Nextcloud logo](assets/img/calendar-contacts/nextcloud.svg){ align=right }
 
     **Nextcloud** is a suite of client-server software for creating and using file hosting services. This includes calendar sync via CalDAV and contacts sync via CardDAV. Nextcloud is free and open-source, thereby allowing anyone to install and operate it without charge on a private server.
 
@@ -92,11 +92,11 @@ Some of these options are self-hostable, or able to be hosted by third party pro
 
 !!! recommendation
 
-    ![DecSync logo](/assets/img/calendar-contacts/decsync.svg){ align=right }
+    ![DecSync logo](assets/img/calendar-contacts/decsync.svg){ align=right }
 
-    **DecSync CC** synchronizes contacts, calendars and tasks using DecSync. It stores this data in a shared directory, using [Syncthing](/file-sharing/#syncthing), or any other file synchronization service.
+    **DecSync CC** synchronizes contacts, calendars and tasks using DecSync. It stores this data in a shared directory, using [Syncthing](file-sharing/#syncthing), or any other file synchronization service.
 
-    There are [plugins](https://github.com/39aldo39/DecSync#rss) to sync other types of data such as [RSS](/news-aggregators).
+    There are [plugins](https://github.com/39aldo39/DecSync#rss) to sync other types of data such as [RSS](news-aggregators.md).
 
     [Visit github.com](https://github.com/39aldo39/DecSync){ .md-button .md-button--primary }
 

docs/cloud.en.md

@@ -1,5 +1,5 @@
 ---
-title: Cloud Storage
+title: "Cloud Storage"
 icon: material/file-cloud
 ---
 If you are currently using a Cloud Storage Service like Dropbox, Google Drive, Microsoft OneDrive or Apple iCloud, you are putting complete trust in your service provider to not look at your files.
@@ -10,7 +10,7 @@ Trust your provider by using an alternative below that supports [end-to-end encr
 
 !!! recommendation
 
-    ![Nextcloud logo](/assets/img/cloud/nextcloud.svg){ align=right }
+    ![Nextcloud logo](assets/img/cloud/nextcloud.svg){ align=right }
 
     **Nextcloud** is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control. It also comes with experimental end-to-end encryption (E2EE).
 
@@ -36,7 +36,7 @@ When self hosting Nextcloud, you should also remember to enable E2EE to protect
 
 !!! recommendation
 
-    ![Proton Drive logo](/assets/img/cloud/protondrive.svg){ align=right }
+    ![Proton Drive logo](assets/img/cloud/protondrive.svg){ align=right }
 
     **Proton Drive** is an end-to-end encrypted (E2EE) general file storage service by the popular encrypted email provider [ProtonMail](https://protonmail.com).
 
@@ -47,7 +47,7 @@ When self hosting Nextcloud, you should also remember to enable E2EE to protect
 
 Proton Drive is currently in beta and only is only available through a web client.
 
-When using a web client, you are placing trust in the server to send you proper JavaScript code to derive the decryption key and authentication token locally in your browser. A compromised server can send you malicious JavaScript code to steal your master password and decrypt your data. If this does not fit your [threat model](/threat-modeling/), consider using an alternative.
+When using a web client, you are placing trust in the server to send you proper JavaScript code to derive the decryption key and authentication token locally in your browser. A compromised server can send you malicious JavaScript code to steal your master password and decrypt your data. If this does not fit your [threat model](threat-modeling.md), consider using an alternative.
 
 ### Cryptee
 

docs/dns.en.md

@@ -0,0 +1,122 @@
+---
+title: "DNS Resolvers"
+icon: material/dns
+---
+
+!!! faq "Should I use encrypted DNS?"
+
+    Encrypted DNS with third party servers should only be used to get around basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences. Encrypted DNS will not help you hide any of your browsing activity.
+
+    [Learn more about DNS](technology/dns.md){ .md-button }
+
+## Recommended Providers
+
+| DNS Provider | Privacy Policy | Type | Protocols | Logging | ECS | Filtering |
+| ------------ | -------------- | ---- | --------- | ------- | --- | --------- |
+| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Commercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^1] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS)
+| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/) | Commercial | Cleartext <br> DoH <br> DoT | Some[^2] | No | Based on server choice.|
+| [**ControlD**](https://controld.com) | [:octicons-link-external-24:](https://controld.com/privacy) | Commercial | Cleartext <br> DoH <br> DoT | Optional[^3] | No |  Based on server choice.  |
+| [**MullvadDNS**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy/) | Commercial | DoH <br> DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock)
+| [**NextDNS**](https://www.nextdns.io) | [:octicons-link-external-24:](https://www.nextdns.io/privacy) | Commercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Optional[^5] | Optional | Based on server choice. |
+| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy/) | Non-Profit | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional |  Based on server choice, Malware blocking by default. |
+
+[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
+[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/)
+[^3]: Neither free nor premium users of ControlD have logging enabled by default. Premium users can enable logging/analytics at will. [https://controld.com/privacy](https://controld.com/privacy)
+[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy/)
+[^5]: NextDNS can provide insights and logging features on an opt-in basis. Users can choose retention times and log storage locations for any logs they choose to keep. If not specifically requested by the user, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
+[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://www.quad9.net/privacy/policy/](https://www.quad9.net/privacy/policy/)
+
+The criteria for the servers listed above are:
+
+- Must support [DNSSEC](technology/dns.md#what-is-dnssec-and-when-is-it-used)
+- Must have [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support
+- [QNAME Minimization](technology/dns.md#what-is-qname-minimization)
+- Allow for [ECS](technology/dns.md#what-is-edns-client-subnet-ecs) to be disabled
+
+## Native Operating System Support
+
+### Android
+
+Android 9 and above support DNS over TLS. Android 13 will support DNS over HTTPS. The settings can be found in: **Settings** &rarr; **Network & Internet** &rarr; **Private DNS**.
+
+### Apple Devices
+
+The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
+
+After installation of either a configuration profile or an app that utilizes the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
+
+#### Signed Profiles
+
+Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [ControlD](https://kb.controld.com/en/tutorials), [NextDNS](https://apple.nextdns.io), [Quad9](https://www.quad9.net/news/blog/ios-mobile-provisioning-profiles/).
+
+#### iOS/iPadOS
+
+Select **Settings** &rarr; **General** &rarr; **VPN, DNS, & Device Management** &rarr; **DNS**
+
+#### macOS
+
+Select **System Preferences &rarr; Profiles** or **System Preferences** &rarr; **Network** &rarr; **Advanced**, (depending on if you have configuration profiles installed).
+
+#### tvOS
+
+Select **Settings** &rarr; **General** &rarr; **Privacy** &rarr; **Share Apple TV Analytics** &rarr; then press the *Play* button on the remote.
+
+### Windows
+
+Windows users can [turn on DoH](https://docs.microsoft.com/en-us/windows-server/networking/dns/doh-client-support) by accessing Windows settings in the control panel.
+
+Select **Settings** &rarr; **Network & Internet** &rarr; **Ethernet or WiFi**, &rarr; **Edit DNS Settings** &rarr; **Preferred DNS encryption** &rarr; **Encrypted only (DNS over HTTPS)**.
+
+### Linux
+
+`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
+
+## Encrypted DNS Proxies
+
+Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](technology/dns.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](technology/dns.md#what-is-encrypted-dns).
+
+### RethinkDNS
+
+!!! recommendation
+
+    ![RethinkDNS logo](assets/img/android/rethinkdns.svg#only-light){ align=right }
+    ![RethinkDNS logo](assets/img/android/rethinkdns-dark.svg#only-dark){ align=right }
+
+    **RethinkDNS** is an open-source Android client supporting [DNS-over-HTTPS](technology/dns.md#dns-over-https-doh), [DNS-over-TLS](technology/dns.md#dns-over-tls-dot), [DNSCrypt](technology/dns.md#dnscrypt) and DNS Proxy along with caching DNS responses, locally logging DNS queries and can be used as a firewall too.
+
+    [Visit rethinkdns.com](https://rethinkdns.com){ .md-button .md-button--primary } [Privacy Policy](https://rethinkdns.com/privacy){ .md-button }
+
+    **Downloads**
+    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=com.celzero.bravedns)
+    - [:pg-f-droid: F-Droid](https://f-droid.org/packages/com.celzero.bravedns)
+    - [:fontawesome-brands-github: Source](https://github.com/celzero/rethink-app)
+
+### DNSCloak
+
+!!! recommendation
+
+    ![DNSCloak logo](assets/img/ios/dnscloak.png){ align=right }
+
+    **DNSCloak** is an open-source iOS client supporting [DNS-over-HTTPS](technology/dns.md#dns-over-https-doh), [DNSCrypt](technology/dns.md#dnscrypt), and [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy/wiki) options such as caching DNS responses, locally logging DNS queries, and custom block lists. Users can [add custom resolvers by DNS stamp](https://medium.com/privacyguides/adding-custom-dns-over-https-resolvers-to-dnscloak-20ff5845f4b5).
+
+    [Visit github.com](https://github.com/s-s/dnscloak/blob/master/README.md){ .md-button .md-button--primary } [Privacy Policy](https://drive.google.com/file/d/1050No_pU74CAWUS5-BwQWyO2x_aiMzWc/view){ .md-button }
+
+    **Downloads**
+    - [:fontawesome-brands-app-store-ios: App Store](https://apps.apple.com/app/id1452162351)
+    - [:fontawesome-brands-github: Source](https://github.com/s-s/dnscloak)
+
+### dnscrypt-proxy
+
+!!! recommendation
+
+    ![dnscrypt-proxy logo](assets/img/dns/dnscrypt-proxy.svg){ align=right }
+
+    **dnscrypt-proxy** is a DNS proxy with support for [DNSCrypt](technology/dns.md#dnscrypt), [DNS-over-HTTPS](technology/dns.md#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS).
+
+    [Visit github.com](https://github.com/DNSCrypt/dnscrypt-proxy/wiki){ .md-button .md-button--primary } [Privacy Policy](https://www.libreoffice.org/about-us/privacy/privacy-policy-en/){ .md-button }
+
+    **Downloads**
+    - [:fontawesome-brands-github: Source](https://github.com/DNSCrypt/dnscrypt-proxy)
+
+!!! warning "The anonymized DNS feature does [**not**](technology/dns.md#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic."

docs/dns.md

@@ -1,112 +0,0 @@
----
-title: "DNS Resolvers"
-icon: material/dns
----
-
-!!! faq "Should I use encrypted DNS?"
-
-    Encrypted DNS with third party servers should only be used to get around basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences. Encrypted DNS will not help you hide any of your browsing activity.
-
-    [Learn more about DNS](technology/dns.md){ .md-button }
-
-## Recommended Providers
-
-| DNS Provider | Privacy Policy | Type | Protocols | Logging | ECS | Filtering |
-| ------------ | -------------- | ---- | --------- | ------- | --- | --------- |
-| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Commercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^1] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS)
-| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/) | [:octicons-link-external-24:](https://www.cloudflare.com/privacypolicy) | Commercial | Cleartext <br> DoH <br> DoT | Some[^2] | No | Based on server choice.|
-| [**ControlID**](https://controld.com) | [:octicons-link-external-24:](https://controld.com/privacy) | Commercial | Cleartext <br> DoH <br> DoT | Optional[^3] | No |  Based on server choice.  |
-| [**MullvadDNS**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/privacy-policy/) [^4] | Commercial | DoH <br> DoT | No | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock)
-| [**NextDNS**](https://www.nextdns.io) | [:octicons-link-external-24:](https://www.nextdns.io/privacy) | Commercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Optional[^5] | Optional | Based on server choice. |
-| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/service/privacy) | Non-Profit | Cleartext <br> DoH <br> DoT <br> DNSCrypt | No | Optional |  Based on server choice, Malware blocking by default. |
-
-[^1]: We store aggregated performance metrics of our DNS server, namely the number of complete requests to a particular server, the number of blocked requests, the speed of processing requests. We keep and store the database of domains requested in the last 24 hours. We need this information to identify and block new trackers and threats. We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters.
-[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is only stored for 25 hours.
-[^3]: Neither free nor premium service have logging enabled by default. Premium users can enable logging/analytics at will.
-[^4]: Our public DNS service offers DNS over HTTPS (DoH) and DNS over TLS (DoT), with QNAME minimization and basic ad blocking. It has been audited by the security experts at Assured. You can use this privacy-enhancing service even if you don't use Mullvad.
-[^5]: NextDNS can provide insights and logging features on an opt-in basis. Users can choose retention times and log storage locations for any logs they choose to keep.
-
-The criteria for servers for this table are:
-
-- Must support [DNSSEC](technology/dns.md#what-is-dnssec-and-when-is-it-used)
-- Must have [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support
-- [QNAME Minimization](technology/dns.md#what-is-qname-minimization)
-
-## Native Operating System Support
-
-### Android
-
-Android 9 and above support DNS over TLS. Android 13 will support DNS over HTTPS. The settings can be found in: *Settings* &rarr; *Network & Internet* &rarr; *Private DNS*.
-
-### Apple Devices
-
-The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
-
-After installation of either a configuration profile or an app that utilizes the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
-
-- **iOS/iPadOS:** *Settings &rarr; General &rarr; VPN, DNS, & Device Management &rarr; DNS*
-- **macOS:** *System Preferences &rarr; Profiles* & *System Preferences &rarr; Network*
-- **tvOS:** *Settings &rarr; General &rarr; Privacy &rarr;* hover on "*Share Apple TV Analytics*" &rarr; press the play button on the remote
-
-Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
-
-- **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [ControlD](https://kb.controld.com/en/tutorials), [NextDNS](https://apple.nextdns.io), [Quad9](https://www.quad9.net/news/blog/ios-mobile-provisioning-profiles/).
-
-### Windows
-
-Windows users can [turn on DoH](https://docs.microsoft.com/en-us/windows-server/networking/dns/doh-client-support) by accessing Windows settings in the control panel.
-
-Select *Settings* &rarr; *Network & Internet* &rarr; *Ethernet* or *WiFi*, &rarr; *Edit DNS Settings* &rarr; Preferred DNS encryption &rarr; *Encrypted only (DNS over HTTPS)*.
-
-### Linux
-
-`systemd-resolved` doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639), which many Linux distributions use to do their DNS lookups. If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
-
-## Encrypted DNS Proxies
-
-Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](/dns/#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](/dns/#what-is-encrypted-dns).
-
-### RethinkDNS
-
-!!! recommendation
-
-    ![RethinkDNS logo](/assets/img/android/rethinkdns.svg#only-light){ align=right }
-    ![RethinkDNS logo](/assets/img/android/rethinkdns-dark.svg#only-dark){ align=right }
-
-    **RethinkDNS** is an open-source Android client supporting [DNS-over-HTTPS](/dns/#dns-over-https-doh), [DNS-over-TLS](/dns/#dns-over-tls-dot), [DNSCrypt](/dns/#dnscrypt) and DNS Proxy along with caching DNS responses, locally logging DNS queries and can be used as a firewall too.
-
-    [Visit rethinkdns.com](https://rethinkdns.com){ .md-button .md-button--primary } [Privacy Policy](https://rethinkdns.com/privacy){ .md-button }
-
-    **Downloads**
-    - [:fontawesome-brands-google-play: Google Play](https://play.google.com/store/apps/details?id=com.celzero.bravedns)
-    - [:pg-f-droid: F-Droid](https://f-droid.org/packages/com.celzero.bravedns)
-    - [:fontawesome-brands-github: Source](https://github.com/celzero/rethink-app)
-
-### DNSCloak
-
-!!! recommendation
-
-    ![DNSCloak logo](/assets/img/ios/dnscloak.png){ align=right }
-
-    **DNSCloak** is an open-source iOS client supporting [DNS-over-HTTPS](/dns/#dns-over-https-doh), [DNSCrypt](/dns/#dnscrypt), and [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy/wiki) options such as caching DNS responses, locally logging DNS queries, and custom block lists. Users can [add custom resolvers by DNS stamp](https://medium.com/privacyguides/adding-custom-dns-over-https-resolvers-to-dnscloak-20ff5845f4b5).
-
-    [Visit github.com](https://github.com/s-s/dnscloak/blob/master/README.md){ .md-button .md-button--primary } [Privacy Policy](https://drive.google.com/file/d/1050No_pU74CAWUS5-BwQWyO2x_aiMzWc/view){ .md-button }
-
-    **Downloads**
-    - [:fontawesome-brands-app-store-ios: App Store](https://apps.apple.com/app/id1452162351)
-    - [:fontawesome-brands-github: Source](https://github.com/s-s/dnscloak)
-
-### dnscrypt-proxy
-
-!!! recommendation
-
-    ![dnscrypt-proxy logo](/assets/img/dns/dnscrypt-proxy.svg){ align=right }
-
-    **dnscrypt-proxy** is a DNS proxy with support for [DNSCrypt](/dns/#dnscrypt), [DNS-over-HTTPS](/dns/#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS).
-
-    [Visit github.com](https://github.com/DNSCrypt/dnscrypt-proxy/wiki){ .md-button .md-button--primary } [Privacy Policy](https://www.libreoffice.org/about-us/privacy/privacy-policy-en/){ .md-button }
-
-    **Downloads**
-    - [:fontawesome-brands-github: Source](https://github.com/DNSCrypt/dnscrypt-proxy)
-
-!!! warning "The anonymized DNS feature does [**not**](/dns#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic."

docs/email-clients.en.md

@@ -1,21 +1,21 @@
 ---
-title: Email Clients
+title: "Email Clients"
 icon: material/email-open
 ---
-Our recommendation list contains email clients that support both [OpenPGP](/encryption/#openpgp) and strong authentication such as [Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth). OAuth allows you to use [Multi-Factor Authentication](/multi-factor-authentication) and prevent account theft.
+Our recommendation list contains email clients that support both [OpenPGP](encryption.md#openpgp) and strong authentication such as [Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth). OAuth allows you to use [Multi-Factor Authentication](multi-factor-authentication) and prevent account theft.
 
 ??? Attention "Email does not provide forward secrecy"
-    When using end-to-end encryption (E2EE) technology like [OpenPGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy), email will still have [some metadata](/email/#email-metadata-overview) that is not encrypted in the header of the email.
+    When using end-to-end encryption (E2EE) technology like [OpenPGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy), email will still have [some metadata](email.md#email-metadata-overview) that is not encrypted in the header of the email.
 
-    OpenPGP also does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed: [How do I protect my private keys?](/email/#email-encryption-overview). Consider using a medium that forward secrecy:
+    OpenPGP also does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed: [How do I protect my private keys?](email.md#email-encryption-overview). Consider using a medium that provides forward secrecy:
 
-    [Real-time Communication](/real-time-communication){ .md-button .md-button--primary }
+    [Real-time Communication](real-time-communication.md){ .md-button .md-button--primary }
 
 ### Thunderbird
 
 !!! recommendation
 
-    ![Thunderbird logo](/assets/img/email-clients/thunderbird.svg){ align=right }
+    ![Thunderbird logo](assets/img/email-clients/thunderbird.svg){ align=right }
 
     **Thunderbird** is a free, open source, cross-platform email, newsgroup, news feed, and chat (XMPP, IRC, Twitter) client developed by the Thunderbird community, and previously by the Mozilla Foundation.
 
@@ -32,12 +32,12 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Apple Mail logo](/assets/img/email-clients/applemail.png){ align=right }
+    ![Apple Mail logo](assets/img/email-clients/applemail.png){ align=right }
 
-    **Apple Mail** is included in macOS and can be extended to have OpenPGP support with [GPG Suite](/encryption/#gpg-suite), which adds the ability to send encrypted email.
+    **Apple Mail** is included in macOS and can be extended to have OpenPGP support with [GPG Suite](encryption/#gpg-suite), which adds the ability to send encrypted email.
 
     !!! note
-        For iOS devices we suggest [Canary Mail](/email-clients/#canary-mail) as it has PGP support which means you can send end-to-end encrypted email.
+        For iOS devices we suggest [Canary Mail](#canary-mail) as it has PGP support which means you can send end-to-end encrypted email.
 
     [Visit apple.com](https://support.apple.com/guide/mail/welcome/mac){ .md-button .md-button--primary } [Privacy Policy](https://www.apple.com/legal/privacy/en-ww/){ .md-button }
 
@@ -45,7 +45,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Evolution logo](/assets/img/email-clients/evolution.svg){ align=right }
+    ![Evolution logo](assets/img/email-clients/evolution.svg){ align=right }
 
     **Evolution** is a personal information management application that provides integrated mail, calendaring and address book functionality. Evolution has extensive [documentation](https://help.gnome.org/users/evolution/stable/) to help you get started.
 
@@ -59,7 +59,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Kontact logo](/assets/img/email-clients/kontact.svg){ align=right }
+    ![Kontact logo](assets/img/email-clients/kontact.svg){ align=right }
 
     **Kontact** is a personal information manager (PIM) application from the [KDE](https://kde.org) project. It provides a mail client, address book, organizer and RSS client.
 
@@ -74,7 +74,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Mailvelope logo](/assets/img/email-clients/mailvelope.svg){ align=right }
+    ![Mailvelope logo](assets/img/email-clients/mailvelope.svg){ align=right }
 
     **Mailvelope** is a browser extension that enables the exchange of encrypted emails following the OpenPGP encryption standard.
 
@@ -90,7 +90,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![K-9 Mail logo](/assets/img/email-clients/k9mail.svg){ align=right }
+    ![K-9 Mail logo](assets/img/email-clients/k9mail.svg){ align=right }
 
     **K-9 Mail** is an independent mail application that supports both POP3 and IMAP mailboxes, but only supports push mail for IMAP.
 
@@ -105,7 +105,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![FairEmail logo](/assets/img/email-clients/fairemail.svg){ align=right }
+    ![FairEmail logo](assets/img/email-clients/fairemail.svg){ align=right }
 
     **FairEmail** is a minimal, open source email app, using open standards (IMAP, SMTP, OpenPGP) with a low data and battery usage.
 
@@ -120,7 +120,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Canary Mail logo](/assets/img/email-clients/canarymail.svg){ align=right }
+    ![Canary Mail logo](assets/img/email-clients/canarymail.svg){ align=right }
 
     **Canary Mail** is a paid email client designed to make end-to-end encryption seamless with security features such as a biometric app lock.
 
@@ -142,7 +142,7 @@ Canary Mail is closed source. We recommend it, due to the few choices there are
 
 !!! recommendation
 
-    ![Neomutt logo](/assets/img/email-clients/mutt.svg){ align=right }
+    ![Neomutt logo](assets/img/email-clients/mutt.svg){ align=right }
 
     NeoMutt is an open-source command line mail reader (or MUA) for Linux and BSD. It's a fork of [Mutt](https://en.wikipedia.org/wiki/Mutt_(email_client)) with added features.
     

docs/email.en.md

@@ -1,5 +1,5 @@
 ---
-title: Private Email Providers
+title: "Private Email Providers"
 icon: material/email
 ---
 
@@ -23,11 +23,11 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![ProtonMail logo](/assets/img/email/protonmail.svg){ align=right }
+    ![ProtonMail logo](assets/img/email/protonmail.svg){ align=right }
 
     **ProtonMail** is an email service with a focus on privacy, encryption, security, and ease of use. They have been in operation since **2013**. ProtonMail is based in Genève, Switzerland. Accounts start with 500 MB storage with their free plan.
 
-    Free accounts have some limitations, such as not being able to search body text and not having access to [ProtonMail Bridge](https://protonmail.com/bridge), which is required to use a [recommended desktop email client](/email-clients) (e.g. Thunderbird). Paid accounts are available starting at **€48/y** which include features like ProtonMail Bridge, additional storage, and custom domain support.
+    Free accounts have some limitations, such as not being able to search body text and not having access to [ProtonMail Bridge](https://protonmail.com/bridge), which is required to use a [recommended desktop email client](email-clients.md) (e.g. Thunderbird). Paid accounts are available starting at **€48/y** which include features like ProtonMail Bridge, additional storage, and custom domain support.
 
     **Free**
 
@@ -67,7 +67,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![Mailbox.org logo](/assets/img/email/mailboxorg.svg){ align=right }
+    ![Mailbox.org logo](assets/img/email/mailboxorg.svg){ align=right }
 
     **Mailbox.org** is an email service with a focus on being secure, ad-free, and privately powered by 100% eco-friendly energy. They have been in operation since 2014. Mailbox.org is based in Berlin, Germany. Accounts start with 2 GB of storage, which can be upgraded as needed.
 
@@ -91,7 +91,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
     Mailbox.org allows for encryption of incoming mail using their [encrypted mailbox](https://kb.mailbox.org/display/MBOKBEN/The+Encrypted+Mailbox). New messages that you receive will then be immediately encrypted with your public key.
 
-    However, [Open-Exchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox.org, [does not support](https://kb.mailbox.org/display/BMBOKBEN/Encryption+of+calendar+and+address+book) the encryption of your address book and calendar. A [standalone option](/calendar-contacts) may be more appropriate for that information.
+    However, [Open-Exchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox.org, [does not support](https://kb.mailbox.org/display/BMBOKBEN/Encryption+of+calendar+and+address+book) the encryption of your address book and calendar. A [standalone option](calendar-contacts.md) may be more appropriate for that information.
 
 ??? check "Email Encryption"
 
@@ -111,8 +111,8 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![Disroot logo](/assets/img/email/disroot.svg#only-light){ align=right }
-    ![Disroot logo](/assets/img/email/disroot-dark.svg#only-dark){ align=right }
+    ![Disroot logo](assets/img/email/disroot.svg#only-light){ align=right }
+    ![Disroot logo](assets/img/email/disroot-dark.svg#only-dark){ align=right }
 
     **Disroot** offers email amongst [other services](https://disroot.org/en/#services). The service is maintained by volunteers and its community. They have been in operation since 2015. Disroot is based in Amsterdam. Disroot is free and uses open source software such as Rainloop to provide service. Users support the service through donations and buying extra storage. The mailbox limit is 1 GB, but extra storage can be purchased 0.15€ per GB per month paid yearly.
 
@@ -136,7 +136,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
     Disroot uses full disk encryption. However, it doesn't appear to be "zero access", meaning it is technically possible for them to decrypt the data they have if it is not additionally encrypted with a tool like OpenPGP.
 
-    Disroot also uses the standard [CalDAV](https://en.wikipedia.org/wiki/CalDAV) and [CardDAV](https://en.wikipedia.org/wiki/CardDAV) protocols for calendars and contacts, which do not support E2EE. A [standalone option](/calendar-contacts) may be more appropriate.
+    Disroot also uses the standard [CalDAV](https://en.wikipedia.org/wiki/CalDAV) and [CardDAV](https://en.wikipedia.org/wiki/CardDAV) protocols for calendars and contacts, which do not support E2EE. A [standalone option](calendar-contacts.md) may be more appropriate.
 
 ??? check "Email Encryption"
 
@@ -154,8 +154,8 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![Tutanota logo](/assets/img/email/tutanota.svg#only-light){ align=right }
-    ![Tutanota logo](/assets/img/email/tutanota-dark.svg#only-dark){ align=right }
+    ![Tutanota logo](assets/img/email/tutanota.svg#only-light){ align=right }
+    ![Tutanota logo](assets/img/email/tutanota-dark.svg#only-dark){ align=right }
 
     **[Tutanota.com](https://tutanota.com)** is an email service with a focus on security and privacy through the use of encryption. Tutanota has been in operation since **2011** and is based in Hanover, Germany. Accounts start with 1GB storage with their free plan.
 
@@ -163,7 +163,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
     [Visit Tutanota.com](https://tutanota.com){ .md-button .md-button--primary }
 
-Tutanota [doesn't allow](https://tutanota.com/faq/#imap) the use of third-party [email clients](/email-clients). Tutanota has no plans pull email from [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) using the [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) protocol. [Email import](https://github.com/tutao/tutanota/issues/630) is currently not possible.
+Tutanota [doesn't allow](https://tutanota.com/faq/#imap) the use of third-party [email clients](email-clients.md). Tutanota has no plans pull email from [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) using the [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) protocol. [Email import](https://github.com/tutao/tutanota/issues/630) is currently not possible.
 
 Emails can be exported [individually or by bulk selection](https://tutanota.com/howto#generalMail). Tutanota does not allow for [subfolders](https://github.com/tutao/tutanota/issues/927) as you might expect with other email providers.
 
@@ -205,8 +205,8 @@ Tutanota is working on a [desktop client](https://tutanota.com/blog/posts/deskto
 
 !!! recommendation
 
-    ![StartMail logo](/assets/img/email/startmail.svg#only-light){ align=right }
-    ![StartMail logo](/assets/img/email/startmail-dark.svg#only-dark){ align=right }
+    ![StartMail logo](assets/img/email/startmail.svg#only-light){ align=right }
+    ![StartMail logo](assets/img/email/startmail-dark.svg#only-dark){ align=right }
 
     **StartMail** is an email service with a focus on security and privacy through the use of standard OpenPGP encryption. StartMail has been in operation since 2014 and is based in Boulevard 11, Zeist Netherlands. Accounts start with 10GB. They offer a 30-day trial.
 
@@ -230,7 +230,7 @@ Tutanota is working on a [desktop client](https://tutanota.com/blog/posts/deskto
 
     StartMail has [zero access encryption at rest](https://www.startmail.com/en/whitepaper/#_Toc458527835), using their "user vault" system. When a user logs in, the vault is opened, and the email is then moved to the vault out of the queue where it is decrypted by the corresponding private key.
 
-    StartMail supports importing [contacts](https://support.startmail.com/hc/en-us/articles/360006495557-Import-contacts) however, they are only accessible in the webmail and not through protocols such as [CalDAV](https://en.wikipedia.org/wiki/CalDAV). Contacts are also not stored using zero knowledge encryption, so a [standalone option](/calendar-contacts) may be more appropriate.
+    StartMail supports importing [contacts](https://support.startmail.com/hc/en-us/articles/360006495557-Import-contacts) however, they are only accessible in the webmail and not through protocols such as [CalDAV](https://en.wikipedia.org/wiki/CalDAV). Contacts are also not stored using zero knowledge encryption, so a [standalone option](calendar-contacts.md) may be more appropriate.
 
 ??? check "Email Encryption"
 
@@ -248,8 +248,8 @@ Tutanota is working on a [desktop client](https://tutanota.com/blog/posts/deskto
 
 !!! recommendation
 
-    ![CTemplar Logo](/assets/img/email/ctemplar.svg#only-light){ align=right }
-    ![CTemplar Logo](/assets/img/email/ctemplar-dark.svg#only-dark){ align=right }
+    ![CTemplar Logo](assets/img/email/ctemplar.svg#only-light){ align=right }
+    ![CTemplar Logo](assets/img/email/ctemplar-dark.svg#only-dark){ align=right }
 
     **CTemplar** is an email service with a focus on security and privacy through the use of standard OpenPGP encryption. CTemplar has been in operation since **2018** and is run from Iceland. Paid accounts start with 5GB. They offer free accounts by [invitation](https://ctemplar.com/email-creation-restriction/).
 
@@ -427,7 +427,7 @@ There is another standard that was popular with business called [S/MIME](https:/
 
 ### What software can I use to get E2EE?
 
-Email providers which allow you to use standard access protocols like [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) and [SMTP](https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol) can be used with any of the [email clients we recommend](/email-clients). This can be less secure as you are now relying on email providers to ensure that their encryption implementation works and has not been compromised in anyway.
+Email providers which allow you to use standard access protocols like [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) and [SMTP](https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol) can be used with any of the [email clients we recommend](email-clients.md). This can be less secure as you are now relying on email providers to ensure that their encryption implementation works and has not been compromised in anyway.
 
 ### How do I protect my private keys?
 
@@ -465,14 +465,14 @@ When emails travel between email providers an encrypted connection is negotiated
 
 !!! recommendation
 
-    ![AnonAddy logo](/assets/img/email/anonaddy.svg#only-light){ align=right }
-    ![AnonAddy logo](/assets/img/email/anonaddy-dark.svg#only-dark){ align=right }
+    ![AnonAddy logo](assets/img/email/anonaddy.svg#only-light){ align=right }
+    ![AnonAddy logo](assets/img/email/anonaddy-dark.svg#only-dark){ align=right }
 
     **[AnonAddy](https://anonaddy.com)** lets users create aliases that forward to their email address. Can be self-hosted. [Source code on GitHub](https://github.com/anonaddy/anonaddy). 
 
 !!! recommendation
 
-    ![Simplelogin logo](/assets/img/email/simplelogin.svg){ align=right }
+    ![Simplelogin logo](assets/img/email/simplelogin.svg){ align=right }
 
     **[SimpleLogin](https://simplelogin.io)** allows you to easily create aliases for your email. Can be self-hosted. [Source code on GitHub](https://github.com/simple-login/app).
 
@@ -484,13 +484,13 @@ Advanced users may consider setting up their own email server. Mailservers requi
 
 !!! recommendation
 
-    ![Mail-in-a-Box logo](/assets/img/email/mail-in-a-box.svg){ align=right }
+    ![Mail-in-a-Box logo](assets/img/email/mail-in-a-box.svg){ align=right }
 
     **[Mail-in-a-Box](https://mailinabox.email)** is an automated setup script for deploying a mail server on Ubuntu. Its goal is to make it easier for users to set up their own mail server.
 
 !!! recommendation
 
-    ![Mailcow logo](/assets/img/email/mailcow.svg){ align=right }
+    ![Mailcow logo](assets/img/email/mailcow.svg){ align=right }
 
     **[Mailcow](https://mailcow.email)** is a more advanced mail server perfect for those with a bit more Linux experience. It has everything you need in a Docker container: A mailserver with DKIM support, antivirus and spam monitoring, webmail and ActiveSync with SOGo, and web-based administration with 2FA support. **[Mailcow Dockerized docs](https://mailcow.github.io/mailcow-dockerized-docs/)**
 

docs/encryption.en.md

@@ -1,5 +1,5 @@
 ---
-title: Encryption Software
+title: "Encryption Software"
 icon: material/file-lock
 ---
 Encryption of data is the only way to control who can access it. If you are currently not using encryption software for your hard disk, emails, or files, you should pick an option here.
@@ -12,8 +12,8 @@ The options listed here are multi-platform and great for creating encrypted back
 
 !!! recommendation
 
-    ![VeraCrypt logo](/assets/img/encryption-software/veracrypt.svg#only-light){ align=right }
-    ![VeraCrypt logo](/assets/img/encryption-software/veracrypt-dark.svg#only-dark){ align=right }
+    ![VeraCrypt logo](assets/img/encryption-software/veracrypt.svg#only-light){ align=right }
+    ![VeraCrypt logo](assets/img/encryption-software/veracrypt-dark.svg#only-dark){ align=right }
 
     **VeraCrypt** is a source-available freeware utility used for on-the-fly encryption. It can create a virtual encrypted disk within a file, encrypt a partition, or encrypt the entire storage device with pre-boot authentication.
 
@@ -35,7 +35,7 @@ Truecrypt has been [audited a number of times](https://en.wikipedia.org/wiki/Tru
 
 !!! recommendation
 
-    ![Cryptomator logo](/assets/img/encryption-software/cryptomator.svg){ align=right }
+    ![Cryptomator logo](assets/img/encryption-software/cryptomator.svg){ align=right }
 
     **Cryptomator** makes it easy for you to upload files to the cloud in a virtual encrypted file system.
 
@@ -57,7 +57,7 @@ Some of the Cryptomator Crypto Libraries have been [audited](https://cryptomator
 
 !!! recommendation
 
-    ![Picocrypt logo](/assets/img/encryption-software/picocrypt.svg){ align=right }
+    ![Picocrypt logo](assets/img/encryption-software/picocrypt.svg){ align=right }
 
     **Picocrypt** is a small and simple encryption tool that provides modern encryption. Picocrypt uses the secure XChaCha20 cipher and the Argon2id key derivation function to provide a high level of security. It uses Go's standard x/crypto modules for its encryption features.
 
@@ -77,7 +77,7 @@ Modern operating systems include [disk encryption](https://en.wikipedia.org/wiki
 
 !!! recommendation
 
-    ![BitLocker logo](/assets/img/encryption-software/bitlocker.png){ align=right }
+    ![BitLocker logo](assets/img/encryption-software/bitlocker.png){ align=right }
 
     **BitLocker** is the full volume encryption solution bundled with Microsoft Windows. The main reason we recommend it is because of its [use of TPM](https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/how-windows-uses-the-tpm). [ElcomSoft](https://en.wikipedia.org/wiki/ElcomSoft), a forensics company, has written about it in [Understanding BitLocker TPM Protection](https://blog.elcomsoft.com/2021/01/understanding-BitLocker-tpm-protection/).
 
@@ -122,7 +122,7 @@ BitLocker is [only supported](https://support.microsoft.com/en-us/windows/turn-o
 
 !!! recommendation
 
-    ![FileVault logo](/assets/img/encryption-software/filevault.png){ align=right }
+    ![FileVault logo](assets/img/encryption-software/filevault.png){ align=right }
 
     **FileVault** is the on-the-fly volume encryption solution built into macOS. FileVault is recommended because it [leverages](https://support.apple.com/guide/security/volume-encryption-with-filevault-sec4c6dc1b6e/web) hardware security capabilities present on an Apple silicon SoC or T2 Security Chip.
 
@@ -134,7 +134,7 @@ We recommend storing a local recovery key in a secure place as opposed to utiliz
 
 !!! recommendation
 
-    ![LUKS logo](/assets/img/encryption-software/luks.png){ align=right }
+    ![LUKS logo](assets/img/encryption-software/luks.png){ align=right }
 
     **LUKS** is the default full disk encryption method for Linux. It can be used to encrypt full volumes, partitions, or create encrypted containers.
 
@@ -170,8 +170,8 @@ Browser-based encryption can be useful when you need to encrypt a file but canno
 
 !!! recommendation
 
-    ![hat.sh logo](/assets/img/encryption-software/hat-sh.png#only-light){ align=right }
-    ![hat.sh logo](/assets/img/encryption-software/hat-sh-dark.png#only-dark){ align=right }
+    ![hat.sh logo](assets/img/encryption-software/hat-sh.png#only-light){ align=right }
+    ![hat.sh logo](assets/img/encryption-software/hat-sh-dark.png#only-dark){ align=right }
 
     **Hat.sh** is a web application that provides secure client-side file encryption in your browser. It can also be self-hosted and is useful if you need to encrypt a file but cannot install any software on your device due to organizational policies.
 
@@ -188,7 +188,7 @@ Tools with command-line interfaces are useful for intergrating [shell scripts](h
 
 !!! recommendation
 
-    ![Kryptor logo](/assets/img/encryption-software/kryptor.png){ align=right }
+    ![Kryptor logo](assets/img/encryption-software/kryptor.png){ align=right }
 
     **Kryptor** is a free and open source file encryption and signing tool that makes use of modern and secure cryptographic algorithms. It aims to be a better version of [age](https://github.com/FiloSottile/age) and [Minisign](https://jedisct1.github.io/minisign/) to provide a simple, user friendly alternative to GPG.
 
@@ -204,7 +204,7 @@ Tools with command-line interfaces are useful for intergrating [shell scripts](h
 
 !!! recommendation
 
-    ![Tomb logo](/assets/img/encryption-software/tomb.png){ align=right }
+    ![Tomb logo](assets/img/encryption-software/tomb.png){ align=right }
 
     **Tomb** is an is a command-line shell wrapper for LUKS. It supports steganography via [third-party tools](https://github.com/dyne/Tomb#how-does-it-work).
 
@@ -231,7 +231,7 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! recommendation
 
-    ![GNU Privacy Guard logo](/assets/img/encryption-software/gnupg.svg){ align=right }
+    ![GNU Privacy Guard logo](assets/img/encryption-software/gnupg.svg){ align=right }
 
     **GnuPG** is a GPL-licensed alternative to the PGP suite of cryptographic software. GnuPG is compliant with [RFC 4880](https://tools.ietf.org/html/rfc4880), which is the current IETF specification of OpenPGP. The GnuPG project has been working on an [updated draft](https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/) in an attempt to modernize OpenPGP. GnuPG is a part of the Free Software Foundation's GNU software project and has received major [funding](https://gnupg.org/blog/20220102-a-new-future-for-gnupg.html) from the German government.
 
@@ -248,7 +248,7 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! recommendation
 
-    ![GPG4win logo](/assets/img/encryption-software/gpg4win.svg){ align=right }
+    ![GPG4win logo](assets/img/encryption-software/gpg4win.svg){ align=right }
 
     **GPG4win** is a package for Windows from [Intevation and g10 Code](https://gpg4win.org/impressum.html). It includes [various tools](https://gpg4win.org/about.html) that assist PGP users on Microsoft Windows. The project was initiated and originally [funded by](https://web.archive.org/web/20190425125223/https://joinup.ec.europa.eu/news/government-used-cryptography) Germany's Federal Office for Information Security (BSI) in 2005.
 
@@ -262,9 +262,9 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! recommendation
 
-    ![GPG Suite logo](/assets/img/encryption-software/gpgsuite.png){ align=right }
+    ![GPG Suite logo](assets/img/encryption-software/gpgsuite.png){ align=right }
 
-    **GPG Suite** provides OpenPGP support for [Apple Mail](/email-clients/#apple-mail) and macOS. GPGTools GmbH costs $24€ yearly for their support plan and includes a 30-day trial.
+    **GPG Suite** provides OpenPGP support for [Apple Mail](email-clients.md#apple-mail) and macOS. GPGTools GmbH costs $24€ yearly for their support plan and includes a 30-day trial.
 
     We recommend taking a look at their [First steps](https://gpgtools.tenderapp.com/kb/how-to/first-steps-where-do-i-start-where-do-i-begin-setup-gpgtools-create-a-new-key-your-first-encrypted-email) and [Knowledge base](https://gpgtools.tenderapp.com/kb) for support.
 
@@ -276,15 +276,15 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! note
 
-    We suggest [Canary Mail](/email-clients/#canary-mail) for using PGP with email on iOS devices.
+    We suggest [Canary Mail](email-clients/#canary-mail) for using PGP with email on iOS devices.
 
 ### OpenKeychain
 
 !!! recommendation
 
-    ![OpenKeychain logo](/assets/img/encryption-software/openkeychain.svg){ align=right }
+    ![OpenKeychain logo](assets/img/encryption-software/openkeychain.svg){ align=right }
 
-    **OpenKeychain** is an Android implementation of GnuPG. It's commonly required by mail clients such as [K-9 Mail](/email-clients/#k-9-mail) and [FairEmail](/email-clients/#fairemail) and other Android apps to provide encryption support. Cure53 completed a [security audit](https://www.openkeychain.org/openkeychain-3-6) of OpenKeychain 3.6 in October 2015. Technical details about the audit and OpenKeychain's solutions can be found [here](https://github.com/open-keychain/open-keychain/wiki/cure53-Security-Audit-2015).
+    **OpenKeychain** is an Android implementation of GnuPG. It's commonly required by mail clients such as [K-9 Mail](email-clients.md#k-9-mail) and [FairEmail](email-clients.md#fairemail) and other Android apps to provide encryption support. Cure53 completed a [security audit](https://www.openkeychain.org/openkeychain-3-6) of OpenKeychain 3.6 in October 2015. Technical details about the audit and OpenKeychain's solutions can be found [here](https://github.com/open-keychain/open-keychain/wiki/cure53-Security-Audit-2015).
 
     [Visit openkeychain.org](https://www.openkeychain.org){ .md-button .md-button--primary } [Privacy Policy](https://www.openkeychain.org/help/privacy-policy){ .md-button }
 

docs/file-sharing.en.md

@@ -1,5 +1,5 @@
 ---
-title: File Sharing and Sync
+title: "File Sharing and Sync"
 icon: material/share-variant
 ---
 Discover how to privately share your files between your devices, with your friends and family, or anonymously online.
@@ -10,7 +10,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![OnionShare logo](/assets/img/file-sharing-sync/onionshare.svg){ align=right }
+    ![OnionShare logo](assets/img/file-sharing-sync/onionshare.svg){ align=right }
 
     **OnionShare** is an open-source tool that lets you securely and anonymously share a file of any size. It works by starting a web server accessible as a Tor onion service, with an unguessable URL that you can share with the recipients to download or send files.
 
@@ -26,7 +26,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![Magic Wormhole logo](/assets/img/file-sharing-sync/magic_wormhole.png){ align=right }
+    ![Magic Wormhole logo](assets/img/file-sharing-sync/magic_wormhole.png){ align=right }
 
     Magic Wormhole is a package that provides a library and a command-line tool named wormhole, which makes it possible to get arbitrary-sized files and directories (or short pieces of text) from one computer to another. Their motto: "Get things from one computer to another, safely.
 
@@ -42,7 +42,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![FreedomBox logo](/assets/img/file-sharing-sync/freedombox.svg){ align=right }
+    ![FreedomBox logo](assets/img/file-sharing-sync/freedombox.svg){ align=right }
 
     **FreedomBox** is a operating system designed to be run on a [single-board computer (SBC)](https://en.wikipedia.org/wiki/Single-board_computer). The purpose is to make it easy to set up server applications that you might want to selfhost.
 
@@ -57,7 +57,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![Syncthing logo](/assets/img/file-sharing-sync/syncthing.svg){ align=right }
+    ![Syncthing logo](assets/img/file-sharing-sync/syncthing.svg){ align=right }
 
     **Syncthing** replaces proprietary sync and cloud services with something open, trustworthy, and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third-party, and how it is transmitted over the Internet.
 
@@ -73,7 +73,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![git-annex logo](/assets/img/file-sharing-sync/gitannex.svg){ align=right }
+    ![git-annex logo](assets/img/file-sharing-sync/gitannex.svg){ align=right }
 
     **git-annex** allows managing files with git, without checking the file contents into git. While that may seem paradoxical, it is useful when dealing with files larger than git can currently easily handle, whether due to limitations in memory, time, or disk space.
 

docs/index.en.md

@@ -1,5 +1,5 @@
 ---
-template: overrides/home.html
+template: overrides/home.en.html
 hide:
   - navigation
   - toc
@@ -47,5 +47,5 @@ It's important for a website like Privacy Guides to always stay up-to-date. We n
 
 **Privacy Guides** is a non-profit, socially motivated website that provides information for protecting your data security and privacy.
 
-We do not make money from recommending certain products, and we do not utilize affiliate links. [Learn more...](about.md)
+We do not make money from recommending certain products, and we do not utilize affiliate links. [Learn more :material-arrow-right:](about.md)
 </div>

docs/linux-desktop.en.md

@@ -1,5 +1,5 @@
 ---
-title: Linux
+title: "Linux"
 icon: fontawesome/brands/linux
 ---
 Linux distributions are commonly recommended for privacy protection and user freedom. Below are some suggestions with some general privacy and security improvements.
@@ -10,7 +10,7 @@ Linux distributions are commonly recommended for privacy protection and user fre
 
 !!! recommendation
 
-    ![Fedora logo](/assets/img/linux-desktop/fedora-workstation.svg){ align=right }
+    ![Fedora logo](assets/img/linux-desktop/fedora-workstation.svg){ align=right }
 
     **Fedora Workstation** is our recommended distribution for users new to Linux. Fedora generally adopts newer technologies before other distributions e.g., [Wayland](https://wayland.freedesktop.org/), [PipeWire](https://pipewire.org), and soon, [FS-Verity](https://fedoraproject.org/wiki/Changes/FsVerityRPM). These new technologies often come with improvements in security, privacy, and usability in general.
 
@@ -22,7 +22,7 @@ Fedora has a semi-[rolling release](https://en.wikipedia.org/wiki/Rolling_releas
 
 !!! recommendation
 
-    ![openSUSE Tumbleweed logo](/assets/img/linux-desktop/opensuse-tumbleweed.svg){ align=right }
+    ![openSUSE Tumbleweed logo](assets/img/linux-desktop/opensuse-tumbleweed.svg){ align=right }
 
     **openSUSE Tumbleweed** is a stable [rolling release](https://en.wikipedia.org/wiki/Rolling_release) distribution.
 
@@ -30,13 +30,13 @@ Fedora has a semi-[rolling release](https://en.wikipedia.org/wiki/Rolling_releas
 
     [Visit get.opensuse.org](https://get.opensuse.org/tumbleweed/){ .md-button .md-button--primary }
 
-Tumbleweed follows a rolling release model where each update is released as a snapshot of the distribution. When the user upgrades their system, a new snapshot is downloaded. Each snapshot is run through a series of automated tests by the [openSUSE Build Service](https://build.opensuse.org) to ensure its quality.
+Tumbleweed follows a rolling release model where each update is released as a snapshot of the distribution. When the user upgrades their system, a new snapshot is downloaded. Each snapshot is run through a series of automated tests by [openQA](https://openqa.opensuse.org) to ensure its quality.
 
 ### Arch Linux
 
 !!! recommendation
 
-    ![Arch logo](/assets/img/linux-desktop/archlinux.svg){ align=right }
+    ![Arch logo](assets/img/linux-desktop/archlinux.svg){ align=right }
 
     **Arch Linux** is a lightweight, do-it-yourself (DIY) distribution meaning that you only get what you install. For more information see their [FAQ](https://wiki.archlinux.org/title/Frequently_asked_questions).
 
@@ -44,7 +44,7 @@ Tumbleweed follows a rolling release model where each update is released as a sn
 
 Arch Linux has a rolling release cycle. There is no fixed release schedule and packages are updated very frequently.
 
-Being a DIY distribution, the user is [expected to setup and maintain](/linux-desktop/#arch-based-distributions) their system. Arch has an [official installer](https://wiki.archlinux.org/title/Archinstall) to make the installation process a little easier.
+Being a DIY distribution, the user is [expected to setup and maintain](#arch-based-distributions) their system. Arch has an [official installer](https://wiki.archlinux.org/title/Archinstall) to make the installation process a little easier.
 
 A large portion of [Arch Linux’s packages](https://reproducible.archlinux.org) are [reproducible](https://reproducible-builds.org).
 
@@ -54,7 +54,7 @@ A large portion of [Arch Linux’s packages](https://reproducible.archlinux.org)
 
 !!! recommendation
 
-    ![Fedora Silverblue logo](/assets/img/linux-desktop/fedora-silverblue.svg){ align=right }
+    ![Fedora Silverblue logo](assets/img/linux-desktop/fedora-silverblue.svg){ align=right }
 
     **Fedora Silverblue** and **Fedora Kinoite** are immutable variants of Fedora with a strong focus on container workflows. Silverblue comes with the [GNOME](https://www.gnome.org/) desktop environment while Kinoite comes with [KDE](https://kde.org/). Silverblue and Kinoite follow the same release schedule as Fedora Workstation, benefiting from the same fast updates and staying very close to upstream.
 
@@ -64,7 +64,7 @@ Silverblue (and Kinoite) differ from Fedora Workstation as they replace the [DNF
 
 After the update is complete the user will reboot the system into the new deployment. `rpm-ostree` keeps two deployments of the system so that a user can easily rollback if something breaks in the new deployment. There is also the option to pin more deployments as needed.
 
-[Flatpak](https://www.flatpak.org) is the primary package installation method on these distrbutions, as `rpm-ostree` is only meant to overlay packages that cannot stay inside of a container on top of the base image.
+[Flatpak](https://www.flatpak.org) is the primary package installation method on these distributions, as `rpm-ostree` is only meant to overlay packages that cannot stay inside of a container on top of the base image.
 
 As an alternative to Flatpaks, there is the option of [Toolbox](https://docs.fedoraproject.org/en-US/fedora-silverblue/toolbox/) to create [Podman](https://podman.io) containers with a shared home directory with the host operating system and mimic a traditional Fedora environment, which is a [useful feature](https://containertoolbx.org) for the discerning developer.
 
@@ -72,7 +72,7 @@ As an alternative to Flatpaks, there is the option of [Toolbox](https://docs.fed
 
 !!! recommendation
 
-    ![NixOS logo](/assets/img/linux-desktop/nixos.svg){ align=right }
+    ![NixOS logo](assets/img/linux-desktop/nixos.svg){ align=right }
 
     NixOS is an independent distribution based on the Nix package manager with a focus on reproducibility and reliability.
 
@@ -84,7 +84,7 @@ NixOS also provides atomic updates; first it downloads (or builds) the packages
 
 Nix the package manager uses a purely functional language - which is also called Nix - to define packages.
 
-[Nixpkgs](https://github.com/nixos/nixpkgs) (the main source of packages) are contained in a single Github repository. You can also define your own packages in the same language and then easily include them in your config.
+[Nixpkgs](https://github.com/nixos/nixpkgs) (the main source of packages) are contained in a single GitHub repository. You can also define your own packages in the same language and then easily include them in your config.
 
 Nix is a source-based package manager; if there’s no pre-built available in the binary cache, Nix will just build the package from source using its definition. It builds each package in a sandboxed *pure* environment, which is as independent of the host system as possible, thus making binaries reproducible.
 
@@ -94,7 +94,7 @@ Nix is a source-based package manager; if there’s no pre-built available in th
 
 !!! recommendation
 
-    ![Whonix logo](/assets/img/linux-desktop/whonix.svg){ align=right }
+    ![Whonix logo](assets/img/linux-desktop/whonix.svg){ align=right }
 
     **Whonix** is based on [Kicksecure](https://www.whonix.org/wiki/Kicksecure), a security-focused fork of Debian. It aims to provide privacy, security, and anonymity on the internet.
 
@@ -104,7 +104,7 @@ Whonix is meant to run as two virtual machines: a “Workstation” and a Tor
 
 Some of its features include Tor Stream Isolation, [keystroke anonymization](https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak), [encrypted swap](https://github.com/Whonix/swap-file-creator), and a hardened memory allocator.
 
-Future versions of Whonix will likely include [full system Apparmor policies](https://github.com/Whonix/apparmor-profile-everything) and a [sandbox app launcher](https://www.whonix.org/wiki/Sandbox-app-launcher) to fully confine all processes on the system.
+Future versions of Whonix will likely include [full system AppArmor policies](https://github.com/Whonix/apparmor-profile-everything) and a [sandbox app launcher](https://www.whonix.org/wiki/Sandbox-app-launcher) to fully confine all processes on the system.
 
 Whonix is best used [in conjunction with Qubes](https://www.whonix.org/wiki/Qubes/Why_use_Qubes_over_other_Virtualizers).
 
@@ -112,11 +112,11 @@ Whonix is best used [in conjunction with Qubes](https://www.whonix.org/wiki/Qube
 
 !!! recommendation
 
-    ![Tails logo](/assets/img/linux-desktop/tails.svg){ align=right }
+    ![Tails logo](assets/img/linux-desktop/tails.svg){ align=right }
 
     **Tails** is a live operating system based on Debian that routes all communications through Tor.
 
-    It can boot on almost any computer from a DVD, USB stick, or sdcard. It aims to preserve privacy and anonymity while circumventing censorship and leaving no trace of itself on the computer it is used on.
+    It can boot on almost any computer from a DVD, USB stick, or SD card. It aims to preserve privacy and anonymity while circumventing censorship and leaving no trace of itself on the computer it is used on.
 
     [Visit tails.boum.org](https://tails.boum.org/){ .md-button .md-button--primary }
 
@@ -215,7 +215,7 @@ We recommend using a desktop environment that supports the [Wayland](https://en.
 
 Fortunately, common environments such as [GNOME](https://www.gnome.org), [KDE](https://kde.org), and the window manager [Sway](https://swaywm.org) have support for Wayland. Some distributions like Fedora and Tumbleweed use it by default and some others may do so in the future as X11 is in [hard maintenance mode](https://www.phoronix.com/scan.php?page=news_item&px=X.Org-Maintenance-Mode-Quickly). If you’re using one of those environments it is as easy as selecting the “Wayland” session at the desktop display manager ([GDM](https://en.wikipedia.org/wiki/GNOME_Display_Manager), [SDDM](https://en.wikipedia.org/wiki/Simple_Desktop_Display_Manager)).
 
-We recommend **against** using desktop environments or window managers that do not have Wayland support such as Cinnamon (default on Linux Mint), Pantheon (default on Elementary OS), MATE, XFCE, and i3.
+We recommend **against** using desktop environments or window managers that do not have Wayland support such as Cinnamon (default on Linux Mint), Pantheon (default on Elementary OS), MATE, Xfce, and i3.
 
 ### Proprietary firmware (microcode updates)
 
@@ -239,7 +239,7 @@ There isn’t much point in randomizing the MAC address for Ethernet connections
 
 ### Other identifiers
 
-There are other system [identifiers](https://madaidans-insecurities.github.io/guides/linux-hardening.html#identifiers) which you may wish to be careful about. You should give this some thought to see if it applies to your [threat model](/threat-modeling):
+There are other system [identifiers](https://madaidans-insecurities.github.io/guides/linux-hardening.html#identifiers) which you may wish to be careful about. You should give this some thought to see if it applies to your [threat model](threat-modeling.md):
 
 - [10.1 Hostnames and usernames](https://madaidans-insecurities.github.io/guides/linux-hardening.html#hostnames)
 - [10.2 Time zones / Locales / Keymaps](https://madaidans-insecurities.github.io/guides/linux-hardening.html#timezones-locales-keymaps)
@@ -314,7 +314,7 @@ Red Hat develops [Podman](https://docs.podman.io/en/latest/) and secures it with
 
 Another option is [Kata containers](https://katacontainers.io/), where virtual machines masquerade as containers. Each Kata container has its own Linux kernel and is isolated from the host.
 
-These container technologies can be useful even for enthusiastic home users who may want to run certain web app software on their local area network (LAN) such as [vaultwarden](https://github.com/dani-garcia/vaultwarden) or images provided by [linuxserver.io](https://www.linuxserver.io) to increase privacy by decreasing dependence on various web services.
+These container technologies can be useful even for enthusiastic home users who may want to run certain web app software on their local area network (LAN) such as [Vaultwarden](https://github.com/dani-garcia/vaultwarden) or images provided by [linuxserver.io](https://www.linuxserver.io) to increase privacy by decreasing dependence on various web services.
 
 ## Additional hardening
 
@@ -346,7 +346,7 @@ Note that setting `kernel.unprivileged_userns_clone=0` will stop Flatpak, Snap (
 
 ### Linux-Hardened
 
-Some distributions like Arch Linux have the [linux-hardened](https://github.com/anthraxx/linux-hardened), kernel package. It includes [hardening patches](https://wiki.archlinux.org/title/security#Kernel_hardening) and more security-conscious defaults. Linux-Hardened has `kernel.unprivileged_userns_clone=0` disabled by default. See the [warning above](/linux-desktop/#kernel-hardening) about how this might impact you.
+Some distributions like Arch Linux have the [linux-hardened](https://github.com/anthraxx/linux-hardened), kernel package. It includes [hardening patches](https://wiki.archlinux.org/title/security#Kernel_hardening) and more security-conscious defaults. Linux-Hardened has `kernel.unprivileged_userns_clone=0` disabled by default. See the [warning above](#kernel-hardening) about how this might impact you.
 
 ### Simultaneous multithreading (SMT)
 
@@ -382,7 +382,7 @@ On systems where [`pam_faillock`](https://man7.org/linux/man-pages/man8/pam_tall
 
 To better protect your [USB](https://en.wikipedia.org/wiki/USB) ports from attacks such as [BadUSB](https://en.wikipedia.org/wiki/BadUSB) we recommend [USBGuard](https://github.com/USBGuard/usbguard). USBGuard has [documentation](https://github.com/USBGuard/usbguard#documentation) as does the [Arch Wiki](https://wiki.archlinux.org/title/USBGuard).
 
-Another alternative option if you’re using the [linux-hardened](/linux-desktop/#linux-hardened) is the [`deny_new_usb`](https://github.com/GrapheneOS/linux-hardened/commit/96dc427ab60d28129b36362e1577b6673b0ba5c4) sysctl. See [Preventing USB Attacks with `linux-hardened`](https://blog.lizzie.io/preventing-usb-attacks-with-linux-hardened.html).
+Another alternative option if you’re using the [linux-hardened](#linux-hardened) is the [`deny_new_usb`](https://github.com/GrapheneOS/linux-hardened/commit/96dc427ab60d28129b36362e1577b6673b0ba5c4) sysctl. See [Preventing USB Attacks with `linux-hardened`](https://blog.lizzie.io/preventing-usb-attacks-with-linux-hardened.html).
 
 ### Secure Boot
 

docs/metadata-removal-tools.en.md

@@ -1,5 +1,5 @@
 ---
-title: Metadata Removal Tools
+title: "Metadata Removal Tools"
 icon: material/tag-remove
 ---
 When sharing files, be sure to remove associated metadata. Image files commonly include [EXIF](https://en.wikipedia.org/wiki/Exif) data. Photos sometimes even include [GPS](https://en.wikipedia.org/wiki/Global_Positioning_System) coordinates in the file metadata.
@@ -10,7 +10,7 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![MAT2 logo](/assets/img/metadata-removal/mat2.svg){ align=right }
+    ![MAT2 logo](assets/img/metadata-removal/mat2.svg){ align=right }
 
     **MAT2** is free software, which allows the metadata to be removed from image, audio, torrent, and document file types. It provides both a command line tool and a graphical user interface via an [extension for Nautilus](https://0xacab.org/jvoisin/mat2/-/tree/master/nautilus), the default file manager of [GNOME](https://www.gnome.org), and [Dolphin](https://0xacab.org/jvoisin/mat2/-/tree/master/dolphin), the default file manager of [KDE](https://kde.org).
 
@@ -29,9 +29,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![ExifCleaner logo](/assets/img/metadata-removal/exifcleaner.svg){ align=right }
+    ![ExifCleaner logo](assets/img/metadata-removal/exifcleaner.svg){ align=right }
 
-    **ExifCleaner** is a freeware, open source graphical app that uses [ExifTool](https://exiftool.org) to remove [EXIF](https://en.wikipedia.org/wiki/Exif) metadata from images, videos, and PDF documents using a simple drag and drop interface. It supports multi-core batch processing and dark mode.
+    **ExifCleaner** is a freeware, open source graphical app that uses [ExifTool](https://exiftool.org) to remove EXIF metadata from images, videos, and PDF documents using a simple drag and drop interface. It supports multi-core batch processing and dark mode.
 
     [Visit exifcleaner.com](https://exifcleaner.com){ .md-button .md-button--primary }
 
@@ -47,9 +47,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![Scrambled Exif logo](/assets/img/metadata-removal/scrambled-exif.svg){ align=right }
+    ![Scrambled Exif logo](assets/img/metadata-removal/scrambled-exif.svg){ align=right }
 
-    **Scrambled Exif** is a metadata removal tool for Android. It can remove [EXIF](https://en.wikipedia.org/wiki/Exif) data for many file formats and has been translated into [many](https://gitlab.com/juanitobananas/scrambled-exif/-/tree/master/app/src/main/res) languages.
+    **Scrambled Exif** is a metadata removal tool for Android. It can remove EXIF data for many file formats and has been translated into [many](https://gitlab.com/juanitobananas/scrambled-exif/-/tree/master/app/src/main/res) languages.
 
     [Visit gitlab.com](https://gitlab.com/juanitobananas/scrambled-exif){ .md-button .md-button--primary }
 
@@ -66,9 +66,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![Imagepipe logo](/assets/img/metadata-removal/imagepipe.svg){ align=right }
+    ![Imagepipe logo](assets/img/metadata-removal/imagepipe.svg){ align=right }
 
-    **Imagepipe** is a a paint app for Android that can be used to redact photos and also delete [EXIF](https://en.wikipedia.org/wiki/Exif) metadata. It has been translated into [many](https://codeberg.org/Starfish/Imagepipe#translations) languages.
+    **Imagepipe** is a a paint app for Android that can be used to redact photos and also delete EXIF metadata. It has been translated into [many](https://codeberg.org/Starfish/Imagepipe#translations) languages.
 
     [Visit codeberg.org](https://codeberg.org/Starfish/Imagepipe){ .md-button .md-button--primary }
 
@@ -84,7 +84,7 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![Metapho logo](/assets/img/metadata-removal/metapho.jpg){ align=right }
+    ![Metapho logo](assets/img/metadata-removal/metapho.jpg){ align=right }
 
     Metapho is a simple and clean viewer for photo metadata such as date, file name, size, camera model, shutter speed, and location.
 
@@ -99,9 +99,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![ExifTool logo](/assets/img/metadata-removal/exiftool.png){ align=right }
+    ![ExifTool logo](assets/img/metadata-removal/exiftool.png){ align=right }
 
-    **ExifTool** is the [original](https://en.wikipedia.org/wiki/ExifTool) perl library and command-line application for reading, writing, and editing meta information (EXIF, IPTC, XMP, and more) in a wide variety of file formats (JPEG, TIFF, PNG, PDF, RAW, and more).
+    **ExifTool** is the original perl library and command-line application for reading, writing, and editing meta information (EXIF, IPTC, XMP, and more) in a wide variety of file formats (JPEG, TIFF, PNG, PDF, RAW, and more).
 
     It's often a component of other EXIF removal applications and is in most Linux distribution repositories.
 

docs/multi-factor-authentication.en.md

@@ -1,5 +1,5 @@
 ---
-title: Multi-Factor Authenticator Recommendations
+title: "Multi-Factor Authenticators"
 icon: 'material/two-factor-authentication'
 ---
 ## Hardware Security Keys
@@ -8,9 +8,9 @@ icon: 'material/two-factor-authentication'
 
 !!! recommendation
 
-    ![YubiKeys](/assets/img/multi-factor-authentication/yubikey.png)
+    ![YubiKeys](assets/img/multi-factor-authentication/yubikey.png)
 
-    The **YubiKeys** are among the most popular security keys. Some YubiKey models have a wide range of features such as: [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 WebAuthn](https://en.wikipedia.org/wiki/WebAuthn), [Yubico OTP](https://developers.yubico.com/OTP/), [PIV](https://en.wikipedia.org/wiki/FIPS_201), [OpenPGP](https://developers.yubico.com/PGP/), [TOTP and HOTP](https://developers.yubico.com/OATH/) authentication.
+    The **YubiKeys** are among the most popular security keys. Some YubiKey models have a wide range of features such as: [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](security/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](security/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP/), [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
 
     One of the benefits of the YubiKey is that one key can do almost everything (YubiKey 5), you could expect from a hardware security key. We do encourage you to take the [quiz](https://www.yubico.com/quiz/) before purchasing in order to make sure you make the right choice.
 
@@ -29,9 +29,9 @@ For models which support HOTP and TOTP, there are 2 slots in the OTP interface w
 
 !!! recommendation
 
-    ![Nitrokey](/assets/img/multi-factor-authentication/nitrokey.jpg){ align=right }
+    ![Nitrokey](assets/img/multi-factor-authentication/nitrokey.jpg){ align=right }
 
-    **Nitrokey** has a security key capable of [FIDO2 WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) called the **Nitrokey FIDO2**. For PGP support, you need to purchase one of their other keys such as the **Nitrokey Start**, **Nitrokey Pro 2** or the **Nitrokey Storage 2**.
+    **Nitrokey** has a security key capable of [FIDO2 and WebAuthn](security/multi-factor-authentication.md#fido-fast-identity-online) called the **Nitrokey FIDO2**. For PGP support, you need to purchase one of their other keys such as the **Nitrokey Start**, **Nitrokey Pro 2** or the **Nitrokey Storage 2**.
 
     [Visit nitrokey.com](https://www.nitrokey.com){ .md-button .md-button--primary } [Privacy Policy](https://www.nitrokey.com/data-privacy-policy){ .md-button }
 
@@ -67,7 +67,7 @@ We highly recommend that you use mobile TOTP apps instead of desktop alternative
 
 !!! recommendation
 
-    ![Aegis logo](/assets/img/multi-factor-authentication/aegis.png){ align=right }
+    ![Aegis logo](assets/img/multi-factor-authentication/aegis.png){ align=right }
 
     **Aegis Authenticator** is a free, secure and open source app to manage your 2-step verification tokens for your online services.
 
@@ -82,7 +82,7 @@ We highly recommend that you use mobile TOTP apps instead of desktop alternative
 
 !!! recommendation
 
-    ![Raivo OTP logo](/assets/img/multi-factor-authentication/raivo-otp.png){ align=right }
+    ![Raivo OTP logo](assets/img/multi-factor-authentication/raivo-otp.png){ align=right }
 
     **Raivo OTP** is a native, lightweight and secure time-based (TOTP) & counter-based (HOTP) password client for iOS. Raivo OTP offers optional iCloud backup & sync. Raivo OTP is also available for macOS in the form of a status bar application, however the Mac app does not work independently of the iOS app.
 

docs/news-aggregators.en.md

@@ -1,5 +1,5 @@
 ---
-title: News Aggregators
+title: "News Aggregators"
 icon: octicons/rss-24
 ---
 
@@ -11,9 +11,9 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Fluent Reader logo](/assets/img/news-aggregators/fluent-reader.svg){ align=right }
+    ![Fluent Reader logo](assets/img/news-aggregators/fluent-reader.svg){ align=right }
 
-    **Fluent Reader** is a secure cross-platform news aggregator that has useful privacy features such as deletion of cookies on exit, strict [content security policies (CSP)](https://en.wikipedia.org/wiki/Content_Security_Policy) and proxy support, meaning you can use it over [Tor](/self-contained-networks/#tor).
+    **Fluent Reader** is a secure cross-platform news aggregator that has useful privacy features such as deletion of cookies on exit, strict [content security policies (CSP)](https://en.wikipedia.org/wiki/Content_Security_Policy) and proxy support, meaning you can use it over [Tor](self-contained-networks.md#tor).
 
     [Visit hyliu.me](https://hyliu.me/fluent-reader){ .md-button .md-button--primary } [Privacy Policy](https://github.com/yang991178/fluent-reader/wiki/Privacy){ .md-button }
 
@@ -26,7 +26,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![GNOME Feeds logo](/assets/img/news-aggregators/gfeeds.svg){ align=right }
+    ![GNOME Feeds logo](assets/img/news-aggregators/gfeeds.svg){ align=right }
 
     **GNOME Feeds** is an [RSS](https://en.wikipedia.org/wiki/RSS) and [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)) news reader for [GNOME](https://www.gnome.org). It has a simple interface and is quite fast.
 
@@ -41,7 +41,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Akregator logo](/assets/img/news-aggregators/akregator.svg){ align=right }
+    ![Akregator logo](assets/img/news-aggregators/akregator.svg){ align=right }
 
     **Akregator** is a news feed reader that is a part of the [KDE](https://kde.org) project. It comes with a fast search, advanced archiving functionality and an internal browser for easy news reading.
 
@@ -55,7 +55,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Handy News Reader logo](/assets/img/news-aggregators/handy-news-reader.svg){ align=right }
+    ![Handy News Reader logo](assets/img/news-aggregators/handy-news-reader.svg){ align=right }
 
     **Handy News Reader** is a fork of [Flym](https://github.com/FredJul/Flym) that has many [features](https://github.com/yanus171/Handy-News-Reader#features) and works well with folders of RSS feeds. It supports [RSS](https://en.wikipedia.org/wiki/RSS), [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)) and [RDF](https://en.wikipedia.org/wiki/RDF%2FXML).
 
@@ -70,7 +70,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![NetNewsWire logo](/assets/img/news-aggregators/netnewswire.png){ align=right }
+    ![NetNewsWire logo](assets/img/news-aggregators/netnewswire.png){ align=right }
 
     **NetNewsWire** a free and open-source feed reader for macOS and iOS with a focus on a native design and feature set. It supports the typical feed formats alongside built-in support for Twitter and Reddit feeds.
 
@@ -85,8 +85,8 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Miniflux logo](/assets/img/news-aggregators/miniflux.svg#only-light){ align=right }
-    ![Miniflux logo](/assets/img/news-aggregators/miniflux-dark.svg#only-dark){ align=right }
+    ![Miniflux logo](assets/img/news-aggregators/miniflux.svg#only-light){ align=right }
+    ![Miniflux logo](assets/img/news-aggregators/miniflux-dark.svg#only-dark){ align=right }
 
     **Miniflux** is a web-based news aggregator that you can self-host. It supports [RSS](https://en.wikipedia.org/wiki/RSS), [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)), [RDF](https://en.wikipedia.org/wiki/RDF%2FXML) and [JSON Feed](https://en.wikipedia.org/wiki/JSON_Feed).
 
@@ -99,7 +99,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Newsboat logo](/assets/img/news-aggregators/newsboat.svg){ align=right }
+    ![Newsboat logo](assets/img/news-aggregators/newsboat.svg){ align=right }
 
     **Newsboat** is an RSS/Atom feed reader for the text console. It's an actively maintained fork of [Newsbeuter](https://en.wikipedia.org/wiki/Newsbeuter). It is very lightweight, and ideal for use over [Secure Shell](https://en.wikipedia.org/wiki/Secure_Shell).
 

docs/notebooks.en.md

@@ -1,5 +1,5 @@
 ---
-title: Notebooks
+title: "Notebooks"
 icon: material/notebook-edit-outline
 ---
 
@@ -13,7 +13,7 @@ If you are currently using an application like Evernote, Google Keep, or Microso
 
 !!! recommendation
 
-    ![Joplin logo](/assets/img/notebooks/joplin.svg){ align=right }
+    ![Joplin logo](assets/img/notebooks/joplin.svg){ align=right }
 
     **Joplin** is a free, open-source, and fully-featured note-taking and to-do application which can handle a large number of markdown notes organized into notebooks and tags. It offers end-to-end encryption and can sync through Nextcloud, Dropbox, and more. It also offers easy import from Evernote and plain-text notes.
 
@@ -38,7 +38,7 @@ If you are currently using an application like Evernote, Google Keep, or Microso
 
 !!! recommendation
 
-    ![Standard Notes logo](/assets/img/notebooks/standard-notes.svg){ align=right }
+    ![Standard Notes logo](assets/img/notebooks/standard-notes.svg){ align=right }
 
     Standard Notes is a simple and private notes app that makes your notes easy and available everywhere you are. It features end-to-end encryption on every platform, and a powerful desktop experience with themes and custom editors. It has also been [independently audited (PDF)](https://s3.amazonaws.com/standard-notes/security/Report-SN-Audit.pdf).
 

docs/passwords.en.md

@@ -1,5 +1,5 @@
 ---
-title: Password Managers
+title: "Password Managers"
 icon: material/form-textbox-password
 ---
 Stay safe and secure online with an encrypted and open-source password manager.
@@ -7,8 +7,8 @@ Stay safe and secure online with an encrypted and open-source password manager.
 ## Password Best Practices
 
 - Always use unique passwords. Don't make yourself a victim of "[credential stuffing](https://en.wikipedia.org/wiki/Credential_stuffing)".
-- Store an exported backup of your passwords in an [encrypted container](/encryption) on another storage device. This can be useful if something happens to your device or the service you are using.
-- If possible, store [Time-based one-time password (TOTP)](https://en.wikipedia.org/wiki/Time-based_one-time_password) tokens in a separate [TOTP app](/security/multi-factor-authentication/#authenticator-apps) and not your password manager. TOTP codes are generated from a "[shared secret](https://en.wikipedia.org/wiki/Time-based_one-time_password#Security)". If the secret is obtained by an adversary they can generate TOTP values. Typically, mobile platforms have better app isolation and more secure methods for storing sensitive credentials.
+- Store an exported backup of your passwords in an [encrypted container](encryption.md) on another storage device. This can be useful if something happens to your device or the service you are using.
+- If possible, store [Time-based one-time password (TOTP)](https://en.wikipedia.org/wiki/Time-based_one-time_password) tokens in a separate [TOTP app](security/multi-factor-authentication.md#authenticator-apps) and not your password manager. TOTP codes are generated from a "[shared secret](https://en.wikipedia.org/wiki/Time-based_one-time_password#Security)". If the secret is obtained by an adversary they can generate TOTP values. Typically, mobile platforms have better app isolation and more secure methods for storing sensitive credentials.
 
 ## Local Password Managers
 
@@ -18,7 +18,7 @@ These password managers store the password database locally.
 
 !!! recommendation
 
-    ![KeepassXC logo](/assets/img/password-management/keepassxc.svg){ align=right }
+    ![KeepassXC logo](assets/img/password-management/keepassxc.svg){ align=right }
 
     **KeePassXC** is a community fork of KeePassX, a native cross-platform port of KeePass Password Safe, with the goal to extend and improve it with new features and bugfixes to provide a feature-rich, fully cross-platform and modern open-source password manager.
 
@@ -41,7 +41,7 @@ These password managers store the password database locally.
 
 !!! recommendation
 
-    ![KeepassDX logo](/assets/img/password-management/keepassdx.svg){ align=right }
+    ![KeepassDX logo](assets/img/password-management/keepassdx.svg){ align=right }
 
     **KeepassDX** is a lightweight password manager for Android, allows editing encrypted data in a single file in KeePass format and can fill in the forms in a secure way. [Contributor Pro](https://play.google.com/store/apps/details?id=com.kunzisoft.keepass.pro) allows unlocking cosmetic content and non-standard protocol features, but more importantly, it helps and encourages development.
 
@@ -62,7 +62,7 @@ These password managers sync up to a cloud server that may be self-hostable.
 
 !!! recommendation
 
-    ![Bitwarden logo](/assets/img/password-management/bitwarden.svg){ align=right }
+    ![Bitwarden logo](assets/img/password-management/bitwarden.svg){ align=right }
 
     **Bitwarden** is a free and open-source password manager. It aims to solve password management problems for individuals, teams, and business organizations. Bitwarden is among the easiest and safest solutions to store all of your logins and passwords while conveniently keeping them synced between all of your devices. If you don't want to use the Bitwarden cloud, you can easily host your own Bitwarden server.
 
@@ -85,9 +85,9 @@ These password managers sync up to a cloud server that may be self-hostable.
 
 !!! recommendation
 
-    ![Psono logo](/assets/img/password-management/psono.svg){ align=right }
+    ![Psono logo](assets/img/password-management/psono.svg){ align=right }
 
-    **Psono** is a free and open source password manager from Germany, with a focus on password management for teams. It can be [self-hosted](/password-management/#password-management-servers). Psono supports secure sharing of passwords, files, bookmarks, and emails. All secrets are protected by a master password.
+    **Psono** is a free and open source password manager from Germany, with a focus on password management for teams. It can be [self-hosted](#password-management-servers). Psono supports secure sharing of passwords, files, bookmarks, and emails. All secrets are protected by a master password.
 
     [Visit psono.com](https://psono.com){ .md-button .md-button--primary } [Privacy Policy](https://psono.com/privacy-policy){ .md-button }
 
@@ -107,8 +107,8 @@ These products are self-hostable synchronization for cloud based password manage
 
 !!! recommendation
 
-    ![Vaultwarden logo](/assets/img/password-management/vaultwarden.svg#only-light){ align=right }
-    ![Vaultwarden logo](/assets/img/password-management/vaultwarden-dark.svg#only-dark){ align=right }
+    ![Vaultwarden logo](assets/img/password-management/vaultwarden.svg#only-light){ align=right }
+    ![Vaultwarden logo](assets/img/password-management/vaultwarden-dark.svg#only-dark){ align=right }
 
     **Vaultwarden** is an alternative implementation of the Bitwarden server API written in Rust and compatible with upstream Bitwarden clients, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal.
 
@@ -122,7 +122,7 @@ These products are self-hostable synchronization for cloud based password manage
 
 !!! recommendation
 
-    ![Psono Server logo](/assets/img/password-management/psono.svg){ align=right }
+    ![Psono Server logo](assets/img/password-management/psono.svg){ align=right }
 
     Psono provides [extensive documentation](https://doc.psono.com/) for their product. The [web-client](https://doc.psono.com/admin/installation/install-webclient.html#installation-with-docker) for Psono can be self hosted; alternatively, you can choose the the full [Community Edition](https://doc.psono.com/admin/installation/install-server-ce.html) or the [Enterprise Edition](https://doc.psono.com/admin/installation/install-server-ee.html) with additional features.
 
@@ -140,7 +140,7 @@ These products are minimal password managers that can be used within scripting a
 
 !!! recommendation
 
-    ![gopass logo](/assets/img/password-management/gopass.svg){ align=right }
+    ![gopass logo](assets/img/password-management/gopass.svg){ align=right }
 
     **gopass** is a password manager for the command line written in Go. It works on all major desktop and server operating systems (Linux, MacOS, BSD, Windows).
 

docs/productivity.en.md

@@ -1,5 +1,5 @@
 ---
-title: Productivity Tools
+title: "Productivity Tools"
 icon: material/file-sign
 ---
 Get working and collaborating without sharing your documents with a middleman or trusting a cloud provider.
@@ -10,7 +10,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![LibreOffice logo](/assets/img/productivity/libreoffice.svg){ align=right }
+    ![LibreOffice logo](assets/img/productivity/libreoffice.svg){ align=right }
 
     **LibreOffice** is a free and open-source office suite with extensive functionality.
 
@@ -32,7 +32,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![OnlyOffice logo](/assets/img/productivity/onlyoffice.svg){ align=right }
+    ![OnlyOffice logo](assets/img/productivity/onlyoffice.svg){ align=right }
 
     **OnlyOffice** is alternative, it is free and open-source office suite with extensive functionality.
 
@@ -53,7 +53,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![Framadate logo](/assets/img/productivity/framadate.svg){ align=right }
+    ![Framadate logo](assets/img/productivity/framadate.svg){ align=right }
 
     **Framadate** is a free and open-source online service for planning an appointment or making a decision quickly and easily. No registration is required.
 
@@ -68,7 +68,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![PrivateBin logo](/assets/img/productivity/privatebin.svg){ align=right }
+    ![PrivateBin logo](assets/img/productivity/privatebin.svg){ align=right }
 
     **PrivateBin** is a minimalist, open-source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256-bit AES. It is the improved version of ZeroBin.
 
@@ -83,7 +83,7 @@ Do note that PrivateBin uses JavaScript to handle encryption, so you must trust
 
 !!! recommendation
 
-    ![CryptPad logo](/assets/img/productivity/cryptpad.svg){ align=right }
+    ![CryptPad logo](assets/img/productivity/cryptpad.svg){ align=right }
 
     **CryptPad** is a private-by-design alternative to popular office tools. All content is end-to-end encrypted. Do note that it uses JavaScript to handle encryption, so you must trust the provider to the extent that they do not inject any malicious JavaScript to get your private key. Consider self-hosting to mitigate this threat.
 
@@ -98,8 +98,8 @@ Do note that PrivateBin uses JavaScript to handle encryption, so you must trust
 
 !!! recommendation
 
-    ![Write.as logo](/assets/img/productivity/writeas.svg#only-light){ align=right }
-    ![Write.as logo](/assets/img/productivity/writeas-dark.svg#only-dark){ align=right }
+    ![Write.as logo](assets/img/productivity/writeas.svg#only-light){ align=right }
+    ![Write.as logo](assets/img/productivity/writeas-dark.svg#only-dark){ align=right }
 
     **Write.as** is a cross-platform, privacy-oriented blogging platform. It's anonymous by default, letting you publish without signing up. If you create an account, it doesn't require any personal information. No ads, distraction-free, and built on a sustainable business model.
 
@@ -120,7 +120,7 @@ Do note that PrivateBin uses JavaScript to handle encryption, so you must trust
 
 !!! recommendation
 
-    ![VSCodium logo](/assets/img/productivity/vscodium.svg){ align=right }
+    ![VSCodium logo](assets/img/productivity/vscodium.svg){ align=right }
 
     **VSCodium** is a free and open-source project featuring binaries of [Visual Studio Code](https://code.visualstudio.com) without Microsoft's branding/telemetry/licensing.
 

docs/qubes.en.md

@@ -1,5 +1,5 @@
 ---
-title: Qubes OS
+title: "Qubes OS"
 icon: pg/qubes-os
 ---
 Qubes OS is a distribution of Linux that uses [Xen](https://en.wikipedia.org/wiki/Xen) to provide app isolation.
@@ -8,7 +8,7 @@ Qubes OS is a distribution of Linux that uses [Xen](https://en.wikipedia.org/wik
 
 !!! recommendation
 
-    ![Qubes OS logo](/assets/img/qubes/qubes_os.svg){ align=right }
+    ![Qubes OS logo](assets/img/qubes/qubes_os.svg){ align=right }
 
     **Qubes** is an open-source operating system designed to provide strong security for desktop computing. Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and utilize most of the Linux drivers.
 

docs/real-time-communication.en.md

@@ -1,5 +1,5 @@
 ---
-title: Real-Time Communication Tools
+title: "Real-Time Communication"
 icon: material/chat-processing
 ---
 ## Encrypted Instant Messengers
@@ -8,7 +8,7 @@ icon: material/chat-processing
 
 !!! recommendation
 
-    ![Signal logo](/assets/img/messengers/signal.svg){ align=right }
+    ![Signal logo](assets/img/messengers/signal.svg){ align=right }
 
     **Signal** is a mobile app developed by Signal Messenger LLC. The app provides instant messaging, as well as voice and video calling.
 
@@ -36,7 +36,7 @@ The protocol was independently [audited](https://eprint.iacr.org/2016/1013.pdf)
 
 !!! recommendation
 
-    ![Element logo](/assets/img/messengers/element.svg){ align=right }
+    ![Element logo](assets/img/messengers/element.svg){ align=right }
 
     **Element** is the reference client for the [Matrix](https://matrix.org/docs/guides/introduction) protocol, an [open standard](https://matrix.org/docs/spec) for secure decentralized real-time communication.
 
@@ -57,7 +57,7 @@ Profile pictures, reactions, and nicknames are not encrypted.
 
 Group voice and video calls are [not](https://github.com/vector-im/element-web/issues/12878) E2EE, and use Jitsi, but this is expected to change with [Native Group VoIP Signalling](https://github.com/matrix-org/matrix-doc/pull/3401). Group calls have [no authentication](https://github.com/vector-im/element-web/issues/13074) currently, meaning that non room participants can also join the calls. We recommend that you do not use this feature for private meetings.
 
-When using [element-web](https://github.com/vector-im/element-web), you must trust the server hosting the Element client. If your [threat model](/threat-modeling) requires stronger protection, then use a desktop or mobile client instead.
+When using [element-web](https://github.com/vector-im/element-web), you must trust the server hosting the Element client. If your [threat model](threat-modeling.md) requires stronger protection, then use a desktop or mobile client instead.
 
 The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last) in 2016. The specification for the Matrix protocol can be found in their [documentation](https://spec.matrix.org/latest/). The [Olm](https://matrix.org/docs/projects/other/olm) cryptographic ratchet used by Matrix is an implementation of Signal’s [Double Ratchet algorithm](https://signal.org/docs/specifications/doubleratchet/).
 
@@ -65,7 +65,7 @@ The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matr
 
 !!! recommendation
 
-    ![Briar logo](/assets/img/messengers/briar.svg){ align=right }
+    ![Briar logo](assets/img/messengers/briar.svg){ align=right }
 
     **Briar** is an encrypted instant messenger that [connects](https://briarproject.org/how-it-works/) to other clients using the Tor Network. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar’s local mesh mode can be useful when internet availability is a problem.
 
@@ -88,7 +88,7 @@ Briar supports perfect forward secrecy by using the Bramble [Handshake](https://
 
 !!! recommendation
 
-    ![Session logo](/assets/img/messengers/session.svg){ align=right }
+    ![Session logo](assets/img/messengers/session.svg){ align=right }
 
     **Session** is an encrypted instant messenger that uses three random [service nodes](https://getsession.org/blog/onion-requests-session-new-message-routing-solution) to route messages anonymously on the [Oxen Network](https://oxen.io).
 
@@ -116,7 +116,7 @@ There are several network architectures commonly used to relay messages between
 
 ### Centralized Networks
 
-![Centralized networks diagram](/assets/img/layout/network-centralized.svg){ align=left }
+![Centralized networks diagram](assets/img/layout/network-centralized.svg){ align=left }
 
 Centralized messengers are those where all participants are on the same server or network of servers controlled by the same organization.
 
@@ -139,7 +139,7 @@ Some self-hosted messengers allow you to set up your own server. Self-hosting ca
 
 ### Federated Networks
 
-![Federated networks diagram](/assets/img/layout/network-decentralized.svg){ align=left }
+![Federated networks diagram](assets/img/layout/network-decentralized.svg){ align=left }
 
 Federated messengers use multiple, independent, decentralized servers that are able to talk to each other (email is one example of a federated service). Federation allows system administrators to control their own server and still be a part of the larger communications network.
 
@@ -162,7 +162,7 @@ When self-hosted, users of a federated server can discover and communicate with
 
 ### Peer-to-Peer (P2P) Networks
 
-![P2P diagram](/assets/img/layout/network-distributed.svg){ align=left }
+![P2P diagram](assets/img/layout/network-distributed.svg){ align=left }
 
 [P2P](https://en.wikipedia.org/wiki/Peer-to-peer) messengers connect to a [distributed network](https://en.wikipedia.org/wiki/Distributed_networking) of nodes to relay a message to the recepient without a third-party server.
 
@@ -183,11 +183,11 @@ P2P networks do not use servers, as users communicate directly between each othe
 - Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online.
 - Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network to learn about who is online.
 - Some common messenger features may not be implemented or incompletely, such as message deletion.
-- Your [IP address](https://en.wikipedia.org/wiki/IP_address) and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a [VPN](/vpn) or [self contained network](/self-contained-networks), such as [Tor](https://www.torproject.org) or [I2P](https://geti2p.net/). Many countries have some form of mass surveillance and/or metadata retention.
+- Your [IP address](https://en.wikipedia.org/wiki/IP_address) and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a [VPN](vpn.md) or [self contained network](self-contained-networks.md), such as [Tor](https://www.torproject.org) or [I2P](https://geti2p.net/). Many countries have some form of mass surveillance and/or metadata retention.
 
 ### Anonymous Routing
 
-![Anonymous routing diagram](/assets/img/layout/network-anonymous-routing.svg){ align=left }
+![Anonymous routing diagram](assets/img/layout/network-anonymous-routing.svg){ align=left }
 
 A messenger using [anonymous routing](https://doi.org/10.1007/978-1-4419-5906-5_628) hides either the identity of the sender, the receiver, or evidence that they have been communicating. Ideally, a messenger should hide all three.
 

docs/router.en.md

@@ -1,5 +1,5 @@
 ---
-title: Router Firmware
+title: "Router Firmware"
 icon: material/router-wireless
 ---
 Below are a few alternative operating systems, that can be used on routers, Wi-Fi access points etc.
@@ -11,8 +11,8 @@ Below are a few alternative operating systems, that can be used on routers, Wi-F
 
 !!! recommendation
 
-    ![OpenWrt logo](/assets/img/router/openwrt.svg#only-light){ align=right }
-    ![OpenWrt logo](/assets/img/router/openwrt-dark.svg#only-dark){ align=right }
+    ![OpenWrt logo](assets/img/router/openwrt.svg#only-light){ align=right }
+    ![OpenWrt logo](assets/img/router/openwrt-dark.svg#only-dark){ align=right }
 
     **OpenWrt** is an operating system (in particular, an embedded operating system) based on the Linux kernel, primarily used on embedded devices to route network traffic. The main components are the Linux kernel, util-linux, uClibc, and BusyBox. All components have been optimized for size, to be small enough for fitting into the limited storage and memory available in home routers.
 
@@ -25,8 +25,8 @@ Below are a few alternative operating systems, that can be used on routers, Wi-F
 
 !!! recommendation
 
-    ![pfSense logo](/assets/img/router/pfsense.svg#only-light){ align=right }
-    ![pfSense logo](/assets/img/router/pfsense-dark.svg#only-dark){ align=right }
+    ![pfSense logo](assets/img/router/pfsense.svg#only-light){ align=right }
+    ![pfSense logo](assets/img/router/pfsense-dark.svg#only-dark){ align=right }
 
     pfSense is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a computer to make a dedicated firewall/router for a network and is noted for its reliability and offering features often only found in expensive commercial firewalls. pfSense is commonly deployed as a perimeter firewall, router, wireless access point, DHCP server, DNS server, and VPN endpoint.
 

docs/search-engines.en.md

@@ -1,18 +1,18 @@
 ---
-title: Search Engines
+title: "Search Engines"
 icon: material/search-web
 ---
 Use a search engine that doesn't build an advertising profile based on your searches.
 
 The recommendations here are based on the merits of each service's privacy policy. There is **no guarantee** that these privacy policies are honored.
 
-Consider using a [VPN](/vpn) or [Tor](https://www.torproject.org/) if your threat model requires hiding your IP address from the search provider.
+Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org/) if your threat model requires hiding your IP address from the search provider.
 
 ### DuckDuckGo
 
 !!! recommendation
 
-    ![DuckDuckGo logo](/assets/img/search-engines/duckduckgo.svg){ align=right }
+    ![DuckDuckGo logo](assets/img/search-engines/duckduckgo.svg){ align=right }
 
     **DuckDuckGo** is a popular search engine and is the default for the Tor Browser.
 
@@ -30,9 +30,9 @@ DuckDuckGo has a [lite](https://duckduckgo.com/lite) and [html](https://duckduck
 
 !!! recommendation
 
-    ![Startpage logo](/assets/img/search-engines/startpage.svg){ align=right }
+    ![Startpage logo](assets/img/search-engines/startpage.svg){ align=right }
 
-    **Startpage** is a search engine that provides Google search results. It is a very convenient way to get Google search results without experiencing dark patterns such as difficult captchas or being refused access because you used a [VPN](/vpn) or [Tor](https://www.torproject.org/download/).
+    **Startpage** is a search engine that provides Google search results. It is a very convenient way to get Google search results without experiencing dark patterns such as difficult captchas or being refused access because you used a [VPN](vpn.md) or [Tor](https://www.torproject.org/download/).
 
     [Visit startpage.com](https://www.startpage.com){ .md-button .md-button--primary } [Privacy Policy](https://www.startpage.com/en/privacy-policy){ .md-button }
 
@@ -46,7 +46,7 @@ Startpage's majority shareholder is System1 who is an adtech company. We don't t
 
 !!! recommendation
 
-    ![Mojeek logo](/assets/img/search-engines/mojeek.svg){ align=right }
+    ![Mojeek logo](assets/img/search-engines/mojeek.svg){ align=right }
 
     **Mojeek** is another privacy friendly search engine. They use their own crawler to provide search data.
 
@@ -60,12 +60,15 @@ Startpage's majority shareholder is System1 who is an adtech company. We don't t
 
 !!! recommendation
 
-    ![Searx logo](/assets/img/search-engines/searx.svg){ align=right }
+    ![Searx logo](assets/img/search-engines/searx.svg){ align=right }
 
-    **Searx** is an [open-source](https://github.com/asciimoo/searx), self-hostable, metasearch engine, aggregating the results of other search engines while not storing information about its users. There is a [list of public instances](https://searx.space/).
+    **Searx** is an open-source, self-hostable, metasearch engine, aggregating the results of other search engines while not storing information about its users. There is a [list of public instances](https://searx.space/).
 
     [Visit searx.me](https://searx.me){ .md-button .md-button--primary } [:pg-tor:](http://searxspbitokayvkhzhsnljde7rqmn7rvoga6e4waeub3h7ug3nghoad.onion){ .md-button }
 
+    **Downloads**
+    - [:fontawesome-brands-github: Source](https://github.com/asciimoo/searx)
+
 Searx is a proxy between the user and the search engines it aggregates from. Your search queries will still be sent to the search engines that Searx gets its results from.
 
 When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting Searx, as other people looking up illegal content on your instance could draw unwanted attention from authorities.

docs/security/multi-factor-authentication.en.md

@@ -0,0 +1,166 @@
+---
+title: "Multi-factor Authentication"
+icon: 'material/two-factor-authentication'
+---
+**Multi-factor authentication** (MFA, or 2FA) is a security mechanism that requires additional steps beyond entering your username (or email) and password. The most common method is time limited codes you might receive from an SMS or app.
+
+Normally, if a hacker (or adversary) is able to figure out your password then they’d gain access to the account that password belongs to. An account with MFA forces the hacker to have both the password (something you *know*) and a device that you own (something you *have*), like your phone.
+
+MFA methods vary in security, but are based on the premise that the more difficult it is for an attacker to gain access to your MFA method, the better. Examples of MFA methods (from weakest to strongest) include [SMS, Email codes](#sms-or-email-mfa), app push notifications, [Time-based One-time Passwords (TOTP)](#time-based-one-time-password-totp), [Yubico OTP](#yubico-otp), and [FIDO (Fast IDentity Online)](#fido-fast-identity-online).
+
+## MFA Method Comparison
+
+### SMS or Email MFA
+
+Receiving codes either from [**SMS**](https://en.wikipedia.org/wiki/One-time_password#SMS) or **email** are one of the weaker ways to secure your accounts with MFA. Obtaining a code by email or SMS takes away from the "something you *have*" idea, because there are a variety of ways a hacker could [take over your phone number](https://en.wikipedia.org/wiki/SIM_swap_scam) or gain access to your email without having physical access to any of your devices at all. If an unauthorized person gained access to your email, they would be able to use that access to both reset your password and receive the authentication code, giving them full access to your account.
+
+### Push Notifications
+
+**Push notifications** take the form of a message being sent to an app on your phone asking you to confirm new account logins. This method is a lot better than SMS or email, since an attacker typically wouldn't be able to get these push notifications without having an already logged-in device, which means they would need to compromise one of your other devices first.
+
+We all make mistakes, and there is the risk that a user may accept the login attempt by accident. Push notification login authorizations are typically sent to *all* your devices at once, widening the availability of the MFA code if you have many devices.
+
+The security of push notification MFA is dependent on both the quality of the app, the server component and the trust of the developer who produces it. Installing an app may also require you to accept invasive privileges that grant access to other data on your device. An individual app also requires that you have a specific app for each service which may not require a password to open, unlike a good [Time-based One-time Password (TOTP)](#time-based-one-time-password-totp) app.
+
+### Time-based One-time Password (TOTP)
+
+**TOTP** is one of the most commons form of MFA available. When a user sets up TOTP they are generally required to scan a [QR Code](https://en.wikipedia.org/wiki/QR_code) which establishes a "[shared secret](https://en.wikipedia.org/wiki/Shared_secret)" with the service that they intend to use. The shared secret is secured inside of the authenticator app's data, and is sometimes protected by a password.
+
+The time-limited code is then derived from the shared secret and the current time. As the code is only valid for a short time, without access to the shared secret an adversary cannot generate new codes.
+
+If you have a hardware security key with TOTP support (such as a YubiKey with [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/)), we recommend that you store your "shared secrets" on the hardware. Hardware such as the YubiKey was developed with the intention of making the "shared secret" difficult to extract and copy. A YubiKey is also not connected to the Internet, unlike a phone with a TOTP app.
+
+Unlike [WebAuthn](#fido-fast-identity-online), TOTP offers no protection against [phishing](https://en.wikipedia.org/wiki/Phishing) or reuse attacks. If an adversary obtains a valid code from you they may use it as many times as they like until it expires (generally 60 seconds).
+
+An adversary could set up a website to imitate an official service in an attempt to trick you into giving out your username, password and current TOTP code. If the adversary then uses those recorded credentials they may be able to log into the real service and hijack the account.
+
+Although not perfect, TOTP is secure enough for most people, and when [hardware security keys](/multi-factor-authentication/#hardware-security-keys) are not supported [authenticator apps](/multi-factor-authentication/#authenticator-apps) are still a good option.
+
+### Hardware security keys
+
+The YubiKey stores data on a tamper-resistant solid-state chip which is [impossible to access](https://security.stackexchange.com/a/245772) non-destructively without a expensive processes and a forensics laboratory.
+
+These keys are generally multi-function and provide a number of methods to authenticate. Below are the most common ones.
+
+#### Yubico OTP
+
+Yubico OTP is an authentication protocol typically implemented in hardware security keys. When a user decides to use Yubico OTP, the key will generate a public ID, private ID, and a Secret Key which is then uploaded to the Yubico OTP server.
+
+When logging into a website, all a user needs to do is to physically touch the security key. The security key will emulate a keyboard and print out a one-time password into the password field.
+
+The service will then forward the one-time password to the Yubico OTP server for validation. A counter is incremented both on the key and Yubico's validation server. The OTP can only only be used once, and when a successful authentication occurs the counter is increased which prevents reuse of the OTP. Yubico provides a [detailed document](https://developers.yubico.com/OTP/OTPs_Explained.html) about the process.
+
+<figure markdown>
+  ![Yubico OTP](../assets/img/multi-factor-authentication/yubico-otp.png)
+</figure>
+
+There are some benefits and disadvantages to using Yubico OTP when compared to [TOTP](#time-based-one-time-password-totp).
+
+The Yubico validation server is a cloud based service, and users place trust in Yubico that they are storing data securely and not profiling users. The public ID associated with Yubico OTP is reused on every website and could be another avenue for third parties to profile the user. Like [TOTP](#time-based-one-time-password-totp), Yubico OTP does not provide phishing resistance.
+
+If your threat model requires you to have different identities on different websites, **do not** use Yubico OTP with the same hardware security key across those websites as public ID is unique to each security key.
+
+#### FIDO (Fast IDentity Online)
+
+[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) with the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
+
+U2F and FIDO2 refer to the [CTAP (Client to Authenticator Protocol)](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the "Relying Party", the website, you're trying to log in on.
+
+WebAuthn is the most secure and private form of second factor authentication. While the user experience is similar to Yubico OTP, the key does not print out a one-time password and validate with a third party server. Instead it uses [public key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) for authentication.
+
+<figure markdown>
+  ![FIDO](../assets/img/multi-factor-authentication/fido.png)
+</figure>
+
+When a user creates an account the public key is sent to the service, then when the user logs in, the service will require the user to "sign" some data with their private key. The benefit of this is that no password data is ever stored by the service, so there is nothing for an adversary to steal.
+
+This presentation discusses the history of password authentication, the pitfalls (such as password reuse), and discussion of FIDO2 and [WebAuthn](https://webauthn.guide) standards.
+
+<iframe width="100%" style="height:50vh"
+  src="https://www.youtube-nocookie.com/embed/aMo4ZlWznao"
+  title="How FIDO2 and WebAuthn Stop Account Takeovers"
+  frameborder="0"
+  allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
+  allowfullscreen>
+</iframe>
+
+FIDO2 and WebAuthn have superior security and privacy properties when compared to any MFA methods.
+
+Typically for web services it is used with WebAuthn which is a part of the [W3C recommendations](https://en.wikipedia.org/wiki/World_Wide_Web_Consortium#W3C_recommendation_(REC)). It uses public key authentication and is more secure than shared secrets used in Yubico OTP and TOTP methods, as it includes the origin name (usually, the domain name) during authentication. Attestation is provided to protect the user from phishing, as it helps them to determine that they are using the authentic service and not a fake copy.
+
+Unlike Yubico OTP, WebAuthn does not use any public ID, so the key is **not** identifiable across different websites. It also does not use any third party cloud server for authentication. All communication is completed between the key and the website the user is logging into. FIDO also uses a counter which is incremented upon use in order to prevent session reuse and cloned keys.
+
+If a website or service supports WebAuthn for the authentication, it is highly recommended that you use it over any other form of MFA.
+
+## General Recommendations
+
+We have these general recommendations:
+
+### Which method should I use?
+
+When configuring your MFA method, keep in mind that it is only as secure as your weakest authentication method you use. This means it is important that you only use the best MFA method available. For instance, if you are already using TOTP, you should disable email and SMS MFA. If you are already using FIDO2/WebAuthn, you should not be using Yubico OTP or TOTP on your account.
+
+### Backups
+
+You should always have backups for your MFA method. Hardware security keys can get lost, stolen, or simply stop working over time. It is recommended that you have a pair of hardware security keys with the same access to your accounts instead of just one.
+
+When using TOTP with an authenticator app, be sure to back up your recovery keys or the app itself, or copy the "shared secrets" to another instance of the app on a different phone or to an encrypted container (e.g [VeraCrypt](../encryption.md#veracrypt)).
+
+### Initial setup
+
+When buying a security key, it is important that you change the default credentials, setup password protection for the key, and enable touch confirmation if your key supports it. Products such as the [YubiKey](#yubico-otp) have multiple interfaces with separate credentials for each one of them, so you should go over each interface and set up protection as well.
+
+### Email and SMS
+
+If you have to use email for MFA, make sure that the email account itself is secured with a proper MFA method.
+
+If you use SMS MFA, use a carrier who will not switch your phone number to a new SIM card without account access, or use a dedicated VOIP number from a provider with similar security to avoid a [SIM swap](https://en.wikipedia.org/wiki/SIM_swap_scam) attack.
+
+[MFA tools we recommend](../multi-factor-authentication.md){ .md-button }
+
+## More places to setup MFA
+
+Beyond just securing your website logins, multi-factor authentication can be used to secure your local logins, SSH keys or even password databases as well.
+
+### Windows
+
+Yubico has a dedicated [Credential Provider](https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows) that adds Challenge-Response authentication for the username + password login flow for local Windows accounts. If you have a YubiKey with Challenge-Response authentication support, take a look at the [Yubico Login for Windows Configuration Guide](https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide), which will allow you to set up MFA on your Windows computer.
+
+### macOS
+
+macOS has [native support](https://support.apple.com/guide/deployment/intro-to-smart-card-integration-depd0b888248/web) for authentication with smart cards (PIV). If you have a smartcard or a hardware security key that supports the PIV interface such as the YubiKey, we recommend that you follow your smartcard/hardware security vendor's documentation and set up second factor authentication for your macOS computer.
+
+Yubico have a guide [Using Your YubiKey as a Smart Card in macOS](https://support.yubico.com/hc/en-us/articles/360016649059) which can help you set up your YubiKey on macOS.
+
+After your smartcard/security key is set up, we recommend running this command in the Terminal:
+
+```text
+sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES
+```
+
+The command will prevent an adversary from bypassing MFA when the computer boots.
+
+### Linux
+
+!!! warning
+    If the [hostname](https://en.wikipedia.org/wiki/Hostname) of your system changes (such as due to DHCP), you would be unable to login. It is vital that you setup a proper hostname for your computer before following this guide.
+
+The `pam_u2f` module on Linux can provide two factor authentication for user login on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as "apt-get"—and package names may however differ. This guide does **not** apply to Qubes OS.
+
+### Qubes OS
+
+Qubes OS has support for Challenge-Response authentication with YubiKeys. If you have a YubiKey with Challenge-Response authentication support, take a look at the Qubes OS [YubiKey documentation](https://www.qubes-os.org/doc/yubikey/) if you want to set up MFA on Qubes OS.
+
+### SSH
+
+#### Hardware security keys
+
+SSH MFA could be set up using multiple different authentication methods that are popular with hardware security keys. We recommend that you check out Yubico's [documentation](https://developers.yubico.com/SSH/) on how to set this up.
+
+#### Time-based One-time Password (TOTP)
+
+SSH MFA can also be set up using TOTP. DigitalOcean has provided a tutorial [How To Set Up Multi-Factor Authentication for SSH on Ubuntu 20.04](https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04). Most things should be the same regardless of distribution, however the package manager commands—such as "apt-get"—and package names may differ.
+
+### KeePass (and KeePassXC)
+
+KeePass and KeePassXC databases can be secured using Challenge-Response or HOTP as a second factor authentication. Yubico has provided a document for KeePass [Using Your YubiKey with KeePass](https://support.yubico.com/hc/en-us/articles/360013779759-Using-Your-YubiKey-with-KeePass) and there is also one on the [KeePassXC](https://keepassxc.org/docs/#faq-yubikey-2fa) website.

docs/security/multi-factor-authentication.md

@@ -1,157 +0,0 @@
----
-title: Multi-factor Authentication
-description: "Using strong MFA can stop over 99% of unauthorized account accesses, and it's easy to set up on the services you already use."
-icon: 'material/two-factor-authentication'
----
-**Multi-factor authentication** (MFA, or 2FA) is a security mechanism that requires additional steps beyond entering your username (or email) and password. The most common method are time limited codes you might receive from an SMS or app.
-
-The idea behind MFA is that even if a hacker (or adversary) is able to figure out your password (something you *know*), they will still need a device you own like your phone (something you *have*) in order to generate the code needed to log in to your account. MFA methods vary in security based on this premise: The more difficult it is for an attacker to gain access to your MFA method, the better. Examples of MFA methods (from weakest to strongest) include [SMS codes](https://en.wikipedia.org/wiki/One-time_password#SMS), email codes, app push notifications, [Time-based One-time Passwords (TOTP)](https://en.wikipedia.org/wiki/Time-based_one-time_password), Yubico OTP, and [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) / [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor).
-
-## MFA Method Comparison
-
-### SMS or Email MFA
-
-Receiving codes either from **SMS** or **email** are one of the weaker ways to secure your accounts with MFA. Obtaining a code by email or SMS takes away from the "something you *have*" idea, because there are a variety of ways a hacker could [take over your phone number](https://en.wikipedia.org/wiki/SIM_swap_scam) or gain access to your email without having physical access to any of your devices at all. If an unauthorized person gained access to your email, they would be able to use that access to both reset your password and receive the authentication code, giving them full access to your account.
-
-### Push Notifications
-
-**Push Notifications** take the form of a message being sent to an app on your phone asking you to confirm new account logins. This method is a lot better than SMS or email, since an attacker typically wouldn't be able to get these push notifications without having an already logged-in device, which means they would need to compromise one of your other devices first.
-
-We all make mistakes, and there is the risk that a user may accept the login attempt by accident. Push notification login authorizations are typically sent to *all* your devices at once, widening the availability of the MFA code if you have many devices.
-
-The security of push notification MFA is dependent on both the quality of the app, the server component and the trust of the developer who produces it. Installing an app may also require you to accept invasive privileges that grant access to other data on your device. An individual app also requires that you have a specific app for each service which may not require a password to open unlike a good [Time-based One-time Password (TOTP)](#time-based-one-time-password-totp) app.
-
-### Time-based One-time Password (TOTP)
-
-**TOTP** is one of the most commons form of MFA available. When a user sets up TOTP they are generally required to scan a [QR Code](https://en.wikipedia.org/wiki/QR_code) which establishes a "shared secret" with the service that they intend to use. The shared secret is secured inside of the authenticator app's data, and is sometimes protected by a password.
-
-The time-limited code is then derived from the shared secret and the current time. As the code is only valid for a short time, without access to the shared secret an adversary cannot generate new codes.
-
-If you have a hardware security key with TOTP support (such as a YubiKey with [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/)), we recommend that you store your "shared secrets" on the hardware. Hardware such as the YubiKey was developed with making the "shared secret" difficult to extract and copy. A YubiKey is also not connected to the Internet, unlike a phone with a TOTP app.
-
-Unlike [FIDO2 / U2F](#fido2-u2f), TOTP offers no protection against [phishing](https://en.wikipedia.org/wiki/Phishing) or reuse attacks. If an adversary obtains a valid code from you they may use it as many times as they like until it expires (generally 60 seconds).
-
-An adversary could set up a website to imitate an official service in an attempt to trick you into giving out your username, password and current TOTP code. If the adversary then uses those recorded credentials they may be able to log into the real service and hijack the account.
-
-Although not perfect it is secure enough for most people, and when [Hardware Security Keys](#hardware-security-keys) are not supported TOTP with [Authenticator Apps](#authenticator-apps) are still a good option.
-
-### Hardware security keys
-
-The YubiKey stores data on a tamper-resistant solid-state chip which is [impossible to access](https://security.stackexchange.com/a/245772) non-destructively without a expensive processes and a forensics laboratory.
-
-As these keys are generally multi-function and provide a number of methods to authenticate we discuss below the most common ones.
-
-#### Yubico OTP
-
-Yubico OTP is an authentication protocol typically implemented in hardware security keys. When a user decides to use Yubico OTP, the key will generate a public ID, private ID, and a Secret Key which is then uploaded to the Yubico OTP server.
-
-When logging into a website all a user needs to do is to physically touch the security key. The security key will emulate a keyboard and print out a one-time password into the password field.
-
-The service will then forward the one-time password to the Yubico OTP server for validation. A counter is incremented both on the key and Yubico's validation server. The OTP can only only be used once and when a successful authentication occurs the counter is increased which prevents reuse of the OTP. Yubico does provide a [detailed document](https://developers.yubico.com/OTP/OTPs_Explained.html) about the process.
-
-<figure markdown>
-  ![Yubico OTP](/assets/img/multi-factor-authentication/yubico-otp.png)
-</figure>
-
-There are some benefits and disadvantages to using Yubico OTP when compared to [TOTP](#time-based-one-time-password-totp).
-
-The Yubico validation server is a cloud based service, and users do place trust in Yubico that they are storing data securely and not profiling users. The public ID associated with Yubico OTP is reused on every website and could be another avenue for third parties to profile the user. Like [TOTP](#time-based-one-time-password-totp), Yubico OTP does not provide phishing resistance.
-
-If your threat model requires you to have different identities on different websites, **do not** use Yubico OTP with the same hardware security key across those websites as public ID is unique to each security key.
-
-#### FIDO2 / U2F
-
-[FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) / [**U2F**](https://en.wikipedia.org/wiki/Universal_2nd_Factor) is the most secure and private form of second factor authentication. While the user experience is similar to Yubico OTP, the key does not print out a one-time password and validate with a third party server. Instead FIDO2 (and U2F) use [public key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) for authentication.
-
-When a user creates an account the public key is sent to the service. When the user logs in the service will require the user to "sign" some data with their private key. The benefit of this is that no password data is ever stored by the service, so there is nothing for an adversary to steal.
-
-This presentation discusses the history of password authentication, the pitfalls (such as password reuse), and discussion of FIDO2 and [WebAuthn](https://webauthn.guide) standards.
-
-<iframe width="100%" style="height:50vh"
-  src="https://www.youtube-nocookie.com/embed/aMo4ZlWznao"
-  title="How FIDO2 and WebAuthn Stop Account Takeovers"
-  frameborder="0"
-  allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
-  allowfullscreen>
-</iframe>
-
-FIDO2 / U2F has superior security and privacy properties when compared to any MFA methods.
-
-Typically for web services it is used with [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) which is a part of the [W3C recommendations](https://en.wikipedia.org/wiki/World_Wide_Web_Consortium#W3C_recommendation_(REC)). It uses public key authentication and is more secure than shared secrets used in Yubico OTP and TOTP methods, as it includes the origin name (usually, the domain name) during authentication. Attestation is provided to protect the user from phishing as it helps them to determine that they are using the authentic service and not a fake copy.
-
-WebAuthn does not use any public ID, so the key is **not** identifiable across different websites like Yubico OTP. It also does not use any third party cloud server for authentication. All communication is completed between the key and the website the user is logging into. FIDO2 / U2F also uses a counter which is incremented upon use in order to prevent session reuse.
-
-If a website or service supports FIDO2 / U2F for the authentication, it is highly recommended that you use it over any other form of MFA.
-
-## General Recommendations
-
-We have these general recommendations:
-
-### Which method to use?
-
-When configuring your MFA method, keep in mind that it is only as secure as your weakest authentication method you use. This means it is important that you only use the best MFA method available. For instance, if you are already using TOTP, you should disable email and SMS MFA. If you are already using FIDO2 / U2F, you should not be using Yubico OTP or TOTP on your account.
-
-### Backups
-
-You should always have backups for your MFA method. Hardware security keys can get lost, stolen, or simply stop working over time. It is recommended that you have a pair of hardware security keys with the same access to your accounts instead of just one.
-
-When using TOTP with an authenticator app, be sure to back up your recovery keys, the app itself, or copy the "shared secrets" to another instance of the app on a different phone or into an encrypted container (e.g. [VeraCrypt](/encryption/#veracrypt)).
-
-### Initial setup
-
-When buying a security key, it is important that you change the default credentials, setup password protection for the key, and enable touch confirmation if your key supports such feature. Products such as the [YubiKey](#yubikey) have multiple interfaces with seperate credentials for each one of them, so you should go over each interface and set up protection as well.
-
-### Email and SMS
-
-If you have to use email for MFA, make sure that the email account itself is secured with a proper MFA method.
-
-If you use SMS MFA, use a carrier who will not switch your phone number to a new SIM card without account access or use a dedicated VOIP number from a provider with similar security to avoid a [SIM swap](https://en.wikipedia.org/wiki/SIM_swap_scam) attack.
-
-[MFA tools we recommend](../multi-factor-authentication.md){ .md-button }
-
-## More places to setup MFA
-
-Beyond just securing your website logins, multi-factor authentication can be used to secure your local logins, ssh keys or even password databases as well.
-
-### Windows
-
-Yubico has a dedicated [Credential Provider](https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows) that adds Challenge-Response authentication for the username + password login flow for local Windows accounts. If you have a YubiKey with Challenge-Response authentication support, take a look at the [Yubico Login for Windows Configuration Guide](https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide), which will allow you to set up MFA on your Windows computer.
-
-### macOS
-
-macOS has [native support](https://support.apple.com/guide/deployment/intro-to-smart-card-integration-depd0b888248/web) for authentication with smart cards (PIV). If you have a smartcard or a hardware security key that supports the PIV interface such as the YubiKey, we recommend that you follow your smartcard/hardware security vendor's documentation and set up second factor authentication for your macOS computer.
-
-Yubico have a guide [Using Your YubiKey as a Smart Card in macOS](https://support.yubico.com/hc/en-us/articles/360016649059) which can help you set up your YubiKey on macOS.
-
-After your smartcard/security key is set up, we recommend running this command in the Terminal:
-
-```text
-sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES
-```
-
-The command will prevent an adversary from bypassing MFA when the computer boots.
-
-### Linux
-
-!!! warning
-    If the [hostname](https://en.wikipedia.org/wiki/Hostname) of your system changes (such as due to DHCP), you would be unable to login. It is vital that you setup a proper hostname for your computer before following this guide.
-
-The `pam_u2f` module on Linux can provide two factor authentication for user login on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands such as "apt-get" and package names may however differ. This guide does **not** apply to Qubes OS.
-
-### Qubes OS
-
-Qubes OS has support for Challenge-Response authentication with YubiKeys. If you have a YubiKey with Challenge-Response authentication support, take a look at the Qubes OS' [YubiKey documentation](https://www.qubes-os.org/doc/yubikey/) if you want to set up MFA on Qubes OS.
-
-### SSH
-
-#### Hardware security keys
-
-SSH MFA could be set up using multiple different authentication methods that are popular with hardware security keys. We recommend that you check out Yubico's [documentation](https://developers.yubico.com/SSH/) on how to set this up.
-
-#### Time-based One-time Password (TOTP)
-
-SSH MFA can also be set up using TOTP and DigitalOcean has provided a tutorial [How To Set Up Multi-Factor Authentication for SSH on Ubuntu 20.04](https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04). Most things should be the same regardless of distribution, however the package manager commands such as "apt-get" and package names may differ.
-
-### KeePass (and KeePassXC)
-
-KeePass and KeePassXC databases can be secured using Challenge-Response or HOTP as a second factor authentication. Yubico has provided a documennt for KeePass [Using Your YubiKey with KeePass](https://support.yubico.com/hc/en-us/articles/360013779759-Using-Your-YubiKey-with-KeePass) and there is also one on the [KeePassXC](https://keepassxc.org/docs/#faq-yubikey-2fa) website.

docs/self-contained-networks.en.md

@@ -1,5 +1,5 @@
 ---
-title: Self-Contained Networks
+title: "Self-Contained Networks"
 icon: material/security-network
 ---
 If you are currently browsing clearnet and want to access the dark web, this section is for you.
@@ -10,7 +10,7 @@ If you are currently browsing clearnet and want to access the dark web, this sec
 
 !!! recommendation
 
-    ![Tor logo](./assets/img/self-contained-networks/tor.svg){ align=right }
+    ![Tor logo](assets/img/self-contained-networks/tor.svg){ align=right }
 
     The Tor network is a group of volunteer-operated servers that allows people to improve their privacy and security on the Internet. Tor's users employ this network by connecting through a series of virtual tunnels rather than making a direct connection, thus allowing both organizations and individuals to share information over public networks without compromising their privacy. Tor is an effective censorship circumvention tool.
 
@@ -32,8 +32,8 @@ If you are currently browsing clearnet and want to access the dark web, this sec
 
 !!! recommendation
 
-    ![I2P logo](./assets/img/self-contained-networks/i2p.svg#only-light){ align=right }
-    ![I2P logo](./assets/img/self-contained-networks/i2p-dark.svg#only-dark){ align=right }
+    ![I2P logo](assets/img/self-contained-networks/i2p.svg#only-light){ align=right }
+    ![I2P logo](assets/img/self-contained-networks/i2p-dark.svg#only-dark){ align=right }
 
     The Invisible Internet Project (I2P) is a computer network layer that allows applications to send messages to each other pseudonymously and securely. Uses include anonymous Web surfing, chatting, blogging, and file transfers. The software that implements this layer is called an I2P router and a computer running I2P is called an I2P node. The software is free and open-source and is published under multiple licenses.
 
@@ -55,7 +55,7 @@ If you are currently browsing clearnet and want to access the dark web, this sec
 
 !!! recommendation
 
-    ![Freenet logo](./assets/img/self-contained-networks/freenet.svg){ align=right }
+    ![Freenet logo](assets/img/self-contained-networks/freenet.svg){ align=right }
 
     Freenet is a peer-to-peer platform for censorship-resistant communication. It uses a decentralized distributed data store to keep and deliver information, and has a suite of free software for publishing and communicating on the Web without fear of censorship. Both Freenet and some of its associated tools were originally designed by Ian Clarke, who defined Freenet's goal as providing freedom of speech on the Internet with strong anonymity protection.
 

docs/setup/integrating-metadata-removal.en.md

@@ -1,6 +1,5 @@
 ---
-title: Integrating Metadata Removal
-description: "Guides for integrating metadata removal solutions in a native fashion."
+title: "Integrating Metadata Removal"
 icon: 'material/data-matrix-remove'
 ---
 
@@ -9,15 +8,15 @@ When sharing files, it's important to remove associated metadata. Image files co
 While there are plenty of metadata removal tools, they typically aren't convenient to use. The guides featured here aim to detail how to integrate metadata removal tools in a simple fashion by utilizing easy-to-access system features.
 
 !!! tip "Related"
-    For a list of the metadata removal tools that we recommend, visit our [metadata removal tools](/metadata-removal-tools/) page.
+    For a list of the metadata removal tools that we recommend, visit our [metadata removal tools](../metadata-removal-tools.md) page.
 
 ## macOS
 
-This guide uses the [Shortcuts](https://support.apple.com/guide/shortcuts-mac/intro-to-shortcuts-apdf22b0444c/mac) app to add an ExifTool script to the *Quick Actions* context menu within Finder. Shortcuts is developed by Apple and bundled in with macOS by default.
+This guide uses the [Shortcuts](https://support.apple.com/guide/shortcuts-mac/intro-to-shortcuts-apdf22b0444c/mac) app to add an [ExifTool](../metadata-removal-tools.md#exiftool) script to the *Quick Actions* context menu within Finder. Shortcuts is developed by Apple and bundled in with macOS by default.
 
 Shortcuts is quite intuitive to work with, so if you don't like the behavior demoed here then experiment with your own solution. For example, you could set the shortcut to take a clipboard input instead. The sky's the limit.
 
-![ExifTool Quick Action](/assets/img/integrating-metadata-removal/preview-macos.png)
+![ExifTool Quick Action](../assets/img/integrating-metadata-removal/preview-macos.png)
 
 ### Prerequisites
 
@@ -27,7 +26,7 @@ Shortcuts is quite intuitive to work with, so if you don't like the behavior dem
     /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
     ```
 
-2. [ExifTool](/metadata-removal-tools/#exiftool): a tool for viewing and manipulating image, audio, video, and PDF metadata.
+2. ExifTool is a tool for viewing and manipulating image, audio, video, and PDF metadata.
 
     ```bash
     brew install exiftool
@@ -64,7 +63,7 @@ Shortcuts is quite intuitive to work with, so if you don't like the behavior dem
     done
     ```
 
-![macOS metadata removal shortcut](/assets/img/integrating-metadata-removal/shortcut-macos.png)
+![macOS metadata removal shortcut](../assets/img/integrating-metadata-removal/shortcut-macos.png)
 
 !!! tip "Worth Mentioning"
     The open source [ImageOptim](https://imageoptim.com/mac) app integrates into Finder's *Services* context menu by default. While it is primarily an image optimization app, it also removes metadata.
@@ -81,11 +80,11 @@ Shortcuts is quite intuitive to work with, so if you don't like the behavior dem
 [Shortcuts](https://support.apple.com/guide/shortcuts/welcome/ios) can be made accessible through the system Share Sheet, making accessing those shortcuts very convenient. This guide will show you how to build a metadata removal shortcut and integrate it into the system *Share Sheet*.
 
 !!! attention
-    This method of metadata removal is not as comprehensive at removing metadata as utilities like [ExifTool](/metadata-removal-tools/#exiftool) and [mat2](/metadata-removal-tools/#mat2) are.
+    This method of metadata removal is not as comprehensive at removing metadata as utilities like [ExifTool](../metadata-removal-tools.md#exiftool) and [mat2](../metadata-removal-tools.md#mat2) are.
 
 The lack of *good* metadata removal apps on the App Store is what makes this solution worthwhile.
 
-![Don't preserve metadata shortcut](/assets/img/integrating-metadata-removal/preview-ios.png)
+![Don't preserve metadata shortcut](../assets/img/integrating-metadata-removal/preview-ios.png)
 
 ### Prerequisites
 
@@ -113,7 +112,7 @@ The lack of *good* metadata removal apps on the App Store is what makes this sol
 
 10. Make sure that you uncheck **preserve metadata**
 
-![iOS/iPadOS metadata removal shortcut](/assets/img/integrating-metadata-removal/shortcut-ios.png)
+![iOS/iPadOS metadata removal shortcut](../assets/img/integrating-metadata-removal/shortcut-ios.png)
 
 ### Enabling & using the Shortcut
 
@@ -122,13 +121,13 @@ The lack of *good* metadata removal apps on the App Store is what makes this sol
 
 ## Windows
 
-Windows allows users to place files in a **SendTo** folder which then appear in the *Send to* context menu. This guide will show you how to add an ExifTool batch script to this menu.
+Windows allows users to place files in a **SendTo** folder which then appear in the *Send to* context menu. This guide will show you how to add an [ExifTool](../metadata-removal-tools.md#exiftool) batch script to this menu.
 
-![Send to metadata removal shortcut](/assets/img/integrating-metadata-removal/preview-windows.jpg)
+![Send to metadata removal shortcut](../assets/img/integrating-metadata-removal/preview-windows.jpg)
 
 ### Prerequisites
 
-1. [ExifTool](/metadata-removal-tools/#exiftool): a tool for viewing and manipulating image, audio, video, and PDF metadata. We suggest you read the [Installation instructions](https://exiftool.org/install.html#Windows) on the official website.
+1. ExifTool is a tool for viewing and manipulating image, audio, video, and PDF metadata. We suggest you read the [Installation instructions](https://exiftool.org/install.html#Windows) on the official website.
 
 !!! note
     You can check if ExifTool is present in your [PATH](https://www.computerhope.com/issues/ch000549.htm) by running `exiftool -ver` in Command Prompt. You should see a version number.
@@ -161,4 +160,4 @@ Windows allows users to place files in a **SendTo** folder which then appear in
 
 ### Using the shortcut
 
-1. Right click a supported file and choose **ExifTool.bat** within the *Send to* context menu
+1. Right click a supported file and choose **ExifTool.bat** within the *Send to* context menu.

docs/social-networks.md

@@ -1,99 +0,0 @@
----
-title: Social Networks
-icon: material/account-supervisor-circle-outline
----
-Find a social network that doesn’t pry into your data or monetize your profile.
-
-## Decentralized Social Networks
-
-### Mastodon (Twitter Alternative)
-
-!!! recommendation
-
-    ![Mastodon logo](/assets/img/social-networks/mastodon.svg){ align=right }
-
-    Mastodon is a social network based on open web protocols and free, open-source software. It is decentralized like email, users can exist on different servers or even different platforms but still communicate with each other. It also has the most users, and the most diverse (in terms of interests) users, it looks good, and it is easy to setup yourself.
-
-    [Visit joinmastodon.org](https://joinmastodon.org){ .md-button .md-button--primary } [Privacy Policy](https://joinmastodon.org/privacy-policy){ .md-button }
-
-    **Downloads**
-    - [:fontawesome-brands-app-store-ios: App Store](https://apps.apple.com/us/app/mastodon-for-iphone/id1571998974)
-    - [:fontawesome-regular-circle-down: All other apps](https://joinmastodon.org/apps)
-    - [:fontawesome-brands-github: Source](https://github.com/mastodon)
-
-### diaspora\* (Google+ Alternative)
-
-!!! recommendation
-
-    ![diaspora* logo](/assets/img/social-networks/diaspora.svg){ align=right }
-
-    diaspora\* is based on three key philosophies: Decentralization, Freedom, and Privacy. It is intended to address privacy concerns related to centralized social networks by allowing users set up their own server (or "pod") to host content. Pods can then interact to share status updates, photographs, and other social data.
-
-    [Visit diasporafoundation.org](https://diasporafoundation.org){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-regular-circle-down: All apps](https://wiki.diasporafoundation.org/Tools_to_use_with_Diaspora)
-    - [:fontawesome-brands-github: Source](https://github.com/diaspora)
-
-### Friendica (Facebook Alternative)
-
-!!! recommendation
-
-    ![Frendica logo](/assets/img/social-networks/friendica.svg){ align=right }
-
-    **Friendica** has an emphasis on extensive privacy settings and easy server installation. It aims to federate with as many other social networks as possible. Currently, Friendica users can integrate contacts from Facebook, Twitter, Diaspora, GNU social, App.net, Pump.io and other services in their social streams.
-
-    [Visit friendi.ca](https://friendi.ca){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-regular-circle-down: All apps](https://friendi.ca/resources/mobile-clients/)
-    - [:fontawesome-brands-github: Source](https://github.com/friendica)
-
-### PixelFed (Instagram Alternative)
-
-!!! recommendation
-
-    ![PixelFed logo](/assets/img/social-networks/pixelfed.svg){ align=right }
-
-    **PixelFed** is a free and ethical photo sharing platform, powered by ActivityPub federation. Pixelfed is an open-source, federated platform. You can run your own instance or join an [existing one](https://fediverse.party/en/pixelfed).
-
-    [Visit pixelfed.org](https://pixelfed.org){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-brands-github: Source](https://github.com/pixelfed)
-
-### Pleroma (Twitter Alternative)
-
-!!! recommendation
-
-    ![Pleroma logo](/assets/img/social-networks/pleroma.svg){ align=right }
-
-    **Pleroma** is a free, federated social networking server built on open protocols. It is compatible with Mastodon and many other ActivityPub and OStatus implementations.
-
-    [Visit pleroma.social](https://pleroma.social){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-regular-circle-down: All apps](https://docs-develop.pleroma.social/backend/clients/)
-    - [:fontawesome-brands-gitlab: Source](https://git.pleroma.social/pleroma)
-
-### Movim
-
-!!! recommendation
-
-    ![Movim logo](/assets/img/social-networks/movim.svg){ align=right }
-
-    **Movim** is a federated social platform that relies on the XMPP standard and therefore allows you to exchange with many other clients on all devices.
-
-    **Downloads**
-    - [:fontawesome-brands-github: Source](https://github.com/movim)
-
-## Related Information
-
-- [JustDeleteMe](https://justdeleteme.xyz) - A directory of direct links to delete your account from web services.
-- [Forget](https://forget.codl.fr) - A service that automatically deletes your old posts on Twitter and Mastodon that everyone has forgotten about.
-
-## Facebook Related
-
-- [How do I permanently delete my Facebook account?](https://www.facebook.com/help/224562897555674)
-- [Facebook Container by Mozilla](https://addons.mozilla.org/firefox/addon/facebook-container)
-- [Stop using Facebook](https://web.archive.org/web/20190510075433/https://www.stopusingfacebook.co/) - A curated list of reasons to stop using Facebook and how to do it.

docs/social-news-aggregator.md

@@ -1,57 +0,0 @@
----
-title: Social News Aggregator
-icon: material/newspaper-variant-outline
----
-Stay up-to-date with privacy-respecting online bulletin boards.
-
-### Tildes
-
-!!! recommendation
-
-    ![Tildes logo](/assets/img/social-media-aggregator/tildes.svg){ align=right }
-
-    **Tildes** is a web-based self-hostable online bulletin board. It is licensed under [AGPLv3](https://gitlab.com/tildes/tildes/blob/master/LICENSE).
-
-    [Visit tildes.net](https://tildes.net){ .md-button .md-button--primary } [Privacy Policy](https://docs.tildes.net/policies/privacy-policy){ .md-button }
-
-    **Downloads**
-    - [:fontawesome-brands-gitlab: Source](hhttps://gitlab.com/tildes)
-
-### Lemmy
-
-!!! recommendation
-
-    ![Lemmy logo](/assets/img/social-media-aggregator/lemmy.svg){ align=right }
-
-    **Lemmy** is an [AGPL](https://github.com/dessalines/lemmy/blob/master/LICENSE)-licensed self-hostable link aggregator and discussion network designed to serve as an alternative to Reddit within the ActivityPub [Fediverse](https://www.wikipedia.org/wiki/Fediverse).
-
-    [Visit lemmy.ml](https://lemmy.ml){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-brands-github: Source](https://github.com/LemmyNet)
-
-### Postmill
-
-!!! recommendation
-
-    ![Postmill logo](/assets/img/social-media-aggregator/postmill.png){ align=right }
-
-    **Postmill** is a free, web-based, social link aggregator with voting and nested comments.
-
-    [Visit postmill.xyz](https://postmill.xyz){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-brands-gitlab: Source](https://gitlab.com/postmill)
-
-### Freepost
-
-!!! recommendation
-
-    ![Freepost logo](/assets/img/social-media-aggregator/freepost.svg){ align=right }
-
-    **Freepost** is a free and open-source discussion board based on free software and free culture with a highly motivated community.
-
-    [Visit freepo.st](https://freepo.st){ .md-button .md-button--primary }
-
-    **Downloads**
-    - [:fontawesome-brands-git: Source](https://notabug.org/zPlus/freepost)

docs/stylesheets/extra.css

@@ -145,3 +145,8 @@ h1, h2, h3, .md-header__topic {
 .md-nav__link svg {
     width: 22px;
 }
+
+/* Unsticky sidebar without JS */
+.no-js .md-sidebar {
+    align-self: auto;
+}

docs/technology/dns.en.md

@@ -109,7 +109,7 @@ We can see the [connection establishment](https://en.wikipedia.org/wiki/Transmis
 
 ## Why **shouldn't** I use encrypted DNS?
 
-In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](/threat-modeling/). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](https://torproject.org) or a [VPN](/vpn) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity.
+In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](../threat-modeling.md). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](https://torproject.org) or a [VPN](vpn) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity.
 
 When we do a DNS lookup, it's generally because we want to access a resource. Below, we will discuss some of the methods that may disclose your browsing activities even when using encrypted DNS:
 
@@ -281,7 +281,7 @@ Encrypted DNS with a 3rd party should only be used to get around redirects and b
 
 ## What is DNSSEC and when is it used?
 
-[Domain Name System Security Extensions (DNSSEC)](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) is used to provide authenticity to the records being fetched from upstream DNS servers. It doesn't provide confidentiality, for that we use one of the [encrypted DNS](/dns#what-is-encrypted-dns) protocols discussed above.
+[Domain Name System Security Extensions (DNSSEC)](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) is used to provide authenticity to the records being fetched from upstream DNS servers. It doesn't provide confidentiality, for that we use one of the [encrypted DNS](#what-is-encrypted-dns) protocols discussed above.
 
 ## What is QNAME minimization?
 

docs/threat-modeling.en.md

@@ -1,6 +1,5 @@
 ---
-layout: evergreen
-title: What are threat models?
+title: "What are threat models?"
 icon: 'material/target-account'
 ---
 

docs/tools.en.md

@@ -0,0 +1,388 @@
+---
+title: "Privacy Tools"
+icon: material/tools
+hide:
+  - toc
+---
+
+If you're looking for a specific solution to something, these are the hardware and software tools we recommend in a variety of categories. Our recommended privacy tools are primarily chosen based on security features, with additional emphasis on decentralized and open-source tools. They are applicable to a variety of threat models ranging from protection against global mass surveillance programs and avoiding big tech companies to mitigating attacks, but only you can determine what will work best for your use case.
+
+If you want assistance figuring out the best privacy tools and alternative programs for your workload/use-case, start a discussion in our [Reddit](https://www.reddit.com/r/privacyguides) or [Matrix](https://matrix.to/#/#privacyguides:matrix.org) communities!
+
+For your convenience, everything we recommend is listed below with a link to the project's homepage. For more details about each project, why they were chosen, and additional tips or tricks we recommend, click the "Learn more" link in each section.
+
+## Web Browsers
+
+<div class="grid cards" markdown>
+
+- ![Tor Browser logo](assets/img/browsers/tor.svg){ .twemoji } [Tor Browser](https://www.torproject.org/)
+- ![Firefox logo](assets/img/browsers/firefox.svg){ .twemoji } [Firefox (Desktop)](https://firefox.com/)
+- ![Bromite logo](assets/img/browsers/bromite.svg){ .twemoji } [Bromite (Android)](https://www.bromite.org/)
+- ![Safari logo](assets/img/browsers/safari.svg){ .twemoji } [Safari (iOS)](https://www.apple.com/safari/)
+
+</div>
+
+**Additional Resources:**
+
+<div class="grid cards annotate" markdown>
+
+- ![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ .twemoji } [uBlock Origin](https://github.com/gorhill/uBlock)
+- ![AdGuard logo](assets/img/browsers/adguard.svg){ .twemoji } [AdGuard for Safari](https://adguard.com/en/adguard-safari/overview.html)
+- ![ToS;DR logo](assets/img/browsers/terms_of_service_didnt_read.svg){ .twemoji } [Terms of Service; Didn't Read](https://tosdr.org/) (1)
+
+</div>
+
+1. We do not recommend installing ToS;DR as a browser extension. The same information is provided on their website.
+
+[Learn more :material-arrow-right:](browsers.md)
+
+## Operating Systems
+
+### Android
+
+<div class="grid cards" markdown>
+
+- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji } [GrapheneOS](https://grapheneos.org/)
+- ![CalyxOS logo](assets/img/android/calyxos.svg){ .twemoji } [CalyxOS](https://calyxos.org/)
+- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji } [DivestOS](https://divestos.org/)
+
+</div>
+
+**Android Apps:**
+
+<div class="grid cards" markdown>
+
+- ![Droid-ify logo](assets/img/android/droid-ify.png){ .twemoji } [Droid-ify (F-Droid Client)](https://github.com/Iamlooker/Droid-ify)
+- ![Orbot logo](assets/img/android/orbot.svg){ .twemoji } [Orbot (Tor Proxy)](https://orbot.app/)
+- ![Shelter logo](assets/img/android/shelter.svg){ .twemoji } [Shelter (Work Profiles)](https://gitea.angry.im/PeterCxy/Shelter)
+- ![Auditor logo](assets/img/android/auditor.svg#only-light){ .twemoji }![GrapheneOS logo](assets/img/android/auditor-dark.svg#only-dark){ .twemoji } [Auditor (Supported Devices)](https://attestation.app/)
+- ![Secure Camera logo](assets/img/android/secure_camera.svg#only-light){ .twemoji }![Secure Camera logo](assets/img/android/secure_camera-dark.svg#only-dark){ .twemoji } [Secure Camera](https://github.com/GrapheneOS/Camera)
+- ![Secure PDF Viewer logo](assets/img/android/secure_pdf_viewer.svg#only-light){ .twemoji }![GrapheneOS logo](assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ .twemoji } [Secure PDF Viewer](https://github.com/GrapheneOS/PdfViewer)
+- ![PrivacyBlur logo](assets/img/android/privacyblur.svg){ .twemoji } [PrivacyBlur](https://privacyblur.app/)
+
+</div>
+
+[Learn more :material-arrow-right:](android.md)
+
+### Linux
+
+<div class="grid cards annotate" markdown>
+
+- ![Fedora logo](assets/img/linux-desktop/fedora-workstation.svg){ .twemoji } [Fedora Workstation](https://getfedora.org/)
+- ![openSUSE Tumbleweed logo](assets/img/linux-desktop/opensuse-tumbleweed.svg){ .twemoji } [OpenSUSE Tumbleweed](https://get.opensuse.org/tumbleweed/)
+- ![Arch logo](assets/img/linux-desktop/archlinux.svg){ .twemoji } [Arch Linux](https://archlinux.org/)
+- ![Fedora Silverblue logo](assets/img/linux-desktop/fedora-silverblue.svg){ .twemoji } [Fedora Silverblue & Kinoite](https://silverblue.fedoraproject.org/)
+- ![nixOS logo](assets/img/linux-desktop/nixos.svg){ .twemoji } [NixOS](https://nixos.org/)
+- ![Whonix logo](assets/img/linux-desktop/whonix.svg){ .twemoji } [Whonix (Tor)](https://www.whonix.org/)
+- ![Tails logo](assets/img/linux-desktop/tails.svg){ .twemoji } [Tails (Live Boot)](https://tails.boum.org/)
+- ![Qubes OS logo](assets/img/qubes/qubes_os.svg){ .twemoji } [Qubes OS (Xen VM Distribution)](https://www.qubes-os.org/) (1)
+
+</div>
+
+1. Qubes uses Xen to provide strong sandboxing between multiple Linux virtual machine installations, and can run most Linux applications. [Learn more about Qubes...](qubes.md)
+
+[Learn more :material-arrow-right:](linux-desktop.md)
+
+### Router Firmware
+
+<div class="grid cards" markdown>
+
+- ![OpenWrt logo](assets/img/router/openwrt.svg#only-light){ .twemoji }![OpenWrt logo](assets/img/router/openwrt-dark.svg#only-dark){ .twemoji } [OpenWrt](https://openwrt.org/)
+- ![pfSense logo](assets/img/router/pfsense.svg#only-light){ .twemoji }![pfSense logo](assets/img/router/pfsense-dark.svg#only-dark){ .twemoji } [pfSense](https://www.pfsense.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](router.md)
+
+## Service Providers
+
+### Cloud Storage
+
+<div class="grid cards" markdown>
+
+- ![Nextcloud logo](assets/img/cloud/nextcloud.svg){ .twemoji } [Nextcloud (Self-Hostable)](https://nextcloud.com/)
+- ![Proton Drive logo](assets/img/cloud/protondrive.svg){ .twemoji } [Proton Drive](https://drive.protonmail.com/)
+- ![Cryptee logo](assets/img/cloud/cryptee.svg#only-light){ .twemoji }![Cryptee logo](assets/img/cloud/cryptee-dark.svg#only-dark){ .twemoji } [Cryptee](https://crypt.ee/)
+- ![Tahoe-LAFS logo](assets/img/cloud/tahoe-lafs.svg#only-light){ .twemoji }![Tahoe-LAFS logo](assets/img/cloud/tahoe-lafs-dark.svg#only-dark){ .twemoji } [Tahoe-LAFS (Advanced)](https://www.tahoe-lafs.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](cloud.md)
+
+### DNS
+
+We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS servers based on a variety of criteria. Some no-logging choices include [MullvadDNS](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) and [Quad9](https://quad9.net/), but we recommend you read our full page on DNS before choosing a provider. In many cases using an alternative DNS provider is not recommended. [Learn more :material-arrow-right:](dns.md)
+
+### Email
+
+<div class="grid cards" markdown>
+
+- ![ProtonMail logo](assets/img/email/mini/protonmail.svg){ .twemoji } [ProtonMail](https://protonmail.com/)
+- ![Mailbox.org logo](assets/img/email/mini/mailboxorg.svg){ .twemoji } [Mailbox.org](https://mailbox.org/)
+- ![Disroot logo](assets/img/email/mini/disroot.svg#only-light){ .twemoji }![Disroot logo](assets/img/email/mini/disroot-dark.svg#only-dark){ .twemoji } [Disroot](https://disroot.org/)
+- ![Tutanota logo](assets/img/email/mini/tutanota.svg){ .twemoji } [Tutanota](https://tutanota.com/)
+- ![StartMail logo](assets/img/email/mini/startmail.svg#only-light){ .twemoji }![StartMail logo](assets/img/email/mini/startmail-dark.svg#only-dark){ .twemoji } [StartMail](https://startmail.com/)
+- ![CTemplar logo](assets/img/email/mini/ctemplar.svg#only-light){ .twemoji }![CTemplar logo](assets/img/email/mini/ctemplar-dark.svg#only-dark){ .twemoji } [CTemplar](https://ctemplar.com/)
+
+</div>
+
+**Email Cloaking Services:**
+
+<div class="grid cards" markdown>
+
+- ![AnonAddy logo](assets/img/email/mini/anonaddy.svg#only-light){ .twemoji }![AnonAddy logo](assets/img/email/mini/anonaddy-dark.svg#only-dark){ .twemoji } [AnonAddy](https://anonaddy.com/)
+- ![SimpleLogin logo](assets/img/email/mini/simplelogin.svg){ .twemoji } [SimpleLogin](https://simplelogin.io/)
+
+</div>
+
+**Self-Hosting Email:**
+
+<div class="grid cards" markdown>
+
+- ![Mail-in-a-Box logo](assets/img/email/mail-in-a-box.svg){ .twemoji } [Mail-in-a-Box](https://mailinabox.email/)
+- ![mailcow logo](assets/img/email/mailcow.svg){ .twemoji } [mailcow](https://mailcow.email/)
+
+</div>
+
+[Learn more :material-arrow-right:](email.md)
+
+### Search Engines
+
+<div class="grid cards" markdown>
+
+- ![DuckDuckGo logo](assets/img/search-engines/duckduckgo.svg){ .twemoji } [DuckDuckGo](https://duckduckgo.com/)
+- ![Startpage logo](assets/img/search-engines/startpage.svg){ .twemoji } [Startpage](https://www.startpage.com/)
+- ![Mojeek logo](assets/img/search-engines//mini/mojeek.svg){ .twemoji } [Mojeek](https://www.mojeek.com/)
+- ![Searx logo](assets/img/search-engines/searx.svg){ .twemoji } [Searx](https://searx.me/)
+
+</div>
+
+[Learn more :material-arrow-right:](search-engines.md)
+
+### VPN Providers
+
+??? danger "VPNs do not provide anonymity"
+
+    Using a VPN will **not** keep your browsing habits anonymous, nor will it add additional security to non-secure (HTTP) traffic.
+
+    If you are looking for **anonymity**, you should use the Tor Browser **instead** of a VPN.
+
+    If you're looking for added **security**, you should always ensure you're connecting to websites using [HTTPS](https://en.wikipedia.org/wiki/HTTPS). A VPN is not a replacement for good security practices.
+
+    [Learn more :material-arrow-right:](vpn.md)
+
+<div class="grid cards" markdown>
+
+- ![Mullvad logo](assets/img/vpn/mini/mullvad.svg){ .twemoji } [Mullvad](https://mullvad.net/)
+- ![ProtonVPN logo](assets/img/vpn/mini/protonvpn.svg){ .twemoji } [ProtonVPN](https://protonvpn.com/)
+- ![IVPN logo](assets/img/vpn/mini/ivpn.svg){ .twemoji } [IVPN](https://www.ivpn.net/)
+
+</div>
+
+[Learn more :material-arrow-right:](vpn.md)
+
+## Software
+
+### Calendar/Contacts Sync
+
+<div class="grid cards" markdown>
+
+- ![Tutanota logo](assets/img/calendar-contacts/tutanota.svg){ .twemoji } [Tutanota (SaaS)](https://tutanota.com/calendar)
+- ![Proton Calendar logo](assets/img/calendar-contacts/proton-calendar.svg){ .twemoji } [Proton Calendar (SaaS)](https://calendar.protonmail.com/)
+- ![EteSync logo](assets/img/calendar-contacts/etesync.svg){ .twemoji } [EteSync](https://www.etesync.com/)
+- ![Tutanota logo](assets/img/calendar-contacts/nextcloud.svg){ .twemoji } [Nextcloud](https://nextcloud.com/)
+- ![DecSync CC logo](assets/img/calendar-contacts/decsync.svg){ .twemoji } [DecSync](https://github.com/39aldo39/DecSync)
+
+</div>
+
+[Learn more :material-arrow-right:](calendar-contacts.md)
+
+### Notebooks
+
+<div class="grid cards" markdown>
+
+- ![Joplin logo](assets/img/notebooks/joplin.svg){ .twemoji } [Joplin](https://joplinapp.org/)
+- ![Standard Notes logo](assets/img/notebooks/standard-notes.svg){ .twemoji } [Standard Notes](https://standardnotes.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](notebooks.md)
+
+### Email Clients
+
+<div class="grid cards" markdown>
+
+- ![Thunderbird logo](assets/img/email-clients/thunderbird.svg){ .twemoji } [Thunderbird](https://www.thunderbird.net/)
+- ![Apple Mail logo](assets/img/email-clients/applemail.png){ .twemoji } [Apple Mail](https://support.apple.com/guide/mail/welcome/mac)
+- ![GNOME Evolution logo](assets/img/email-clients/evolution.svg){ .twemoji } [GNOME Evolution (Linux)](https://wiki.gnome.org/Apps/Evolution)
+- ![Kontact logo](assets/img/email-clients/kontact.svg){ .twemoji } [Kontact (Linux)](https://kontact.kde.org/)
+- ![Mailvelope logo](assets/img/email-clients/mailvelope.svg){ .twemoji } [Mailvelope (PGP in standard webmail)](https://www.mailvelope.com/)
+- ![K-9 Mail logo](assets/img/email-clients/k9mail.svg){ .twemoji } [K-9 Mail (Android)](https://k9mail.app/)
+- ![FairEmail logo](assets/img/email-clients/fairemail.svg){ .twemoji } [FairEmail (Android)](https://email.faircode.eu/)
+- ![Canary Mail logo](assets/img/email-clients/canarymail.svg){ .twemoji } [Canary Mail (iOS)](https://canarymail.io/)
+- ![NeoMutt logo](assets/img/email-clients/mutt.svg){ .twemoji } [NeoMutt (CLI)](https://neomutt.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](email-clients.md)
+
+### Encryption Tools
+
+??? info "Operating System Disk Encryption"
+
+    For encrypting your operating system drive, we typically recommend using whichever encryption tool your operating system provides, whether that is **BitLocker** on Windows, **FileVault** on macOS, or **LUKS** on Linux. These tools are available out of the box and typically utilize hardware encryption elements such as a TPM that other full-disk encryption software like VeraCrypt will not. VeraCrypt is still suitable for non-operating system disks such as external drives, especially drives that may be accessed from multiple operating systems.
+
+    [Learn more :material-arrow-right:](encryption.md##operating-system-included-full-disk-encryption-fde)
+
+<div class="grid cards" markdown>
+
+- ![VeraCrypt logo](assets/img/encryption-software/veracrypt.svg#only-light){ .twemoji }![VeraCrypt logo](assets/img/encryption-software/veracrypt-dark.svg#only-dark){ .twemoji } [VeraCrypt (FDE)](https://veracrypt.fr/)
+- ![Cryptomator logo](assets/img/encryption-software/cryptomator.svg){ .twemoji } [Cryptomator](https://cryptomator.org/)
+- ![Picocrypt logo](assets/img/encryption-software/picocrypt.svg){ .twemoji } [Picocrypt](https://evansu.cc/picocrypt)
+- ![Hat.sh logo](assets/img/encryption-software/hat-sh.png#only-light){ .twemoji }![Hat.sh logo](assets/img/encryption-software/hat-sh-dark.png#only-dark){ .twemoji } [Hat.sh (Browser-based)](https://hat.sh/)
+- ![Kryptor logo](assets/img/encryption-software/kryptor.png){ .twemoji } [Kryptor](https://www.kryptor.co.uk/)
+- ![Tomb logo](assets/img/encryption-software/tomb.png){ .twemoji } [Tomb](https://www.dyne.org/software/tomb)
+
+</div>
+
+**OpenPGP Clients:**
+
+<div class="grid cards" markdown>
+
+- ![GnuPG logo](assets/img/encryption-software/gnupg.svg){ .twemoji } [GnuPG](https://gnupg.org)
+- ![GPG4Win logo](assets/img/encryption-software/gpg4win.svg){ .twemoji } [GPG4Win (Windows)](https://gpg4win.org)
+- ![GPG Suite logo](assets/img/encryption-software/gpgsuite.png){ .twemoji } [GPG Suite (macOS)](https://gpgtools.org)
+- ![OpenKeychain logo](assets/img/encryption-software/openkeychain.svg){ .twemoji } [OpenKeychain](https://www.openkeychain.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](encryption.md)
+
+### File Sharing
+
+<div class="grid cards" markdown>
+
+- ![OnionShare logo](assets/img/file-sharing-sync/onionshare.svg){ .twemoji } [OnionShare](https://onionshare.org/)
+- ![Magic Wormhole logo](assets/img/file-sharing-sync/magic_wormhole.png){ .twemoji } [Magic Wormhole](https://magic-wormhole.readthedocs.io/)
+- ![FreedomBox logo](assets/img/file-sharing-sync/freedombox.svg){ .twemoji } [FreedomBox](https://freedombox.org/)
+- ![Syncthing logo](assets/img/file-sharing-sync/syncthing.svg){ .twemoji } [Syncthing](https://syncthing.net/)
+- ![git-annex logo](assets/img/file-sharing-sync/gitannex.svg){ .twemoji } [git-annex](https://git-annex.branchable.com/)
+
+</div>
+
+[Learn more :material-arrow-right:](file-sharing.md)
+
+### Metadata Removal Tools
+
+<div class="grid cards" markdown>
+
+- ![MAT2 logo](assets/img/metadata-removal/mat2.svg){ .twemoji } [MAT2](https://0xacab.org/jvoisin/mat2)
+- ![ExifCleaner logo](assets/img/metadata-removal/exifcleaner.svg){ .twemoji } [ExifCleaner](https://exifcleaner.com/)
+- ![Scrambled Exif logo](assets/img/metadata-removal/scrambled-exif.svg){ .twemoji } [Scrambled Exif (Android)](https://gitlab.com/juanitobananas/scrambled-exif)
+- ![Imagepipe logo](assets/img/metadata-removal/imagepipe.svg){ .twemoji } [Imagepipe (Android)](https://codeberg.org/Starfish/Imagepipe)
+- ![Metapho logo](assets/img/metadata-removal/metapho.jpg){ .twemoji } [Metapho (iOS)](https://zininworks.com/metapho)
+- ![ExifTool logo](assets/img/metadata-removal/exiftool.png){ .twemoji } [ExifTool (CLI)](https://exiftool.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](metadata-removal-tools.md)
+
+### Multi-Factor Authentication Tools
+
+<div class="grid cards" markdown>
+
+- ![YubiKeys](assets/img/multi-factor-authentication/yubikey.png){ .twemoji } [YubiKey](https://www.yubico.com/)
+- ![Nitrokey](assets/img/multi-factor-authentication/nitrokey.jpg){ .twemoji } [Nitrokey](https://www.nitrokey.com/)
+- ![Aegis logo](assets/img/multi-factor-authentication/aegis.png){ .twemoji } [Aegis Authenticator](https://getaegis.app/)
+- ![Raivo OTP logo](assets/img/multi-factor-authentication/raivo-otp.png){ .twemoji } [Raivo OTP](https://github.com/raivo-otp/ios-application)
+
+</div>
+
+[Learn more :material-arrow-right:](multi-factor-authentication.md)
+
+### Password Managers
+
+<div class="grid cards" markdown>
+
+- ![KeePassXC logo](assets/img/password-management/keepassxc.svg){ .twemoji } [KeePassXC](https://keepassxc.org/)
+- ![KeePassDX logo](assets/img/password-management/keepassdx.svg){ .twemoji } [KeePassDX (Android)](https://www.keepassdx.com/)
+- ![Bitwarden logo](assets/img/password-management/bitwarden.svg){ .twemoji } [Bitwarden](https://bitwarden.com/)
+- ![Psono logo](assets/img/password-management/psono.svg){ .twemoji } [Psono](https://psono.com/)
+- ![gopass logo](assets/img/password-management/gopass.svg){ .twemoji } [gopass](https://www.gopass.pw/)
+- ![Vaultwarden logo](assets/img/password-management/vaultwarden.svg#only-light){ .twemoji }![Vaultwarden logo](assets/img/password-management/vaultwarden-dark.svg#only-dark){ .twemoji } [Vaultwarden (Bitwarden Server)](https://github.com/dani-garcia/vaultwarden)
+
+</div>
+
+[Learn more :material-arrow-right:](passwords.md)
+
+### Productivity Tools
+
+<div class="grid cards" markdown>
+
+- ![LibreOffice logo](assets/img/productivity/libreoffice.svg){ .twemoji } [LibreOffice](https://www.libreoffice.org/)
+- ![OnlyOffice logo](assets/img/productivity/onlyoffice.svg){ .twemoji } [OnlyOffice](https://www.onlyoffice.com/)
+- ![Framadate logo](assets/img/productivity/framadate.svg){ .twemoji } [Framadate (Appointment Planning)](https://framadate.org/)
+- ![PrivateBin logo](assets/img/productivity/privatebin.svg){ .twemoji } [PrivateBin (Pastebin)](https://privatebin.info/)
+- ![CryptPad logo](assets/img/productivity/cryptpad.svg){ .twemoji } [CryptPad](https://cryptpad.fr/)
+- ![Write.as logo](assets/img/productivity/writeas.svg#only-light){ .twemoji }![Write.as logo](assets/img/productivity/writeas-dark.svg#only-dark){ .twemoji } [Write.as (Blogging Platform)](https://write.as/)
+- ![VSCodium logo](assets/img/productivity/vscodium.svg){ .twemoji } [VSCodium (Source-Code Editor)](https://vscodium.com/)
+
+</div>
+
+[Learn more :material-arrow-right:](productivity.md)
+
+### Real-Time Communication
+
+<div class="grid cards" markdown>
+
+- ![Signal logo](assets/img/messengers/signal.svg){ .twemoji } [Signal](https://signal.org/)
+- ![Element logo](assets/img/messengers/element.svg){ .twemoji } [Element](https://element.io/)
+- ![Briar logo](assets/img/messengers/briar.svg){ .twemoji } [Briar (Android)](https://briarproject.org/)
+- ![Session logo](assets/img/messengers/session.svg){ .twemoji } [Session](https://getsession.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](real-time-communication.md)
+
+### News Aggregators
+
+<div class="grid cards" markdown>
+
+- ![Fluent Reader](assets/img/news-aggregators/fluent-reader.svg){ .twemoji } [Fluent Reader](https://hyliu.me/fluent-reader)
+- ![GNOME Feeds](assets/img/news-aggregators/gfeeds.svg){ .twemoji } [GNOME Feeds](https://gfeeds.gabmus.org)
+- ![Akregator](assets/img/news-aggregators/akregator.svg){ .twemoji } [Akregator](https://apps.kde.org/akregator)
+- ![Handy News Reader](assets/img/news-aggregators/handy-news-reader.svg){ .twemoji } [Handy News Reader](https://github.com/yanus171/Handy-News-Reader)
+- ![NetNewsWire](assets/img/news-aggregators/netnewswire.png){ .twemoji } [NetNewsWire](https://netnewswire.com)
+- ![Miniflux](assets/img/news-aggregators/miniflux.svg#only-light){ .twemoji }![Miniflux logo](assets/img/news-aggregators/miniflux-dark.svg#only-dark){ .twemoji } [Miniflux](https://miniflux.app)
+- ![Newsboat](assets/img/news-aggregators/newsboat.svg){ .twemoji } [Newsboat](https://newsboat.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](news-aggregators.md)
+
+### Self-Contained Networks
+
+<div class="grid cards" markdown>
+
+- ![Tor logo](./assets/img/self-contained-networks/tor.svg){ .twemoji } [Tor](https://www.torproject.org/)
+- ![I2P logo](./assets/img/self-contained-networks/i2p.svg#only-light){ .twemoji } ![I2P logo](./assets/img/self-contained-networks/i2p-dark.svg#only-dark){ .twemoji } [I2P](https://geti2p.net/)
+- ![Freenet logo](./assets/img/self-contained-networks/freenet.svg){ .twemoji } [Freenet](https://freenetproject.org/)
+
+</div>
+
+[Learn more :material-arrow-right:](self-contained-networks.md)
+
+### Video Streaming Clients
+
+<div class="grid cards" markdown>
+
+- ![FreeTube logo](assets/img/video-streaming/freetube.svg){ .twemoji } [FreeTube (YouTube, Desktop)](https://freetubeapp.io/)
+- ![LBRY logo](assets/img/video-streaming/lbry.svg){ .twemoji } [LBRY](https://lbry.com/)
+- ![NewPipe logo](assets/img//video-streaming/newpipe.svg){ .twemoji } [NewPipe (YouTube, Android)](https://newpipe.net/)
+- ![NewPipe x SponsorBlock logo](assets/img/video-streaming/newpipe.svg){ .twemoji } [NewPipe x Sponsorblock](https://github.com/polymorphicshade/NewPipe)
+- ![Invidious logo](assets/img/video-streaming/invidious.svg#only-light){ .twemoji }![Invidious logo](assets/img/video-streaming/invidious-dark.svg#only-dark){ .twemoji } [Invidious (YouTube, Web)](https://invidious.io/)
+- ![Piped logo](assets/img/video-streaming/piped.svg){ .twemoji } [Piped (YouTube, Web)](https://piped.kavin.rocks/)
+
+</div>
+
+[Learn more :material-arrow-right:](video-streaming.md)

docs/tools.md

@@ -1,413 +0,0 @@
----
-title: Recommended Privacy Tools
-icon: material/tools
-hide:
-  - toc
----
-
-If you're looking for a specific solution to something, these are the hardware and software tools we recommend in a variety of categories. Our recommended privacy tools are primarily chosen based on security features, with additional emphasis on decentralized and open-source tools. They are applicable to a variety of threat models ranging from protection against global mass surveillance programs and avoiding big tech companies to mitigating attacks, but only you can determine what will work best for your use case.
-
-If you want assistance figuring out the best privacy tools and alternative programs for your workload/use-case, start a discussion in our [Reddit](https://www.reddit.com/r/privacyguides) or [Matrix](https://matrix.to/#/#privacyguides:matrix.org) communities!
-
-For your convenience, everything we recommend is listed below with a link to the project's homepage. For more details about each project, why they were chosen, and additional tips or tricks we recommend, click the "Learn more" link in each section.
-
-## Web Browsers
-
-<div class="grid cards" markdown>
-
-- ![Tor Browser logo](/assets/img/browsers/tor.svg){ .twemoji } [Tor Browser](https://www.torproject.org/)
-- ![Firefox logo](/assets/img/browsers/firefox.svg){ .twemoji } [Firefox (Desktop)](https://firefox.com/)
-- ![Bromite logo](/assets/img/browsers/bromite.svg){ .twemoji } [Bromite (Android)](https://www.bromite.org/)
-- ![Safari logo](/assets/img/browsers/safari.svg){ .twemoji } [Safari (iOS)](https://www.apple.com/safari/)
-
-</div>
-
-**Additional Resources:**
-
-<div class="grid cards" markdown>
-
-- ![uBlock Origin logo](/assets/img/browsers/ublock_origin.svg){ .twemoji } [uBlock Origin](https://github.com/gorhill/uBlock)
-- ![AdGuard logo](/assets/img/browsers/adguard.svg){ .twemoji } [AdGuard for Safari](https://adguard.com/en/adguard-safari/overview.html)
-- ![ToS;DR logo](/assets/img/browsers/terms_of_service_didnt_read.svg){ .twemoji } [Terms of Service; Didn't Read\*](https://tosdr.org/)
-
-</div>
-
-[Learn more...](browsers.md)
-
-\* We do not recommend installing ToS;DR as a browser extension. The same information is provided on their website.
-
-## Operating Systems
-
-### Android
-
-<div class="grid cards" markdown>
-
-- ![GrapheneOS logo](/assets/img/android/grapheneos.svg#only-light){ .twemoji }![GrapheneOS logo](/assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji } [GrapheneOS](https://grapheneos.org/)
-- ![CalyxOS logo](/assets/img/android/calyxos.svg){ .twemoji } [CalyxOS](https://calyxos.org/)
-- ![DivestOS logo](/assets/img/android/divestos.svg){ .twemoji } [DivestOS](https://divestos.org/)
-
-</div>
-
-**Android Apps:**
-
-<div class="grid cards" markdown>
-
-- ![Droid-ify logo](/assets/img/android/droid-ify.png){ .twemoji } [Droid-ify (F-Droid Client)](https://github.com/Iamlooker/Droid-ify)
-- ![Orbot logo](/assets/img/android/orbot.svg){ .twemoji } [Orbot (Tor Proxy)](https://orbot.app/)
-- ![Shelter logo](/assets/img/android/shelter.svg){ .twemoji } [Shelter (Work Profiles)](https://gitea.angry.im/PeterCxy/Shelter)
-- ![Auditor logo](/assets/img/android/auditor.svg#only-light){ .twemoji }![GrapheneOS logo](/assets/img/android/auditor-dark.svg#only-dark){ .twemoji } [Auditor (Supported Devices)](https://attestation.app/)
-- ![Secure Camera logo](/assets/img/android/secure_camera.svg#only-light){ .twemoji }![Secure Camera logo](/assets/img/android/secure_camera-dark.svg#only-dark){ .twemoji } [Secure Camera](https://github.com/GrapheneOS/Camera)
-- ![Secure PDF Viewer logo](/assets/img/android/secure_pdf_viewer.svg#only-light){ .twemoji }![GrapheneOS logo](/assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ .twemoji } [Secure PDF Viewer](https://github.com/GrapheneOS/PdfViewer)
-- ![PrivacyBlur logo](/assets/img/android/privacyblur.svg){ .twemoji } [PrivacyBlur](https://privacyblur.app/)
-
-</div>
-
-[Learn more...](android.md)
-
-### Linux
-
-<div class="grid cards" markdown>
-
-- ![Fedora logo](/assets/img/linux-desktop/fedora-workstation.svg){ .twemoji } [Fedora Workstation](https://getfedora.org/)
-- ![openSUSE Tumbleweed logo](/assets/img/linux-desktop/opensuse-tumbleweed.svg){ .twemoji } [OpenSUSE Tumbleweed](https://get.opensuse.org/tumbleweed/)
-- ![Arch logo](/assets/img/linux-desktop/archlinux.svg){ .twemoji } [Arch Linux](https://archlinux.org/)
-- ![Fedora Silverblue logo](/assets/img/linux-desktop/fedora-silverblue.svg){ .twemoji } [Fedora Silverblue & Kinoite](https://silverblue.fedoraproject.org/)
-- ![nixOS logo](/assets/img/linux-desktop/nixos.svg){ .twemoji } [NixOS](https://nixos.org/)
-- ![Whonix logo](/assets/img/linux-desktop/whonix.svg){ .twemoji } [Whonix (Tor)](https://www.whonix.org/)
-- ![Tails logo](/assets/img/linux-desktop/tails.svg){ .twemoji } [Tails (Live Boot)](https://tails.boum.org/)
-- ![Qubes OS logo](/assets/img/qubes/qubes_os.svg){ .twemoji } [Qubes OS (Xen VM Distribution)\*](https://www.qubes-os.org/)
-
-</div>
-
-[Learn more...](linux-desktop.md)
-
-\* Qubes uses Xen to provide strong sandboxing between multiple Linux virtual machine installations, and can run most Linux applications. [Learn more about Qubes...](qubes.md)
-
-### Router Firmware
-
-<div class="grid cards" markdown>
-
-- ![OpenWrt logo](/assets/img/router/openwrt.svg#only-light){ .twemoji }![OpenWrt logo](/assets/img/router/openwrt-dark.svg#only-dark){ .twemoji } [OpenWrt](https://openwrt.org/)
-- ![pfSense logo](/assets/img/router/pfsense.svg#only-light){ .twemoji }![pfSense logo](/assets/img/router/pfsense-dark.svg#only-dark){ .twemoji } [pfSense](https://www.pfsense.org/)
-
-</div>
-
-[Learn more...](router.md)
-
-## Service Providers
-
-### Cloud Storage
-
-<div class="grid cards" markdown>
-
-- ![Nextcloud logo](/assets/img/cloud/nextcloud.svg){ .twemoji } [Nextcloud (Self-Hostable)](https://nextcloud.com/)
-- ![Proton Drive logo](/assets/img/cloud/protondrive.svg){ .twemoji } [Proton Drive](https://drive.protonmail.com/)
-- ![Cryptee logo](/assets/img/cloud/cryptee.svg#only-light){ .twemoji }![Cryptee logo](/assets/img/cloud/cryptee-dark.svg#only-dark){ .twemoji } [Cryptee](https://crypt.ee/)
-- ![Tahoe-LAFS logo](/assets/img/cloud/tahoe-lafs.svg#only-light){ .twemoji }![Tahoe-LAFS logo](/assets/img/cloud/tahoe-lafs-dark.svg#only-dark){ .twemoji } [Tahoe-LAFS (Advanced)](https://www.tahoe-lafs.org/)
-
-</div>
-
-[Learn more...](cloud.md)
-
-### DNS
-
-We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS servers based on a variety of criteria. Some no-logging choices include [MullvadDNS](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) and [Quad9](https://quad9.net/), but we recommend you read our full page on DNS before choosing a provider. In many cases using an alternative DNS provider is not recommended. [Learn more...](dns.md)
-
-### Email
-
-<div class="grid cards" markdown>
-
-- ![ProtonMail logo](/assets/img/email/mini/protonmail.svg){ .twemoji } [ProtonMail](https://protonmail.com/)
-- ![Mailbox.org logo](/assets/img/email/mini/mailboxorg.svg){ .twemoji } [Mailbox.org](https://mailbox.org/)
-- ![Disroot logo](/assets/img/email/mini/disroot.svg#only-light){ .twemoji }![Disroot logo](/assets/img/email/mini/disroot-dark.svg#only-dark){ .twemoji } [Disroot](https://disroot.org/)
-- ![Tutanota logo](/assets/img/email/mini/tutanota.svg){ .twemoji } [Tutanota](https://tutanota.com/)
-- ![StartMail logo](/assets/img/email/mini/startmail.svg#only-light){ .twemoji }![StartMail logo](/assets/img/email/mini/startmail-dark.svg#only-dark){ .twemoji } [StartMail](https://startmail.com/)
-- ![CTemplar logo](/assets/img/email/mini/ctemplar.svg#only-light){ .twemoji }![CTemplar logo](/assets/img/email/mini/ctemplar-dark.svg#only-dark){ .twemoji } [CTemplar](https://ctemplar.com/)
-
-</div>
-
-**Email Cloaking Services:**
-
-<div class="grid cards" markdown>
-
-- ![AnonAddy logo](/assets/img/email/mini/anonaddy.svg#only-light){ .twemoji }![AnonAddy logo](/assets/img/email/mini/anonaddy-dark.svg#only-dark){ .twemoji } [AnonAddy](https://anonaddy.com/)
-- ![SimpleLogin logo](/assets/img/email/mini/simplelogin.svg){ .twemoji } [SimpleLogin](https://simplelogin.io/)
-
-</div>
-
-**Self-Hosting Email:**
-
-<div class="grid cards" markdown>
-
-- ![Mail-in-a-Box logo](/assets/img/email/mail-in-a-box.svg){ .twemoji } [Mail-in-a-Box](https://mailinabox.email/)
-- ![mailcow logo](/assets/img/email/mailcow.svg){ .twemoji } [mailcow](https://mailcow.email/)
-
-</div>
-
-[Learn more...](email.md)
-
-### Search Engines
-
-<div class="grid cards" markdown>
-
-- ![DuckDuckGo logo](/assets/img/search-engines/duckduckgo.svg){ .twemoji } [DuckDuckGo](https://duckduckgo.com/)
-- ![Startpage logo](/assets/img/search-engines/startpage.svg){ .twemoji } [Startpage](https://www.startpage.com/)
-- ![Mojeek logo](/assets/img/search-engines//mini/mojeek.svg){ .twemoji } [Mojeek](https://www.mojeek.com/)
-- ![Searx logo](/assets/img/search-engines/searx.svg){ .twemoji } [Searx](https://searx.me/)
-
-</div>
-
-[Learn more...](search-engines.md)
-
-### Social Media
-
-<div class="grid cards" markdown>
-
-- ![Mastodon logo](/assets/img/social-networks/mastodon.svg){ .twemoji } [Mastodon](https://joinmastodon.org/)
-- ![diaspora logo](/assets/img/social-networks/diaspora.svg){ .twemoji } [diaspora\*](https://diasporafoundation.org/)
-- ![Friendica logo](/assets/img/social-networks/friendica.svg){ .twemoji } [Friendica](https://friendi.ca/)
-- ![PixelFed logo](/assets/img/social-networks/pixelfed.svg){ .twemoji } [PixelFed](https://pixelfed.org/)
-- ![Pleroma logo](/assets/img/social-networks/pleroma.svg){ .twemoji } [Pleroma](https://pleroma.social/)
-- ![Movim logo](/assets/img/social-networks/movim.svg){ .twemoji } [Movim](https://github.com/movim)
-
-</div>
-
-[Learn more...](social-networks.md)
-
-**News Aggregators:**
-
-<div class="grid cards" markdown>
-
-- ![Tildes logo](/assets/img/social-media-aggregator/tildes.svg){ .twemoji } [Tildes](https://tildes.net/)
-- ![Lemmy logo](/assets/img/social-media-aggregator/lemmy.svg){ .twemoji } [Lemmy](https://lemmy.ml/)
-- ![Postmill logo](/assets/img/social-media-aggregator/postmill.png){ .twemoji } [Postmill](https://postmill.xyz/)
-- ![Freepost logo](/assets/img/social-media-aggregator/freepost.svg){ .twemoji } [Freepost](https://freepo.st/)
-
-</div>
-
-[Learn more...](social-news-aggregator.md)
-
-### VPN Providers
-
-??? danger "VPNs do not provide anonymity"
-
-    Using a VPN will **not** keep your browsing habits anonymous, nor will it add additional security to non-secure (HTTP) traffic.
-
-    If you are looking for **anonymity**, you should use the Tor Browser **instead** of a VPN.
-
-    If you're looking for added **security**, you should always ensure you're connecting to websites using [HTTPS](https://en.wikipedia.org/wiki/HTTPS). A VPN is not a replacement for good security practices.
-
-    [Learn more](vpn.md)
-
-<div class="grid cards" markdown>
-
-- ![Mullvad logo](/assets/img/vpn/mini/mullvad.svg){ .twemoji } [Mullvad](https://mullvad.net/)
-- ![ProtonVPN logo](/assets/img/vpn/mini/protonvpn.svg){ .twemoji } [ProtonVPN](https://protonvpn.com/)
-- ![IVPN logo](/assets/img/vpn/mini/ivpn.svg){ .twemoji } [IVPN](https://www.ivpn.net/)
-
-</div>
-
-[Learn more...](vpn.md)
-
-## Software
-
-### Calendar/Contacts Sync
-
-<div class="grid cards" markdown>
-
-- ![Tutanota logo](/assets/img/calendar-contacts/tutanota.svg){ .twemoji } [Tutanota (SaaS)](https://tutanota.com/calendar)
-- ![Proton Calendar logo](/assets/img/calendar-contacts/proton-calendar.svg){ .twemoji } [Proton Calendar (SaaS)](https://calendar.protonmail.com/)
-- ![EteSync logo](/assets/img/calendar-contacts/etesync.svg){ .twemoji } [EteSync](https://www.etesync.com/)
-- ![Tutanota logo](/assets/img/calendar-contacts/nextcloud.svg){ .twemoji } [Nextcloud](https://nextcloud.com/)
-- ![DecSync CC logo](/assets/img/calendar-contacts/decsync.svg){ .twemoji } [DecSync](https://github.com/39aldo39/DecSync)
-
-</div>
-
-[Learn more...](calendar-contacts.md)
-
-### Notebooks
-
-<div class="grid cards" markdown>
-
-- ![Joplin logo](/assets/img/notebooks/joplin.svg){ .twemoji } [Joplin](https://joplinapp.org/)
-- ![Standard Notes logo](/assets/img/notebooks/standard-notes.svg){ .twemoji } [Standard Notes](https://standardnotes.org/)
-
-</div>
-
-[Learn more...](notebooks.md)
-
-### Email Clients
-
-<div class="grid cards" markdown>
-
-- ![Thunderbird logo](/assets/img/email-clients/thunderbird.svg){ .twemoji } [Thunderbird](https://www.thunderbird.net/)
-- ![GNOME Evolution logo](/assets/img/email-clients/evolution.svg){ .twemoji } [GNOME Evolution (Linux)](https://wiki.gnome.org/Apps/Evolution)
-- ![Kontact logo](/assets/img/email-clients/kontact.svg){ .twemoji } [Kontact (Linux)](https://kontact.kde.org/)
-- ![Mailvelope logo](/assets/img/email-clients/mailvelope.svg){ .twemoji } [Mailvelope (PGP in standard webmail)](https://www.mailvelope.com/)
-- ![K-9 Mail logo](/assets/img/email-clients/k9mail.svg){ .twemoji } [K-9 Mail (Android)](https://k9mail.app/)
-- ![FairEmail logo](/assets/img/email-clients/fairemail.svg){ .twemoji } [FairEmail (Android)](https://email.faircode.eu/)
-- ![Canary Mail logo](/assets/img/email-clients/canarymail.svg){ .twemoji } [Canary Mail (iOS)](https://canarymail.io/)
-- ![NeoMutt logo](/assets/img/email-clients/mutt.svg){ .twemoji } [NeoMutt (CLI)](https://neomutt.org/)
-
-</div>
-
-[Learn more...](email-clients.md)
-
-### Encryption Tools
-
-??? info "Operating System Disk Encryption"
-
-    For encrypting your operating system drive, we typically recommend using whichever encryption tool your operating system provides, whether that is **BitLocker** on Windows, **FileVault** on macOS, or **LUKS** on Linux. These tools are available out of the box and typically utilize hardware encryption elements such as a TPM that other full-disk encryption software like VeraCrypt will not. VeraCrypt is still suitable for non-operating system disks such as external drives, especially drives that may be accessed from multiple operating systems.
-
-    [Learn more](encryption.md##operating-system-included-full-disk-encryption-fde)
-
-<div class="grid cards" markdown>
-
-- ![VeraCrypt logo](/assets/img/encryption-software/veracrypt.svg#only-light){ .twemoji }![VeraCrypt logo](/assets/img/encryption-software/veracrypt-dark.svg#only-dark){ .twemoji } [VeraCrypt (FDE)](https://veracrypt.fr/)
-- ![Cryptomator logo](/assets/img/encryption-software/cryptomator.svg){ .twemoji } [Cryptomator](https://cryptomator.org/)
-- ![Picocrypt logo](/assets/img/encryption-software/picocrypt.svg){ .twemoji } [Picocrypt](https://evansu.cc/picocrypt)
-- ![Hat.sh logo](/assets/img/encryption-software/hat-sh.png#only-light){ .twemoji }![Hat.sh logo](/assets/img/encryption-software/hat-sh-dark.png#only-dark){ .twemoji } [Hat.sh (Browser-based)](https://hat.sh/)
-- ![Kryptor logo](/assets/img/encryption-software/kryptor.png){ .twemoji } [Kryptor](https://www.kryptor.co.uk/)
-- ![Tomb logo](/assets/img/encryption-software/tomb.png){ .twemoji } [Tomb](https://www.dyne.org/software/tomb)
-
-</div>
-
-**OpenPGP Clients:**
-
-<div class="grid cards" markdown>
-
-- ![GnuPG logo](/assets/img/encryption-software/gnupg.svg){ .twemoji } [GnuPG](https://gnupg.org)
-- ![GPG4Win logo](/assets/img/encryption-software/gpg4win.svg){ .twemoji } [GPG4Win (Windows)](https://gpg4win.org)
-- ![GPG Suite logo](/assets/img/encryption-software/gpgsuite.png){ .twemoji } [GPG Suite (macOS)](https://gpgtools.org)
-- ![OpenKeychain logo](/assets/img/encryption-software/openkeychain.svg){ .twemoji } [OpenKeychain](https://www.openkeychain.org/)
-
-</div>
-
-[Learn more...](encryption.md)
-
-### File Sharing
-
-<div class="grid cards" markdown>
-
-- ![OnionShare logo](/assets/img/file-sharing-sync/onionshare.svg){ .twemoji } [OnionShare](https://onionshare.org/)
-- ![Magic Wormhole logo](/assets/img/file-sharing-sync/magic_wormhole.png){ .twemoji } [Magic Wormhole](https://magic-wormhole.readthedocs.io/)
-- ![FreedomBox logo](/assets/img/file-sharing-sync/freedombox.svg){ .twemoji } [FreedomBox](https://freedombox.org/)
-- ![Syncthing logo](/assets/img/file-sharing-sync/syncthing.svg){ .twemoji } [Syncthing](https://syncthing.net/)
-- ![git-annex logo](/assets/img/file-sharing-sync/gitannex.svg){ .twemoji } [git-annex](https://git-annex.branchable.com/)
-
-</div>
-
-[Learn more...](file-sharing.md)
-
-### Metadata Removal Tools
-
-<div class="grid cards" markdown>
-
-- ![MAT2 logo](/assets/img/metadata-removal/mat2.svg){ .twemoji } [MAT2](https://0xacab.org/jvoisin/mat2)
-- ![ExifCleaner logo](/assets/img/metadata-removal/exifcleaner.svg){ .twemoji } [ExifCleaner](https://exifcleaner.com/)
-- ![Scrambled Exif logo](/assets/img/metadata-removal/scrambled-exif.svg){ .twemoji } [Scrambled Exif (Android)](https://gitlab.com/juanitobananas/scrambled-exif)
-- ![Imagepipe logo](/assets/img/metadata-removal/imagepipe.svg){ .twemoji } [Imagepipe (Android)](https://codeberg.org/Starfish/Imagepipe)
-- ![Metapho logo](/assets/img/metadata-removal/metapho.jpg){ .twemoji } [Metapho (iOS)](https://zininworks.com/metapho)
-- ![ExifTool logo](/assets/img/metadata-removal/exiftool.png){ .twemoji } [ExifTool (CLI)](https://exiftool.org/)
-
-</div>
-
-[Learn more...](metadata-removal-tools.md)
-
-### Multi-Factor Authentication Tools
-
-<div class="grid cards" markdown>
-
-- ![YubiKeys](/assets/img/multi-factor-authentication/yubikey.png){ .twemoji } [YubiKey](https://www.yubico.com/)
-- ![Nitrokey](/assets/img/multi-factor-authentication/nitrokey.jpg){ .twemoji } [Nitrokey](https://www.nitrokey.com/)
-- ![Aegis logo](/assets/img/multi-factor-authentication/aegis.png){ .twemoji } [Aegis Authenticator](https://getaegis.app/)
-- ![Raivo OTP logo](/assets/img/multi-factor-authentication/raivo-otp.png){ .twemoji } [Raivo OTP](https://github.com/raivo-otp/ios-application)
-
-</div>
-
-[Learn more...](multi-factor-authentication.md)
-
-### Password Managers
-
-<div class="grid cards" markdown>
-
-- ![KeePassXC logo](/assets/img/password-management/keepassxc.svg){ .twemoji } [KeePassXC](https://keepassxc.org/)
-- ![KeePassDX logo](/assets/img/password-management/keepassdx.svg){ .twemoji } [KeePassDX (Android)](https://www.keepassdx.com/)
-- ![Bitwarden logo](/assets/img/password-management/bitwarden.svg){ .twemoji } [Bitwarden](https://bitwarden.com/)
-- ![Psono logo](/assets/img/password-management/psono.svg){ .twemoji } [Psono](https://psono.com/)
-- ![gopass logo](/assets/img/password-management/gopass.svg){ .twemoji } [gopass](https://www.gopass.pw/)
-- ![Vaultwarden logo](/assets/img/password-management/vaultwarden.svg#only-light){ .twemoji }![Vaultwarden logo](/assets/img/password-management/vaultwarden-dark.svg#only-dark){ .twemoji } [Vaultwarden (Bitwarden Server)](https://github.com/dani-garcia/vaultwarden)
-
-</div>
-
-[Learn more...](passwords.md)
-
-### Productivity Tools
-
-<div class="grid cards" markdown>
-
-- ![LibreOffice logo](/assets/img/productivity/libreoffice.svg){ .twemoji } [LibreOffice](https://www.libreoffice.org/)
-- ![OnlyOffice logo](/assets/img/productivity/onlyoffice.svg){ .twemoji } [OnlyOffice](https://www.onlyoffice.com/)
-- ![Framadate logo](/assets/img/productivity/framadate.svg){ .twemoji } [Framadate (Appointment Planning)](https://framadate.org/)
-- ![PrivateBin logo](/assets/img/productivity/privatebin.svg){ .twemoji } [PrivateBin (Pastebin)](https://privatebin.info/)
-- ![CryptPad logo](/assets/img/productivity/cryptpad.svg){ .twemoji } [CryptPad](https://cryptpad.fr/)
-- ![Write.as logo](/assets/img/productivity/writeas.svg#only-light){ .twemoji }![Write.as logo](/assets/img/productivity/writeas-dark.svg#only-dark){ .twemoji } [Write.as (Blogging Platform)](https://write.as/)
-- ![VSCodium logo](/assets/img/productivity/vscodium.svg){ .twemoji } [VSCodium (Source-Code Editor)](https://vscodium.com/)
-
-</div>
-
-[Learn more...](productivity.md)
-
-### Real-Time Communication
-
-<div class="grid cards" markdown>
-
-- ![Signal logo](/assets/img/messengers/signal.svg){ .twemoji } [Signal](https://signal.org/)
-- ![Element logo](/assets/img/messengers/element.svg){ .twemoji } [Element](https://element.io/)
-- ![Briar logo](/assets/img/messengers/briar.svg){ .twemoji } [Briar (Android)](https://briarproject.org/)
-- ![Session logo](/assets/img/messengers/session.svg){ .twemoji } [Session](https://getsession.org/)
-
-</div>
-
-### News Aggregators
-
-<div class="grid cards" markdown>
-
-- ![Fluent Reader](/assets/img/news-aggregators/fluent-reader.svg){ .twemoji } [Fluent Reader](https://hyliu.me/fluent-reader)
-- ![GNOME Feeds](/assets/img/news-aggregators/gfeeds.svg){ .twemoji } [GNOME Feeds](https://gfeeds.gabmus.org)
-- ![Akregator](/assets/img/news-aggregators/akregator.svg){ .twemoji } [Akregator](https://apps.kde.org/akregator)
-- ![Handy News Reader](/assets/img/news-aggregators/handy-news-reader.svg){ .twemoji } [Handy News Reader](https://github.com/yanus171/Handy-News-Reader)
-- ![NetNewsWire](/assets/img/news-aggregators/netnewswire.png){ .twemoji } [NetNewsWire](https://netnewswire.com)
-- ![Miniflux](/assets/img/news-aggregators/miniflux.svg#only-light){ .twemoji }![Miniflux logo](/assets/img/news-aggregators/miniflux-dark.svg#only-dark){ .twemoji } [Miniflux](https://miniflux.app)
-- ![Newsboat](/assets/img/news-aggregators/newsboat.svg){ .twemoji } [Newsboat](https://newsboat.org/)
-
-</div>
-
-[Learn more...](real-time-communication.md)
-
-### Self-Contained Networks
-
-<div class="grid cards" markdown>
-
-- ![Tor logo](./assets/img/self-contained-networks/tor.svg){ .twemoji } [Tor](https://www.torproject.org/)
-- ![I2P logo](./assets/img/self-contained-networks/i2p.svg#only-light){ .twemoji } ![I2P logo](./assets/img/self-contained-networks/i2p-dark.svg#only-dark){ .twemoji } [I2P](https://geti2p.net/)
-- ![Freenet logo](./assets/img/self-contained-networks/freenet.svg){ .twemoji } [Freenet](https://freenetproject.org/)
-
-</div>
-
-[Learn more...](self-contained-networks.md)
-
-### Video Streaming Clients
-
-<div class="grid cards" markdown>
-
-- ![FreeTube logo](/assets/img/video-streaming/freetube.svg){ .twemoji } [FreeTube (YouTube, Desktop)](https://freetubeapp.io/)
-- ![LBRY logo](/assets/img/video-streaming/lbry.svg){ .twemoji } [LBRY](https://lbry.com/)
-- ![NewPipe logo](/assets/img//video-streaming/newpipe.svg){ .twemoji } [NewPipe (YouTube, Android)](https://newpipe.net/)
-- ![NewPipe x SponsorBlock logo](/assets/img/video-streaming/newpipe.svg){ .twemoji } [NewPipe x Sponsorblock](https://github.com/polymorphicshade/NewPipe)
-- ![Invidious logo](/assets/img/video-streaming/invidious.svg#only-light){ .twemoji }![Invidious logo](/assets/img/video-streaming/invidious-dark.svg#only-dark){ .twemoji } [Invidious (YouTube, Web)](https://invidious.io/)
-- ![Piped logo](/assets/img/video-streaming/piped.svg){ .twemoji } [Piped (YouTube, Web)](https://piped.kavin.rocks/)
-
-</div>
-
-[Learn more...](video-streaming.md)

docs/video-streaming.en.md

@@ -1,8 +1,8 @@
 ---
-title: Video Streaming
+title: "Video Streaming"
 icon: material/video-wireless
 ---
-The primary threat when using a video streaming platform is that your streaming habits and subscription lists could be used to profile you. You should combine these tools with a [VPN](/vpn) or [Tor](https://www.torproject.org/) to make it harder to profile your usage.
+The primary threat when using a video streaming platform is that your streaming habits and subscription lists could be used to profile you. You should combine these tools with a [VPN](vpn.md) or [Tor](https://www.torproject.org/) to make it harder to profile your usage.
 
 ## Clients
 
@@ -10,11 +10,11 @@ The primary threat when using a video streaming platform is that your streaming
 
 !!! Warning
 
-    When using Freetube, your IP address is still known to YouTube, [Invidious](https://instances.invidious.io) and the SponsorBlock instances that you use. Consider using a [VPN](/vpn) or [Tor](https://www.torproject.org) if your [threat model](/threat-modeling.md) requires hiding your IP address.
+    When using Freetube, your IP address is still known to YouTube, [Invidious](https://instances.invidious.io) and the SponsorBlock instances that you use. Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org) if your [threat model](threat-modeling.md) requires hiding your IP address.
 
 !!! recommendation
 
-    ![FreeTube logo](/assets/img/video-streaming/freetube.svg){ align=right }
+    ![FreeTube logo](assets/img/video-streaming/freetube.svg){ align=right }
 
     **FreeTube** is a free and open source desktop application for [YouTube](https://youtube.com). When using FreeTube, your subscription list and playlists are saved locally on your device.
 
@@ -37,7 +37,7 @@ The primary threat when using a video streaming platform is that your streaming
 
 !!! recommendation
 
-    ![LBRY logo](/assets/img/video-streaming/lbry.svg){ align=right }
+    ![LBRY logo](assets/img/video-streaming/lbry.svg){ align=right }
 
     **The LBRY network** is a decentralized video sharing network. It uses a [BitTorrent](https://wikipedia.org/wiki/BitTorrent)-like network to store the video content, and a [blockchain](https://wikipedia.org/wiki/Blockchain) to store the indexes for those videos. The main benefit of this design is censorship resistance.
 
@@ -53,7 +53,7 @@ The primary threat when using a video streaming platform is that your streaming
 
 !!! warning
 
-    While watching and hosting videos, your IP address is visible to the LBRY network. Consider using a [VPN](/vpn) or [Tor](https://www.torproject.org) if your [threat model](/threat-modeling) requires hiding your IP address.
+    While watching and hosting videos, your IP address is visible to the LBRY network. Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org) if your [threat model](threat-modeling) requires hiding your IP address.
 
 We recommend **against** synchronizing your wallet with LBRY Inc., as synchronizing encrypted wallets is not supported yet. If you synchronize your wallet with LBRY Inc., you have to trust them to not look at your subscription list, [LBC](https://lbry.com/faq/earn-credits) funds, or take control of your channel.
 
@@ -63,7 +63,7 @@ You can  disable *Save hosting data to help the LBRY network* option (⚙️ Set
 
 !!! recommendation
 
-    ![Newpipe logo](/assets/img//video-streaming/newpipe.svg){ align=right }
+    ![Newpipe logo](assets/img//video-streaming/newpipe.svg){ align=right }
 
     **NewPipe** is a free and open source Android application for [YouTube](https://youtube.com), [SoundCloud](https://soundcloud.com), [media.ccc.de](https://media.ccc.de), [FramaTube](https://framatube.org), and [Bandcamp](https://bandcamp.com).
 
@@ -83,7 +83,7 @@ You can  disable *Save hosting data to help the LBRY network* option (⚙️ Set
 
 !!! recommendation
 
-    ![NewPipe x SponsorBlock logo](/assets/img/video-streaming/newpipe.svg){ align=right }
+    ![NewPipe x SponsorBlock logo](assets/img/video-streaming/newpipe.svg){ align=right }
 
     **NewPipe x SponsorBlock** is a fork of [NewPipe](https://newpipe.net) with [SponsorBlock](https://sponsor.ajay.app) integrated to help you skip sponsored advertisements.
     It also has some experimental settings such as the ability to use the built-in player for local playback, an option to force fullscreen on landscape mode, and an option to disable error reporting prompts.
@@ -106,8 +106,8 @@ This fork is not endorsed by or affiliated with the upstream project. The NewPip
 
 !!! recommendation
 
-    ![Invidious logo](/assets/img/video-streaming/invidious.svg#only-light){ align=right }
-    ![Invidious logo](/assets/img/video-streaming/invidious-dark.svg#only-dark){ align=right }
+    ![Invidious logo](assets/img/video-streaming/invidious.svg#only-light){ align=right }
+    ![Invidious logo](assets/img/video-streaming/invidious-dark.svg#only-dark){ align=right }
 
     **Invidious** is a free and open source front end for YouTube that is also self-hostable. There are list of [public instances](https://instances.invidious.io). Some instances have [Tor](https://www.torproject.org) onion services support.
 
@@ -129,7 +129,7 @@ When you are using an Invidious instance, be sure to go read the Privacy Policy
 
 !!! recommendation
 
-    ![Piped logo](/assets/img/video-streaming/piped.svg){ align=right }
+    ![Piped logo](assets/img/video-streaming/piped.svg){ align=right }
 
     **Piped** is a free and open source front end for YouTube that is also self-hostable. Alternative instances can be selected from "Preferences".
 

docs/vpn.en.md

@@ -1,5 +1,5 @@
 ---
-title: VPN Services
+title: "VPN Services"
 icon: material/vpn
 ---
 
@@ -31,8 +31,8 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 !!! recommendation
 
-    ![Mullvad logo](/assets/img/vpn/mullvad.svg#only-light){ align=right }
-    ![Mullvad logo](/assets/img/vpn/mullvad-dark.svg#only-dark){ align=right }
+    ![Mullvad logo](assets/img/vpn/mullvad.svg#only-light){ align=right }
+    ![Mullvad logo](assets/img/vpn/mullvad-dark.svg#only-dark){ align=right }
 
     **Mullvad** is a fast and inexpensive VPN with a serious focus on transparency and security. They have been in operation since **2009**. Mullvad is based in Sweden and does not have a free trial.
 
@@ -92,7 +92,7 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 !!! recommendation
 
-    ![ProtonVPN logo](/assets/img/vpn/protonvpn.svg){ align=right }
+    ![ProtonVPN logo](assets/img/vpn/protonvpn.svg){ align=right }
 
     **ProtonVPN** is a strong contender in the VPN space, and they have been in operation since 2016. ProtonVPN is based in Switzerland and offers a limited free pricing tier, as well as premium options. They offer a further 14% discount for buying a 2 year subscription.
 
@@ -124,9 +124,9 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
     ProtonVPN [recommends](https://protonvpn.com/blog/wireguard/) the use of WireGuard with their service. On ProtonVPN's Windows, macOS, iOS, Android, ChromeOS, and Android TV apps, WireGuard is the default protocol; however, [support](https://protonvpn.com/support/how-to-change-vpn-protocols/) for the protocol is not present in their Linux app.
 
-??? missing "Remote Port Forwarding"
+??? warning "Remote Port Forwarding"
 
-    ProtonVPN does not currently support remote port forwarding, which may impact some applications. Especially Peer-to-Peer applications like Torrent clients.
+    ProtonVPN currently only supports remote [port forwarding](https://protonvpn.com/support/port-forwarding/) on Windows, which may impact some applications. Especially Peer-to-Peer applications like Torrent clients.
 
 ??? check "Mobile Clients"
 
@@ -140,7 +140,7 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 !!! recommendation
 
-    ![IVPN logo](/assets/img/vpn/ivpn.svg){ align=right }
+    ![IVPN logo](assets/img/vpn/ivpn.svg){ align=right }
 
     **IVPN** is another premium VPN provider, and they have been in operation since 2009. IVPN is based in Gibraltar.
 
@@ -288,7 +288,7 @@ Must not have any marketing which is irresponsible:
 
 Responsible marketing that is both educational and useful to the consumer could include:
 
-- An accurate comparison to when Tor or other [self-contained networks](/self-contained-networks) should be used.
+- An accurate comparison to when Tor or other [self-contained networks.md](self-contained-networks) should be used.
 - Availability of the VPN provider's website over a .onion [Hidden Service](https://en.wikipedia.org/wiki/.onion)
 
 ### Additional Functionality
@@ -346,7 +346,7 @@ For use cases like these, or if you have another compelling reason, the VPN prov
 ### Sources and Further Reading
 
 1. [VPN - a Very Precarious Narrative](https://schub.io/blog/2019/04/08/very-precarious-narrative.html) by Dennis Schubert
-2. [The self-contained networks](/self-contained-networks) recommended by Privacy Guides are able to replace a VPN that allows access to services on local area network
+2. [The self-contained networks](self-contained-networks.md) recommended by Privacy Guides are able to replace a VPN that allows access to services on local area network
 3. [Slicing Onions: Part 1 – Myth-busting Tor](https://medium.com/privacyguides/slicing-onions-part-1-myth-busting-tor-9ec188ae1904) by blacklight447
 4. [Slicing Onions: Part 2 – Onion recipes; VPN not required](https://web.archive.org/web/20210116140725/https://write.privacytools.io/my-thoughts-on-security/slicing-onions-part-2-onion-recipes-vpn-not-required) by blacklight447
 5. [IVPN Privacy Guides](https://www.ivpn.net/privacy-guides)

mkdocs.production.yml

@@ -1,10 +0,0 @@
-INHERIT: mkdocs.yml
-site_url: "https://www.privacyguides.org/"
-watch:
-  - theme
-  - mkdocs.yml
-plugins:
-  - search
-  - privacy:
-      externals_exclude:
-        - cdn.jsdelivr.net/npm/mathjax@3/* 

mkdocs.yml

@@ -1,3 +1,7 @@
+docs_dir: 'docs'
+site_url: "https://www.privacyguides.org/"
+site_dir: 'site'
+
 site_name: Privacy Guides
 site_description: |
   Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.
@@ -5,6 +9,7 @@ copyright: |
   <b>Privacy Guides</b> is a non-profit, socially motivated website that provides information for protecting your data security and privacy.<br>
   We do not make money from recommending certain products, and we do not utilize affiliate links.<br>
   This content was made available by the Privacy Guides team and contributors. <a href="https://github.com/privacyguides/privacyguides">Get involved</a>!
+
 extra:
   generator: false
   social:
@@ -20,53 +25,6 @@ repo_url: https://github.com/privacyguides/privacyguides.org
 repo_name: privacyguides.org
 edit_uri: edit/main/docs/
 
-nav:
-  - Home: 'index.md'
-  - 'Privacy Introduction':
-    - 'Threat Modeling': 'threat-modeling.md'
-    - 'Technology Basics':
-      - 'DNS': 'technology/dns.md'
-    - 'Security Basics':
-      - 'Multi-Factor Authentication': 'security/multi-factor-authentication.md'
-    - 'Setup Guides':
-      - 'Integrating Metadata Removal': 'setup/integrating-metadata-removal.md'
-  - 'Recommendations':
-    - 'Privacy Tools': 'tools.md'
-    - 'Browsers':
-      - 'Web Browsers': 'browsers.md'
-    - 'Operating Systems':
-      - 'Android': 'android.md'
-      - 'Linux Desktop': 'linux-desktop.md'
-      - 'Qubes OS': 'qubes.md'
-      - 'Router Firmware': 'router.md'
-    - 'Providers':
-      - 'Cloud Storage': 'cloud.md'
-      - 'DNS Servers': 'dns.md'
-      - 'Email Providers': 'email.md'
-      - 'Search Engines': 'search-engines.md'
-      - 'Social Networks': 'social-networks.md'
-      - 'Social News Aggregators': 'social-news-aggregator.md'
-      - 'VPN Providers': 'vpn.md'
-    - 'Software':
-      - 'Calendar/Contacts Sync': 'calendar-contacts.md'
-      - 'Digital Notebooks': 'notebooks.md'
-      - 'Email Clients': 'email-clients.md'
-      - 'Encryption Tools': 'encryption.md'
-      - 'File Sharing/Sync': 'file-sharing.md'
-      - 'Metadata Removal Tools': 'metadata-removal-tools.md'
-      - 'Multi-Factor Authenticators': 'multi-factor-authentication.md'
-      - 'Password Managers': 'passwords.md'
-      - 'Productivity Tools': 'productivity.md'
-      - 'Real-Time Communication': 'real-time-communication.md'
-      - 'News Aggregators': 'news-aggregators.md'
-      - 'Self-Contained Networks': 'self-contained-networks.md'
-      - 'Video Streaming': 'video-streaming.md'
-  - 'About Us':
-    - 'Privacy Guides': 'about.md'
-    - 'Notices': 'about/notices.md'
-    - 'Privacy Policy': 'about/privacy-policy.md'
-  - 'Blog': 'https://blog.privacyguides.org/'
-
 theme:
   name: material
   custom_dir: theme
@@ -96,7 +54,18 @@ watch:
   - theme
 
 plugins:
+  - i18n:
+      default_language: en
+      material_alternate: true
+      languages:
+        en:
+          name: English
+          build: false
   - tags
+  - search
+  - privacy:
+      externals_exclude:
+        - cdn.jsdelivr.net/npm/mathjax@3/* 
 extra_css:
   - stylesheets/extra.css
 markdown_extensions:
@@ -130,3 +99,49 @@ markdown_extensions:
 
 extra_javascript:
   - javascripts/mathjax.js
+
+nav:
+  - Home: 'index.md'
+  - 'Privacy Introduction':
+    - 'threat-modeling.md'
+    - 'Technology Basics':
+      - 'technology/dns.md'
+    - 'Security Basics':
+      - 'security/multi-factor-authentication.md'
+    - 'Setup Guides':
+      - 'setup/integrating-metadata-removal.md'
+  - 'Recommendations':
+    - 'tools.md'
+    - 'Browsers':
+      - 'browsers.md'
+    - 'Operating Systems':
+      - 'android.md'
+      - 'linux-desktop.md'
+      - 'qubes.md'
+      - 'router.md'
+    - 'Providers':
+      - 'cloud.md'
+      - 'dns.md'
+      - 'email.md'
+      - 'search-engines.md'
+      - 'vpn.md'
+    - 'Software':
+      - 'calendar-contacts.md'
+      - 'notebooks.md'
+      - 'email-clients.md'
+      - 'encryption.md'
+      - 'file-sharing.md'
+      - 'metadata-removal-tools.md'
+      - 'multi-factor-authentication.md'
+      - 'passwords.md'
+      - 'productivity.md'
+      - 'real-time-communication.md'
+      - 'news-aggregators.md'
+      - 'self-contained-networks.md'
+      - 'video-streaming.md'
+  - 'About Us':
+    - 'about.md'
+    - 'about/notices.md'
+    - 'about/privacy-policy.md'
+  - 'Discussions': 'https://github.com/orgs/privacyguides/discussions'
+  - 'Blog': 'https://blog.privacyguides.org/'

theme/overrides/home.en.html

@@ -10,8 +10,8 @@
       <div class="mdx-hero">
         <div class="mdx-hero__content">
           <h1>The guide to restoring your online privacy.</h1>
-          <p>{{ config.site_description }}</p>
-          <a href="{{ 'tools/' | url }}" title="Recommended privacy tools, services, and knowledge" class="md-button md-button--primary">
+          <p>Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.</p>
+          <a href="tools/" title="Recommended privacy tools, services, and knowledge" class="md-button md-button--primary">
             Recommended Tools
           </a>
           <a href="https://blog.privacyguides.org/" title="Blog posts from Privacy Guides contributors" class="md-button">