Split Android page into separate articles and update device recommendations (#1053)

Co-authored-by: Tad <8296104+SkewedZeppelin@users.noreply.github.com>

.github/ISSUE_TEMPLATE/2_Website_Issues.md

@@ -1,7 +1,6 @@
 ---
 name: "Website Issue"
 about: Report a bug with the website. (NO CONTENT ISSUES)
-title: "Website Issue | "
 ---
 
 <!--

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,3 @@
-blank_issues_enabled: false
 contact_links:
   - name: Suggest a New Provider or Software
     url: https://github.com/privacyguides/privacyguides.org/discussions/new
@@ -9,3 +8,6 @@ contact_links:
   - name: Share an Idea
     url: https://github.com/privacyguides/privacyguides.org/discussions/new
     about: Suggest a new feature/section/page or anything else for the website.
+  - name: Report a Translation Issue
+    url: https://crowdin.com/project/privacyguides/discussions
+    about: Please report an issue with website translations on Crowdin.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,4 @@
-<!-- Submitting a PR? Awesome!! -->
-
-## Description
+<!-- Please use a descriptive title for your PR, it will be included in our changelog -->
 
 Resolves: # <!-- Did you solve an open GitHub issue? Put the number here so we mark it complete! -->
 

.github/workflows/crowdin.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - name: crowdin action
       uses: crowdin/github-action@1.4.8

.github/workflows/deploy.yml

@@ -1,5 +1,6 @@
 name: Deploy Website
 on:
+  workflow_dispatch:
   release:
     types: [published]
 
@@ -36,12 +37,12 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
         run: |
-          git clone --depth 1 https://${GH_TOKEN}@github.com/squidfunk/mkdocs-material-insiders.git
+          git clone --depth 1 https://${GH_TOKEN}@github.com/privacyguides/mkdocs-material-insiders.git
           pip install -e mkdocs-material-insiders
 
       - name: Build website
         run: |
-          mkdocs build --config-file mkdocs.production.yml
+          mkdocs build
           mv .well-known site/
           tar cvf site.tar site
           mkdocs --version

README.md

@@ -53,7 +53,6 @@ Our current list of team members can be found [here](https://github.com/orgs/pri
 - 🈴 [Help translate the site](https://crwd.in/privacyguides) [[Matrix chat](https://matrix.to/#/#pg-i18n:aragon.sh)]
 - 📝 Edit the site, everything's accessible in this repo
   - Browse our [open issues](https://github.com/privacyguides/privacyguides.org/issues) to see what needs to be updated
-  - When making more significant (than simple typo fixes, etc.) changes, update the [changelog](/CHANGELOG.md)
   - View some contribution tips on our [contributor's wiki](https://github.com/privacyguides/privacyguides.org/wiki)
 
 ## Developing
@@ -76,5 +75,8 @@ Our current list of team members can be found [here](https://github.com/orgs/pri
 2. Push the tag to GitHub: `git push --tags`
 3. [Create a new release](https://github.com/privacyguides/privacyguides.org/releases/new) selecting the new tag
     - Title the release the same as the tag version number without the `v`, i.e. `2.X.X`
-    - GitHub should let you auto-generate release notes, otherwise copy notes from the changelog
+      - For more significant releases, add a **short** title, for example [2.3.0 - Localization Support](https://github.com/privacyguides/privacyguides.org/releases/tag/v2.3.0) or [2.2.0 - Removing Social Networks](https://github.com/privacyguides/privacyguides.org/releases/tag/v2.2.0)
+    - GitHub should let you auto-generate release notes based on PR titles
+      - Mark more significant changes in bold, see [2.3.0](https://github.com/privacyguides/privacyguides.org/releases/tag/v2.3.0) for example
 4. Publish release, it will be deployed to the live site automatically
+    - When publishing more significant releases (generally any with a MINOR version increment) check the "Create a discussion for this release" box to post an announcement

crowdin.yml

@@ -2,8 +2,8 @@ project_id_env: CROWDIN_PROJECT_ID
 api_token_env: CROWDIN_PERSONAL_TOKEN
 "preserve_hierarchy": true
 files:
-- source: "/docs/**/*.en.md"
-  translation: "/docs/**/%file_name%.%locale_with_underscore%.md"
+- source: "/docs/**/*.en.*"
+  translation: "/docs/**/%file_name%.%locale_with_underscore%.%file_extension%"
   translation_replace:
     "en.": ""
   update_option: update_as_unapproved

docs/about/privacy-policy.en.md

@@ -98,6 +98,6 @@ For complaints under GDPR more generally, European Union users may lodge complai
 
 This version of our privacy statement took effect April 4th, 2022.
 
-We will post any new versions of this statement [here](/about/privacy-policy). We may change how we announce changes in future versions of this document. In the meantime we may update our contact information at any time without announcing a change. Please refer to the [Privacy Policy](/about/privacy-policy) for the latest contact information at any time.
+We will post any new versions of this statement [here](privacy-policy.en.md). We may change how we announce changes in future versions of this document. In the meantime we may update our contact information at any time without announcing a change. Please refer to the [Privacy Policy](privacy-policy.en.md) for the latest contact information at any time.
 
-A full revision [history](https://github.com/privacyguides/privacyguides.org/commits/main/docs/about/privacy-policy.md) of this page can be found on GitHub.
+A full revision [history](https://github.com/privacyguides/privacyguides.org/commits/main/docs/about/privacy-policy.en.md) of this page can be found on GitHub.

docs/android.en.md

@@ -2,18 +2,27 @@
 title: "Android"
 icon: 'fontawesome/brands/android'
 ---
-Android is a secure operating system that has strong [app sandboxing](https://source.android.com/security/app-sandbox), [Verified Boot](https://source.android.com/security/verifiedboot), and a robust [permission](https://developer.android.com/guide/topics/permissions/overview) control system.
 
-The main privacy concern with most Android devices is that they usually include [Google Play Services](https://developers.google.com/android/guides/overview). This component is proprietary, [closed source](https://en.wikipedia.org/wiki/Proprietary_software), has a privileged role on your phone, and may collect private user information. It is neither a part of the [Android Open Source Project](https://source.android.com/) (AOSP) nor is it included with the below derivatives.
+These are the Android operating systems, devices, and apps we recommend to maximize your mobile device's security and privacy. We also have additional Android-related information:
+
+- [General Android Overview and Recommendations :material-arrow-right:](android/overview.md)
+- [Android Security and Privacy Features :material-arrow-right:](android/security.md)
+- [GrapheneOS vs CalyxOS Comparison :material-arrow-right:](android/grapheneos-vs-calyxos.md)
 
 ## AOSP Derivatives
 
+Generally speaking we recommend installing one of these custom Android operating systems on your device, listed in order of preference, depending on your device's compatibility with these operating systems. If you are unable to run any of the following operating systems on your device, you are likely going to be best off sticking with your stock Android installation (as opposed to an operating system not listed here such as LineageOS), but we would recommend upgrading to a new device if at all possible.
+
+!!! note
+
+    End-of-life devices (such as GrapheneOS or CalyxOS's "extended support" devices) do not have full security patches (firmware updates) due to the original equipment manufacturer (OEM) discontinuing support. These devices cannot be considered completely secure regardless of installed software.
+
 ### GrapheneOS
 
 !!! recommendation
 
-    ![GrapheneOS logo](/assets/img/android/grapheneos.svg#only-light){ align=right }
-    ![GrapheneOS logo](/assets/img/android/grapheneos-dark.svg#only-dark){ align=right }
+    ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ align=right }
+    ![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ align=right }
 
     **GrapheneOS** is the best choice when it comes to privacy and security.
 
@@ -21,23 +30,17 @@ The main privacy concern with most Android devices is that they usually include
 
     [Visit grapheneos.org](https://grapheneos.org/){ .md-button .md-button--primary } [Privacy Policy](https://grapheneos.org/faq#privacy-policy){ .md-button }
 
-Notably, GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play). Google Play Services can be run fully sandboxed like a regular user app and contained in a work profile or user [profile](/android/#android-security-privacy) of your choice. This means that you can run apps dependant on Play Services, such as those that require push notifications using Google's [Firebase Cloud Messaging](https://firebase.google.com/docs/cloud-messaging/) service. GrapheneOS allows you to take advantage of most [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) whilst having full user control over their permissions and access.
+Notably, GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play). Google Play Services can be run fully sandboxed like a regular user app and contained in a work profile or user [profile](#android-security-privacy) of your choice. This means that you can run apps dependant on Play Services, such as those that require push notifications using Google's [Firebase Cloud Messaging](https://firebase.google.com/docs/cloud-messaging/) service. GrapheneOS allows you to take advantage of most [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) whilst having full user control over their permissions and access.
 
 Currently, only [Pixel phones](https://grapheneos.org/faq#device-support) meet its hardware security requirement and are supported.
 
-!!! attention
-
-    GrapheneOS's "extended support" devices do not have full security patches (firmware updates) due to the original equipment manufacturer (OEM) discontinuing support. These devices cannot be considered completely secure.
-
 ### CalyxOS
 
 !!! recommendation
 
-    ![CalyxOS logo](/assets/img/android/calyxos.svg){ align=right }
+    ![CalyxOS logo](assets/img/android/calyxos.svg){ align=right }
 
-    **CalyxOS** is a decent alternative to GrapheneOS.
-
-    It has some privacy features on top of AOSP, including [Datura firewall](https://calyxos.org/docs/tech/datura-details), [Signal](https://signal.org) integration in the dialer app, and a built in panic button. CalyxOS also comes with firmware updates and signed builds, so [verified boot](https://source.android.com/security/verifiedboot) is fully supported.
+    **CalyxOS** is a system with some privacy features on top of AOSP, including [Datura](https://calyxos.org/docs/tech/datura-details) firewall, [Signal](https://signal.org) integration in the dialer app, and a built in panic button. CalyxOS also comes with firmware updates and signed builds, so [verified boot](https://source.android.com/security/verifiedboot) is fully supported.
 
     [Visit calyxos.org](https://calyxos.org/){ .md-button .md-button--primary } [Privacy Policy](https://calyxinstitute.org/legal/privacy-policy){ .md-button }
 
@@ -45,15 +48,11 @@ To accomodate users who need Google Play Services, CalyxOS optionally includes [
 
 Currently, CalyxOS only supports [Pixel phones](https://calyxos.org/docs/guide/device-support/).
 
-!!! attention
-
-    CalyxOS's "extended support" does not have full security patches due to the original equipment manufacturer (OEM) discontinuing support; therefore, they cannot be considered completely secure.
-
 ### DivestOS
 
 !!! recommendation
 
-    ![DivestOS logo](/assets/img/android/divestos.svg){ align=right }
+    ![DivestOS logo](assets/img/android/divestos.svg){ align=right }
 
     **DivestOS** is a [soft-fork](https://en.wikipedia.org/wiki/Fork_(software_development)#Forking_of_free_and_open-source_software) of [LineageOS](https://lineageos.org/).
     DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
@@ -64,7 +63,7 @@ DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki
 
 DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747/) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled.
 
-DivestOS 16.0, 17.1, and 18.1 implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](/android/#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and 18.1 feature GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, and [`ptrace_scope`](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features). All branches additionally have various miscellaneous patches courtesy of GrapheneOS.
+DivestOS 16.0, 17.1, and 18.1 implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and 18.1 feature GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, and [`ptrace_scope`](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features). All branches additionally have various miscellaneous patches courtesy of GrapheneOS.
 
 !!! attention
 
@@ -72,47 +71,80 @@ DivestOS 16.0, 17.1, and 18.1 implements GrapheneOS's [`INTERNET`](https://devel
 
     Not all of the supported devices have [verified boot](https://source.android.com/security/verifiedboot), and some perform it better than others.
 
-## Android security and privacy features
+## Android Devices
 
-### User Profiles
+Avoid buying phones from mobile network operators. These often have a **locked bootloader** and do not support [OEM unlocking](https://source.android.com/devices/bootloader/locking_unlocking). These phone variants will prevent you from installing any kind of alternative Android distribution.
 
-Multiple user profiles (Settings → System → Multiple users) are the simplest way to isolate in Android. With user profiles you can limit a user from making calls, SMS or installing apps on the device. Each profile is encrypted using its own encryption key and cannot access the data of any other profiles. Even the device owner cannot view the data of other profiles without knowing their password. Multiple user profiles is a more secure method of isolation.
+Be very **careful** about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen there's a possibility of [IMEI blacklisting](https://www.gsma.com/security/resources/imei-blacklisting/). There is also a risk involved with you being associated with the activity of the previous owner.
 
-### Work Profile
+A few more tips regarding Android devices and operating system compatibility:
 
-[Work Profiles](https://support.google.com/work/android/answer/6191949) are another way to isolate individual apps and may be more convenient than separate user profiles.
+- Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.
+- Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper [Verified Boot](https://source.android.com/security/verifiedboot) support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
+- In short, if a device or Android distribution is not listed here, there is probably a good reason, so check our [discussions](https://github.com/privacyguides/privacyguides.org/discussions) page.
 
-A **device controller** such as [Shelter](#recommended-apps) is required, unless you're using CalyxOS which includes one.
+### Google Pixel
 
-The work profile is dependent on a device controller to function. Features such as *File Shuttle* and *contact search blocking* or any kind of isolation features must be implemented by the controller. The user must also fully trust the device controller app, as it has full access to the data inside of the work profile.
+!!! recommendation
 
-This method is generally less secure than a secondary user profile; however, it does allow you the convenience of running apps in both the work and personal profiles simultaneously.
+    ![Google Pixel 6](assets/img/android/google-pixel.png){ align=right }
 
-### Verified Boot
+    **Google Pixel** devices are known to have good security and properly support [Verified Boot](https://source.android.com/security/verifiedboot), even when installing custom operating systems.
 
-[Verified Boot](https://source.android.com/security/verifiedboot) is an important part of the Android security model. It provides protection against [evil maid](https://en.wikipedia.org/wiki/Evil_maid_attack) attacks, malware persistence, and ensures security updates cannot be downgraded with [rollback protection](https://source.android.com/security/verifiedboot/verified-boot#rollback-protection).
+    Beginning with the **Pixel 6** and **6 Pro**, Pixel devices receive a minimum of 5 years of guaranteed security updates, ensuring a much longer lifespan compared to the 2-4 years competing OEMs typically offer.
 
-Android 10 and above has moved away from full-disk encryption (FDE) to more flexible [file-based encryption](https://source.android.com/security/encryption/file-based).
+    [Visit store.google.com](https://store.google.com/category/phones){ .md-button .md-button--primary }
 
-Each user's data is encrypted using their own unique encryption key, and the operating system files are left unencrypted. Verified Boot ensures the integrity of the operating system files preventing an adversary with physical access from tampering or installing malware on the device. In the unlikely case that malware is able to exploit other parts of the system and gain higher privileged access, Verified Boot will prevent and revert changes to the system partition upon reboot of the device.
+Unless you know you have a specific need for [CalyxOS/microG features](https://calyxos.org/features/) that are unavailable on GrapheneOS, we strongly recommend GrapheneOS over other operating system choices on Pixel devices.
 
-Unfortunately, original equipment manufacturers (OEMs) are only obliged to support Verified Boot on their stock Android distribution. Only a few OEMs such as Google support custom Android Verified Boot (AVB) key enrollment on their devices. Some AOSP derivatives such as LineageOS or /e/ OS do not support Verified Boot even on hardware with Verified Boot support for third party operating systems. We recommend that you check for support **before** purchasing a new device. AOSP derivatives which do not support Verified Boot are **not** recommended.
+[More about GrapheneOS vs CalyxOS](android/grapheneos-vs-calyxos.md){ .md-button }
 
-### VPN Killswitch
+The installation of GrapheneOS on a Pixel phone is easy with their [web installer](https://grapheneos.org/install/web). If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the [NitroPhone](https://shop.nitrokey.com/shop) as they come preloaded with GrapheneOS from the reputable [Nitrokey](https://www.nitrokey.com/about) company.
 
-Android 7 and above supports a VPN killswitch and it is available without the need to install third party apps. This feature can prevent leaks if the VPN is disconnected. It can be found in ⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN.
+A few more tips for purchasing a Google Pixel:
 
-### Global Toggles
+- If you're after a bargain on a Pixel device, we suggest buying an "**a**" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
+- Consider price beating options and specials offered at [brick and mortar](https://en.wikipedia.org/wiki/Brick_and_mortar) stores.
+- Look at online community bargain sites in your country. These can alert you to good sales.
+- Google provides a list showing the [support cycle](https://support.google.com/nexus/answer/4457705) for each one of their devices. The price per day for a device can be calculated as: $\text{Cost} \over \text {EoL Date }-\text{ Current Date}$, meaning that the longer use of the device the lower cost per day.
 
-Modern Android devices have global toggles for disabling [Bluetooth](https://en.wikipedia.org/wiki/Bluetooth) and location services. Android 12 introduced toggles for the camera and microphone. When not in use, we recommend disabling these features. Apps cannot use disabled features (even if granted individual permission) until re-enabled.
+### Other Devices
 
-## Recommended Apps
+!!! important
+
+    Google Pixel phones are the only devices which are fully supported by all of our recommended Android distributions. Additionally, Pixel devices have stronger hardware security than any other Android device currently on the market, due to Google's custom Titan security chips acting as the Secure Element for secrets storage and rate limiting. Secure Elements are more limited and have a smaller attack surface than the Trusted Execution Environment (TEE), which is also used to run "trusted" programs. Most other phones do not have a Secure Element and have to using the TEE for both secrets storage, rate limiting, and trusted computing."
+
+If you are unable to purchase a Pixel device, any device which is supported by CalyxOS should be reasonably secure and private enough for most users after installing CalyxOS.
+
+In any case, when purchasing a device we recommend getting one as new as possible. The software and firmware of mobile devices are only supported for a limited time, so buying new extends that lifespan as much as possible. 
+
+We do not recommend the following devices over a Google Pixel device, but we do have some notes on devices from other manufacturers:
+
+#### OnePlus
+
+If you are unable to obtain a Google Pixel, recent OnePlus devices provide a good balance of security with custom operating systems and longevity, with OnePlus 8 and later devices receiving 4 years of security updates. CalyxOS has [experimental support](https://calyxos.org/news/2022/04/01/fairphone4-oneplus8t-oneplus9-test-builds/) for the **OnePlus 8T** and **9**.
+
+DivestOS has support for most OnePlus devices up to the **OnePlus 7T Pro**, with varying levels of support.
+
+#### Fairphone
+
+!!! danger
+
+    Out of the box, Fairphone devices are incredibly insecure. [Fairphone's stock bootloader trusts the public AVB signing key](https://forum.fairphone.com/t/bootloader-avb-keys-used-in-roms-for-fairphone-3-4/83448/11), meaning any system can be installed and the phone will trust it as if it is the stock system. This essentially breaks verified boot on a stock Fairphone device.
+
+    This problem is solved when you install a custom operating system such as CalyxOS or DivestOS and trust the developer's signing keys rather than the stock system's. To reiterate, **you must install a custom operating system with custom boot keys to use Fairphone devices in a secure manner.**
+
+CalyxOS has [experimental support](https://calyxos.org/news/2022/04/01/fairphone4-oneplus8t-oneplus9-test-builds/) for the **Fairphone 4**. DivestOS has builds available for the **Fairphone 3**.
+
+While Fairphone markets their devices as receiving 6 years of support, the SOC (Qualcomm Snapdragon 750G on the Fairphone 4) has a considerably sooner EOL date. This means that firmware security updates from Qualcomm for the Fairphone 4 will end in September 2023, regardless of whether Fairphone continues to release software security updates.
+
+## General Apps
 
 ### Orbot
 
 !!! recommendation
 
-    ![Orbot logo](/assets/img/android/orbot.svg){ align=right }
+    ![Orbot logo](assets/img/android/orbot.svg){ align=right }
 
     **Orbot** is a free proxy app that routes your connections through the Tor Network.
 
@@ -138,7 +170,7 @@ For resistance against traffic analysis attacks, consider enabling *Isolate Dest
 
 !!! recommendation
 
-    ![Shelter logo](/assets/img/android/shelter.svg){ align=right }
+    ![Shelter logo](assets/img/android/shelter.svg){ align=right }
 
     **Shelter** is an app that helps you leverage the Android work profile to isolate other apps.
 
@@ -164,8 +196,8 @@ For resistance against traffic analysis attacks, consider enabling *Isolate Dest
 
 !!! recommendation
 
-    ![Auditor logo](/assets/img/android/auditor.svg#only-light){ align=right }
-    ![Auditor logo](/assets/img/android/auditor-dark.svg#only-dark){ align=right }
+    ![Auditor logo](assets/img/android/auditor.svg#only-light){ align=right }
+    ![Auditor logo](assets/img/android/auditor-dark.svg#only-dark){ align=right }
 
     **Auditor** is an app which leverages hardware security features to provide device integrity monitoring for [supported devices](https://attestation.app/about#device-support). Currently it works with GrapheneOS and the device's stock operating system.
 
@@ -185,15 +217,15 @@ Auditor performs attestation and intrusion detection by:
 
 No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring.
 
-If your [threat model](/threat-modeling/) requires privacy you could consider using Orbot or a VPN to hide your IP address from the attestation service.
+If your [threat model](threat-modeling.md) requires privacy you could consider using Orbot or a VPN to hide your IP address from the attestation service.
 To make sure that your hardware and operating system is genuine, [perform local attestation](https://grapheneos.org/install/web#verifying-installation) immediately after the device has been installed and prior to any internet connection.
 
 ### Secure Camera
 
 !!! recommendation
 
-    ![Secure camera logo](/assets/img/android/secure_camera.svg#only-light){ align=right }
-    ![Secure camera logo](/assets/img/android/secure_camera-dark.svg#only-dark){ align=right }
+    ![Secure camera logo](assets/img/android/secure_camera.svg#only-light){ align=right }
+    ![Secure camera logo](assets/img/android/secure_camera-dark.svg#only-dark){ align=right }
 
       **Secure Camera** is an camera app focused on privacy and security which can capture images, videos, and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices.
 
@@ -219,8 +251,8 @@ Main privacy features include:
 
 !!! recommendation
 
-    ![Secure PDF Viewer logo](/assets/img/android/secure_pdf_viewer.svg#only-light){ align=right }
-    ![Secure PDF Viewer logo](/assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ align=right }
+    ![Secure PDF Viewer logo](assets/img/android/secure_pdf_viewer.svg#only-light){ align=right }
+    ![Secure PDF Viewer logo](assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ align=right }
 
     **Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [webview](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files.
 
@@ -236,7 +268,7 @@ Main privacy features include:
 
 !!! recommendation
 
-    ![PrivacyBlur logo](/assets/img/android/privacyblur.svg){ align=right }
+    ![PrivacyBlur logo](assets/img/android/privacyblur.svg){ align=right }
 
     **PrivacyBlur** is a free app which can blur sensitive portions of pictures before sharing them online.
 
@@ -251,96 +283,7 @@ Main privacy features include:
 
     You should **never** use blur to redact [text in images](https://bishopfox.com/blog/unredacter-tool-never-pixelation). If you want to redact text in an image, draw a box over the text. For this we suggest [Pocket Paint](https://github.com/Catrobat/Paintroid) or [Imagepipe](https://codeberg.org/Starfish/Imagepipe).
 
-## General Recommendations
-
-### Avoid Root
-
-[Rooting](https://en.wikipedia.org/wiki/Rooting_(Android)) Android phones can decrease security significantly as it weakens the complete [Android security model](https://en.wikipedia.org/wiki/Android_(operating_system)#Security_and_privacy). This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful [Verified Boot](https://source.android.com/security/verifiedboot). Apps that require root will also modify the system partition meaning that Verified Boot would have to remain disabled. Having root exposed directly in the user interface also increases the [attack surface](https://en.wikipedia.org/wiki/Attack_surface) of your device and may assist in [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation) vulnerabilities and [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) policy bypasses.
-
-Adblockers (AdAway) which modify the [hosts file](https://en.wikipedia.org/wiki/Hosts_(file)) and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest encrypted [DNS](/dns) or [VPN](/vpn) server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.
-
-AFWall+ works based on the [packet filtering](https://en.wikipedia.org/wiki/Firewall_(computing)#Packet_filter) approach and may be bypassable in some situations.
-
-We do not believe that the security sacrifices made by rooting a phone are worth the questionable privacy benefits of those apps.
-
-### Firmware Updates
-
-Firmware updates are critical for maintaining security and without them your device cannot be secure. Original equipment manufacturers (OEMs)—in other words, phone manufacturers—have support agreements with their partners to provide the closed source components for a limited support period. These are detailed in the monthly [Android Security Bulletins](https://source.android.com/security/bulletin).
-
-As the components of the phone such as the processor and radio technologies rely on closed source components, the updates must be provided by the respective manufacturers. Therefore it is important that you purchase a device within an active support cycle. [Qualcomm](https://www.qualcomm.com/news/releases/2020/12/16/qualcomm-and-google-announce-collaboration-extend-android-os-support-and) and [Samsung](https://news.samsung.com/us/samsung-galaxy-security-extending-updates-knox/) support their devices for 4 years while cheaper products often have shorter support. With the introduction of the [Pixel 6](https://support.google.com/pixelphone/answer/4457705), Google now makes their own system on chip (SoC) and they will provide 5 years of support.
-
-Devices that have reached their end-of-life (EoL) and are no longer supported by the SoC manufacturer, cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.
-
-### Android Versions
-
-It's important to not use an [end-of-life](https://endoflife.date/android) version of Android. Newer versions of Android not only receive security updates for the operating system but also important privacy enhancing updates too. For example, [prior to Android 10](https://developer.android.com/about/versions/10/privacy/changes), any user apps with the [`READ_PHONE_STATE`](https://developer.android.com/reference/android/Manifest.permission#READ_PHONE_STATE) permission could access sensitive and unique serial numbers of your phone such as [IMEI](https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity), [MEID](https://en.wikipedia.org/wiki/Mobile_equipment_identifier), your SIM card's [IMSI](https://en.wikipedia.org/wiki/International_mobile_subscriber_identity), whereas now they must be system apps to do so. System apps are only provided by the OEM or Android distribution.
-
-### Android Permissions
-
-[Permissions on Android](https://developer.android.com/guide/topics/permissions/overview) grant users control over what apps are allowed to access. Google regularly makes [improvements](https://developer.android.com/about/versions/11/privacy/permissions) on the permission system in each successive version. All user installed apps are strictly [sandboxed](https://source.android.com/security/app-sandbox), therefore there is no need to install any antivirus apps. The savings you make from not purchasing or subscribing to security apps is better spent on paying for a supported device in the future.
-
-Should you want to run an app that you're unsure about, consider using a user or work [profile](/android/#android-security-privacy).
-
-### Advanced Protection Program
-
-If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection/). It is available at no cost to anyone with two or more hardware security keys with [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) support.
-
-The Advanced Protection Program provides enhanced threat monitoring and enables:
-
-- Stricter two factor authentication; e.g. that [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) or [FIDO2](https://en.wikipedia.org/wiki/WebAuthn) **must** be used and disallows the use of [SMS OTPs](https://en.wikipedia.org/wiki/One-time_password#SMS), [TOTP](https://en.wikipedia.org/wiki/Time-based_one-time_password), and [OAuth](https://en.wikipedia.org/wiki/OAuth)
-- Only Google and verified third party apps can access account data
-- Scanning of incoming emails on Gmail accounts for [phishing](https://en.wikipedia.org/wiki/Phishing#Email_phishing) attempts
-- Stricter [safe browser scanning](https://www.google.com/chrome/privacy/whitepaper.html#malware) with Google Chrome
-- Stricter recovery process for accounts with lost credentials
-
- For users that are using the privileged Google Play Services (common on stock operating systems), the Advanced Protection Program also comes with [additional benefits](https://support.google.com/accounts/answer/9764949?hl=en) such as:
-
-- Not allowing app installation outside of the Google Play Store, the OS vendor's app store, or via [`adb`](https://en.wikipedia.org/wiki/Android_Debug_Bridge)
-- Mandatory automatic device scanning with [Play Protect](https://support.google.com/googleplay/answer/2812853?hl=en#zippy=%2Chow-malware-protection-works%2Chow-privacy-alerts-work)
-- Warning the user about unverified applications
-
-### SafetyNet and Play Integrity API
-
-[SafetyNet](https://developer.android.com/training/safetynet/attestation) and the [Play Integrity APIs](https://developer.android.com/google/play/integrity) are generally used for [banking apps](https://grapheneos.org/usage#banking-apps). Many banking apps will work fine in GrapheneOS with sandboxed Play services, however some non-financal apps have their own crude anti-tampering mechanisms which might fail. GrapheneOS passes the `basicIntegrity` check, but not the certification check `ctsProfileMatch`. Devices with Android 8 or later have hardware attestation support which cannot be bypassed without leaked keys or serious vulnerabilities.
-
-As for Google Wallet, we don't recommend this due to their [privacy policy](https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en), which states you must opt-out if you don't want your credit rating and personal information shared with affiliate marketing services.
-
-### Advertising ID
-
-All devices with Google Play Services installed automatically generate an [advertising ID](https://support.google.com/googleplay/android-developer/answer/6048248?hl=en) used for targeted advertising. Disable this feature to limit the data collected about you.
-
-On Android distributions with [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), go to ⚙️ Settings → Apps → Sandboxed Google Play → Google Settings → Ads and select **Delete advertising ID**.
-
-On Android distributions with privileged Google Play Services (such as stock OSes), the setting may be in one of several locations. Check
-
-- ⚙️ Settings → Google → Ads
-- ⚙️ Settings → Privacy → Ads
-
-Depending on your system, you will either be given the option to delete your advertising ID or to "Opt out of interest-based ads". You should delete the advertising ID if you are given the option to, and if you are not, we recommend that you opt out of interested-based ads and then reset your advertising ID.
-
-### Android Device Shopping
-
-Google Pixels are known to have good security and properly support [Verified Boot](https://source.android.com/security/verifiedboot). Some other phones such as the Fairphone and OnePlus devices also support custom Android Verified Boot (AVB) key enrollment. However, there have been issues with their older models. In the past they were using [test keys](https://social.coop/@dazinism/105346943304083054) or not doing proper verification, making Verified Boot on those devices useless.
-
-Avoid buying phones from mobile network operators. These often have a **locked bootloader** and do not support [OEM unlocking](https://source.android.com/devices/bootloader/locking_unlocking). These phone variants will prevent you from installing any kind of alternative Android distribution. Phones that cannot be unlocked will often have an [IMEI](https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity) starting with "35", that includes phones from purchased from Verizon, Telus, Rogers, EE, etc.
-
-Be very **careful** about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen there's a possibility of [IMEI blacklisting](https://www.gsma.com/security/resources/imei-blacklisting/). There is also a risk involved with you being associated with the activity of the previous owner.
-
-We have these general tips:
-
-- If you're after a bargain on a Pixel device, we suggest buying an "**a**" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
-- Consider price beating options and specials offered at [brick and mortar](https://en.wikipedia.org/wiki/Brick_and_mortar) stores.
-- Look at online community bargain sites in your country. These can alert you to good sales.
-- Google provides a list showing the [support cycle](https://support.google.com/nexus/answer/4457705) for each one of their devices. The price per day for a device can be calculated as: $\text{Cost} \over \text {EoL Date }-\text{ Current Date}$, meaning that the longer use of the device the lower cost per day.
-- Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.
-- Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper [Verified Boot](https://source.android.com/security/verifiedboot) support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
-- In short, if a device or Android distribution is not listed here, there is probably a good reason, so check our [discussions](https://github.com/privacyguides/privacyguides.org/discussions) page.
-
-The installation of GrapheneOS on a Pixel phone is easy with their [web installer](https://grapheneos.org/install/web). If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the [NitroPhone](https://shop.nitrokey.com/shop) as they come preloaded with GrapheneOS from the reputable [Nitrokey](https://www.nitrokey.com/about) company. The GrapheneOS project is not currently affiliated with any vendor and cannot ensure the quality or security of their products.
-
-A [CalyxOS membership](https://calyxinstitute.org/membership/calyxos) also entitles you to a device preloaded with CalyxOS.
-
-## Where to get your applications
+## App Stores
 
 ### GrapheneOS's App Store
 
@@ -362,7 +305,7 @@ We have these general tips:
 - Check if an app is available on the [IzzyOnDroid](https://apt.izzysoft.de/fdroid/) repository. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. We recommend that you download the GitHub builds and install them manually first, then use IzzyOnDroid for any subsequent updates. This will ensure that the signature of the applications you get from IzzyOnDroid matches that of the developer and the packages have not been tampered with.
 - Check if there are any differences between the F-Droid version and the Google Play Store version. Some applications like [IVPN](https://www.ivpn.net/) do not include certain features (eg [AntiTracker](https://www.ivpn.net/knowledgebase/general/antitracker-faq/)) in their Google Play Store build out of fear of censorship by Google.
 
-Evaluate whether the additional features in the F-Droid build are worth the slower updates. Also think about whether faster updates from the Google Play Store are worth the potential privacy issues in your [threat model](/threat-modeling/).
+Evaluate whether the additional features in the F-Droid build are worth the slower updates. Also think about whether faster updates from the Google Play Store are worth the potential privacy issues in your [threat model](threat-modeling.md).
 
 #### Droid-ify
 
@@ -381,40 +324,3 @@ To mitigate these problems, we recommend [Droid-ify](https://github.com/Iamlooke
     **Downloads:**
     - [:fontawesome-brands-android: APK Download](https://android.izzysoft.de/repo/apk/com.looker.droidify)
     - [:fontawesome-brands-github: GitHub](https://github.com/Iamlooker/Droid-ify)
-
-## Security comparison of GrapheneOS and CalyxOS
-
-### Profiles
-
-CalyxOS includes a device controller app so there is no need to install a third party app like [Shelter](/android/#recommended-apps). GrapheneOS plans to introduce nested profile support with better isolation in the future.
-
-GrapheneOS extends the [user profile](/android/#android-security-privacy) feature allowing a user to press an "End Session" button. This button clears the encryption key from memory. There are plans to add a [cross profile notifications system](https://github.com/GrapheneOS/os-issue-tracker/issues/88) in the future.
-
-### Sandboxed Google Play vs Privileged MicroG
-
-When Google Play services are used on GrapheneOS, they run as a user app and are contained within a user or work profile.
-
-Sandboxed Google Play is confined using the highly restrictive, default [`untrusted_app`](https://source.android.com/security/selinux/concepts) domain provided by [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux). Permissions for apps to use Google Play Services can be revoked at any time by the user.
-
-MicroG is a reimplementation of Google Play Services. This means it needs to be updated every time Android has a major version update (or the Android API changes). It also needs to run in the highly privileged [`system_app`](https://source.android.com/security/selinux/concepts) SELinux domain like normal Google Play Services and requires access to [signature spoofing](https://madaidans-insecurities.github.io/android.html#microg-signature-spoofing) so this is less secure than the Sandboxed Google Play approach. We do not believe MicroG provides any privacy advantages over Sandboxed Google Play except for the option to *shift trust* of the location backend from Google to another provider such as Mozilla or DejaVu.
-
-From a usability point of view, Sandboxed Google Play also works well with far more applications than MicroG, thanks to its support for services like [Google Play Games](https://play.google.com/googleplaygames) and [In-app Billing API](https://android-doc.github.io/google/play/billing/api.html).
-
-### Privileged App Extensions
-
-Android 12 comes with special support for seamless app updates with [third party app stores](https://android-developers.googleblog.com/2020/09/listening-to-developer-feedback-to.html). The popular Free and Open Source Software (FOSS) repository [F-Droid](https://f-droid.org) doesn't implement this feature and requires a [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged) to be included with the Android distribution in order to have unattended app installation.
-
-GrapheneOS doesn't compromise on security; therefore, they do not include the F-Droid extension. Users have to confirm all updates manually if they want to use F-Droid. Alternatively, they can use the Droid-ify client which does support seamless app updates in Android 12. GrapheneOS officially recommends [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play) instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like [NewPipe](/video-streaming)).
-
-CalyxOS includes the [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged), which may lower device security. Seamless app updates should be possible with [Aurora Store](https://auroraoss.com) in Android 12.
-
-### Additional hardening
-
-GrapheneOS improves upon [AOSP](https://source.android.com/) security with:
-
-- **Hardened WebView:** Vanadium WebView requires [64-bit](https://en.wikipedia.org/wiki/64-bit_computing) processes on the [WebView](https://developer.android.com/reference/android/webkit/WebView) process and disables legacy [32-bit](https://en.wikipedia.org/wiki/32-bit_computing) processes. It uses hardened compiler options such as [`-fwrapv`](https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html) and [`-fstack-protector-strong`](https://gcc.gnu.org/onlinedocs/gcc-4.9.3/gcc/Optimize-Options.html), which can help protect against [stack buffer overflows](https://en.wikipedia.org/wiki/Stack_buffer_overflow). [API](https://en.wikipedia.org/wiki/API)s such as the [battery status API](https://chromestatus.com/feature/4537134732017664) are disabled for privacy reasons. All system apps on GrapheneOS use the Vanadium WebView which means user installed apps that use WebView will also benefit from Vanadium's hardening. The [Vanadium patch set](https://github.com/GrapheneOS/Vanadium/tree/12/patches) is a lot more comprehensive than CalyxOS's [Chromium patch set](https://gitlab.com/CalyxOS/chromium-patches) which is derived from it.
-- **Hardened Kernel:** GrapheneOS kernel includes some hardening from the [linux-hardened](https://github.com/GrapheneOS/linux-hardened) project and the [Kernel Self Protection Project (KSPP)](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). CalyxOS uses the [same kernel](https://calyxos.org/docs/development/build/kernel/) as regular Android with some minor modifications.
-- **Hardened Memory Allocator:** GrapheneOS uses the [hardened malloc](https://github.com/GrapheneOS/hardened_malloc) subproject as its memory allocator. This focuses on hardening against [memory heap corruption](https://en.wikipedia.org/wiki/Memory_corruption). CalyxOS uses the default AOSP [Scudo Malloc](https://source.android.com/devices/tech/debug/scudo), which is generally [less effective](https://twitter.com/danielmicay/status/1033671709197398016). Hardened Malloc has uncovered vulnerabilities in AOSP which have been [fixed](https://github.com/GrapheneOS/platform_system_core/commit/be11b59725aa6118b0e1f0712572e835c3d50746) by GrapheneOS such as [CVE-2021-0703](https://nvd.nist.gov/vuln/detail/CVE-2021-0703).
-- **Secure Exec Spawning:** GrapheneOS [spawns](https://en.wikipedia.org/wiki/Spawn_(computing)) fresh processes as opposed to using the [Zygote model](https://ayusch.com/android-internals-the-android-os-boot-process) used by AOSP and CalyxOS. The Zygote model weakens [Address Space Layout Randomization](https://en.wikipedia.org/wiki/Address_space_layout_randomization) (ASLR) and is considered [less secure](https://wenke.gtisc.gatech.edu/papers/morula.pdf). Creating [fresh processes](https://grapheneos.org/usage#exec-spawning) is safer but will have some performance penalty when launching a new application. These penalties are not really noticeable unless you have an [old device](https://support.google.com/nexus/answer/4457705) with slow storage such as the Pixel 3a/3a XL as it has [eMMC](https://en.wikipedia.org/wiki/MultiMediaCard#eMMC).
-
-**Please note that these are just a few examples and are not an extensive list of GrapheneOS's hardening**. For a more complete list, please read GrapheneOS' [official documentation](https://grapheneos.org/features).

docs/android/grapheneos-vs-calyxos.md

@@ -0,0 +1,38 @@
+---
+title: "GrapheneOS vs CalyxOS"
+icon: 'material/cellphone-cog'
+---
+## Profiles
+
+CalyxOS includes a device controller app so there is no need to install a third party app like Shelter.
+
+GrapheneOS extends the user profile feature allowing a user to press an "End Session" button. This button clears the encryption key from memory. There are plans to add a [cross profile notifications system](https://github.com/GrapheneOS/os-issue-tracker/issues/88) in the future. GrapheneOS plans to introduce nested profile support with better isolation in the future.
+
+## Sandboxed Google Play vs Privileged MicroG
+
+When Google Play services are used on GrapheneOS, they run as a user app and are contained within a user or work profile.
+
+Sandboxed Google Play is confined using the highly restrictive, default [`untrusted_app`](https://source.android.com/security/selinux/concepts) domain provided by [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux). Permissions for apps to use Google Play Services can be revoked at any time by the user.
+
+MicroG is a reimplementation of Google Play Services. This means it needs to be updated every time Android has a major version update (or the Android API changes). It also needs to run in the highly privileged [`system_app`](https://source.android.com/security/selinux/concepts) SELinux domain like normal Google Play Services and requires access to [signature spoofing](https://madaidans-insecurities.github.io/android.html#microg-signature-spoofing) so this is less secure than the Sandboxed Google Play approach. We do not believe MicroG provides any privacy advantages over Sandboxed Google Play except for the option to *shift trust* of the location backend from Google to another provider such as Mozilla or DejaVu.
+
+From a usability point of view, Sandboxed Google Play also works well with far more applications than MicroG, thanks to its support for services like [Google Play Games](https://play.google.com/googleplaygames) and [In-app Billing API](https://android-doc.github.io/google/play/billing/api.html).
+
+## Privileged App Extensions
+
+Android 12 comes with special support for seamless app updates with [third party app stores](https://android-developers.googleblog.com/2020/09/listening-to-developer-feedback-to.html). The popular Free and Open Source Software (FOSS) repository [F-Droid](https://f-droid.org) doesn't implement this feature and requires a [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged) to be included with the Android distribution in order to have unattended app installation.
+
+GrapheneOS doesn't compromise on security; therefore, they do not include the F-Droid extension. Users have to confirm all updates manually if they want to use F-Droid. Alternatively, they can use the Droid-ify client which does support seamless app updates in Android 12. GrapheneOS officially recommends [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play) instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like [NewPipe](../video-streaming.md)).
+
+CalyxOS includes the [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged), which may lower device security. Seamless app updates should be possible with [Aurora Store](https://auroraoss.com) in Android 12.
+
+## Additional hardening
+
+GrapheneOS improves upon [AOSP](https://source.android.com/) security with:
+
+- **Hardened WebView:** Vanadium WebView requires [64-bit](https://en.wikipedia.org/wiki/64-bit_computing) processes on the [WebView](https://developer.android.com/reference/android/webkit/WebView) process and disables legacy [32-bit](https://en.wikipedia.org/wiki/32-bit_computing) processes. It uses hardened compiler options such as [`-fwrapv`](https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html) and [`-fstack-protector-strong`](https://gcc.gnu.org/onlinedocs/gcc-4.9.3/gcc/Optimize-Options.html), which can help protect against [stack buffer overflows](https://en.wikipedia.org/wiki/Stack_buffer_overflow). [API](https://en.wikipedia.org/wiki/API)s such as the [battery status API](https://chromestatus.com/feature/4537134732017664) are disabled for privacy reasons. All system apps on GrapheneOS use the Vanadium WebView which means user installed apps that use WebView will also benefit from Vanadium's hardening. The [Vanadium patch set](https://github.com/GrapheneOS/Vanadium/tree/12/patches) is a lot more comprehensive than CalyxOS's [Chromium patch set](https://gitlab.com/CalyxOS/chromium-patches) which is derived from it.
+- **Hardened Kernel:** GrapheneOS kernel includes some hardening from the [linux-hardened](https://github.com/GrapheneOS/linux-hardened) project and the [Kernel Self Protection Project (KSPP)](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). CalyxOS uses the [same kernel](https://calyxos.org/docs/development/build/kernel/) as regular Android with some minor modifications.
+- **Hardened Memory Allocator:** GrapheneOS uses the [hardened malloc](https://github.com/GrapheneOS/hardened_malloc) subproject as its memory allocator. This focuses on hardening against [memory heap corruption](https://en.wikipedia.org/wiki/Memory_corruption). CalyxOS uses the default AOSP [Scudo Malloc](https://source.android.com/devices/tech/debug/scudo), which is generally [less effective](https://twitter.com/danielmicay/status/1033671709197398016). Hardened Malloc has uncovered vulnerabilities in AOSP which have been [fixed](https://github.com/GrapheneOS/platform_system_core/commit/be11b59725aa6118b0e1f0712572e835c3d50746) by GrapheneOS such as [CVE-2021-0703](https://nvd.nist.gov/vuln/detail/CVE-2021-0703).
+- **Secure Exec Spawning:** GrapheneOS [spawns](https://en.wikipedia.org/wiki/Spawn_(computing)) fresh processes as opposed to using the [Zygote model](https://ayusch.com/android-internals-the-android-os-boot-process) used by AOSP and CalyxOS. The Zygote model weakens [Address Space Layout Randomization](https://en.wikipedia.org/wiki/Address_space_layout_randomization) (ASLR) and is considered [less secure](https://wenke.gtisc.gatech.edu/papers/morula.pdf). Creating [fresh processes](https://grapheneos.org/usage#exec-spawning) is safer but will have some performance penalty when launching a new application. These penalties are not really noticeable unless you have an [old device](https://support.google.com/nexus/answer/4457705) with slow storage such as the Pixel 3a/3a XL as it has [eMMC](https://en.wikipedia.org/wiki/MultiMediaCard#eMMC).
+
+**Please note that these are just a few examples and are not an extensive list of GrapheneOS's hardening**. For a more complete list, please read GrapheneOS' [official documentation](https://grapheneos.org/features).

docs/android/overview.md

@@ -0,0 +1,72 @@
+---
+title: Android Overview
+icon: material/cellphone-check
+---
+Android is a secure operating system that has strong [app sandboxing](https://source.android.com/security/app-sandbox), [Verified Boot](https://source.android.com/security/verifiedboot), and a robust [permission](https://developer.android.com/guide/topics/permissions/overview) control system.
+
+The main privacy concern with most Android devices is that they usually include [Google Play Services](https://developers.google.com/android/guides/overview). This component is proprietary, [closed source](https://en.wikipedia.org/wiki/Proprietary_software), has a privileged role on your phone, and may collect private user information. It is neither a part of the [Android Open Source Project](https://source.android.com/) (AOSP) nor is it included with the below derivatives.
+
+## Avoid Root
+
+[Rooting](https://en.wikipedia.org/wiki/Rooting_(Android)) Android phones can decrease security significantly as it weakens the complete [Android security model](https://en.wikipedia.org/wiki/Android_(operating_system)#Security_and_privacy). This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful [Verified Boot](https://source.android.com/security/verifiedboot). Apps that require root will also modify the system partition meaning that Verified Boot would have to remain disabled. Having root exposed directly in the user interface also increases the [attack surface](https://en.wikipedia.org/wiki/Attack_surface) of your device and may assist in [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation) vulnerabilities and [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) policy bypasses.
+
+Adblockers (AdAway) which modify the [hosts file](https://en.wikipedia.org/wiki/Hosts_(file)) and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest encrypted [DNS](../dns.md) or [VPN](../vpn.md) server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.
+
+AFWall+ works based on the [packet filtering](https://en.wikipedia.org/wiki/Firewall_(computing)#Packet_filter) approach and may be bypassable in some situations.
+
+We do not believe that the security sacrifices made by rooting a phone are worth the questionable privacy benefits of those apps.
+
+## Firmware Updates
+
+Firmware updates are critical for maintaining security and without them your device cannot be secure. Original equipment manufacturers (OEMs)—in other words, phone manufacturers—have support agreements with their partners to provide the closed source components for a limited support period. These are detailed in the monthly [Android Security Bulletins](https://source.android.com/security/bulletin).
+
+As the components of the phone such as the processor and radio technologies rely on closed source components, the updates must be provided by the respective manufacturers. Therefore it is important that you purchase a device within an active support cycle. [Qualcomm](https://www.qualcomm.com/news/releases/2020/12/16/qualcomm-and-google-announce-collaboration-extend-android-os-support-and) and [Samsung](https://news.samsung.com/us/samsung-galaxy-security-extending-updates-knox/) support their devices for 4 years while cheaper products often have shorter support. With the introduction of the [Pixel 6](https://support.google.com/pixelphone/answer/4457705), Google now makes their own system on chip (SoC) and they will provide 5 years of support.
+
+Devices that have reached their end-of-life (EoL) and are no longer supported by the SoC manufacturer, cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.
+
+## Android Versions
+
+It's important to not use an [end-of-life](https://endoflife.date/android) version of Android. Newer versions of Android not only receive security updates for the operating system but also important privacy enhancing updates too. For example, [prior to Android 10](https://developer.android.com/about/versions/10/privacy/changes), any user apps with the [`READ_PHONE_STATE`](https://developer.android.com/reference/android/Manifest.permission#READ_PHONE_STATE) permission could access sensitive and unique serial numbers of your phone such as [IMEI](https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity), [MEID](https://en.wikipedia.org/wiki/Mobile_equipment_identifier), your SIM card's [IMSI](https://en.wikipedia.org/wiki/International_mobile_subscriber_identity), whereas now they must be system apps to do so. System apps are only provided by the OEM or Android distribution.
+
+## Android Permissions
+
+[Permissions on Android](https://developer.android.com/guide/topics/permissions/overview) grant users control over what apps are allowed to access. Google regularly makes [improvements](https://developer.android.com/about/versions/11/privacy/permissions) on the permission system in each successive version. All user installed apps are strictly [sandboxed](https://source.android.com/security/app-sandbox), therefore there is no need to install any antivirus apps. The savings you make from not purchasing or subscribing to security apps is better spent on paying for a supported device in the future.
+
+Should you want to run an app that you're unsure about, consider using a user or work [profile](android/#android-security-privacy).
+
+## Advanced Protection Program
+
+If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection/). It is available at no cost to anyone with two or more hardware security keys with [FIDO](/security/multi-factor-authentication.md#fido-fast-identity-online) support.
+
+The Advanced Protection Program provides enhanced threat monitoring and enables:
+
+- Stricter two factor authentication; e.g. that [FIDO](/security/multi-factor-authentication/#fido-fast-identity-online) **must** be used and disallows the use of [SMS OTPs](/security/multi-factor-authentication/#sms-or-email-mfa), [TOTP](/security/multi-factor-authentication.md#time-based-one-time-password-totp), and [OAuth](https://en.wikipedia.org/wiki/OAuth)
+- Only Google and verified third party apps can access account data
+- Scanning of incoming emails on Gmail accounts for [phishing](https://en.wikipedia.org/wiki/Phishing#Email_phishing) attempts
+- Stricter [safe browser scanning](https://www.google.com/chrome/privacy/whitepaper.html#malware) with Google Chrome
+- Stricter recovery process for accounts with lost credentials
+
+ For users that are using the privileged Google Play Services (common on stock operating systems), the Advanced Protection Program also comes with [additional benefits](https://support.google.com/accounts/answer/9764949?hl=en) such as:
+
+- Not allowing app installation outside of the Google Play Store, the OS vendor's app store, or via [`adb`](https://en.wikipedia.org/wiki/Android_Debug_Bridge)
+- Mandatory automatic device scanning with [Play Protect](https://support.google.com/googleplay/answer/2812853?hl=en#zippy=%2Chow-malware-protection-works%2Chow-privacy-alerts-work)
+- Warning the user about unverified applications
+
+## SafetyNet and Play Integrity API
+
+[SafetyNet](https://developer.android.com/training/safetynet/attestation) and the [Play Integrity APIs](https://developer.android.com/google/play/integrity) are generally used for [banking apps](https://grapheneos.org/usage#banking-apps). Many banking apps will work fine in GrapheneOS with sandboxed Play services, however some non-financal apps have their own crude anti-tampering mechanisms which might fail. GrapheneOS passes the `basicIntegrity` check, but not the certification check `ctsProfileMatch`. Devices with Android 8 or later have hardware attestation support which cannot be bypassed without leaked keys or serious vulnerabilities.
+
+As for Google Wallet, we don't recommend this due to their [privacy policy](https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en), which states you must opt-out if you don't want your credit rating and personal information shared with affiliate marketing services.
+
+## Advertising ID
+
+All devices with Google Play Services installed automatically generate an [advertising ID](https://support.google.com/googleplay/android-developer/answer/6048248?hl=en) used for targeted advertising. Disable this feature to limit the data collected about you.
+
+On Android distributions with [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), go to ⚙️ Settings → Apps → Sandboxed Google Play → Google Settings → Ads and select **Delete advertising ID**.
+
+On Android distributions with privileged Google Play Services (such as stock OSes), the setting may be in one of several locations. Check
+
+- ⚙️ Settings → Google → Ads
+- ⚙️ Settings → Privacy → Ads
+
+Depending on your system, you will either be given the option to delete your advertising ID or to "Opt out of interest-based ads". You should delete the advertising ID if you are given the option to, and if you are not, we recommend that you opt out of interested-based ads and then reset your advertising ID.

docs/android/security.md

@@ -0,0 +1,36 @@
+---
+title: "Android Security and Privacy Features"
+icon: 'material/cellphone-lock'
+---
+
+## User Profiles
+
+Multiple user profiles (Settings → System → Multiple users) are the simplest way to isolate in Android. With user profiles you can limit a user from making calls, SMS or installing apps on the device. Each profile is encrypted using its own encryption key and cannot access the data of any other profiles. Even the device owner cannot view the data of other profiles without knowing their password. Multiple user profiles is a more secure method of isolation.
+
+## Work Profile
+
+[Work Profiles](https://support.google.com/work/android/answer/6191949) are another way to isolate individual apps and may be more convenient than separate user profiles.
+
+A **device controller** such as [Shelter](#recommended-apps) is required, unless you're using CalyxOS which includes one.
+
+The work profile is dependent on a device controller to function. Features such as *File Shuttle* and *contact search blocking* or any kind of isolation features must be implemented by the controller. The user must also fully trust the device controller app, as it has full access to the data inside of the work profile.
+
+This method is generally less secure than a secondary user profile; however, it does allow you the convenience of running apps in both the work and personal profiles simultaneously.
+
+## Verified Boot
+
+[Verified Boot](https://source.android.com/security/verifiedboot) is an important part of the Android security model. It provides protection against [evil maid](https://en.wikipedia.org/wiki/Evil_maid_attack) attacks, malware persistence, and ensures security updates cannot be downgraded with [rollback protection](https://source.android.com/security/verifiedboot/verified-boot#rollback-protection).
+
+Android 10 and above has moved away from full-disk encryption (FDE) to more flexible [file-based encryption](https://source.android.com/security/encryption/file-based).
+
+Each user's data is encrypted using their own unique encryption key, and the operating system files are left unencrypted. Verified Boot ensures the integrity of the operating system files preventing an adversary with physical access from tampering or installing malware on the device. In the unlikely case that malware is able to exploit other parts of the system and gain higher privileged access, Verified Boot will prevent and revert changes to the system partition upon reboot of the device.
+
+Unfortunately, original equipment manufacturers (OEMs) are only obliged to support Verified Boot on their stock Android distribution. Only a few OEMs such as Google support custom Android Verified Boot (AVB) key enrollment on their devices. Some AOSP derivatives such as LineageOS or /e/ OS do not support Verified Boot even on hardware with Verified Boot support for third party operating systems. We recommend that you check for support **before** purchasing a new device. AOSP derivatives which do not support Verified Boot are **not** recommended.
+
+## VPN Killswitch
+
+Android 7 and above supports a VPN killswitch and it is available without the need to install third party apps. This feature can prevent leaks if the VPN is disconnected. It can be found in ⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN.
+
+## Global Toggles
+
+Modern Android devices have global toggles for disabling [Bluetooth](https://en.wikipedia.org/wiki/Bluetooth) and location services. Android 12 introduced toggles for the camera and microphone. When not in use, we recommend disabling these features. Apps cannot use disabled features (even if granted individual permission) until re-enabled.

docs/assets/img/dns/dns-dark.svg

@@ -1,166 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
- "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<!-- Generated by graphviz version 2.48.0 (0)
- -->
-<!-- Title: DNS Pages: 1 -->
-<svg width="630pt" height="935pt"
- viewBox="0.00 0.00 630.00 935.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(36 899)">
-<title>DNS</title>
-<!-- Start -->
-<g id="node1" class="node">
-<title>Start</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M89,-863C89,-863 55,-863 55,-863 49,-863 43,-857 43,-851 43,-851 43,-839 43,-839 43,-833 49,-827 55,-827 55,-827 89,-827 89,-827 95,-827 101,-833 101,-839 101,-839 101,-851 101,-851 101,-857 95,-863 89,-863"/>
-<text text-anchor="middle" x="72" y="-841.3" font-family="monospace" font-size="14.00">Start</text>
-</g>
-<!-- anonymous -->
-<g id="node3" class="node">
-<title>anonymous</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-791 0,-733.5 72,-676 144,-733.5 72,-791"/>
-<text text-anchor="middle" x="72" y="-737.3" font-family="monospace" font-size="14.00">Trying to be</text>
-<text text-anchor="middle" x="72" y="-722.3" font-family="monospace" font-size="14.00"> anonymous?</text>
-</g>
-<!-- Start&#45;&gt;anonymous -->
-<g id="edge1" class="edge">
-<title>Start&#45;&gt;anonymous</title>
-<path fill="none" stroke="white" d="M72,-826.59C72,-826.59 72,-801.45 72,-801.45"/>
-<polygon fill="white" stroke="white" points="72,-791.45 76.5,-801.45 72,-796.45 72,-801.45 72,-801.45 72,-801.45 72,-796.45 67.5,-801.45 72,-791.45 72,-791.45"/>
-</g>
-<!-- nothing -->
-<g id="node2" class="node">
-<title>nothing</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M249.5,-36C249.5,-36 174.5,-36 174.5,-36 168.5,-36 162.5,-30 162.5,-24 162.5,-24 162.5,-12 162.5,-12 162.5,-6 168.5,0 174.5,0 174.5,0 249.5,0 249.5,0 255.5,0 261.5,-6 261.5,-12 261.5,-12 261.5,-24 261.5,-24 261.5,-30 255.5,-36 249.5,-36"/>
-<text text-anchor="middle" x="212" y="-14.3" font-family="monospace" font-size="14.00">Do nothing</text>
-</g>
-<!-- censorship -->
-<g id="node4" class="node">
-<title>censorship</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-640 0,-582.5 72,-525 144,-582.5 72,-640"/>
-<text text-anchor="middle" x="72" y="-586.3" font-family="monospace" font-size="14.00">Avoiding</text>
-<text text-anchor="middle" x="72" y="-571.3" font-family="monospace" font-size="14.00"> censorship?</text>
-</g>
-<!-- anonymous&#45;&gt;censorship -->
-<g id="edge3" class="edge">
-<title>anonymous&#45;&gt;censorship</title>
-<path fill="none" stroke="white" d="M72,-675.98C72,-675.98 72,-650.11 72,-650.11"/>
-<polygon fill="white" stroke="white" points="72,-640.11 76.5,-650.11 72,-645.11 72,-650.11 72,-650.11 72,-650.11 72,-645.11 67.5,-650.11 72,-640.11 72,-640.11"/>
-<text text-anchor="middle" x="63.5" y="-651.85" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- tor -->
-<g id="node8" class="node">
-<title>tor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-697.5C300,-697.5 406,-697.5 406,-697.5 412,-697.5 418,-703.5 418,-709.5 418,-709.5 418,-757.5 418,-757.5 418,-763.5 412,-769.5 406,-769.5 406,-769.5 300,-769.5 300,-769.5 294,-769.5 288,-763.5 288,-757.5 288,-757.5 288,-709.5 288,-709.5 288,-703.5 294,-697.5 300,-697.5"/>
-<text text-anchor="middle" x="353" y="-729.8" font-family="monospace" font-size="14.00">Use Tor</text>
-</g>
-<!-- anonymous&#45;&gt;tor -->
-<g id="edge2" class="edge">
-<title>anonymous&#45;&gt;tor</title>
-<path fill="none" stroke="white" d="M143.64,-733C143.64,-733 277.75,-733 277.75,-733"/>
-<polygon fill="white" stroke="white" points="287.75,-733 277.75,-737.5 282.75,-733 277.75,-733 277.75,-733 277.75,-733 282.75,-733 277.75,-728.5 287.75,-733 287.75,-733"/>
-<text text-anchor="middle" x="198.19" y="-736.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- privacy -->
-<g id="node5" class="node">
-<title>privacy</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-489 140,-431.5 212,-374 284,-431.5 212,-489"/>
-<text text-anchor="middle" x="212" y="-435.3" font-family="monospace" font-size="14.00">Want privacy</text>
-<text text-anchor="middle" x="212" y="-420.3" font-family="monospace" font-size="14.00"> from ISP?</text>
-</g>
-<!-- censorship&#45;&gt;privacy -->
-<g id="edge5" class="edge">
-<title>censorship&#45;&gt;privacy</title>
-<path fill="none" stroke="white" d="M84.7,-535C115.31,-535 190.67,-535 190.67,-535 190.67,-535 190.67,-482.11 190.67,-482.11"/>
-<polygon fill="white" stroke="white" points="190.67,-472.11 195.17,-482.11 190.67,-477.11 190.67,-482.11 190.67,-482.11 190.67,-482.11 190.67,-477.11 186.17,-482.11 190.67,-472.11 190.67,-472.11"/>
-<text text-anchor="middle" x="155.63" y="-538.8" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- vpnOrTor -->
-<g id="node9" class="node">
-<title>vpnOrTor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-546.5C300,-546.5 406,-546.5 406,-546.5 412,-546.5 418,-552.5 418,-558.5 418,-558.5 418,-606.5 418,-606.5 418,-612.5 412,-618.5 406,-618.5 406,-618.5 300,-618.5 300,-618.5 294,-618.5 288,-612.5 288,-606.5 288,-606.5 288,-558.5 288,-558.5 288,-552.5 294,-546.5 300,-546.5"/>
-<text text-anchor="middle" x="353" y="-586.3" font-family="monospace" font-size="14.00">Use VPN</text>
-<text text-anchor="middle" x="353" y="-571.3" font-family="monospace" font-size="14.00"> or Tor</text>
-</g>
-<!-- censorship&#45;&gt;vpnOrTor -->
-<g id="edge4" class="edge">
-<title>censorship&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="white" d="M129.88,-594C129.88,-594 277.82,-594 277.82,-594"/>
-<polygon fill="white" stroke="white" points="287.82,-594 277.82,-598.5 282.82,-594 277.82,-594 277.82,-594 277.82,-594 282.82,-594 277.82,-589.5 287.82,-594 287.82,-594"/>
-<text text-anchor="middle" x="191.35" y="-597.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- obnoxious -->
-<g id="node6" class="node">
-<title>obnoxious</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-338 140,-280.5 212,-223 284,-280.5 212,-338"/>
-<text text-anchor="middle" x="212" y="-291.8" font-family="monospace" font-size="14.00">ISP makes</text>
-<text text-anchor="middle" x="212" y="-276.8" font-family="monospace" font-size="14.00"> obnoxious</text>
-<text text-anchor="middle" x="212" y="-261.8" font-family="monospace" font-size="14.00"> redirects?</text>
-</g>
-<!-- privacy&#45;&gt;obnoxious -->
-<g id="edge7" class="edge">
-<title>privacy&#45;&gt;obnoxious</title>
-<path fill="none" stroke="white" d="M212,-373.98C212,-373.98 212,-348.11 212,-348.11"/>
-<polygon fill="white" stroke="white" points="212,-338.11 216.5,-348.11 212,-343.11 212,-348.11 212,-348.11 212,-348.11 212,-343.11 207.5,-348.11 212,-338.11 212,-338.11"/>
-<text text-anchor="middle" x="203.5" y="-349.85" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- privacy&#45;&gt;vpnOrTor -->
-<g id="edge6" class="edge">
-<title>privacy&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="white" d="M237.33,-468.98C237.33,-510 237.33,-570 237.33,-570 237.33,-570 277.73,-570 277.73,-570"/>
-<polygon fill="white" stroke="white" points="287.73,-570 277.73,-574.5 282.73,-570 277.73,-570 277.73,-570 277.73,-570 282.73,-570 277.73,-565.5 287.73,-570 287.73,-570"/>
-<text text-anchor="middle" x="224.83" y="-543.49" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- ispDNS -->
-<g id="node7" class="node">
-<title>ispDNS</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-187 140,-129.5 212,-72 284,-129.5 212,-187"/>
-<text text-anchor="middle" x="212" y="-148.3" font-family="monospace" font-size="14.00">Does ISP</text>
-<text text-anchor="middle" x="212" y="-133.3" font-family="monospace" font-size="14.00"> support</text>
-<text text-anchor="middle" x="212" y="-118.3" font-family="monospace" font-size="14.00"> encrypted</text>
-<text text-anchor="middle" x="212" y="-103.3" font-family="monospace" font-size="14.00"> DNS?</text>
-</g>
-<!-- obnoxious&#45;&gt;ispDNS -->
-<g id="edge9" class="edge">
-<title>obnoxious&#45;&gt;ispDNS</title>
-<path fill="none" stroke="white" d="M212,-222.98C212,-222.98 212,-197.11 212,-197.11"/>
-<polygon fill="white" stroke="white" points="212,-187.11 216.5,-197.11 212,-192.11 212,-197.11 212,-197.11 212,-197.11 212,-192.11 207.5,-197.11 212,-187.11 212,-187.11"/>
-<text text-anchor="middle" x="203.5" y="-198.85" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- encryptedDNS -->
-<g id="node10" class="node">
-<title>encryptedDNS</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-244.5C440,-244.5 546,-244.5 546,-244.5 552,-244.5 558,-250.5 558,-256.5 558,-256.5 558,-304.5 558,-304.5 558,-310.5 552,-316.5 546,-316.5 546,-316.5 440,-316.5 440,-316.5 434,-316.5 428,-310.5 428,-304.5 428,-304.5 428,-256.5 428,-256.5 428,-250.5 434,-244.5 440,-244.5"/>
-<text text-anchor="middle" x="493" y="-291.8" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-276.8" font-family="monospace" font-size="14.00"> DNS with 3rd</text>
-<text text-anchor="middle" x="493" y="-261.8" font-family="monospace" font-size="14.00"> party</text>
-</g>
-<!-- obnoxious&#45;&gt;encryptedDNS -->
-<g id="edge8" class="edge">
-<title>obnoxious&#45;&gt;encryptedDNS</title>
-<path fill="none" stroke="white" d="M283.64,-280C283.64,-280 417.75,-280 417.75,-280"/>
-<polygon fill="white" stroke="white" points="427.75,-280 417.75,-284.5 422.75,-280 417.75,-280 417.75,-280 417.75,-280 422.75,-280 417.75,-275.5 427.75,-280 427.75,-280"/>
-<text text-anchor="middle" x="338.19" y="-283.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-<!-- ispDNS&#45;&gt;nothing -->
-<g id="edge11" class="edge">
-<title>ispDNS&#45;&gt;nothing</title>
-<path fill="none" stroke="white" d="M212,-71.79C212,-71.79 212,-46.13 212,-46.13"/>
-<polygon fill="white" stroke="white" points="212,-36.13 216.5,-46.13 212,-41.13 212,-46.13 212,-46.13 212,-46.13 212,-41.13 207.5,-46.13 212,-36.13 212,-36.13"/>
-<text text-anchor="middle" x="203.5" y="-47.76" font-family="monospace" font-size="14.00" fill="white">No</text>
-</g>
-<!-- useISP -->
-<g id="node11" class="node">
-<title>useISP</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-93.5C440,-93.5 546,-93.5 546,-93.5 552,-93.5 558,-99.5 558,-105.5 558,-105.5 558,-153.5 558,-153.5 558,-159.5 552,-165.5 546,-165.5 546,-165.5 440,-165.5 440,-165.5 434,-165.5 428,-159.5 428,-153.5 428,-153.5 428,-105.5 428,-105.5 428,-99.5 434,-93.5 440,-93.5"/>
-<text text-anchor="middle" x="493" y="-133.3" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-118.3" font-family="monospace" font-size="14.00"> DNS with ISP</text>
-</g>
-<!-- ispDNS&#45;&gt;useISP -->
-<g id="edge10" class="edge">
-<title>ispDNS&#45;&gt;useISP</title>
-<path fill="none" stroke="white" d="M283.64,-129C283.64,-129 417.75,-129 417.75,-129"/>
-<polygon fill="white" stroke="white" points="427.75,-129 417.75,-133.5 422.75,-129 417.75,-129 417.75,-129 417.75,-129 422.75,-129 417.75,-124.5 427.75,-129 427.75,-129"/>
-<text text-anchor="middle" x="338.19" y="-132.8" font-family="monospace" font-size="14.00" fill="white">Yes</text>
-</g>
-</g>
-</svg>

docs/assets/img/dns/dns.svg

@@ -1,166 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
- "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<!-- Generated by graphviz version 2.48.0 (0)
- -->
-<!-- Title: DNS Pages: 1 -->
-<svg width="630pt" height="935pt"
- viewBox="0.00 0.00 630.00 935.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(36 899)">
-<title>DNS</title>
-<!-- Start -->
-<g id="node1" class="node">
-<title>Start</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M89,-863C89,-863 55,-863 55,-863 49,-863 43,-857 43,-851 43,-851 43,-839 43,-839 43,-833 49,-827 55,-827 55,-827 89,-827 89,-827 95,-827 101,-833 101,-839 101,-839 101,-851 101,-851 101,-857 95,-863 89,-863"/>
-<text text-anchor="middle" x="72" y="-841.3" font-family="monospace" font-size="14.00">Start</text>
-</g>
-<!-- anonymous -->
-<g id="node3" class="node">
-<title>anonymous</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-791 0,-733.5 72,-676 144,-733.5 72,-791"/>
-<text text-anchor="middle" x="72" y="-737.3" font-family="monospace" font-size="14.00">Trying to be</text>
-<text text-anchor="middle" x="72" y="-722.3" font-family="monospace" font-size="14.00"> anonymous?</text>
-</g>
-<!-- Start&#45;&gt;anonymous -->
-<g id="edge1" class="edge">
-<title>Start&#45;&gt;anonymous</title>
-<path fill="none" stroke="black" d="M72,-826.59C72,-826.59 72,-801.45 72,-801.45"/>
-<polygon fill="black" stroke="black" points="72,-791.45 76.5,-801.45 72,-796.45 72,-801.45 72,-801.45 72,-801.45 72,-796.45 67.5,-801.45 72,-791.45 72,-791.45"/>
-</g>
-<!-- nothing -->
-<g id="node2" class="node">
-<title>nothing</title>
-<path fill="#d4bbd2" stroke="#d4bbd2" d="M249.5,-36C249.5,-36 174.5,-36 174.5,-36 168.5,-36 162.5,-30 162.5,-24 162.5,-24 162.5,-12 162.5,-12 162.5,-6 168.5,0 174.5,0 174.5,0 249.5,0 249.5,0 255.5,0 261.5,-6 261.5,-12 261.5,-12 261.5,-24 261.5,-24 261.5,-30 255.5,-36 249.5,-36"/>
-<text text-anchor="middle" x="212" y="-14.3" font-family="monospace" font-size="14.00">Do nothing</text>
-</g>
-<!-- censorship -->
-<g id="node4" class="node">
-<title>censorship</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="72,-640 0,-582.5 72,-525 144,-582.5 72,-640"/>
-<text text-anchor="middle" x="72" y="-586.3" font-family="monospace" font-size="14.00">Avoiding</text>
-<text text-anchor="middle" x="72" y="-571.3" font-family="monospace" font-size="14.00"> censorship?</text>
-</g>
-<!-- anonymous&#45;&gt;censorship -->
-<g id="edge3" class="edge">
-<title>anonymous&#45;&gt;censorship</title>
-<path fill="none" stroke="black" d="M72,-675.98C72,-675.98 72,-650.11 72,-650.11"/>
-<polygon fill="black" stroke="black" points="72,-640.11 76.5,-650.11 72,-645.11 72,-650.11 72,-650.11 72,-650.11 72,-645.11 67.5,-650.11 72,-640.11 72,-640.11"/>
-<text text-anchor="middle" x="63.5" y="-651.85" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- tor -->
-<g id="node8" class="node">
-<title>tor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-697.5C300,-697.5 406,-697.5 406,-697.5 412,-697.5 418,-703.5 418,-709.5 418,-709.5 418,-757.5 418,-757.5 418,-763.5 412,-769.5 406,-769.5 406,-769.5 300,-769.5 300,-769.5 294,-769.5 288,-763.5 288,-757.5 288,-757.5 288,-709.5 288,-709.5 288,-703.5 294,-697.5 300,-697.5"/>
-<text text-anchor="middle" x="353" y="-729.8" font-family="monospace" font-size="14.00">Use Tor</text>
-</g>
-<!-- anonymous&#45;&gt;tor -->
-<g id="edge2" class="edge">
-<title>anonymous&#45;&gt;tor</title>
-<path fill="none" stroke="black" d="M143.64,-733C143.64,-733 277.75,-733 277.75,-733"/>
-<polygon fill="black" stroke="black" points="287.75,-733 277.75,-737.5 282.75,-733 277.75,-733 277.75,-733 277.75,-733 282.75,-733 277.75,-728.5 287.75,-733 287.75,-733"/>
-<text text-anchor="middle" x="198.19" y="-736.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- privacy -->
-<g id="node5" class="node">
-<title>privacy</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-489 140,-431.5 212,-374 284,-431.5 212,-489"/>
-<text text-anchor="middle" x="212" y="-435.3" font-family="monospace" font-size="14.00">Want privacy</text>
-<text text-anchor="middle" x="212" y="-420.3" font-family="monospace" font-size="14.00"> from ISP?</text>
-</g>
-<!-- censorship&#45;&gt;privacy -->
-<g id="edge5" class="edge">
-<title>censorship&#45;&gt;privacy</title>
-<path fill="none" stroke="black" d="M84.7,-535C115.31,-535 190.67,-535 190.67,-535 190.67,-535 190.67,-482.11 190.67,-482.11"/>
-<polygon fill="black" stroke="black" points="190.67,-472.11 195.17,-482.11 190.67,-477.11 190.67,-482.11 190.67,-482.11 190.67,-482.11 190.67,-477.11 186.17,-482.11 190.67,-472.11 190.67,-472.11"/>
-<text text-anchor="middle" x="155.63" y="-538.8" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- vpnOrTor -->
-<g id="node9" class="node">
-<title>vpnOrTor</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M300,-546.5C300,-546.5 406,-546.5 406,-546.5 412,-546.5 418,-552.5 418,-558.5 418,-558.5 418,-606.5 418,-606.5 418,-612.5 412,-618.5 406,-618.5 406,-618.5 300,-618.5 300,-618.5 294,-618.5 288,-612.5 288,-606.5 288,-606.5 288,-558.5 288,-558.5 288,-552.5 294,-546.5 300,-546.5"/>
-<text text-anchor="middle" x="353" y="-586.3" font-family="monospace" font-size="14.00">Use VPN</text>
-<text text-anchor="middle" x="353" y="-571.3" font-family="monospace" font-size="14.00"> or Tor</text>
-</g>
-<!-- censorship&#45;&gt;vpnOrTor -->
-<g id="edge4" class="edge">
-<title>censorship&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="black" d="M129.88,-594C129.88,-594 277.82,-594 277.82,-594"/>
-<polygon fill="black" stroke="black" points="287.82,-594 277.82,-598.5 282.82,-594 277.82,-594 277.82,-594 277.82,-594 282.82,-594 277.82,-589.5 287.82,-594 287.82,-594"/>
-<text text-anchor="middle" x="191.35" y="-597.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- obnoxious -->
-<g id="node6" class="node">
-<title>obnoxious</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-338 140,-280.5 212,-223 284,-280.5 212,-338"/>
-<text text-anchor="middle" x="212" y="-291.8" font-family="monospace" font-size="14.00">ISP makes</text>
-<text text-anchor="middle" x="212" y="-276.8" font-family="monospace" font-size="14.00"> obnoxious</text>
-<text text-anchor="middle" x="212" y="-261.8" font-family="monospace" font-size="14.00"> redirects?</text>
-</g>
-<!-- privacy&#45;&gt;obnoxious -->
-<g id="edge7" class="edge">
-<title>privacy&#45;&gt;obnoxious</title>
-<path fill="none" stroke="black" d="M212,-373.98C212,-373.98 212,-348.11 212,-348.11"/>
-<polygon fill="black" stroke="black" points="212,-338.11 216.5,-348.11 212,-343.11 212,-348.11 212,-348.11 212,-348.11 212,-343.11 207.5,-348.11 212,-338.11 212,-338.11"/>
-<text text-anchor="middle" x="203.5" y="-349.85" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- privacy&#45;&gt;vpnOrTor -->
-<g id="edge6" class="edge">
-<title>privacy&#45;&gt;vpnOrTor</title>
-<path fill="none" stroke="black" d="M237.33,-468.98C237.33,-510 237.33,-570 237.33,-570 237.33,-570 277.73,-570 277.73,-570"/>
-<polygon fill="black" stroke="black" points="287.73,-570 277.73,-574.5 282.73,-570 277.73,-570 277.73,-570 277.73,-570 282.73,-570 277.73,-565.5 287.73,-570 287.73,-570"/>
-<text text-anchor="middle" x="224.83" y="-543.49" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- ispDNS -->
-<g id="node7" class="node">
-<title>ispDNS</title>
-<polygon fill="#ffebc2" stroke="#ffebc2" points="212,-187 140,-129.5 212,-72 284,-129.5 212,-187"/>
-<text text-anchor="middle" x="212" y="-148.3" font-family="monospace" font-size="14.00">Does ISP</text>
-<text text-anchor="middle" x="212" y="-133.3" font-family="monospace" font-size="14.00"> support</text>
-<text text-anchor="middle" x="212" y="-118.3" font-family="monospace" font-size="14.00"> encrypted</text>
-<text text-anchor="middle" x="212" y="-103.3" font-family="monospace" font-size="14.00"> DNS?</text>
-</g>
-<!-- obnoxious&#45;&gt;ispDNS -->
-<g id="edge9" class="edge">
-<title>obnoxious&#45;&gt;ispDNS</title>
-<path fill="none" stroke="black" d="M212,-222.98C212,-222.98 212,-197.11 212,-197.11"/>
-<polygon fill="black" stroke="black" points="212,-187.11 216.5,-197.11 212,-192.11 212,-197.11 212,-197.11 212,-197.11 212,-192.11 207.5,-197.11 212,-187.11 212,-187.11"/>
-<text text-anchor="middle" x="203.5" y="-198.85" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- encryptedDNS -->
-<g id="node10" class="node">
-<title>encryptedDNS</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-244.5C440,-244.5 546,-244.5 546,-244.5 552,-244.5 558,-250.5 558,-256.5 558,-256.5 558,-304.5 558,-304.5 558,-310.5 552,-316.5 546,-316.5 546,-316.5 440,-316.5 440,-316.5 434,-316.5 428,-310.5 428,-304.5 428,-304.5 428,-256.5 428,-256.5 428,-250.5 434,-244.5 440,-244.5"/>
-<text text-anchor="middle" x="493" y="-291.8" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-276.8" font-family="monospace" font-size="14.00"> DNS with 3rd</text>
-<text text-anchor="middle" x="493" y="-261.8" font-family="monospace" font-size="14.00"> party</text>
-</g>
-<!-- obnoxious&#45;&gt;encryptedDNS -->
-<g id="edge8" class="edge">
-<title>obnoxious&#45;&gt;encryptedDNS</title>
-<path fill="none" stroke="black" d="M283.64,-280C283.64,-280 417.75,-280 417.75,-280"/>
-<polygon fill="black" stroke="black" points="427.75,-280 417.75,-284.5 422.75,-280 417.75,-280 417.75,-280 417.75,-280 422.75,-280 417.75,-275.5 427.75,-280 427.75,-280"/>
-<text text-anchor="middle" x="338.19" y="-283.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-<!-- ispDNS&#45;&gt;nothing -->
-<g id="edge11" class="edge">
-<title>ispDNS&#45;&gt;nothing</title>
-<path fill="none" stroke="black" d="M212,-71.79C212,-71.79 212,-46.13 212,-46.13"/>
-<polygon fill="black" stroke="black" points="212,-36.13 216.5,-46.13 212,-41.13 212,-46.13 212,-46.13 212,-46.13 212,-41.13 207.5,-46.13 212,-36.13 212,-36.13"/>
-<text text-anchor="middle" x="203.5" y="-47.76" font-family="monospace" font-size="14.00">No</text>
-</g>
-<!-- useISP -->
-<g id="node11" class="node">
-<title>useISP</title>
-<path fill="#7aa0da" stroke="#7aa0da" d="M440,-93.5C440,-93.5 546,-93.5 546,-93.5 552,-93.5 558,-99.5 558,-105.5 558,-105.5 558,-153.5 558,-153.5 558,-159.5 552,-165.5 546,-165.5 546,-165.5 440,-165.5 440,-165.5 434,-165.5 428,-159.5 428,-153.5 428,-153.5 428,-105.5 428,-105.5 428,-99.5 434,-93.5 440,-93.5"/>
-<text text-anchor="middle" x="493" y="-133.3" font-family="monospace" font-size="14.00">Use encrypted</text>
-<text text-anchor="middle" x="493" y="-118.3" font-family="monospace" font-size="14.00"> DNS with ISP</text>
-</g>
-<!-- ispDNS&#45;&gt;useISP -->
-<g id="edge10" class="edge">
-<title>ispDNS&#45;&gt;useISP</title>
-<path fill="none" stroke="black" d="M283.64,-129C283.64,-129 417.75,-129 417.75,-129"/>
-<polygon fill="black" stroke="black" points="427.75,-129 417.75,-133.5 422.75,-129 417.75,-129 417.75,-129 417.75,-129 422.75,-129 417.75,-124.5 427.75,-129 427.75,-129"/>
-<text text-anchor="middle" x="338.19" y="-132.8" font-family="monospace" font-size="14.00">Yes</text>
-</g>
-</g>
-</svg>

docs/browsers.en.md

@@ -12,7 +12,7 @@ These are our current web browser recommendations and settings. We recommend kee
 
 !!! recommendation
 
-    ![Tor Browser logo](/assets/img/browsers/tor.svg){ align=right }
+    ![Tor Browser logo](assets/img/browsers/tor.svg){ align=right }
 
     **Tor Browser** is the choice if you need anonymity. This browser provides you with access to the Tor Bridges and [Tor Network](https://en.wikipedia.org/wiki/Tor_(network)), along with extensions that can be automatically configured to fit its three security levels - *Standard*, *Safer* and *Safest*. We recommend that you do not change any of Tor Browser's default configurations outside of the standard security levels.
 
@@ -36,7 +36,7 @@ These are our current web browser recommendations and settings. We recommend kee
 
 !!! recommendation
 
-    ![Firefox logo](/assets/img/browsers/firefox.svg){ align=right }
+    ![Firefox logo](assets/img/browsers/firefox.svg){ align=right }
 
     **Firefox** provides strong privacy settings such as [Enhanced Tracking Protection](https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop), which can help block various [types of tracking](https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop#w_what-enhanced-tracking-protection-blocks).
 
@@ -95,11 +95,11 @@ You can still stay logged into websites by allowing exceptions.
 
 #### Sync
 
-The [Firefox sync](https://hacks.mozilla.org/2018/11/firefox-sync-privacy/) service is end-to-end encrypted.
+The [Firefox Sync](https://hacks.mozilla.org/2018/11/firefox-sync-privacy/) service is end-to-end encrypted.
 
 #### Extensions
 
-We generally do not recommend installing any extensions as they increase your [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [uBlock Origin](/browsers/#additional-resources) might be useful to you. The extension is also a 🏆️ [Recommended Extension](https://support.mozilla.org/kb/add-on-badges#w_recommended-extensions) by Mozilla.
+We generally do not recommend installing any extensions as they increase your [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [uBlock Origin](#additional-resources) might be useful to you. The extension is also a 🏆️ [Recommended Extension](https://support.mozilla.org/kb/add-on-badges#w_recommended-extensions) by Mozilla.
 
 #### Arkenfox (advanced)
 
@@ -115,7 +115,7 @@ On iOS, any app that can browse the web is [restricted](https://developer.apple.
 
 !!! recommendation
 
-    ![Bromite logo](/assets/img/browsers/bromite.svg){ align=right }
+    ![Bromite logo](assets/img/browsers/bromite.svg){ align=right }
 
     **Bromite** is a [Chromium](https://en.wikipedia.org/wiki/Chromium_(web_browser))-based browser with privacy and security enhancements, built-in ad blocking, and some fingerprinting randomization.
 
@@ -145,7 +145,7 @@ These options can be found in *Privacy and Security* ( ⁝ → ⚙️ Settings
 
 !!! recommendation
 
-    ![Safari logo](/assets/img/browsers/safari.svg){ align=right }
+    ![Safari logo](assets/img/browsers/safari.svg){ align=right }
 
     **Safari** is the default browser in iOS. It includes [privacy features](https://support.apple.com/guide/iphone/browse-the-web-privately-iphb01fc3c85/15.0/ios/15.0) such as Intelligent Tracking Protection, Privacy Report, isolated Private Browsing tabs, iCloud Private Relay, and automatic HTTPS upgrades.
 
@@ -197,7 +197,7 @@ If you use iCloud, we also recommend checking to ensure Safari's default downloa
 
 #### Extensions
 
-We generally do not recommend installing [any extensions](https://www.sentinelone.com/blog/inside-safari-extensions-malware-golden-key-user-data/) as they increase your browser's [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [AdGuard for Safari](/browsers/#additional-resources) might be useful to you.
+We generally do not recommend installing [any extensions](https://www.sentinelone.com/blog/inside-safari-extensions-malware-golden-key-user-data/) as they increase your browser's [attack surface](https://en.wikipedia.org/wiki/Attack_surface); however, if you want content blocking, [AdGuard for Safari](#additional-resources) might be useful to you.
 
 ## Additional Resources
 
@@ -205,7 +205,7 @@ We generally do not recommend installing [any extensions](https://www.sentinelon
 
 !!! recommendation
 
-    ![uBlock Origin logo](/assets/img/browsers/ublock_origin.svg){ align=right }
+    ![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ align=right }
 
     **uBlock Origin** is a popular content blocker that could help you block ads, trackers, and fingerprinting scripts.
 
@@ -230,7 +230,7 @@ uBlock Origin also has different [blocking modes](https://github.com/gorhill/uBl
 
 !!! recommendation
 
-    ![AdGuard logo](/assets/img/browsers/adguard.svg){ align=right }
+    ![AdGuard logo](assets/img/browsers/adguard.svg){ align=right }
 
     **AdGuard for Safari** is a free and open-source content-blocking extension for Safari that uses the native [Content Blocker API](https://developer.apple.com/documentation/safariservices/creating_a_content_blocker). 
     
@@ -255,7 +255,7 @@ There is also [AdGuard for iOS](https://adguard.com/en/adguard-ios/overview.html
 
 !!! recommendation
 
-    ![Terms of Service; Didn't Read logo](/assets/img/browsers/terms_of_service_didnt_read.svg){ align=right }
+    ![Terms of Service; Didn't Read logo](assets/img/browsers/terms_of_service_didnt_read.svg){ align=right }
 
     **Terms of Service; Didn't Read** grades websites based on their terms of service agreements and privacy policies. It also gives short summaries of those agreements. The analyses and ratings are published transparently by a community of reviewers.
 

docs/calendar-contacts.en.md

@@ -6,14 +6,14 @@ Calendaring and contacts are some of the most sensitive data posess. Use only pr
 
 ## Software as a service (SaaS) only
 
-These products are included with an subscription to the respective [email providers](/email).
+These products are included with an subscription to the respective [email providers](email.md).
 
 ### Tutanota
 
 !!! recommendation
 
-    ![Tutanota logo](/assets/img/calendar-contacts/tutanota.svg#only-light){ align=right }
-    ![Tutanota logo](/assets/img/calendar-contacts/tutanota-dark.svg#only-dark){ align=right }
+    ![Tutanota logo](assets/img/calendar-contacts/tutanota.svg#only-light){ align=right }
+    ![Tutanota logo](assets/img/calendar-contacts/tutanota-dark.svg#only-dark){ align=right }
 
     **Tutanota** has an [encrypted calendar](https://tutanota.com/blog/posts/free-encrypted-calendar/) in their desktop and mobile clients.
 
@@ -33,7 +33,7 @@ These products are included with an subscription to the respective [email provid
 
 !!! recommendation
 
-    ![Proton Calendar logo](/assets/img/calendar-contacts/proton-calendar.svg){ align=right }
+    ![Proton Calendar logo](assets/img/calendar-contacts/proton-calendar.svg){ align=right }
 
     **Proton Calendar** is an calendar app that is available to ProtonMail users. All data stored within it is end-to-end encrypted when stored on ProtonMail's servers.
 
@@ -51,7 +51,7 @@ Some of these options are self-hostable, or able to be hosted by third party pro
 
 !!! recommendation
 
-    ![EteSync logo](/assets/img/calendar-contacts/etesync.svg){ align=right }
+    ![EteSync logo](assets/img/calendar-contacts/etesync.svg){ align=right }
 
     **EteSync** is a secure, end-to-end encrypted, and privacy-respecting cloud backup and synchronization software for your personal information (e.g. contacts and calendars). There are native clients for Android, iOS, and the web, and an adapter layer for most desktop clients.
 
@@ -70,7 +70,7 @@ Some of these options are self-hostable, or able to be hosted by third party pro
 
 !!! recommendation
 
-    ![Nextcloud logo](/assets/img/calendar-contacts/nextcloud.svg){ align=right }
+    ![Nextcloud logo](assets/img/calendar-contacts/nextcloud.svg){ align=right }
 
     **Nextcloud** is a suite of client-server software for creating and using file hosting services. This includes calendar sync via CalDAV and contacts sync via CardDAV. Nextcloud is free and open-source, thereby allowing anyone to install and operate it without charge on a private server.
 
@@ -92,11 +92,11 @@ Some of these options are self-hostable, or able to be hosted by third party pro
 
 !!! recommendation
 
-    ![DecSync logo](/assets/img/calendar-contacts/decsync.svg){ align=right }
+    ![DecSync logo](assets/img/calendar-contacts/decsync.svg){ align=right }
 
-    **DecSync CC** synchronizes contacts, calendars and tasks using DecSync. It stores this data in a shared directory, using [Syncthing](/file-sharing/#syncthing), or any other file synchronization service.
+    **DecSync CC** synchronizes contacts, calendars and tasks using DecSync. It stores this data in a shared directory, using [Syncthing](file-sharing/#syncthing), or any other file synchronization service.
 
-    There are [plugins](https://github.com/39aldo39/DecSync#rss) to sync other types of data such as [RSS](/news-aggregators).
+    There are [plugins](https://github.com/39aldo39/DecSync#rss) to sync other types of data such as [RSS](news-aggregators.md).
 
     [Visit github.com](https://github.com/39aldo39/DecSync){ .md-button .md-button--primary }
 

docs/cloud.en.md

@@ -10,7 +10,7 @@ Trust your provider by using an alternative below that supports [end-to-end encr
 
 !!! recommendation
 
-    ![Nextcloud logo](/assets/img/cloud/nextcloud.svg){ align=right }
+    ![Nextcloud logo](assets/img/cloud/nextcloud.svg){ align=right }
 
     **Nextcloud** is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control. It also comes with experimental end-to-end encryption (E2EE).
 
@@ -36,7 +36,7 @@ When self hosting Nextcloud, you should also remember to enable E2EE to protect
 
 !!! recommendation
 
-    ![Proton Drive logo](/assets/img/cloud/protondrive.svg){ align=right }
+    ![Proton Drive logo](assets/img/cloud/protondrive.svg){ align=right }
 
     **Proton Drive** is an end-to-end encrypted (E2EE) general file storage service by the popular encrypted email provider [ProtonMail](https://protonmail.com).
 
@@ -47,7 +47,7 @@ When self hosting Nextcloud, you should also remember to enable E2EE to protect
 
 Proton Drive is currently in beta and only is only available through a web client.
 
-When using a web client, you are placing trust in the server to send you proper JavaScript code to derive the decryption key and authentication token locally in your browser. A compromised server can send you malicious JavaScript code to steal your master password and decrypt your data. If this does not fit your [threat model](/threat-modeling/), consider using an alternative.
+When using a web client, you are placing trust in the server to send you proper JavaScript code to derive the decryption key and authentication token locally in your browser. A compromised server can send you malicious JavaScript code to steal your master password and decrypt your data. If this does not fit your [threat model](threat-modeling.md), consider using an alternative.
 
 ### Cryptee
 

docs/dns.en.md

@@ -15,7 +15,7 @@ icon: material/dns
 | ------------ | -------------- | ---- | --------- | ------- | --- | --------- |
 | [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Commercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^1] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS)
 | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/) | Commercial | Cleartext <br> DoH <br> DoT | Some[^2] | No | Based on server choice.|
-| [**ControlID**](https://controld.com) | [:octicons-link-external-24:](https://controld.com/privacy) | Commercial | Cleartext <br> DoH <br> DoT | Optional[^3] | No |  Based on server choice.  |
+| [**ControlD**](https://controld.com) | [:octicons-link-external-24:](https://controld.com/privacy) | Commercial | Cleartext <br> DoH <br> DoT | Optional[^3] | No |  Based on server choice.  |
 | [**MullvadDNS**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy/) | Commercial | DoH <br> DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock)
 | [**NextDNS**](https://www.nextdns.io) | [:octicons-link-external-24:](https://www.nextdns.io/privacy) | Commercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Optional[^5] | Optional | Based on server choice. |
 | [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy/) | Non-Profit | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional |  Based on server choice, Malware blocking by default. |
@@ -32,12 +32,13 @@ The criteria for the servers listed above are:
 - Must support [DNSSEC](technology/dns.md#what-is-dnssec-and-when-is-it-used)
 - Must have [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support
 - [QNAME Minimization](technology/dns.md#what-is-qname-minimization)
+- Allow for [ECS](technology/dns.md#what-is-edns-client-subnet-ecs) to be disabled
 
 ## Native Operating System Support
 
 ### Android
 
-Android 9 and above support DNS over TLS. Android 13 will support DNS over HTTPS. The settings can be found in: *Settings* &rarr; *Network & Internet* &rarr; *Private DNS*.
+Android 9 and above support DNS over TLS. Android 13 will support DNS over HTTPS. The settings can be found in: **Settings** &rarr; **Network & Internet** &rarr; **Private DNS**.
 
 ### Apple Devices
 
@@ -45,36 +46,44 @@ The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. B
 
 After installation of either a configuration profile or an app that utilizes the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
 
-- **iOS/iPadOS:** *Settings &rarr; General &rarr; VPN, DNS, & Device Management &rarr; DNS*
-- **macOS:** *System Preferences &rarr; Profiles* & *System Preferences &rarr; Network*
-- **tvOS:** *Settings &rarr; General &rarr; Privacy &rarr;* hover on "*Share Apple TV Analytics*" &rarr; press the play button on the remote
+#### Signed Profiles
 
-Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
+Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [ControlD](https://kb.controld.com/en/tutorials), [NextDNS](https://apple.nextdns.io), [Quad9](https://www.quad9.net/news/blog/ios-mobile-provisioning-profiles/).
 
-- **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [ControlD](https://kb.controld.com/en/tutorials), [NextDNS](https://apple.nextdns.io), [Quad9](https://www.quad9.net/news/blog/ios-mobile-provisioning-profiles/).
+#### iOS/iPadOS
+
+Select **Settings** &rarr; **General** &rarr; **VPN, DNS, & Device Management** &rarr; **DNS**
+
+#### macOS
+
+Select **System Preferences &rarr; Profiles** or **System Preferences** &rarr; **Network** &rarr; **Advanced**, (depending on if you have configuration profiles installed).
+
+#### tvOS
+
+Select **Settings** &rarr; **General** &rarr; **Privacy** &rarr; **Share Apple TV Analytics** &rarr; then press the *Play* button on the remote.
 
 ### Windows
 
 Windows users can [turn on DoH](https://docs.microsoft.com/en-us/windows-server/networking/dns/doh-client-support) by accessing Windows settings in the control panel.
 
-Select *Settings* &rarr; *Network & Internet* &rarr; *Ethernet* or *WiFi*, &rarr; *Edit DNS Settings* &rarr; Preferred DNS encryption &rarr; *Encrypted only (DNS over HTTPS)*.
+Select **Settings** &rarr; **Network & Internet** &rarr; **Ethernet or WiFi**, &rarr; **Edit DNS Settings** &rarr; **Preferred DNS encryption** &rarr; **Encrypted only (DNS over HTTPS)**.
 
 ### Linux
 
-`systemd-resolved` doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639), which many Linux distributions use to do their DNS lookups. If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
+`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
 
 ## Encrypted DNS Proxies
 
-Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](/dns/#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](/dns/#what-is-encrypted-dns).
+Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](technology/dns.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](technology/dns.md#what-is-encrypted-dns).
 
 ### RethinkDNS
 
 !!! recommendation
 
-    ![RethinkDNS logo](/assets/img/android/rethinkdns.svg#only-light){ align=right }
-    ![RethinkDNS logo](/assets/img/android/rethinkdns-dark.svg#only-dark){ align=right }
+    ![RethinkDNS logo](assets/img/android/rethinkdns.svg#only-light){ align=right }
+    ![RethinkDNS logo](assets/img/android/rethinkdns-dark.svg#only-dark){ align=right }
 
-    **RethinkDNS** is an open-source Android client supporting [DNS-over-HTTPS](/dns/#dns-over-https-doh), [DNS-over-TLS](/dns/#dns-over-tls-dot), [DNSCrypt](/dns/#dnscrypt) and DNS Proxy along with caching DNS responses, locally logging DNS queries and can be used as a firewall too.
+    **RethinkDNS** is an open-source Android client supporting [DNS-over-HTTPS](technology/dns.md#dns-over-https-doh), [DNS-over-TLS](technology/dns.md#dns-over-tls-dot), [DNSCrypt](technology/dns.md#dnscrypt) and DNS Proxy along with caching DNS responses, locally logging DNS queries and can be used as a firewall too.
 
     [Visit rethinkdns.com](https://rethinkdns.com){ .md-button .md-button--primary } [Privacy Policy](https://rethinkdns.com/privacy){ .md-button }
 
@@ -87,9 +96,9 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](/d
 
 !!! recommendation
 
-    ![DNSCloak logo](/assets/img/ios/dnscloak.png){ align=right }
+    ![DNSCloak logo](assets/img/ios/dnscloak.png){ align=right }
 
-    **DNSCloak** is an open-source iOS client supporting [DNS-over-HTTPS](/dns/#dns-over-https-doh), [DNSCrypt](/dns/#dnscrypt), and [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy/wiki) options such as caching DNS responses, locally logging DNS queries, and custom block lists. Users can [add custom resolvers by DNS stamp](https://medium.com/privacyguides/adding-custom-dns-over-https-resolvers-to-dnscloak-20ff5845f4b5).
+    **DNSCloak** is an open-source iOS client supporting [DNS-over-HTTPS](technology/dns.md#dns-over-https-doh), [DNSCrypt](technology/dns.md#dnscrypt), and [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy/wiki) options such as caching DNS responses, locally logging DNS queries, and custom block lists. Users can [add custom resolvers by DNS stamp](https://medium.com/privacyguides/adding-custom-dns-over-https-resolvers-to-dnscloak-20ff5845f4b5).
 
     [Visit github.com](https://github.com/s-s/dnscloak/blob/master/README.md){ .md-button .md-button--primary } [Privacy Policy](https://drive.google.com/file/d/1050No_pU74CAWUS5-BwQWyO2x_aiMzWc/view){ .md-button }
 
@@ -101,13 +110,13 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](/d
 
 !!! recommendation
 
-    ![dnscrypt-proxy logo](/assets/img/dns/dnscrypt-proxy.svg){ align=right }
+    ![dnscrypt-proxy logo](assets/img/dns/dnscrypt-proxy.svg){ align=right }
 
-    **dnscrypt-proxy** is a DNS proxy with support for [DNSCrypt](/dns/#dnscrypt), [DNS-over-HTTPS](/dns/#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS).
+    **dnscrypt-proxy** is a DNS proxy with support for [DNSCrypt](technology/dns.md#dnscrypt), [DNS-over-HTTPS](technology/dns.md#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS).
 
     [Visit github.com](https://github.com/DNSCrypt/dnscrypt-proxy/wiki){ .md-button .md-button--primary } [Privacy Policy](https://www.libreoffice.org/about-us/privacy/privacy-policy-en/){ .md-button }
 
     **Downloads**
     - [:fontawesome-brands-github: Source](https://github.com/DNSCrypt/dnscrypt-proxy)
 
-!!! warning "The anonymized DNS feature does [**not**](/dns#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic."
+!!! warning "The anonymized DNS feature does [**not**](technology/dns.md#why-shouldnt-i-use-encrypted-dns) anonymize other network traffic."

docs/email-clients.en.md

@@ -2,20 +2,20 @@
 title: "Email Clients"
 icon: material/email-open
 ---
-Our recommendation list contains email clients that support both [OpenPGP](/encryption/#openpgp) and strong authentication such as [Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth). OAuth allows you to use [Multi-Factor Authentication](/multi-factor-authentication) and prevent account theft.
+Our recommendation list contains email clients that support both [OpenPGP](encryption.md#openpgp) and strong authentication such as [Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth). OAuth allows you to use [Multi-Factor Authentication](multi-factor-authentication) and prevent account theft.
 
 ??? Attention "Email does not provide forward secrecy"
-    When using end-to-end encryption (E2EE) technology like [OpenPGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy), email will still have [some metadata](/email/#email-metadata-overview) that is not encrypted in the header of the email.
+    When using end-to-end encryption (E2EE) technology like [OpenPGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy), email will still have [some metadata](email.md#email-metadata-overview) that is not encrypted in the header of the email.
 
-    OpenPGP also does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed: [How do I protect my private keys?](/email/#email-encryption-overview). Consider using a medium that provides forward secrecy:
+    OpenPGP also does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed: [How do I protect my private keys?](email.md#email-encryption-overview). Consider using a medium that provides forward secrecy:
 
-    [Real-time Communication](/real-time-communication){ .md-button .md-button--primary }
+    [Real-time Communication](real-time-communication.md){ .md-button .md-button--primary }
 
 ### Thunderbird
 
 !!! recommendation
 
-    ![Thunderbird logo](/assets/img/email-clients/thunderbird.svg){ align=right }
+    ![Thunderbird logo](assets/img/email-clients/thunderbird.svg){ align=right }
 
     **Thunderbird** is a free, open source, cross-platform email, newsgroup, news feed, and chat (XMPP, IRC, Twitter) client developed by the Thunderbird community, and previously by the Mozilla Foundation.
 
@@ -32,12 +32,12 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Apple Mail logo](/assets/img/email-clients/applemail.png){ align=right }
+    ![Apple Mail logo](assets/img/email-clients/applemail.png){ align=right }
 
-    **Apple Mail** is included in macOS and can be extended to have OpenPGP support with [GPG Suite](/encryption/#gpg-suite), which adds the ability to send encrypted email.
+    **Apple Mail** is included in macOS and can be extended to have OpenPGP support with [GPG Suite](encryption/#gpg-suite), which adds the ability to send encrypted email.
 
     !!! note
-        For iOS devices we suggest [Canary Mail](/email-clients/#canary-mail) as it has PGP support which means you can send end-to-end encrypted email.
+        For iOS devices we suggest [Canary Mail](#canary-mail) as it has PGP support which means you can send end-to-end encrypted email.
 
     [Visit apple.com](https://support.apple.com/guide/mail/welcome/mac){ .md-button .md-button--primary } [Privacy Policy](https://www.apple.com/legal/privacy/en-ww/){ .md-button }
 
@@ -45,7 +45,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Evolution logo](/assets/img/email-clients/evolution.svg){ align=right }
+    ![Evolution logo](assets/img/email-clients/evolution.svg){ align=right }
 
     **Evolution** is a personal information management application that provides integrated mail, calendaring and address book functionality. Evolution has extensive [documentation](https://help.gnome.org/users/evolution/stable/) to help you get started.
 
@@ -59,7 +59,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Kontact logo](/assets/img/email-clients/kontact.svg){ align=right }
+    ![Kontact logo](assets/img/email-clients/kontact.svg){ align=right }
 
     **Kontact** is a personal information manager (PIM) application from the [KDE](https://kde.org) project. It provides a mail client, address book, organizer and RSS client.
 
@@ -74,7 +74,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Mailvelope logo](/assets/img/email-clients/mailvelope.svg){ align=right }
+    ![Mailvelope logo](assets/img/email-clients/mailvelope.svg){ align=right }
 
     **Mailvelope** is a browser extension that enables the exchange of encrypted emails following the OpenPGP encryption standard.
 
@@ -90,7 +90,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![K-9 Mail logo](/assets/img/email-clients/k9mail.svg){ align=right }
+    ![K-9 Mail logo](assets/img/email-clients/k9mail.svg){ align=right }
 
     **K-9 Mail** is an independent mail application that supports both POP3 and IMAP mailboxes, but only supports push mail for IMAP.
 
@@ -105,7 +105,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![FairEmail logo](/assets/img/email-clients/fairemail.svg){ align=right }
+    ![FairEmail logo](assets/img/email-clients/fairemail.svg){ align=right }
 
     **FairEmail** is a minimal, open source email app, using open standards (IMAP, SMTP, OpenPGP) with a low data and battery usage.
 
@@ -120,7 +120,7 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 !!! recommendation
 
-    ![Canary Mail logo](/assets/img/email-clients/canarymail.svg){ align=right }
+    ![Canary Mail logo](assets/img/email-clients/canarymail.svg){ align=right }
 
     **Canary Mail** is a paid email client designed to make end-to-end encryption seamless with security features such as a biometric app lock.
 
@@ -138,15 +138,15 @@ Our recommendation list contains email clients that support both [OpenPGP](/encr
 
 Canary Mail is closed source. We recommend it, due to the few choices there are for email clients on iOS that support [Pretty Good Privacy (PGP)](https://en.wikipedia.org/wiki/Pretty_Good_Privacy), end-to-end encryption (E2EE).
 
-### Neomutt
+### NeoMutt
 
 !!! recommendation
 
-    ![Neomutt logo](/assets/img/email-clients/mutt.svg){ align=right }
+    ![NeoMutt logo](assets/img/email-clients/mutt.svg){ align=right }
 
     NeoMutt is an open-source command line mail reader (or MUA) for Linux and BSD. It's a fork of [Mutt](https://en.wikipedia.org/wiki/Mutt_(email_client)) with added features.
-    
-    Neomut is a text-based client that has a steep learning curve. It is however, very customizable.
+
+    NeoMutt is a text-based client that has a steep learning curve. It is however, very customizable.
 
     [Visit neomutt.org](https://neomutt.org){ .md-button .md-button--primary }
 

docs/email.en.md

@@ -23,11 +23,11 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![ProtonMail logo](/assets/img/email/protonmail.svg){ align=right }
+    ![ProtonMail logo](assets/img/email/protonmail.svg){ align=right }
 
     **ProtonMail** is an email service with a focus on privacy, encryption, security, and ease of use. They have been in operation since **2013**. ProtonMail is based in Genève, Switzerland. Accounts start with 500 MB storage with their free plan.
 
-    Free accounts have some limitations, such as not being able to search body text and not having access to [ProtonMail Bridge](https://protonmail.com/bridge), which is required to use a [recommended desktop email client](/email-clients) (e.g. Thunderbird). Paid accounts are available starting at **€48/y** which include features like ProtonMail Bridge, additional storage, and custom domain support.
+    Free accounts have some limitations, such as not being able to search body text and not having access to [ProtonMail Bridge](https://protonmail.com/bridge), which is required to use a [recommended desktop email client](email-clients.md) (e.g. Thunderbird). Paid accounts are available starting at **€48/y** which include features like ProtonMail Bridge, additional storage, and custom domain support.
 
     **Free**
 
@@ -67,7 +67,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![Mailbox.org logo](/assets/img/email/mailboxorg.svg){ align=right }
+    ![Mailbox.org logo](assets/img/email/mailboxorg.svg){ align=right }
 
     **Mailbox.org** is an email service with a focus on being secure, ad-free, and privately powered by 100% eco-friendly energy. They have been in operation since 2014. Mailbox.org is based in Berlin, Germany. Accounts start with 2 GB of storage, which can be upgraded as needed.
 
@@ -91,7 +91,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
     Mailbox.org allows for encryption of incoming mail using their [encrypted mailbox](https://kb.mailbox.org/display/MBOKBEN/The+Encrypted+Mailbox). New messages that you receive will then be immediately encrypted with your public key.
 
-    However, [Open-Exchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox.org, [does not support](https://kb.mailbox.org/display/BMBOKBEN/Encryption+of+calendar+and+address+book) the encryption of your address book and calendar. A [standalone option](/calendar-contacts) may be more appropriate for that information.
+    However, [Open-Exchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox.org, [does not support](https://kb.mailbox.org/display/BMBOKBEN/Encryption+of+calendar+and+address+book) the encryption of your address book and calendar. A [standalone option](calendar-contacts.md) may be more appropriate for that information.
 
 ??? check "Email Encryption"
 
@@ -111,8 +111,8 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![Disroot logo](/assets/img/email/disroot.svg#only-light){ align=right }
-    ![Disroot logo](/assets/img/email/disroot-dark.svg#only-dark){ align=right }
+    ![Disroot logo](assets/img/email/disroot.svg#only-light){ align=right }
+    ![Disroot logo](assets/img/email/disroot-dark.svg#only-dark){ align=right }
 
     **Disroot** offers email amongst [other services](https://disroot.org/en/#services). The service is maintained by volunteers and its community. They have been in operation since 2015. Disroot is based in Amsterdam. Disroot is free and uses open source software such as Rainloop to provide service. Users support the service through donations and buying extra storage. The mailbox limit is 1 GB, but extra storage can be purchased 0.15€ per GB per month paid yearly.
 
@@ -136,7 +136,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
     Disroot uses full disk encryption. However, it doesn't appear to be "zero access", meaning it is technically possible for them to decrypt the data they have if it is not additionally encrypted with a tool like OpenPGP.
 
-    Disroot also uses the standard [CalDAV](https://en.wikipedia.org/wiki/CalDAV) and [CardDAV](https://en.wikipedia.org/wiki/CardDAV) protocols for calendars and contacts, which do not support E2EE. A [standalone option](/calendar-contacts) may be more appropriate.
+    Disroot also uses the standard [CalDAV](https://en.wikipedia.org/wiki/CalDAV) and [CardDAV](https://en.wikipedia.org/wiki/CardDAV) protocols for calendars and contacts, which do not support E2EE. A [standalone option](calendar-contacts.md) may be more appropriate.
 
 ??? check "Email Encryption"
 
@@ -154,8 +154,8 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
 !!! recommendation
 
-    ![Tutanota logo](/assets/img/email/tutanota.svg#only-light){ align=right }
-    ![Tutanota logo](/assets/img/email/tutanota-dark.svg#only-dark){ align=right }
+    ![Tutanota logo](assets/img/email/tutanota.svg#only-light){ align=right }
+    ![Tutanota logo](assets/img/email/tutanota-dark.svg#only-dark){ align=right }
 
     **[Tutanota.com](https://tutanota.com)** is an email service with a focus on security and privacy through the use of encryption. Tutanota has been in operation since **2011** and is based in Hanover, Germany. Accounts start with 1GB storage with their free plan.
 
@@ -163,7 +163,7 @@ Find a secure email provider that will keep your privacy in mind. Don’t settle
 
     [Visit Tutanota.com](https://tutanota.com){ .md-button .md-button--primary }
 
-Tutanota [doesn't allow](https://tutanota.com/faq/#imap) the use of third-party [email clients](/email-clients). Tutanota has no plans pull email from [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) using the [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) protocol. [Email import](https://github.com/tutao/tutanota/issues/630) is currently not possible.
+Tutanota [doesn't allow](https://tutanota.com/faq/#imap) the use of third-party [email clients](email-clients.md). Tutanota has no plans pull email from [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) using the [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) protocol. [Email import](https://github.com/tutao/tutanota/issues/630) is currently not possible.
 
 Emails can be exported [individually or by bulk selection](https://tutanota.com/howto#generalMail). Tutanota does not allow for [subfolders](https://github.com/tutao/tutanota/issues/927) as you might expect with other email providers.
 
@@ -205,8 +205,8 @@ Tutanota is working on a [desktop client](https://tutanota.com/blog/posts/deskto
 
 !!! recommendation
 
-    ![StartMail logo](/assets/img/email/startmail.svg#only-light){ align=right }
-    ![StartMail logo](/assets/img/email/startmail-dark.svg#only-dark){ align=right }
+    ![StartMail logo](assets/img/email/startmail.svg#only-light){ align=right }
+    ![StartMail logo](assets/img/email/startmail-dark.svg#only-dark){ align=right }
 
     **StartMail** is an email service with a focus on security and privacy through the use of standard OpenPGP encryption. StartMail has been in operation since 2014 and is based in Boulevard 11, Zeist Netherlands. Accounts start with 10GB. They offer a 30-day trial.
 
@@ -230,7 +230,7 @@ Tutanota is working on a [desktop client](https://tutanota.com/blog/posts/deskto
 
     StartMail has [zero access encryption at rest](https://www.startmail.com/en/whitepaper/#_Toc458527835), using their "user vault" system. When a user logs in, the vault is opened, and the email is then moved to the vault out of the queue where it is decrypted by the corresponding private key.
 
-    StartMail supports importing [contacts](https://support.startmail.com/hc/en-us/articles/360006495557-Import-contacts) however, they are only accessible in the webmail and not through protocols such as [CalDAV](https://en.wikipedia.org/wiki/CalDAV). Contacts are also not stored using zero knowledge encryption, so a [standalone option](/calendar-contacts) may be more appropriate.
+    StartMail supports importing [contacts](https://support.startmail.com/hc/en-us/articles/360006495557-Import-contacts) however, they are only accessible in the webmail and not through protocols such as [CalDAV](https://en.wikipedia.org/wiki/CalDAV). Contacts are also not stored using zero knowledge encryption, so a [standalone option](calendar-contacts.md) may be more appropriate.
 
 ??? check "Email Encryption"
 
@@ -248,8 +248,8 @@ Tutanota is working on a [desktop client](https://tutanota.com/blog/posts/deskto
 
 !!! recommendation
 
-    ![CTemplar Logo](/assets/img/email/ctemplar.svg#only-light){ align=right }
-    ![CTemplar Logo](/assets/img/email/ctemplar-dark.svg#only-dark){ align=right }
+    ![CTemplar Logo](assets/img/email/ctemplar.svg#only-light){ align=right }
+    ![CTemplar Logo](assets/img/email/ctemplar-dark.svg#only-dark){ align=right }
 
     **CTemplar** is an email service with a focus on security and privacy through the use of standard OpenPGP encryption. CTemplar has been in operation since **2018** and is run from Iceland. Paid accounts start with 5GB. They offer free accounts by [invitation](https://ctemplar.com/email-creation-restriction/).
 
@@ -427,7 +427,7 @@ There is another standard that was popular with business called [S/MIME](https:/
 
 ### What software can I use to get E2EE?
 
-Email providers which allow you to use standard access protocols like [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) and [SMTP](https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol) can be used with any of the [email clients we recommend](/email-clients). This can be less secure as you are now relying on email providers to ensure that their encryption implementation works and has not been compromised in anyway.
+Email providers which allow you to use standard access protocols like [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) and [SMTP](https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol) can be used with any of the [email clients we recommend](email-clients.md). This can be less secure as you are now relying on email providers to ensure that their encryption implementation works and has not been compromised in anyway.
 
 ### How do I protect my private keys?
 
@@ -465,14 +465,14 @@ When emails travel between email providers an encrypted connection is negotiated
 
 !!! recommendation
 
-    ![AnonAddy logo](/assets/img/email/anonaddy.svg#only-light){ align=right }
-    ![AnonAddy logo](/assets/img/email/anonaddy-dark.svg#only-dark){ align=right }
+    ![AnonAddy logo](assets/img/email/anonaddy.svg#only-light){ align=right }
+    ![AnonAddy logo](assets/img/email/anonaddy-dark.svg#only-dark){ align=right }
 
     **[AnonAddy](https://anonaddy.com)** lets users create aliases that forward to their email address. Can be self-hosted. [Source code on GitHub](https://github.com/anonaddy/anonaddy). 
 
 !!! recommendation
 
-    ![Simplelogin logo](/assets/img/email/simplelogin.svg){ align=right }
+    ![Simplelogin logo](assets/img/email/simplelogin.svg){ align=right }
 
     **[SimpleLogin](https://simplelogin.io)** allows you to easily create aliases for your email. Can be self-hosted. [Source code on GitHub](https://github.com/simple-login/app).
 
@@ -484,13 +484,13 @@ Advanced users may consider setting up their own email server. Mailservers requi
 
 !!! recommendation
 
-    ![Mail-in-a-Box logo](/assets/img/email/mail-in-a-box.svg){ align=right }
+    ![Mail-in-a-Box logo](assets/img/email/mail-in-a-box.svg){ align=right }
 
     **[Mail-in-a-Box](https://mailinabox.email)** is an automated setup script for deploying a mail server on Ubuntu. Its goal is to make it easier for users to set up their own mail server.
 
 !!! recommendation
 
-    ![Mailcow logo](/assets/img/email/mailcow.svg){ align=right }
+    ![Mailcow logo](assets/img/email/mailcow.svg){ align=right }
 
     **[Mailcow](https://mailcow.email)** is a more advanced mail server perfect for those with a bit more Linux experience. It has everything you need in a Docker container: A mailserver with DKIM support, antivirus and spam monitoring, webmail and ActiveSync with SOGo, and web-based administration with 2FA support. **[Mailcow Dockerized docs](https://mailcow.github.io/mailcow-dockerized-docs/)**
 

docs/encryption.en.md

@@ -12,8 +12,8 @@ The options listed here are multi-platform and great for creating encrypted back
 
 !!! recommendation
 
-    ![VeraCrypt logo](/assets/img/encryption-software/veracrypt.svg#only-light){ align=right }
-    ![VeraCrypt logo](/assets/img/encryption-software/veracrypt-dark.svg#only-dark){ align=right }
+    ![VeraCrypt logo](assets/img/encryption-software/veracrypt.svg#only-light){ align=right }
+    ![VeraCrypt logo](assets/img/encryption-software/veracrypt-dark.svg#only-dark){ align=right }
 
     **VeraCrypt** is a source-available freeware utility used for on-the-fly encryption. It can create a virtual encrypted disk within a file, encrypt a partition, or encrypt the entire storage device with pre-boot authentication.
 
@@ -35,7 +35,7 @@ Truecrypt has been [audited a number of times](https://en.wikipedia.org/wiki/Tru
 
 !!! recommendation
 
-    ![Cryptomator logo](/assets/img/encryption-software/cryptomator.svg){ align=right }
+    ![Cryptomator logo](assets/img/encryption-software/cryptomator.svg){ align=right }
 
     **Cryptomator** makes it easy for you to upload files to the cloud in a virtual encrypted file system.
 
@@ -57,7 +57,7 @@ Some of the Cryptomator Crypto Libraries have been [audited](https://cryptomator
 
 !!! recommendation
 
-    ![Picocrypt logo](/assets/img/encryption-software/picocrypt.svg){ align=right }
+    ![Picocrypt logo](assets/img/encryption-software/picocrypt.svg){ align=right }
 
     **Picocrypt** is a small and simple encryption tool that provides modern encryption. Picocrypt uses the secure XChaCha20 cipher and the Argon2id key derivation function to provide a high level of security. It uses Go's standard x/crypto modules for its encryption features.
 
@@ -77,7 +77,7 @@ Modern operating systems include [disk encryption](https://en.wikipedia.org/wiki
 
 !!! recommendation
 
-    ![BitLocker logo](/assets/img/encryption-software/bitlocker.png){ align=right }
+    ![BitLocker logo](assets/img/encryption-software/bitlocker.png){ align=right }
 
     **BitLocker** is the full volume encryption solution bundled with Microsoft Windows. The main reason we recommend it is because of its [use of TPM](https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/how-windows-uses-the-tpm). [ElcomSoft](https://en.wikipedia.org/wiki/ElcomSoft), a forensics company, has written about it in [Understanding BitLocker TPM Protection](https://blog.elcomsoft.com/2021/01/understanding-BitLocker-tpm-protection/).
 
@@ -122,7 +122,7 @@ BitLocker is [only supported](https://support.microsoft.com/en-us/windows/turn-o
 
 !!! recommendation
 
-    ![FileVault logo](/assets/img/encryption-software/filevault.png){ align=right }
+    ![FileVault logo](assets/img/encryption-software/filevault.png){ align=right }
 
     **FileVault** is the on-the-fly volume encryption solution built into macOS. FileVault is recommended because it [leverages](https://support.apple.com/guide/security/volume-encryption-with-filevault-sec4c6dc1b6e/web) hardware security capabilities present on an Apple silicon SoC or T2 Security Chip.
 
@@ -134,7 +134,7 @@ We recommend storing a local recovery key in a secure place as opposed to utiliz
 
 !!! recommendation
 
-    ![LUKS logo](/assets/img/encryption-software/luks.png){ align=right }
+    ![LUKS logo](assets/img/encryption-software/luks.png){ align=right }
 
     **LUKS** is the default full disk encryption method for Linux. It can be used to encrypt full volumes, partitions, or create encrypted containers.
 
@@ -170,8 +170,8 @@ Browser-based encryption can be useful when you need to encrypt a file but canno
 
 !!! recommendation
 
-    ![hat.sh logo](/assets/img/encryption-software/hat-sh.png#only-light){ align=right }
-    ![hat.sh logo](/assets/img/encryption-software/hat-sh-dark.png#only-dark){ align=right }
+    ![hat.sh logo](assets/img/encryption-software/hat-sh.png#only-light){ align=right }
+    ![hat.sh logo](assets/img/encryption-software/hat-sh-dark.png#only-dark){ align=right }
 
     **Hat.sh** is a web application that provides secure client-side file encryption in your browser. It can also be self-hosted and is useful if you need to encrypt a file but cannot install any software on your device due to organizational policies.
 
@@ -188,7 +188,7 @@ Tools with command-line interfaces are useful for intergrating [shell scripts](h
 
 !!! recommendation
 
-    ![Kryptor logo](/assets/img/encryption-software/kryptor.png){ align=right }
+    ![Kryptor logo](assets/img/encryption-software/kryptor.png){ align=right }
 
     **Kryptor** is a free and open source file encryption and signing tool that makes use of modern and secure cryptographic algorithms. It aims to be a better version of [age](https://github.com/FiloSottile/age) and [Minisign](https://jedisct1.github.io/minisign/) to provide a simple, user friendly alternative to GPG.
 
@@ -204,7 +204,7 @@ Tools with command-line interfaces are useful for intergrating [shell scripts](h
 
 !!! recommendation
 
-    ![Tomb logo](/assets/img/encryption-software/tomb.png){ align=right }
+    ![Tomb logo](assets/img/encryption-software/tomb.png){ align=right }
 
     **Tomb** is an is a command-line shell wrapper for LUKS. It supports steganography via [third-party tools](https://github.com/dyne/Tomb#how-does-it-work).
 
@@ -231,7 +231,7 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! recommendation
 
-    ![GNU Privacy Guard logo](/assets/img/encryption-software/gnupg.svg){ align=right }
+    ![GNU Privacy Guard logo](assets/img/encryption-software/gnupg.svg){ align=right }
 
     **GnuPG** is a GPL-licensed alternative to the PGP suite of cryptographic software. GnuPG is compliant with [RFC 4880](https://tools.ietf.org/html/rfc4880), which is the current IETF specification of OpenPGP. The GnuPG project has been working on an [updated draft](https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/) in an attempt to modernize OpenPGP. GnuPG is a part of the Free Software Foundation's GNU software project and has received major [funding](https://gnupg.org/blog/20220102-a-new-future-for-gnupg.html) from the German government.
 
@@ -248,7 +248,7 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! recommendation
 
-    ![GPG4win logo](/assets/img/encryption-software/gpg4win.svg){ align=right }
+    ![GPG4win logo](assets/img/encryption-software/gpg4win.svg){ align=right }
 
     **GPG4win** is a package for Windows from [Intevation and g10 Code](https://gpg4win.org/impressum.html). It includes [various tools](https://gpg4win.org/about.html) that assist PGP users on Microsoft Windows. The project was initiated and originally [funded by](https://web.archive.org/web/20190425125223/https://joinup.ec.europa.eu/news/government-used-cryptography) Germany's Federal Office for Information Security (BSI) in 2005.
 
@@ -262,9 +262,9 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! recommendation
 
-    ![GPG Suite logo](/assets/img/encryption-software/gpgsuite.png){ align=right }
+    ![GPG Suite logo](assets/img/encryption-software/gpgsuite.png){ align=right }
 
-    **GPG Suite** provides OpenPGP support for [Apple Mail](/email-clients/#apple-mail) and macOS. GPGTools GmbH costs $24€ yearly for their support plan and includes a 30-day trial.
+    **GPG Suite** provides OpenPGP support for [Apple Mail](email-clients.md#apple-mail) and macOS. GPGTools GmbH costs $24€ yearly for their support plan and includes a 30-day trial.
 
     We recommend taking a look at their [First steps](https://gpgtools.tenderapp.com/kb/how-to/first-steps-where-do-i-start-where-do-i-begin-setup-gpgtools-create-a-new-key-your-first-encrypted-email) and [Knowledge base](https://gpgtools.tenderapp.com/kb) for support.
 
@@ -276,15 +276,15 @@ When encrypting with PGP, the user has the option to configure different options
 
 !!! note
 
-    We suggest [Canary Mail](/email-clients/#canary-mail) for using PGP with email on iOS devices.
+    We suggest [Canary Mail](email-clients/#canary-mail) for using PGP with email on iOS devices.
 
 ### OpenKeychain
 
 !!! recommendation
 
-    ![OpenKeychain logo](/assets/img/encryption-software/openkeychain.svg){ align=right }
+    ![OpenKeychain logo](assets/img/encryption-software/openkeychain.svg){ align=right }
 
-    **OpenKeychain** is an Android implementation of GnuPG. It's commonly required by mail clients such as [K-9 Mail](/email-clients/#k-9-mail) and [FairEmail](/email-clients/#fairemail) and other Android apps to provide encryption support. Cure53 completed a [security audit](https://www.openkeychain.org/openkeychain-3-6) of OpenKeychain 3.6 in October 2015. Technical details about the audit and OpenKeychain's solutions can be found [here](https://github.com/open-keychain/open-keychain/wiki/cure53-Security-Audit-2015).
+    **OpenKeychain** is an Android implementation of GnuPG. It's commonly required by mail clients such as [K-9 Mail](email-clients.md#k-9-mail) and [FairEmail](email-clients.md#fairemail) and other Android apps to provide encryption support. Cure53 completed a [security audit](https://www.openkeychain.org/openkeychain-3-6) of OpenKeychain 3.6 in October 2015. Technical details about the audit and OpenKeychain's solutions can be found [here](https://github.com/open-keychain/open-keychain/wiki/cure53-Security-Audit-2015).
 
     [Visit openkeychain.org](https://www.openkeychain.org){ .md-button .md-button--primary } [Privacy Policy](https://www.openkeychain.org/help/privacy-policy){ .md-button }
 

docs/file-sharing.en.md

@@ -10,7 +10,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![OnionShare logo](/assets/img/file-sharing-sync/onionshare.svg){ align=right }
+    ![OnionShare logo](assets/img/file-sharing-sync/onionshare.svg){ align=right }
 
     **OnionShare** is an open-source tool that lets you securely and anonymously share a file of any size. It works by starting a web server accessible as a Tor onion service, with an unguessable URL that you can share with the recipients to download or send files.
 
@@ -26,7 +26,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![Magic Wormhole logo](/assets/img/file-sharing-sync/magic_wormhole.png){ align=right }
+    ![Magic Wormhole logo](assets/img/file-sharing-sync/magic_wormhole.png){ align=right }
 
     Magic Wormhole is a package that provides a library and a command-line tool named wormhole, which makes it possible to get arbitrary-sized files and directories (or short pieces of text) from one computer to another. Their motto: "Get things from one computer to another, safely.
 
@@ -42,7 +42,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![FreedomBox logo](/assets/img/file-sharing-sync/freedombox.svg){ align=right }
+    ![FreedomBox logo](assets/img/file-sharing-sync/freedombox.svg){ align=right }
 
     **FreedomBox** is a operating system designed to be run on a [single-board computer (SBC)](https://en.wikipedia.org/wiki/Single-board_computer). The purpose is to make it easy to set up server applications that you might want to selfhost.
 
@@ -57,7 +57,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![Syncthing logo](/assets/img/file-sharing-sync/syncthing.svg){ align=right }
+    ![Syncthing logo](assets/img/file-sharing-sync/syncthing.svg){ align=right }
 
     **Syncthing** replaces proprietary sync and cloud services with something open, trustworthy, and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third-party, and how it is transmitted over the Internet.
 
@@ -73,7 +73,7 @@ Discover how to privately share your files between your devices, with your frien
 
 !!! recommendation
 
-    ![git-annex logo](/assets/img/file-sharing-sync/gitannex.svg){ align=right }
+    ![git-annex logo](assets/img/file-sharing-sync/gitannex.svg){ align=right }
 
     **git-annex** allows managing files with git, without checking the file contents into git. While that may seem paradoxical, it is useful when dealing with files larger than git can currently easily handle, whether due to limitations in memory, time, or disk space.
 

docs/index.en.md

@@ -47,5 +47,5 @@ It's important for a website like Privacy Guides to always stay up-to-date. We n
 
 **Privacy Guides** is a non-profit, socially motivated website that provides information for protecting your data security and privacy.
 
-We do not make money from recommending certain products, and we do not utilize affiliate links. [Learn more...](about.md)
+We do not make money from recommending certain products, and we do not utilize affiliate links. [Learn more :material-arrow-right:](about.md)
 </div>

docs/linux-desktop.en.md

@@ -10,7 +10,7 @@ Linux distributions are commonly recommended for privacy protection and user fre
 
 !!! recommendation
 
-    ![Fedora logo](/assets/img/linux-desktop/fedora-workstation.svg){ align=right }
+    ![Fedora logo](assets/img/linux-desktop/fedora-workstation.svg){ align=right }
 
     **Fedora Workstation** is our recommended distribution for users new to Linux. Fedora generally adopts newer technologies before other distributions e.g., [Wayland](https://wayland.freedesktop.org/), [PipeWire](https://pipewire.org), and soon, [FS-Verity](https://fedoraproject.org/wiki/Changes/FsVerityRPM). These new technologies often come with improvements in security, privacy, and usability in general.
 
@@ -22,7 +22,7 @@ Fedora has a semi-[rolling release](https://en.wikipedia.org/wiki/Rolling_releas
 
 !!! recommendation
 
-    ![openSUSE Tumbleweed logo](/assets/img/linux-desktop/opensuse-tumbleweed.svg){ align=right }
+    ![openSUSE Tumbleweed logo](assets/img/linux-desktop/opensuse-tumbleweed.svg){ align=right }
 
     **openSUSE Tumbleweed** is a stable [rolling release](https://en.wikipedia.org/wiki/Rolling_release) distribution.
 
@@ -30,13 +30,13 @@ Fedora has a semi-[rolling release](https://en.wikipedia.org/wiki/Rolling_releas
 
     [Visit get.opensuse.org](https://get.opensuse.org/tumbleweed/){ .md-button .md-button--primary }
 
-Tumbleweed follows a rolling release model where each update is released as a snapshot of the distribution. When the user upgrades their system, a new snapshot is downloaded. Each snapshot is run through a series of automated tests by the [openSUSE Build Service](https://build.opensuse.org) to ensure its quality.
+Tumbleweed follows a rolling release model where each update is released as a snapshot of the distribution. When the user upgrades their system, a new snapshot is downloaded. Each snapshot is run through a series of automated tests by [openQA](https://openqa.opensuse.org) to ensure its quality.
 
 ### Arch Linux
 
 !!! recommendation
 
-    ![Arch logo](/assets/img/linux-desktop/archlinux.svg){ align=right }
+    ![Arch logo](assets/img/linux-desktop/archlinux.svg){ align=right }
 
     **Arch Linux** is a lightweight, do-it-yourself (DIY) distribution meaning that you only get what you install. For more information see their [FAQ](https://wiki.archlinux.org/title/Frequently_asked_questions).
 
@@ -44,7 +44,7 @@ Tumbleweed follows a rolling release model where each update is released as a sn
 
 Arch Linux has a rolling release cycle. There is no fixed release schedule and packages are updated very frequently.
 
-Being a DIY distribution, the user is [expected to setup and maintain](/linux-desktop/#arch-based-distributions) their system. Arch has an [official installer](https://wiki.archlinux.org/title/Archinstall) to make the installation process a little easier.
+Being a DIY distribution, the user is [expected to setup and maintain](#arch-based-distributions) their system. Arch has an [official installer](https://wiki.archlinux.org/title/Archinstall) to make the installation process a little easier.
 
 A large portion of [Arch Linux’s packages](https://reproducible.archlinux.org) are [reproducible](https://reproducible-builds.org).
 
@@ -54,7 +54,7 @@ A large portion of [Arch Linux’s packages](https://reproducible.archlinux.org)
 
 !!! recommendation
 
-    ![Fedora Silverblue logo](/assets/img/linux-desktop/fedora-silverblue.svg){ align=right }
+    ![Fedora Silverblue logo](assets/img/linux-desktop/fedora-silverblue.svg){ align=right }
 
     **Fedora Silverblue** and **Fedora Kinoite** are immutable variants of Fedora with a strong focus on container workflows. Silverblue comes with the [GNOME](https://www.gnome.org/) desktop environment while Kinoite comes with [KDE](https://kde.org/). Silverblue and Kinoite follow the same release schedule as Fedora Workstation, benefiting from the same fast updates and staying very close to upstream.
 
@@ -64,7 +64,7 @@ Silverblue (and Kinoite) differ from Fedora Workstation as they replace the [DNF
 
 After the update is complete the user will reboot the system into the new deployment. `rpm-ostree` keeps two deployments of the system so that a user can easily rollback if something breaks in the new deployment. There is also the option to pin more deployments as needed.
 
-[Flatpak](https://www.flatpak.org) is the primary package installation method on these distrbutions, as `rpm-ostree` is only meant to overlay packages that cannot stay inside of a container on top of the base image.
+[Flatpak](https://www.flatpak.org) is the primary package installation method on these distributions, as `rpm-ostree` is only meant to overlay packages that cannot stay inside of a container on top of the base image.
 
 As an alternative to Flatpaks, there is the option of [Toolbox](https://docs.fedoraproject.org/en-US/fedora-silverblue/toolbox/) to create [Podman](https://podman.io) containers with a shared home directory with the host operating system and mimic a traditional Fedora environment, which is a [useful feature](https://containertoolbx.org) for the discerning developer.
 
@@ -72,7 +72,7 @@ As an alternative to Flatpaks, there is the option of [Toolbox](https://docs.fed
 
 !!! recommendation
 
-    ![NixOS logo](/assets/img/linux-desktop/nixos.svg){ align=right }
+    ![NixOS logo](assets/img/linux-desktop/nixos.svg){ align=right }
 
     NixOS is an independent distribution based on the Nix package manager with a focus on reproducibility and reliability.
 
@@ -84,7 +84,7 @@ NixOS also provides atomic updates; first it downloads (or builds) the packages
 
 Nix the package manager uses a purely functional language - which is also called Nix - to define packages.
 
-[Nixpkgs](https://github.com/nixos/nixpkgs) (the main source of packages) are contained in a single Github repository. You can also define your own packages in the same language and then easily include them in your config.
+[Nixpkgs](https://github.com/nixos/nixpkgs) (the main source of packages) are contained in a single GitHub repository. You can also define your own packages in the same language and then easily include them in your config.
 
 Nix is a source-based package manager; if there’s no pre-built available in the binary cache, Nix will just build the package from source using its definition. It builds each package in a sandboxed *pure* environment, which is as independent of the host system as possible, thus making binaries reproducible.
 
@@ -94,7 +94,7 @@ Nix is a source-based package manager; if there’s no pre-built available in th
 
 !!! recommendation
 
-    ![Whonix logo](/assets/img/linux-desktop/whonix.svg){ align=right }
+    ![Whonix logo](assets/img/linux-desktop/whonix.svg){ align=right }
 
     **Whonix** is based on [Kicksecure](https://www.whonix.org/wiki/Kicksecure), a security-focused fork of Debian. It aims to provide privacy, security, and anonymity on the internet.
 
@@ -104,7 +104,7 @@ Whonix is meant to run as two virtual machines: a “Workstation” and a Tor
 
 Some of its features include Tor Stream Isolation, [keystroke anonymization](https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak), [encrypted swap](https://github.com/Whonix/swap-file-creator), and a hardened memory allocator.
 
-Future versions of Whonix will likely include [full system Apparmor policies](https://github.com/Whonix/apparmor-profile-everything) and a [sandbox app launcher](https://www.whonix.org/wiki/Sandbox-app-launcher) to fully confine all processes on the system.
+Future versions of Whonix will likely include [full system AppArmor policies](https://github.com/Whonix/apparmor-profile-everything) and a [sandbox app launcher](https://www.whonix.org/wiki/Sandbox-app-launcher) to fully confine all processes on the system.
 
 Whonix is best used [in conjunction with Qubes](https://www.whonix.org/wiki/Qubes/Why_use_Qubes_over_other_Virtualizers).
 
@@ -112,11 +112,11 @@ Whonix is best used [in conjunction with Qubes](https://www.whonix.org/wiki/Qube
 
 !!! recommendation
 
-    ![Tails logo](/assets/img/linux-desktop/tails.svg){ align=right }
+    ![Tails logo](assets/img/linux-desktop/tails.svg){ align=right }
 
     **Tails** is a live operating system based on Debian that routes all communications through Tor.
 
-    It can boot on almost any computer from a DVD, USB stick, or sdcard. It aims to preserve privacy and anonymity while circumventing censorship and leaving no trace of itself on the computer it is used on.
+    It can boot on almost any computer from a DVD, USB stick, or SD card. It aims to preserve privacy and anonymity while circumventing censorship and leaving no trace of itself on the computer it is used on.
 
     [Visit tails.boum.org](https://tails.boum.org/){ .md-button .md-button--primary }
 
@@ -215,7 +215,7 @@ We recommend using a desktop environment that supports the [Wayland](https://en.
 
 Fortunately, common environments such as [GNOME](https://www.gnome.org), [KDE](https://kde.org), and the window manager [Sway](https://swaywm.org) have support for Wayland. Some distributions like Fedora and Tumbleweed use it by default and some others may do so in the future as X11 is in [hard maintenance mode](https://www.phoronix.com/scan.php?page=news_item&px=X.Org-Maintenance-Mode-Quickly). If you’re using one of those environments it is as easy as selecting the “Wayland” session at the desktop display manager ([GDM](https://en.wikipedia.org/wiki/GNOME_Display_Manager), [SDDM](https://en.wikipedia.org/wiki/Simple_Desktop_Display_Manager)).
 
-We recommend **against** using desktop environments or window managers that do not have Wayland support such as Cinnamon (default on Linux Mint), Pantheon (default on Elementary OS), MATE, XFCE, and i3.
+We recommend **against** using desktop environments or window managers that do not have Wayland support such as Cinnamon (default on Linux Mint), Pantheon (default on Elementary OS), MATE, Xfce, and i3.
 
 ### Proprietary firmware (microcode updates)
 
@@ -239,7 +239,7 @@ There isn’t much point in randomizing the MAC address for Ethernet connections
 
 ### Other identifiers
 
-There are other system [identifiers](https://madaidans-insecurities.github.io/guides/linux-hardening.html#identifiers) which you may wish to be careful about. You should give this some thought to see if it applies to your [threat model](/threat-modeling):
+There are other system [identifiers](https://madaidans-insecurities.github.io/guides/linux-hardening.html#identifiers) which you may wish to be careful about. You should give this some thought to see if it applies to your [threat model](threat-modeling.md):
 
 - [10.1 Hostnames and usernames](https://madaidans-insecurities.github.io/guides/linux-hardening.html#hostnames)
 - [10.2 Time zones / Locales / Keymaps](https://madaidans-insecurities.github.io/guides/linux-hardening.html#timezones-locales-keymaps)
@@ -314,7 +314,7 @@ Red Hat develops [Podman](https://docs.podman.io/en/latest/) and secures it with
 
 Another option is [Kata containers](https://katacontainers.io/), where virtual machines masquerade as containers. Each Kata container has its own Linux kernel and is isolated from the host.
 
-These container technologies can be useful even for enthusiastic home users who may want to run certain web app software on their local area network (LAN) such as [vaultwarden](https://github.com/dani-garcia/vaultwarden) or images provided by [linuxserver.io](https://www.linuxserver.io) to increase privacy by decreasing dependence on various web services.
+These container technologies can be useful even for enthusiastic home users who may want to run certain web app software on their local area network (LAN) such as [Vaultwarden](https://github.com/dani-garcia/vaultwarden) or images provided by [linuxserver.io](https://www.linuxserver.io) to increase privacy by decreasing dependence on various web services.
 
 ## Additional hardening
 
@@ -346,7 +346,7 @@ Note that setting `kernel.unprivileged_userns_clone=0` will stop Flatpak, Snap (
 
 ### Linux-Hardened
 
-Some distributions like Arch Linux have the [linux-hardened](https://github.com/anthraxx/linux-hardened), kernel package. It includes [hardening patches](https://wiki.archlinux.org/title/security#Kernel_hardening) and more security-conscious defaults. Linux-Hardened has `kernel.unprivileged_userns_clone=0` disabled by default. See the [warning above](/linux-desktop/#kernel-hardening) about how this might impact you.
+Some distributions like Arch Linux have the [linux-hardened](https://github.com/anthraxx/linux-hardened), kernel package. It includes [hardening patches](https://wiki.archlinux.org/title/security#Kernel_hardening) and more security-conscious defaults. Linux-Hardened has `kernel.unprivileged_userns_clone=0` disabled by default. See the [warning above](#kernel-hardening) about how this might impact you.
 
 ### Simultaneous multithreading (SMT)
 
@@ -382,7 +382,7 @@ On systems where [`pam_faillock`](https://man7.org/linux/man-pages/man8/pam_tall
 
 To better protect your [USB](https://en.wikipedia.org/wiki/USB) ports from attacks such as [BadUSB](https://en.wikipedia.org/wiki/BadUSB) we recommend [USBGuard](https://github.com/USBGuard/usbguard). USBGuard has [documentation](https://github.com/USBGuard/usbguard#documentation) as does the [Arch Wiki](https://wiki.archlinux.org/title/USBGuard).
 
-Another alternative option if you’re using the [linux-hardened](/linux-desktop/#linux-hardened) is the [`deny_new_usb`](https://github.com/GrapheneOS/linux-hardened/commit/96dc427ab60d28129b36362e1577b6673b0ba5c4) sysctl. See [Preventing USB Attacks with `linux-hardened`](https://blog.lizzie.io/preventing-usb-attacks-with-linux-hardened.html).
+Another alternative option if you’re using the [linux-hardened](#linux-hardened) is the [`deny_new_usb`](https://github.com/GrapheneOS/linux-hardened/commit/96dc427ab60d28129b36362e1577b6673b0ba5c4) sysctl. See [Preventing USB Attacks with `linux-hardened`](https://blog.lizzie.io/preventing-usb-attacks-with-linux-hardened.html).
 
 ### Secure Boot
 

docs/metadata-removal-tools.en.md

@@ -10,7 +10,7 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![MAT2 logo](/assets/img/metadata-removal/mat2.svg){ align=right }
+    ![MAT2 logo](assets/img/metadata-removal/mat2.svg){ align=right }
 
     **MAT2** is free software, which allows the metadata to be removed from image, audio, torrent, and document file types. It provides both a command line tool and a graphical user interface via an [extension for Nautilus](https://0xacab.org/jvoisin/mat2/-/tree/master/nautilus), the default file manager of [GNOME](https://www.gnome.org), and [Dolphin](https://0xacab.org/jvoisin/mat2/-/tree/master/dolphin), the default file manager of [KDE](https://kde.org).
 
@@ -29,9 +29,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![ExifCleaner logo](/assets/img/metadata-removal/exifcleaner.svg){ align=right }
+    ![ExifCleaner logo](assets/img/metadata-removal/exifcleaner.svg){ align=right }
 
-    **ExifCleaner** is a freeware, open source graphical app that uses [ExifTool](https://exiftool.org) to remove [EXIF](https://en.wikipedia.org/wiki/Exif) metadata from images, videos, and PDF documents using a simple drag and drop interface. It supports multi-core batch processing and dark mode.
+    **ExifCleaner** is a freeware, open source graphical app that uses [ExifTool](https://exiftool.org) to remove EXIF metadata from images, videos, and PDF documents using a simple drag and drop interface. It supports multi-core batch processing and dark mode.
 
     [Visit exifcleaner.com](https://exifcleaner.com){ .md-button .md-button--primary }
 
@@ -47,9 +47,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![Scrambled Exif logo](/assets/img/metadata-removal/scrambled-exif.svg){ align=right }
+    ![Scrambled Exif logo](assets/img/metadata-removal/scrambled-exif.svg){ align=right }
 
-    **Scrambled Exif** is a metadata removal tool for Android. It can remove [EXIF](https://en.wikipedia.org/wiki/Exif) data for many file formats and has been translated into [many](https://gitlab.com/juanitobananas/scrambled-exif/-/tree/master/app/src/main/res) languages.
+    **Scrambled Exif** is a metadata removal tool for Android. It can remove EXIF data for many file formats and has been translated into [many](https://gitlab.com/juanitobananas/scrambled-exif/-/tree/master/app/src/main/res) languages.
 
     [Visit gitlab.com](https://gitlab.com/juanitobananas/scrambled-exif){ .md-button .md-button--primary }
 
@@ -66,9 +66,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![Imagepipe logo](/assets/img/metadata-removal/imagepipe.svg){ align=right }
+    ![Imagepipe logo](assets/img/metadata-removal/imagepipe.svg){ align=right }
 
-    **Imagepipe** is a a paint app for Android that can be used to redact photos and also delete [EXIF](https://en.wikipedia.org/wiki/Exif) metadata. It has been translated into [many](https://codeberg.org/Starfish/Imagepipe#translations) languages.
+    **Imagepipe** is a a paint app for Android that can be used to redact photos and also delete EXIF metadata. It has been translated into [many](https://codeberg.org/Starfish/Imagepipe#translations) languages.
 
     [Visit codeberg.org](https://codeberg.org/Starfish/Imagepipe){ .md-button .md-button--primary }
 
@@ -84,7 +84,7 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![Metapho logo](/assets/img/metadata-removal/metapho.jpg){ align=right }
+    ![Metapho logo](assets/img/metadata-removal/metapho.jpg){ align=right }
 
     Metapho is a simple and clean viewer for photo metadata such as date, file name, size, camera model, shutter speed, and location.
 
@@ -99,9 +99,9 @@ When sharing files, be sure to remove associated metadata. Image files commonly
 
 !!! recommendation
 
-    ![ExifTool logo](/assets/img/metadata-removal/exiftool.png){ align=right }
+    ![ExifTool logo](assets/img/metadata-removal/exiftool.png){ align=right }
 
-    **ExifTool** is the [original](https://en.wikipedia.org/wiki/ExifTool) perl library and command-line application for reading, writing, and editing meta information (EXIF, IPTC, XMP, and more) in a wide variety of file formats (JPEG, TIFF, PNG, PDF, RAW, and more).
+    **ExifTool** is the original perl library and command-line application for reading, writing, and editing meta information (EXIF, IPTC, XMP, and more) in a wide variety of file formats (JPEG, TIFF, PNG, PDF, RAW, and more).
 
     It's often a component of other EXIF removal applications and is in most Linux distribution repositories.
 

docs/multi-factor-authentication.en.md

@@ -8,9 +8,9 @@ icon: 'material/two-factor-authentication'
 
 !!! recommendation
 
-    ![YubiKeys](/assets/img/multi-factor-authentication/yubikey.png)
+    ![YubiKeys](assets/img/multi-factor-authentication/yubikey.png)
 
-    The **YubiKeys** are among the most popular security keys. Some YubiKey models have a wide range of features such as: [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 WebAuthn](https://en.wikipedia.org/wiki/WebAuthn), [Yubico OTP](https://developers.yubico.com/OTP/), [PIV](https://en.wikipedia.org/wiki/FIPS_201), [OpenPGP](https://developers.yubico.com/PGP/), [TOTP and HOTP](https://developers.yubico.com/OATH/) authentication.
+    The **YubiKeys** are among the most popular security keys. Some YubiKey models have a wide range of features such as: [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](security/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](security/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP/), [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
 
     One of the benefits of the YubiKey is that one key can do almost everything (YubiKey 5), you could expect from a hardware security key. We do encourage you to take the [quiz](https://www.yubico.com/quiz/) before purchasing in order to make sure you make the right choice.
 
@@ -29,9 +29,9 @@ For models which support HOTP and TOTP, there are 2 slots in the OTP interface w
 
 !!! recommendation
 
-    ![Nitrokey](/assets/img/multi-factor-authentication/nitrokey.jpg){ align=right }
+    ![Nitrokey](assets/img/multi-factor-authentication/nitrokey.jpg){ align=right }
 
-    **Nitrokey** has a security key capable of [FIDO2 WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) called the **Nitrokey FIDO2**. For PGP support, you need to purchase one of their other keys such as the **Nitrokey Start**, **Nitrokey Pro 2** or the **Nitrokey Storage 2**.
+    **Nitrokey** has a security key capable of [FIDO2 and WebAuthn](security/multi-factor-authentication.md#fido-fast-identity-online) called the **Nitrokey FIDO2**. For PGP support, you need to purchase one of their other keys such as the **Nitrokey Start**, **Nitrokey Pro 2** or the **Nitrokey Storage 2**.
 
     [Visit nitrokey.com](https://www.nitrokey.com){ .md-button .md-button--primary } [Privacy Policy](https://www.nitrokey.com/data-privacy-policy){ .md-button }
 
@@ -67,7 +67,7 @@ We highly recommend that you use mobile TOTP apps instead of desktop alternative
 
 !!! recommendation
 
-    ![Aegis logo](/assets/img/multi-factor-authentication/aegis.png){ align=right }
+    ![Aegis logo](assets/img/multi-factor-authentication/aegis.png){ align=right }
 
     **Aegis Authenticator** is a free, secure and open source app to manage your 2-step verification tokens for your online services.
 
@@ -82,7 +82,7 @@ We highly recommend that you use mobile TOTP apps instead of desktop alternative
 
 !!! recommendation
 
-    ![Raivo OTP logo](/assets/img/multi-factor-authentication/raivo-otp.png){ align=right }
+    ![Raivo OTP logo](assets/img/multi-factor-authentication/raivo-otp.png){ align=right }
 
     **Raivo OTP** is a native, lightweight and secure time-based (TOTP) & counter-based (HOTP) password client for iOS. Raivo OTP offers optional iCloud backup & sync. Raivo OTP is also available for macOS in the form of a status bar application, however the Mac app does not work independently of the iOS app.
 

docs/news-aggregators.en.md

@@ -11,9 +11,9 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Fluent Reader logo](/assets/img/news-aggregators/fluent-reader.svg){ align=right }
+    ![Fluent Reader logo](assets/img/news-aggregators/fluent-reader.svg){ align=right }
 
-    **Fluent Reader** is a secure cross-platform news aggregator that has useful privacy features such as deletion of cookies on exit, strict [content security policies (CSP)](https://en.wikipedia.org/wiki/Content_Security_Policy) and proxy support, meaning you can use it over [Tor](/self-contained-networks/#tor).
+    **Fluent Reader** is a secure cross-platform news aggregator that has useful privacy features such as deletion of cookies on exit, strict [content security policies (CSP)](https://en.wikipedia.org/wiki/Content_Security_Policy) and proxy support, meaning you can use it over [Tor](self-contained-networks.md#tor).
 
     [Visit hyliu.me](https://hyliu.me/fluent-reader){ .md-button .md-button--primary } [Privacy Policy](https://github.com/yang991178/fluent-reader/wiki/Privacy){ .md-button }
 
@@ -26,7 +26,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![GNOME Feeds logo](/assets/img/news-aggregators/gfeeds.svg){ align=right }
+    ![GNOME Feeds logo](assets/img/news-aggregators/gfeeds.svg){ align=right }
 
     **GNOME Feeds** is an [RSS](https://en.wikipedia.org/wiki/RSS) and [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)) news reader for [GNOME](https://www.gnome.org). It has a simple interface and is quite fast.
 
@@ -41,7 +41,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Akregator logo](/assets/img/news-aggregators/akregator.svg){ align=right }
+    ![Akregator logo](assets/img/news-aggregators/akregator.svg){ align=right }
 
     **Akregator** is a news feed reader that is a part of the [KDE](https://kde.org) project. It comes with a fast search, advanced archiving functionality and an internal browser for easy news reading.
 
@@ -55,7 +55,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Handy News Reader logo](/assets/img/news-aggregators/handy-news-reader.svg){ align=right }
+    ![Handy News Reader logo](assets/img/news-aggregators/handy-news-reader.svg){ align=right }
 
     **Handy News Reader** is a fork of [Flym](https://github.com/FredJul/Flym) that has many [features](https://github.com/yanus171/Handy-News-Reader#features) and works well with folders of RSS feeds. It supports [RSS](https://en.wikipedia.org/wiki/RSS), [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)) and [RDF](https://en.wikipedia.org/wiki/RDF%2FXML).
 
@@ -70,7 +70,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![NetNewsWire logo](/assets/img/news-aggregators/netnewswire.png){ align=right }
+    ![NetNewsWire logo](assets/img/news-aggregators/netnewswire.png){ align=right }
 
     **NetNewsWire** a free and open-source feed reader for macOS and iOS with a focus on a native design and feature set. It supports the typical feed formats alongside built-in support for Twitter and Reddit feeds.
 
@@ -85,8 +85,8 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Miniflux logo](/assets/img/news-aggregators/miniflux.svg#only-light){ align=right }
-    ![Miniflux logo](/assets/img/news-aggregators/miniflux-dark.svg#only-dark){ align=right }
+    ![Miniflux logo](assets/img/news-aggregators/miniflux.svg#only-light){ align=right }
+    ![Miniflux logo](assets/img/news-aggregators/miniflux-dark.svg#only-dark){ align=right }
 
     **Miniflux** is a web-based news aggregator that you can self-host. It supports [RSS](https://en.wikipedia.org/wiki/RSS), [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)), [RDF](https://en.wikipedia.org/wiki/RDF%2FXML) and [JSON Feed](https://en.wikipedia.org/wiki/JSON_Feed).
 
@@ -99,7 +99,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 !!! recommendation
 
-    ![Newsboat logo](/assets/img/news-aggregators/newsboat.svg){ align=right }
+    ![Newsboat logo](assets/img/news-aggregators/newsboat.svg){ align=right }
 
     **Newsboat** is an RSS/Atom feed reader for the text console. It's an actively maintained fork of [Newsbeuter](https://en.wikipedia.org/wiki/Newsbeuter). It is very lightweight, and ideal for use over [Secure Shell](https://en.wikipedia.org/wiki/Secure_Shell).
 
@@ -112,7 +112,7 @@ A [news aggregator](https://en.wikipedia.org/wiki/News_aggregator) is a way to k
 
 Some social media services also support RSS although it's not often advertised.
 
-### Youtube
+### YouTube
 
 You can subscribe YouTube channels without logging in and associating usage information with your Google Account. To subscribe to a YouTube channel with an RSS client, first look for your [channel code](https://support.google.com/youtube/answer/6180214), replace `channel_id` below:
 

docs/notebooks.en.md

@@ -13,7 +13,7 @@ If you are currently using an application like Evernote, Google Keep, or Microso
 
 !!! recommendation
 
-    ![Joplin logo](/assets/img/notebooks/joplin.svg){ align=right }
+    ![Joplin logo](assets/img/notebooks/joplin.svg){ align=right }
 
     **Joplin** is a free, open-source, and fully-featured note-taking and to-do application which can handle a large number of markdown notes organized into notebooks and tags. It offers end-to-end encryption and can sync through Nextcloud, Dropbox, and more. It also offers easy import from Evernote and plain-text notes.
 
@@ -38,7 +38,7 @@ If you are currently using an application like Evernote, Google Keep, or Microso
 
 !!! recommendation
 
-    ![Standard Notes logo](/assets/img/notebooks/standard-notes.svg){ align=right }
+    ![Standard Notes logo](assets/img/notebooks/standard-notes.svg){ align=right }
 
     Standard Notes is a simple and private notes app that makes your notes easy and available everywhere you are. It features end-to-end encryption on every platform, and a powerful desktop experience with themes and custom editors. It has also been [independently audited (PDF)](https://s3.amazonaws.com/standard-notes/security/Report-SN-Audit.pdf).
 

docs/passwords.en.md

@@ -7,8 +7,8 @@ Stay safe and secure online with an encrypted and open-source password manager.
 ## Password Best Practices
 
 - Always use unique passwords. Don't make yourself a victim of "[credential stuffing](https://en.wikipedia.org/wiki/Credential_stuffing)".
-- Store an exported backup of your passwords in an [encrypted container](/encryption) on another storage device. This can be useful if something happens to your device or the service you are using.
-- If possible, store [Time-based one-time password (TOTP)](https://en.wikipedia.org/wiki/Time-based_one-time_password) tokens in a separate [TOTP app](/security/multi-factor-authentication/#authenticator-apps) and not your password manager. TOTP codes are generated from a "[shared secret](https://en.wikipedia.org/wiki/Time-based_one-time_password#Security)". If the secret is obtained by an adversary they can generate TOTP values. Typically, mobile platforms have better app isolation and more secure methods for storing sensitive credentials.
+- Store an exported backup of your passwords in an [encrypted container](encryption.md) on another storage device. This can be useful if something happens to your device or the service you are using.
+- If possible, store [Time-based one-time password (TOTP)](https://en.wikipedia.org/wiki/Time-based_one-time_password) tokens in a separate [TOTP app](security/multi-factor-authentication.md#authenticator-apps) and not your password manager. TOTP codes are generated from a "[shared secret](https://en.wikipedia.org/wiki/Time-based_one-time_password#Security)". If the secret is obtained by an adversary they can generate TOTP values. Typically, mobile platforms have better app isolation and more secure methods for storing sensitive credentials.
 
 ## Local Password Managers
 
@@ -18,7 +18,7 @@ These password managers store the password database locally.
 
 !!! recommendation
 
-    ![KeepassXC logo](/assets/img/password-management/keepassxc.svg){ align=right }
+    ![KeepassXC logo](assets/img/password-management/keepassxc.svg){ align=right }
 
     **KeePassXC** is a community fork of KeePassX, a native cross-platform port of KeePass Password Safe, with the goal to extend and improve it with new features and bugfixes to provide a feature-rich, fully cross-platform and modern open-source password manager.
 
@@ -41,7 +41,7 @@ These password managers store the password database locally.
 
 !!! recommendation
 
-    ![KeepassDX logo](/assets/img/password-management/keepassdx.svg){ align=right }
+    ![KeepassDX logo](assets/img/password-management/keepassdx.svg){ align=right }
 
     **KeepassDX** is a lightweight password manager for Android, allows editing encrypted data in a single file in KeePass format and can fill in the forms in a secure way. [Contributor Pro](https://play.google.com/store/apps/details?id=com.kunzisoft.keepass.pro) allows unlocking cosmetic content and non-standard protocol features, but more importantly, it helps and encourages development.
 
@@ -62,7 +62,7 @@ These password managers sync up to a cloud server that may be self-hostable.
 
 !!! recommendation
 
-    ![Bitwarden logo](/assets/img/password-management/bitwarden.svg){ align=right }
+    ![Bitwarden logo](assets/img/password-management/bitwarden.svg){ align=right }
 
     **Bitwarden** is a free and open-source password manager. It aims to solve password management problems for individuals, teams, and business organizations. Bitwarden is among the easiest and safest solutions to store all of your logins and passwords while conveniently keeping them synced between all of your devices. If you don't want to use the Bitwarden cloud, you can easily host your own Bitwarden server.
 
@@ -85,9 +85,9 @@ These password managers sync up to a cloud server that may be self-hostable.
 
 !!! recommendation
 
-    ![Psono logo](/assets/img/password-management/psono.svg){ align=right }
+    ![Psono logo](assets/img/password-management/psono.svg){ align=right }
 
-    **Psono** is a free and open source password manager from Germany, with a focus on password management for teams. It can be [self-hosted](/password-management/#password-management-servers). Psono supports secure sharing of passwords, files, bookmarks, and emails. All secrets are protected by a master password.
+    **Psono** is a free and open source password manager from Germany, with a focus on password management for teams. It can be [self-hosted](#password-management-servers). Psono supports secure sharing of passwords, files, bookmarks, and emails. All secrets are protected by a master password.
 
     [Visit psono.com](https://psono.com){ .md-button .md-button--primary } [Privacy Policy](https://psono.com/privacy-policy){ .md-button }
 
@@ -107,8 +107,8 @@ These products are self-hostable synchronization for cloud based password manage
 
 !!! recommendation
 
-    ![Vaultwarden logo](/assets/img/password-management/vaultwarden.svg#only-light){ align=right }
-    ![Vaultwarden logo](/assets/img/password-management/vaultwarden-dark.svg#only-dark){ align=right }
+    ![Vaultwarden logo](assets/img/password-management/vaultwarden.svg#only-light){ align=right }
+    ![Vaultwarden logo](assets/img/password-management/vaultwarden-dark.svg#only-dark){ align=right }
 
     **Vaultwarden** is an alternative implementation of the Bitwarden server API written in Rust and compatible with upstream Bitwarden clients, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal.
 
@@ -122,7 +122,7 @@ These products are self-hostable synchronization for cloud based password manage
 
 !!! recommendation
 
-    ![Psono Server logo](/assets/img/password-management/psono.svg){ align=right }
+    ![Psono Server logo](assets/img/password-management/psono.svg){ align=right }
 
     Psono provides [extensive documentation](https://doc.psono.com/) for their product. The [web-client](https://doc.psono.com/admin/installation/install-webclient.html#installation-with-docker) for Psono can be self hosted; alternatively, you can choose the the full [Community Edition](https://doc.psono.com/admin/installation/install-server-ce.html) or the [Enterprise Edition](https://doc.psono.com/admin/installation/install-server-ee.html) with additional features.
 
@@ -140,7 +140,7 @@ These products are minimal password managers that can be used within scripting a
 
 !!! recommendation
 
-    ![gopass logo](/assets/img/password-management/gopass.svg){ align=right }
+    ![gopass logo](assets/img/password-management/gopass.svg){ align=right }
 
     **gopass** is a password manager for the command line written in Go. It works on all major desktop and server operating systems (Linux, MacOS, BSD, Windows).
 

docs/productivity.en.md

@@ -10,7 +10,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![LibreOffice logo](/assets/img/productivity/libreoffice.svg){ align=right }
+    ![LibreOffice logo](assets/img/productivity/libreoffice.svg){ align=right }
 
     **LibreOffice** is a free and open-source office suite with extensive functionality.
 
@@ -32,7 +32,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![OnlyOffice logo](/assets/img/productivity/onlyoffice.svg){ align=right }
+    ![OnlyOffice logo](assets/img/productivity/onlyoffice.svg){ align=right }
 
     **OnlyOffice** is alternative, it is free and open-source office suite with extensive functionality.
 
@@ -53,7 +53,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![Framadate logo](/assets/img/productivity/framadate.svg){ align=right }
+    ![Framadate logo](assets/img/productivity/framadate.svg){ align=right }
 
     **Framadate** is a free and open-source online service for planning an appointment or making a decision quickly and easily. No registration is required.
 
@@ -68,7 +68,7 @@ Get working and collaborating without sharing your documents with a middleman or
 
 !!! recommendation
 
-    ![PrivateBin logo](/assets/img/productivity/privatebin.svg){ align=right }
+    ![PrivateBin logo](assets/img/productivity/privatebin.svg){ align=right }
 
     **PrivateBin** is a minimalist, open-source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256-bit AES. It is the improved version of ZeroBin.
 
@@ -83,7 +83,7 @@ Do note that PrivateBin uses JavaScript to handle encryption, so you must trust
 
 !!! recommendation
 
-    ![CryptPad logo](/assets/img/productivity/cryptpad.svg){ align=right }
+    ![CryptPad logo](assets/img/productivity/cryptpad.svg){ align=right }
 
     **CryptPad** is a private-by-design alternative to popular office tools. All content is end-to-end encrypted. Do note that it uses JavaScript to handle encryption, so you must trust the provider to the extent that they do not inject any malicious JavaScript to get your private key. Consider self-hosting to mitigate this threat.
 
@@ -98,8 +98,8 @@ Do note that PrivateBin uses JavaScript to handle encryption, so you must trust
 
 !!! recommendation
 
-    ![Write.as logo](/assets/img/productivity/writeas.svg#only-light){ align=right }
-    ![Write.as logo](/assets/img/productivity/writeas-dark.svg#only-dark){ align=right }
+    ![Write.as logo](assets/img/productivity/writeas.svg#only-light){ align=right }
+    ![Write.as logo](assets/img/productivity/writeas-dark.svg#only-dark){ align=right }
 
     **Write.as** is a cross-platform, privacy-oriented blogging platform. It's anonymous by default, letting you publish without signing up. If you create an account, it doesn't require any personal information. No ads, distraction-free, and built on a sustainable business model.
 
@@ -120,7 +120,7 @@ Do note that PrivateBin uses JavaScript to handle encryption, so you must trust
 
 !!! recommendation
 
-    ![VSCodium logo](/assets/img/productivity/vscodium.svg){ align=right }
+    ![VSCodium logo](assets/img/productivity/vscodium.svg){ align=right }
 
     **VSCodium** is a free and open-source project featuring binaries of [Visual Studio Code](https://code.visualstudio.com) without Microsoft's branding/telemetry/licensing.
 

docs/qubes.en.md

@@ -8,7 +8,7 @@ Qubes OS is a distribution of Linux that uses [Xen](https://en.wikipedia.org/wik
 
 !!! recommendation
 
-    ![Qubes OS logo](/assets/img/qubes/qubes_os.svg){ align=right }
+    ![Qubes OS logo](assets/img/qubes/qubes_os.svg){ align=right }
 
     **Qubes** is an open-source operating system designed to provide strong security for desktop computing. Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and utilize most of the Linux drivers.
 

docs/real-time-communication.en.md

@@ -8,7 +8,7 @@ icon: material/chat-processing
 
 !!! recommendation
 
-    ![Signal logo](/assets/img/messengers/signal.svg){ align=right }
+    ![Signal logo](assets/img/messengers/signal.svg){ align=right }
 
     **Signal** is a mobile app developed by Signal Messenger LLC. The app provides instant messaging, as well as voice and video calling.
 
@@ -36,7 +36,7 @@ The protocol was independently [audited](https://eprint.iacr.org/2016/1013.pdf)
 
 !!! recommendation
 
-    ![Element logo](/assets/img/messengers/element.svg){ align=right }
+    ![Element logo](assets/img/messengers/element.svg){ align=right }
 
     **Element** is the reference client for the [Matrix](https://matrix.org/docs/guides/introduction) protocol, an [open standard](https://matrix.org/docs/spec) for secure decentralized real-time communication.
 
@@ -57,7 +57,7 @@ Profile pictures, reactions, and nicknames are not encrypted.
 
 Group voice and video calls are [not](https://github.com/vector-im/element-web/issues/12878) E2EE, and use Jitsi, but this is expected to change with [Native Group VoIP Signalling](https://github.com/matrix-org/matrix-doc/pull/3401). Group calls have [no authentication](https://github.com/vector-im/element-web/issues/13074) currently, meaning that non room participants can also join the calls. We recommend that you do not use this feature for private meetings.
 
-When using [element-web](https://github.com/vector-im/element-web), you must trust the server hosting the Element client. If your [threat model](/threat-modeling) requires stronger protection, then use a desktop or mobile client instead.
+When using [element-web](https://github.com/vector-im/element-web), you must trust the server hosting the Element client. If your [threat model](threat-modeling.md) requires stronger protection, then use a desktop or mobile client instead.
 
 The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last) in 2016. The specification for the Matrix protocol can be found in their [documentation](https://spec.matrix.org/latest/). The [Olm](https://matrix.org/docs/projects/other/olm) cryptographic ratchet used by Matrix is an implementation of Signal’s [Double Ratchet algorithm](https://signal.org/docs/specifications/doubleratchet/).
 
@@ -65,7 +65,7 @@ The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matr
 
 !!! recommendation
 
-    ![Briar logo](/assets/img/messengers/briar.svg){ align=right }
+    ![Briar logo](assets/img/messengers/briar.svg){ align=right }
 
     **Briar** is an encrypted instant messenger that [connects](https://briarproject.org/how-it-works/) to other clients using the Tor Network. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar’s local mesh mode can be useful when internet availability is a problem.
 
@@ -88,7 +88,7 @@ Briar supports perfect forward secrecy by using the Bramble [Handshake](https://
 
 !!! recommendation
 
-    ![Session logo](/assets/img/messengers/session.svg){ align=right }
+    ![Session logo](assets/img/messengers/session.svg){ align=right }
 
     **Session** is an encrypted instant messenger that uses three random [service nodes](https://getsession.org/blog/onion-requests-session-new-message-routing-solution) to route messages anonymously on the [Oxen Network](https://oxen.io).
 
@@ -116,7 +116,7 @@ There are several network architectures commonly used to relay messages between
 
 ### Centralized Networks
 
-![Centralized networks diagram](/assets/img/layout/network-centralized.svg){ align=left }
+![Centralized networks diagram](assets/img/layout/network-centralized.svg){ align=left }
 
 Centralized messengers are those where all participants are on the same server or network of servers controlled by the same organization.
 
@@ -139,7 +139,7 @@ Some self-hosted messengers allow you to set up your own server. Self-hosting ca
 
 ### Federated Networks
 
-![Federated networks diagram](/assets/img/layout/network-decentralized.svg){ align=left }
+![Federated networks diagram](assets/img/layout/network-decentralized.svg){ align=left }
 
 Federated messengers use multiple, independent, decentralized servers that are able to talk to each other (email is one example of a federated service). Federation allows system administrators to control their own server and still be a part of the larger communications network.
 
@@ -162,7 +162,7 @@ When self-hosted, users of a federated server can discover and communicate with
 
 ### Peer-to-Peer (P2P) Networks
 
-![P2P diagram](/assets/img/layout/network-distributed.svg){ align=left }
+![P2P diagram](assets/img/layout/network-distributed.svg){ align=left }
 
 [P2P](https://en.wikipedia.org/wiki/Peer-to-peer) messengers connect to a [distributed network](https://en.wikipedia.org/wiki/Distributed_networking) of nodes to relay a message to the recepient without a third-party server.
 
@@ -183,11 +183,11 @@ P2P networks do not use servers, as users communicate directly between each othe
 - Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online.
 - Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network to learn about who is online.
 - Some common messenger features may not be implemented or incompletely, such as message deletion.
-- Your [IP address](https://en.wikipedia.org/wiki/IP_address) and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a [VPN](/vpn) or [self contained network](/self-contained-networks), such as [Tor](https://www.torproject.org) or [I2P](https://geti2p.net/). Many countries have some form of mass surveillance and/or metadata retention.
+- Your [IP address](https://en.wikipedia.org/wiki/IP_address) and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a [VPN](vpn.md) or [self contained network](self-contained-networks.md), such as [Tor](https://www.torproject.org) or [I2P](https://geti2p.net/). Many countries have some form of mass surveillance and/or metadata retention.
 
 ### Anonymous Routing
 
-![Anonymous routing diagram](/assets/img/layout/network-anonymous-routing.svg){ align=left }
+![Anonymous routing diagram](assets/img/layout/network-anonymous-routing.svg){ align=left }
 
 A messenger using [anonymous routing](https://doi.org/10.1007/978-1-4419-5906-5_628) hides either the identity of the sender, the receiver, or evidence that they have been communicating. Ideally, a messenger should hide all three.
 

docs/router.en.md

@@ -11,8 +11,8 @@ Below are a few alternative operating systems, that can be used on routers, Wi-F
 
 !!! recommendation
 
-    ![OpenWrt logo](/assets/img/router/openwrt.svg#only-light){ align=right }
-    ![OpenWrt logo](/assets/img/router/openwrt-dark.svg#only-dark){ align=right }
+    ![OpenWrt logo](assets/img/router/openwrt.svg#only-light){ align=right }
+    ![OpenWrt logo](assets/img/router/openwrt-dark.svg#only-dark){ align=right }
 
     **OpenWrt** is an operating system (in particular, an embedded operating system) based on the Linux kernel, primarily used on embedded devices to route network traffic. The main components are the Linux kernel, util-linux, uClibc, and BusyBox. All components have been optimized for size, to be small enough for fitting into the limited storage and memory available in home routers.
 
@@ -25,8 +25,8 @@ Below are a few alternative operating systems, that can be used on routers, Wi-F
 
 !!! recommendation
 
-    ![pfSense logo](/assets/img/router/pfsense.svg#only-light){ align=right }
-    ![pfSense logo](/assets/img/router/pfsense-dark.svg#only-dark){ align=right }
+    ![pfSense logo](assets/img/router/pfsense.svg#only-light){ align=right }
+    ![pfSense logo](assets/img/router/pfsense-dark.svg#only-dark){ align=right }
 
     pfSense is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a computer to make a dedicated firewall/router for a network and is noted for its reliability and offering features often only found in expensive commercial firewalls. pfSense is commonly deployed as a perimeter firewall, router, wireless access point, DHCP server, DNS server, and VPN endpoint.
 

docs/search-engines.en.md

@@ -6,13 +6,13 @@ Use a search engine that doesn't build an advertising profile based on your sear
 
 The recommendations here are based on the merits of each service's privacy policy. There is **no guarantee** that these privacy policies are honored.
 
-Consider using a [VPN](/vpn) or [Tor](https://www.torproject.org/) if your threat model requires hiding your IP address from the search provider.
+Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org/) if your threat model requires hiding your IP address from the search provider.
 
 ### DuckDuckGo
 
 !!! recommendation
 
-    ![DuckDuckGo logo](/assets/img/search-engines/duckduckgo.svg){ align=right }
+    ![DuckDuckGo logo](assets/img/search-engines/duckduckgo.svg){ align=right }
 
     **DuckDuckGo** is a popular search engine and is the default for the Tor Browser.
 
@@ -30,9 +30,9 @@ DuckDuckGo has a [lite](https://duckduckgo.com/lite) and [html](https://duckduck
 
 !!! recommendation
 
-    ![Startpage logo](/assets/img/search-engines/startpage.svg){ align=right }
+    ![Startpage logo](assets/img/search-engines/startpage.svg){ align=right }
 
-    **Startpage** is a search engine that provides Google search results. It is a very convenient way to get Google search results without experiencing dark patterns such as difficult captchas or being refused access because you used a [VPN](/vpn) or [Tor](https://www.torproject.org/download/).
+    **Startpage** is a search engine that provides Google search results. It is a very convenient way to get Google search results without experiencing dark patterns such as difficult captchas or being refused access because you used a [VPN](vpn.md) or [Tor](https://www.torproject.org/download/).
 
     [Visit startpage.com](https://www.startpage.com){ .md-button .md-button--primary } [Privacy Policy](https://www.startpage.com/en/privacy-policy){ .md-button }
 
@@ -46,7 +46,7 @@ Startpage's majority shareholder is System1 who is an adtech company. We don't t
 
 !!! recommendation
 
-    ![Mojeek logo](/assets/img/search-engines/mojeek.svg){ align=right }
+    ![Mojeek logo](assets/img/search-engines/mojeek.svg){ align=right }
 
     **Mojeek** is another privacy friendly search engine. They use their own crawler to provide search data.
 
@@ -60,11 +60,11 @@ Startpage's majority shareholder is System1 who is an adtech company. We don't t
 
 !!! recommendation
 
-    ![Searx logo](/assets/img/search-engines/searx.svg){ align=right }
+    ![Searx logo](assets/img/search-engines/searx.svg){ align=right }
 
     **Searx** is an open-source, self-hostable, metasearch engine, aggregating the results of other search engines while not storing information about its users. There is a [list of public instances](https://searx.space/).
 
-    [Visit searx.me](https://searx.me){ .md-button .md-button--primary } [:pg-tor:](http://searxspbitokayvkhzhsnljde7rqmn7rvoga6e4waeub3h7ug3nghoad.onion){ .md-button }
+    [Visit searx.github.io](https://searx.github.io/searx){ .md-button .md-button--primary } [:pg-tor:](http://searxspbitokayvkhzhsnljde7rqmn7rvoga6e4waeub3h7ug3nghoad.onion){ .md-button }
 
     **Downloads**
     - [:fontawesome-brands-github: Source](https://github.com/asciimoo/searx)

docs/security/multi-factor-authentication.en.md

@@ -2,67 +2,77 @@
 title: "Multi-factor Authentication"
 icon: 'material/two-factor-authentication'
 ---
-**Multi-factor authentication** (MFA, or 2FA) is a security mechanism that requires additional steps beyond entering your username (or email) and password. The most common method are time limited codes you might receive from an SMS or app.
+**Multi-factor authentication** (MFA, or 2FA) is a security mechanism that requires additional steps beyond entering your username (or email) and password. The most common method is time limited codes you might receive from an SMS or app.
 
-The idea behind MFA is that even if a hacker (or adversary) is able to figure out your password (something you *know*), they will still need a device you own like your phone (something you *have*) in order to generate the code needed to log in to your account. MFA methods vary in security based on this premise: The more difficult it is for an attacker to gain access to your MFA method, the better. Examples of MFA methods (from weakest to strongest) include [SMS codes](https://en.wikipedia.org/wiki/One-time_password#SMS), email codes, app push notifications, [Time-based One-time Passwords (TOTP)](https://en.wikipedia.org/wiki/Time-based_one-time_password), Yubico OTP, and [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) / [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor).
+Normally, if a hacker (or adversary) is able to figure out your password then they’d gain access to the account that password belongs to. An account with MFA forces the hacker to have both the password (something you *know*) and a device that you own (something you *have*), like your phone.
+
+MFA methods vary in security, but are based on the premise that the more difficult it is for an attacker to gain access to your MFA method, the better. Examples of MFA methods (from weakest to strongest) include [SMS, Email codes](#sms-or-email-mfa), app push notifications, [Time-based One-time Passwords (TOTP)](#time-based-one-time-password-totp), [Yubico OTP](#yubico-otp), and [FIDO (Fast IDentity Online)](#fido-fast-identity-online).
 
 ## MFA Method Comparison
 
 ### SMS or Email MFA
 
-Receiving codes either from **SMS** or **email** are one of the weaker ways to secure your accounts with MFA. Obtaining a code by email or SMS takes away from the "something you *have*" idea, because there are a variety of ways a hacker could [take over your phone number](https://en.wikipedia.org/wiki/SIM_swap_scam) or gain access to your email without having physical access to any of your devices at all. If an unauthorized person gained access to your email, they would be able to use that access to both reset your password and receive the authentication code, giving them full access to your account.
+Receiving codes either from [**SMS**](https://en.wikipedia.org/wiki/One-time_password#SMS) or **email** are one of the weaker ways to secure your accounts with MFA. Obtaining a code by email or SMS takes away from the "something you *have*" idea, because there are a variety of ways a hacker could [take over your phone number](https://en.wikipedia.org/wiki/SIM_swap_scam) or gain access to your email without having physical access to any of your devices at all. If an unauthorized person gained access to your email, they would be able to use that access to both reset your password and receive the authentication code, giving them full access to your account.
 
 ### Push Notifications
 
-**Push Notifications** take the form of a message being sent to an app on your phone asking you to confirm new account logins. This method is a lot better than SMS or email, since an attacker typically wouldn't be able to get these push notifications without having an already logged-in device, which means they would need to compromise one of your other devices first.
+**Push notifications** take the form of a message being sent to an app on your phone asking you to confirm new account logins. This method is a lot better than SMS or email, since an attacker typically wouldn't be able to get these push notifications without having an already logged-in device, which means they would need to compromise one of your other devices first.
 
 We all make mistakes, and there is the risk that a user may accept the login attempt by accident. Push notification login authorizations are typically sent to *all* your devices at once, widening the availability of the MFA code if you have many devices.
 
-The security of push notification MFA is dependent on both the quality of the app, the server component and the trust of the developer who produces it. Installing an app may also require you to accept invasive privileges that grant access to other data on your device. An individual app also requires that you have a specific app for each service which may not require a password to open unlike a good [Time-based One-time Password (TOTP)](#time-based-one-time-password-totp) app.
+The security of push notification MFA is dependent on both the quality of the app, the server component and the trust of the developer who produces it. Installing an app may also require you to accept invasive privileges that grant access to other data on your device. An individual app also requires that you have a specific app for each service which may not require a password to open, unlike a good [Time-based One-time Password (TOTP)](#time-based-one-time-password-totp) app.
 
 ### Time-based One-time Password (TOTP)
 
-**TOTP** is one of the most commons form of MFA available. When a user sets up TOTP they are generally required to scan a [QR Code](https://en.wikipedia.org/wiki/QR_code) which establishes a "shared secret" with the service that they intend to use. The shared secret is secured inside of the authenticator app's data, and is sometimes protected by a password.
+**TOTP** is one of the most commons form of MFA available. When a user sets up TOTP they are generally required to scan a [QR Code](https://en.wikipedia.org/wiki/QR_code) which establishes a "[shared secret](https://en.wikipedia.org/wiki/Shared_secret)" with the service that they intend to use. The shared secret is secured inside of the authenticator app's data, and is sometimes protected by a password.
 
 The time-limited code is then derived from the shared secret and the current time. As the code is only valid for a short time, without access to the shared secret an adversary cannot generate new codes.
 
-If you have a hardware security key with TOTP support (such as a YubiKey with [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/)), we recommend that you store your "shared secrets" on the hardware. Hardware such as the YubiKey was developed with making the "shared secret" difficult to extract and copy. A YubiKey is also not connected to the Internet, unlike a phone with a TOTP app.
+If you have a hardware security key with TOTP support (such as a YubiKey with [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/)), we recommend that you store your "shared secrets" on the hardware. Hardware such as the YubiKey was developed with the intention of making the "shared secret" difficult to extract and copy. A YubiKey is also not connected to the Internet, unlike a phone with a TOTP app.
 
-Unlike [FIDO2 / U2F](#fido2-u2f), TOTP offers no protection against [phishing](https://en.wikipedia.org/wiki/Phishing) or reuse attacks. If an adversary obtains a valid code from you they may use it as many times as they like until it expires (generally 60 seconds).
+Unlike [WebAuthn](#fido-fast-identity-online), TOTP offers no protection against [phishing](https://en.wikipedia.org/wiki/Phishing) or reuse attacks. If an adversary obtains a valid code from you they may use it as many times as they like until it expires (generally 60 seconds).
 
 An adversary could set up a website to imitate an official service in an attempt to trick you into giving out your username, password and current TOTP code. If the adversary then uses those recorded credentials they may be able to log into the real service and hijack the account.
 
-Although not perfect it is secure enough for most people, and when [Hardware Security Keys](#hardware-security-keys) are not supported TOTP with [Authenticator Apps](#authenticator-apps) are still a good option.
+Although not perfect, TOTP is secure enough for most people, and when [hardware security keys](/multi-factor-authentication/#hardware-security-keys) are not supported [authenticator apps](/multi-factor-authentication/#authenticator-apps) are still a good option.
 
 ### Hardware security keys
 
 The YubiKey stores data on a tamper-resistant solid-state chip which is [impossible to access](https://security.stackexchange.com/a/245772) non-destructively without a expensive processes and a forensics laboratory.
 
-As these keys are generally multi-function and provide a number of methods to authenticate we discuss below the most common ones.
+These keys are generally multi-function and provide a number of methods to authenticate. Below are the most common ones.
 
 #### Yubico OTP
 
 Yubico OTP is an authentication protocol typically implemented in hardware security keys. When a user decides to use Yubico OTP, the key will generate a public ID, private ID, and a Secret Key which is then uploaded to the Yubico OTP server.
 
-When logging into a website all a user needs to do is to physically touch the security key. The security key will emulate a keyboard and print out a one-time password into the password field.
+When logging into a website, all a user needs to do is to physically touch the security key. The security key will emulate a keyboard and print out a one-time password into the password field.
 
-The service will then forward the one-time password to the Yubico OTP server for validation. A counter is incremented both on the key and Yubico's validation server. The OTP can only only be used once and when a successful authentication occurs the counter is increased which prevents reuse of the OTP. Yubico does provide a [detailed document](https://developers.yubico.com/OTP/OTPs_Explained.html) about the process.
+The service will then forward the one-time password to the Yubico OTP server for validation. A counter is incremented both on the key and Yubico's validation server. The OTP can only only be used once, and when a successful authentication occurs the counter is increased which prevents reuse of the OTP. Yubico provides a [detailed document](https://developers.yubico.com/OTP/OTPs_Explained.html) about the process.
 
 <figure markdown>
-  ![Yubico OTP](/assets/img/multi-factor-authentication/yubico-otp.png)
+  ![Yubico OTP](../assets/img/multi-factor-authentication/yubico-otp.png)
 </figure>
 
 There are some benefits and disadvantages to using Yubico OTP when compared to [TOTP](#time-based-one-time-password-totp).
 
-The Yubico validation server is a cloud based service, and users do place trust in Yubico that they are storing data securely and not profiling users. The public ID associated with Yubico OTP is reused on every website and could be another avenue for third parties to profile the user. Like [TOTP](#time-based-one-time-password-totp), Yubico OTP does not provide phishing resistance.
+The Yubico validation server is a cloud based service, and users place trust in Yubico that they are storing data securely and not profiling users. The public ID associated with Yubico OTP is reused on every website and could be another avenue for third parties to profile the user. Like [TOTP](#time-based-one-time-password-totp), Yubico OTP does not provide phishing resistance.
 
 If your threat model requires you to have different identities on different websites, **do not** use Yubico OTP with the same hardware security key across those websites as public ID is unique to each security key.
 
-#### FIDO2 / U2F
+#### FIDO (Fast IDentity Online)
 
-[FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) / [**U2F**](https://en.wikipedia.org/wiki/Universal_2nd_Factor) is the most secure and private form of second factor authentication. While the user experience is similar to Yubico OTP, the key does not print out a one-time password and validate with a third party server. Instead FIDO2 (and U2F) use [public key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) for authentication.
+[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) with the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
 
-When a user creates an account the public key is sent to the service. When the user logs in the service will require the user to "sign" some data with their private key. The benefit of this is that no password data is ever stored by the service, so there is nothing for an adversary to steal.
+U2F and FIDO2 refer to the [CTAP (Client to Authenticator Protocol)](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the "Relying Party", the website, you're trying to log in on.
+
+WebAuthn is the most secure and private form of second factor authentication. While the user experience is similar to Yubico OTP, the key does not print out a one-time password and validate with a third party server. Instead it uses [public key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) for authentication.
+
+<figure markdown>
+  ![FIDO](../assets/img/multi-factor-authentication/fido.png)
+</figure>
+
+When a user creates an account the public key is sent to the service, then when the user logs in, the service will require the user to "sign" some data with their private key. The benefit of this is that no password data is ever stored by the service, so there is nothing for an adversary to steal.
 
 This presentation discusses the history of password authentication, the pitfalls (such as password reuse), and discussion of FIDO2 and [WebAuthn](https://webauthn.guide) standards.
 
@@ -74,43 +84,43 @@ This presentation discusses the history of password authentication, the pitfalls
   allowfullscreen>
 </iframe>
 
-FIDO2 / U2F has superior security and privacy properties when compared to any MFA methods.
+FIDO2 and WebAuthn have superior security and privacy properties when compared to any MFA methods.
 
-Typically for web services it is used with [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) which is a part of the [W3C recommendations](https://en.wikipedia.org/wiki/World_Wide_Web_Consortium#W3C_recommendation_(REC)). It uses public key authentication and is more secure than shared secrets used in Yubico OTP and TOTP methods, as it includes the origin name (usually, the domain name) during authentication. Attestation is provided to protect the user from phishing as it helps them to determine that they are using the authentic service and not a fake copy.
+Typically for web services it is used with WebAuthn which is a part of the [W3C recommendations](https://en.wikipedia.org/wiki/World_Wide_Web_Consortium#W3C_recommendation_(REC)). It uses public key authentication and is more secure than shared secrets used in Yubico OTP and TOTP methods, as it includes the origin name (usually, the domain name) during authentication. Attestation is provided to protect the user from phishing, as it helps them to determine that they are using the authentic service and not a fake copy.
 
-WebAuthn does not use any public ID, so the key is **not** identifiable across different websites like Yubico OTP. It also does not use any third party cloud server for authentication. All communication is completed between the key and the website the user is logging into. FIDO2 / U2F also uses a counter which is incremented upon use in order to prevent session reuse.
+Unlike Yubico OTP, WebAuthn does not use any public ID, so the key is **not** identifiable across different websites. It also does not use any third party cloud server for authentication. All communication is completed between the key and the website the user is logging into. FIDO also uses a counter which is incremented upon use in order to prevent session reuse and cloned keys.
 
-If a website or service supports FIDO2 / U2F for the authentication, it is highly recommended that you use it over any other form of MFA.
+If a website or service supports WebAuthn for the authentication, it is highly recommended that you use it over any other form of MFA.
 
 ## General Recommendations
 
 We have these general recommendations:
 
-### Which method to use?
+### Which method should I use?
 
-When configuring your MFA method, keep in mind that it is only as secure as your weakest authentication method you use. This means it is important that you only use the best MFA method available. For instance, if you are already using TOTP, you should disable email and SMS MFA. If you are already using FIDO2 / U2F, you should not be using Yubico OTP or TOTP on your account.
+When configuring your MFA method, keep in mind that it is only as secure as your weakest authentication method you use. This means it is important that you only use the best MFA method available. For instance, if you are already using TOTP, you should disable email and SMS MFA. If you are already using FIDO2/WebAuthn, you should not be using Yubico OTP or TOTP on your account.
 
 ### Backups
 
 You should always have backups for your MFA method. Hardware security keys can get lost, stolen, or simply stop working over time. It is recommended that you have a pair of hardware security keys with the same access to your accounts instead of just one.
 
-When using TOTP with an authenticator app, be sure to back up your recovery keys, the app itself, or copy the "shared secrets" to another instance of the app on a different phone or into an encrypted container (e.g. [VeraCrypt](/encryption/#veracrypt)).
+When using TOTP with an authenticator app, be sure to back up your recovery keys or the app itself, or copy the "shared secrets" to another instance of the app on a different phone or to an encrypted container (e.g [VeraCrypt](../encryption.md#veracrypt)).
 
 ### Initial setup
 
-When buying a security key, it is important that you change the default credentials, setup password protection for the key, and enable touch confirmation if your key supports such feature. Products such as the [YubiKey](#yubikey) have multiple interfaces with seperate credentials for each one of them, so you should go over each interface and set up protection as well.
+When buying a security key, it is important that you change the default credentials, setup password protection for the key, and enable touch confirmation if your key supports it. Products such as the [YubiKey](#yubico-otp) have multiple interfaces with separate credentials for each one of them, so you should go over each interface and set up protection as well.
 
 ### Email and SMS
 
 If you have to use email for MFA, make sure that the email account itself is secured with a proper MFA method.
 
-If you use SMS MFA, use a carrier who will not switch your phone number to a new SIM card without account access or use a dedicated VOIP number from a provider with similar security to avoid a [SIM swap](https://en.wikipedia.org/wiki/SIM_swap_scam) attack.
+If you use SMS MFA, use a carrier who will not switch your phone number to a new SIM card without account access, or use a dedicated VoIP number from a provider with similar security to avoid a [SIM swap](https://en.wikipedia.org/wiki/SIM_swap_scam) attack.
 
 [MFA tools we recommend](../multi-factor-authentication.md){ .md-button }
 
 ## More places to setup MFA
 
-Beyond just securing your website logins, multi-factor authentication can be used to secure your local logins, ssh keys or even password databases as well.
+Beyond just securing your website logins, multi-factor authentication can be used to secure your local logins, SSH keys or even password databases as well.
 
 ### Windows
 
@@ -135,11 +145,11 @@ The command will prevent an adversary from bypassing MFA when the computer boots
 !!! warning
     If the [hostname](https://en.wikipedia.org/wiki/Hostname) of your system changes (such as due to DHCP), you would be unable to login. It is vital that you setup a proper hostname for your computer before following this guide.
 
-The `pam_u2f` module on Linux can provide two factor authentication for user login on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands such as "apt-get" and package names may however differ. This guide does **not** apply to Qubes OS.
+The `pam_u2f` module on Linux can provide two factor authentication for user login on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as "apt-get"—and package names may however differ. This guide does **not** apply to Qubes OS.
 
 ### Qubes OS
 
-Qubes OS has support for Challenge-Response authentication with YubiKeys. If you have a YubiKey with Challenge-Response authentication support, take a look at the Qubes OS' [YubiKey documentation](https://www.qubes-os.org/doc/yubikey/) if you want to set up MFA on Qubes OS.
+Qubes OS has support for Challenge-Response authentication with YubiKeys. If you have a YubiKey with Challenge-Response authentication support, take a look at the Qubes OS [YubiKey documentation](https://www.qubes-os.org/doc/yubikey/) if you want to set up MFA on Qubes OS.
 
 ### SSH
 
@@ -149,8 +159,8 @@ SSH MFA could be set up using multiple different authentication methods that are
 
 #### Time-based One-time Password (TOTP)
 
-SSH MFA can also be set up using TOTP and DigitalOcean has provided a tutorial [How To Set Up Multi-Factor Authentication for SSH on Ubuntu 20.04](https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04). Most things should be the same regardless of distribution, however the package manager commands such as "apt-get" and package names may differ.
+SSH MFA can also be set up using TOTP. DigitalOcean has provided a tutorial [How To Set Up Multi-Factor Authentication for SSH on Ubuntu 20.04](https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04). Most things should be the same regardless of distribution, however the package manager commands—such as "apt-get"—and package names may differ.
 
 ### KeePass (and KeePassXC)
 
-KeePass and KeePassXC databases can be secured using Challenge-Response or HOTP as a second factor authentication. Yubico has provided a documennt for KeePass [Using Your YubiKey with KeePass](https://support.yubico.com/hc/en-us/articles/360013779759-Using-Your-YubiKey-with-KeePass) and there is also one on the [KeePassXC](https://keepassxc.org/docs/#faq-yubikey-2fa) website.
+KeePass and KeePassXC databases can be secured using Challenge-Response or HOTP as a second factor authentication. Yubico has provided a document for KeePass [Using Your YubiKey with KeePass](https://support.yubico.com/hc/en-us/articles/360013779759-Using-Your-YubiKey-with-KeePass) and there is also one on the [KeePassXC](https://keepassxc.org/docs/#faq-yubikey-2fa) website.

docs/self-contained-networks.en.md

@@ -10,7 +10,7 @@ If you are currently browsing clearnet and want to access the dark web, this sec
 
 !!! recommendation
 
-    ![Tor logo](./assets/img/self-contained-networks/tor.svg){ align=right }
+    ![Tor logo](assets/img/self-contained-networks/tor.svg){ align=right }
 
     The Tor network is a group of volunteer-operated servers that allows people to improve their privacy and security on the Internet. Tor's users employ this network by connecting through a series of virtual tunnels rather than making a direct connection, thus allowing both organizations and individuals to share information over public networks without compromising their privacy. Tor is an effective censorship circumvention tool.
 
@@ -32,8 +32,8 @@ If you are currently browsing clearnet and want to access the dark web, this sec
 
 !!! recommendation
 
-    ![I2P logo](./assets/img/self-contained-networks/i2p.svg#only-light){ align=right }
-    ![I2P logo](./assets/img/self-contained-networks/i2p-dark.svg#only-dark){ align=right }
+    ![I2P logo](assets/img/self-contained-networks/i2p.svg#only-light){ align=right }
+    ![I2P logo](assets/img/self-contained-networks/i2p-dark.svg#only-dark){ align=right }
 
     The Invisible Internet Project (I2P) is a computer network layer that allows applications to send messages to each other pseudonymously and securely. Uses include anonymous Web surfing, chatting, blogging, and file transfers. The software that implements this layer is called an I2P router and a computer running I2P is called an I2P node. The software is free and open-source and is published under multiple licenses.
 
@@ -55,7 +55,7 @@ If you are currently browsing clearnet and want to access the dark web, this sec
 
 !!! recommendation
 
-    ![Freenet logo](./assets/img/self-contained-networks/freenet.svg){ align=right }
+    ![Freenet logo](assets/img/self-contained-networks/freenet.svg){ align=right }
 
     Freenet is a peer-to-peer platform for censorship-resistant communication. It uses a decentralized distributed data store to keep and deliver information, and has a suite of free software for publishing and communicating on the Web without fear of censorship. Both Freenet and some of its associated tools were originally designed by Ian Clarke, who defined Freenet's goal as providing freedom of speech on the Internet with strong anonymity protection.
 

docs/setup/integrating-metadata-removal.en.md

@@ -3,20 +3,20 @@ title: "Integrating Metadata Removal"
 icon: 'material/data-matrix-remove'
 ---
 
-When sharing files, it's important to remove associated metadata. Image files commonly include [EXIF](https://en.wikipedia.org/wiki/Exif) data, and sometimes photos even include GPS coordinates within its metadata.
+When sharing files, it's important to remove associated metadata. Image files commonly include [Exif](https://en.wikipedia.org/wiki/Exif) data, and sometimes photos even include GPS coordinates within its metadata.
 
 While there are plenty of metadata removal tools, they typically aren't convenient to use. The guides featured here aim to detail how to integrate metadata removal tools in a simple fashion by utilizing easy-to-access system features.
 
 !!! tip "Related"
-    For a list of the metadata removal tools that we recommend, visit our [metadata removal tools](/metadata-removal-tools/) page.
+    For a list of the metadata removal tools that we recommend, visit our [metadata removal tools](../metadata-removal-tools.md) page.
 
 ## macOS
 
-This guide uses the [Shortcuts](https://support.apple.com/guide/shortcuts-mac/intro-to-shortcuts-apdf22b0444c/mac) app to add an ExifTool script to the *Quick Actions* context menu within Finder. Shortcuts is developed by Apple and bundled in with macOS by default.
+This guide uses the [Shortcuts](https://support.apple.com/guide/shortcuts-mac/intro-to-shortcuts-apdf22b0444c/mac) app to add an [ExifTool](../metadata-removal-tools.md#exiftool) script to the *Quick Actions* context menu within Finder. Shortcuts is developed by Apple and bundled in with macOS by default.
 
 Shortcuts is quite intuitive to work with, so if you don't like the behavior demoed here then experiment with your own solution. For example, you could set the shortcut to take a clipboard input instead. The sky's the limit.
 
-![ExifTool Quick Action](/assets/img/integrating-metadata-removal/preview-macos.png)
+![ExifTool Quick Action](../assets/img/integrating-metadata-removal/preview-macos.png)
 
 ### Prerequisites
 
@@ -26,7 +26,7 @@ Shortcuts is quite intuitive to work with, so if you don't like the behavior dem
     /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
     ```
 
-2. [ExifTool](/metadata-removal-tools/#exiftool): a tool for viewing and manipulating image, audio, video, and PDF metadata.
+2. ExifTool is a tool for viewing and manipulating image, audio, video, and PDF metadata.
 
     ```bash
     brew install exiftool
@@ -63,7 +63,7 @@ Shortcuts is quite intuitive to work with, so if you don't like the behavior dem
     done
     ```
 
-![macOS metadata removal shortcut](/assets/img/integrating-metadata-removal/shortcut-macos.png)
+![macOS metadata removal shortcut](../assets/img/integrating-metadata-removal/shortcut-macos.png)
 
 !!! tip "Worth Mentioning"
     The open source [ImageOptim](https://imageoptim.com/mac) app integrates into Finder's *Services* context menu by default. While it is primarily an image optimization app, it also removes metadata.
@@ -80,11 +80,11 @@ Shortcuts is quite intuitive to work with, so if you don't like the behavior dem
 [Shortcuts](https://support.apple.com/guide/shortcuts/welcome/ios) can be made accessible through the system Share Sheet, making accessing those shortcuts very convenient. This guide will show you how to build a metadata removal shortcut and integrate it into the system *Share Sheet*.
 
 !!! attention
-    This method of metadata removal is not as comprehensive at removing metadata as utilities like [ExifTool](/metadata-removal-tools/#exiftool) and [mat2](/metadata-removal-tools/#mat2) are.
+    This method of metadata removal is not as comprehensive at removing metadata as utilities like [ExifTool](../metadata-removal-tools.md#exiftool) and [mat2](../metadata-removal-tools.md#mat2) are.
 
 The lack of *good* metadata removal apps on the App Store is what makes this solution worthwhile.
 
-![Don't preserve metadata shortcut](/assets/img/integrating-metadata-removal/preview-ios.png)
+![Don't preserve metadata shortcut](../assets/img/integrating-metadata-removal/preview-ios.png)
 
 ### Prerequisites
 
@@ -112,7 +112,7 @@ The lack of *good* metadata removal apps on the App Store is what makes this sol
 
 10. Make sure that you uncheck **preserve metadata**
 
-![iOS/iPadOS metadata removal shortcut](/assets/img/integrating-metadata-removal/shortcut-ios.png)
+![iOS/iPadOS metadata removal shortcut](../assets/img/integrating-metadata-removal/shortcut-ios.png)
 
 ### Enabling & using the Shortcut
 
@@ -121,13 +121,13 @@ The lack of *good* metadata removal apps on the App Store is what makes this sol
 
 ## Windows
 
-Windows allows users to place files in a **SendTo** folder which then appear in the *Send to* context menu. This guide will show you how to add an ExifTool batch script to this menu.
+Windows allows users to place files in a **SendTo** folder which then appear in the *Send to* context menu. This guide will show you how to add an [ExifTool](../metadata-removal-tools.md#exiftool) batch script to this menu.
 
-![Send to metadata removal shortcut](/assets/img/integrating-metadata-removal/preview-windows.jpg)
+![Send to metadata removal shortcut](../assets/img/integrating-metadata-removal/preview-windows.jpg)
 
 ### Prerequisites
 
-1. [ExifTool](/metadata-removal-tools/#exiftool): a tool for viewing and manipulating image, audio, video, and PDF metadata. We suggest you read the [Installation instructions](https://exiftool.org/install.html#Windows) on the official website.
+1. ExifTool is a tool for viewing and manipulating image, audio, video, and PDF metadata. We suggest you read the [Installation instructions](https://exiftool.org/install.html#Windows) on the official website.
 
 !!! note
     You can check if ExifTool is present in your [PATH](https://www.computerhope.com/issues/ch000549.htm) by running `exiftool -ver` in Command Prompt. You should see a version number.
@@ -160,4 +160,4 @@ Windows allows users to place files in a **SendTo** folder which then appear in
 
 ### Using the shortcut
 
-1. Right click a supported file and choose **ExifTool.bat** within the *Send to* context menu
+1. Right click a supported file and choose **ExifTool.bat** within the *Send to* context menu.

docs/technology/dns.en.md

@@ -52,7 +52,7 @@ Below, we discuss and provide a tutorial to prove what an outside observer may s
         tshark -r /tmp/dns.pcap
         ```
 
-If you run the Wireguard command above, the top pane shows the "[frames](https://en.wikipedia.org/wiki/Ethernet_frame)", and the bottom pane shows all the data about the selected frame. Enterprise filtering and monitoring solutions (such as those purchased by governments) can do the process automatically, without human interaction, and can aggregate those frames to produce statistical data useful to the network observer.
+If you run the Wireshark command above, the top pane shows the "[frames](https://en.wikipedia.org/wiki/Ethernet_frame)", and the bottom pane shows all the data about the selected frame. Enterprise filtering and monitoring solutions (such as those purchased by governments) can do the process automatically, without human interaction, and can aggregate those frames to produce statistical data useful to the network observer.
 
 | No. | Time     | Source    | Destination | Protocol | Length | Info                                                                   |
 |-----|----------|-----------|-------------|----------|--------|------------------------------------------------------------------------|
@@ -109,7 +109,7 @@ We can see the [connection establishment](https://en.wikipedia.org/wiki/Transmis
 
 ## Why **shouldn't** I use encrypted DNS?
 
-In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](/threat-modeling/). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](https://torproject.org) or a [VPN](/vpn) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity.
+In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](../threat-modeling.md). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](https://torproject.org) or a [VPN](vpn) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity.
 
 When we do a DNS lookup, it's generally because we want to access a resource. Below, we will discuss some of the methods that may disclose your browsing activities even when using encrypted DNS:
 
@@ -117,7 +117,7 @@ When we do a DNS lookup, it's generally because we want to access a resource. Be
 
 The simplest way to determine browsing activity might be to look at the IP addresses your devices are accessing. For example, if the observer knows that `privacyguides.org` is at `198.98.54.105`, and your device is requesting data from `198.98.54.105`, there is a good chance you're visiting Privacy Guides.
 
-This method is only useful when the IP address belongs to a server that only hosts few websites. It's also not very useful if the site is hosted on a shared platform, (e.g. Github Pages, Cloudflare Pages, Netlify, Wordpress, Blogger, etc). It also isn't very useful if the server is hosted behind a [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy), which is very common on the modern Internet.
+This method is only useful when the IP address belongs to a server that only hosts few websites. It's also not very useful if the site is hosted on a shared platform, (e.g. Github Pages, Cloudflare Pages, Netlify, WordPress, Blogger, etc). It also isn't very useful if the server is hosted behind a [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy), which is very common on the modern Internet.
 
 ### Server Name Indication (SNI)
 
@@ -281,7 +281,7 @@ Encrypted DNS with a 3rd party should only be used to get around redirects and b
 
 ## What is DNSSEC and when is it used?
 
-[Domain Name System Security Extensions (DNSSEC)](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) is used to provide authenticity to the records being fetched from upstream DNS servers. It doesn't provide confidentiality, for that we use one of the [encrypted DNS](/dns#what-is-encrypted-dns) protocols discussed above.
+[Domain Name System Security Extensions (DNSSEC)](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) is used to provide authenticity to the records being fetched from upstream DNS servers. It doesn't provide confidentiality, for that we use one of the [encrypted DNS](#what-is-encrypted-dns) protocols discussed above.
 
 ## What is QNAME minimization?
 

docs/threat-modeling.en.md

@@ -1,5 +1,5 @@
 ---
-title: "What are threat models?"
+title: "Threat Modeling"
 icon: 'material/target-account'
 ---
 

docs/tools.en.md

@@ -15,26 +15,26 @@ For your convenience, everything we recommend is listed below with a link to the
 
 <div class="grid cards" markdown>
 
-- ![Tor Browser logo](/assets/img/browsers/tor.svg){ .twemoji } [Tor Browser](https://www.torproject.org/)
-- ![Firefox logo](/assets/img/browsers/firefox.svg){ .twemoji } [Firefox (Desktop)](https://firefox.com/)
-- ![Bromite logo](/assets/img/browsers/bromite.svg){ .twemoji } [Bromite (Android)](https://www.bromite.org/)
-- ![Safari logo](/assets/img/browsers/safari.svg){ .twemoji } [Safari (iOS)](https://www.apple.com/safari/)
+- ![Tor Browser logo](assets/img/browsers/tor.svg){ .twemoji } [Tor Browser](https://www.torproject.org/)
+- ![Firefox logo](assets/img/browsers/firefox.svg){ .twemoji } [Firefox (Desktop)](https://firefox.com/)
+- ![Bromite logo](assets/img/browsers/bromite.svg){ .twemoji } [Bromite (Android)](https://www.bromite.org/)
+- ![Safari logo](assets/img/browsers/safari.svg){ .twemoji } [Safari (iOS)](https://www.apple.com/safari/)
 
 </div>
 
 **Additional Resources:**
 
-<div class="grid cards" markdown>
+<div class="grid cards annotate" markdown>
 
-- ![uBlock Origin logo](/assets/img/browsers/ublock_origin.svg){ .twemoji } [uBlock Origin](https://github.com/gorhill/uBlock)
-- ![AdGuard logo](/assets/img/browsers/adguard.svg){ .twemoji } [AdGuard for Safari](https://adguard.com/en/adguard-safari/overview.html)
-- ![ToS;DR logo](/assets/img/browsers/terms_of_service_didnt_read.svg){ .twemoji } [Terms of Service; Didn't Read\*](https://tosdr.org/)
+- ![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ .twemoji } [uBlock Origin](https://github.com/gorhill/uBlock)
+- ![AdGuard logo](assets/img/browsers/adguard.svg){ .twemoji } [AdGuard for Safari](https://adguard.com/en/adguard-safari/overview.html)
+- ![ToS;DR logo](assets/img/browsers/terms_of_service_didnt_read.svg){ .twemoji } [Terms of Service; Didn't Read](https://tosdr.org/) (1)
 
 </div>
 
-[Learn more...](browsers.md)
+1. We do not recommend installing ToS;DR as a browser extension. The same information is provided on their website.
 
-\* We do not recommend installing ToS;DR as a browser extension. The same information is provided on their website.
+[Learn more :material-arrow-right:](browsers.md)
 
 ## Operating Systems
 
@@ -42,9 +42,9 @@ For your convenience, everything we recommend is listed below with a link to the
 
 <div class="grid cards" markdown>
 
-- ![GrapheneOS logo](/assets/img/android/grapheneos.svg#only-light){ .twemoji }![GrapheneOS logo](/assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji } [GrapheneOS](https://grapheneos.org/)
-- ![CalyxOS logo](/assets/img/android/calyxos.svg){ .twemoji } [CalyxOS](https://calyxos.org/)
-- ![DivestOS logo](/assets/img/android/divestos.svg){ .twemoji } [DivestOS](https://divestos.org/)
+- ![GrapheneOS logo](assets/img/android/grapheneos.svg#only-light){ .twemoji }![GrapheneOS logo](assets/img/android/grapheneos-dark.svg#only-dark){ .twemoji } [GrapheneOS](https://grapheneos.org/)
+- ![CalyxOS logo](assets/img/android/calyxos.svg){ .twemoji } [CalyxOS](https://calyxos.org/)
+- ![DivestOS logo](assets/img/android/divestos.svg){ .twemoji } [DivestOS](https://divestos.org/)
 
 </div>
 
@@ -52,47 +52,47 @@ For your convenience, everything we recommend is listed below with a link to the
 
 <div class="grid cards" markdown>
 
-- ![Droid-ify logo](/assets/img/android/droid-ify.png){ .twemoji } [Droid-ify (F-Droid Client)](https://github.com/Iamlooker/Droid-ify)
-- ![Orbot logo](/assets/img/android/orbot.svg){ .twemoji } [Orbot (Tor Proxy)](https://orbot.app/)
-- ![Shelter logo](/assets/img/android/shelter.svg){ .twemoji } [Shelter (Work Profiles)](https://gitea.angry.im/PeterCxy/Shelter)
-- ![Auditor logo](/assets/img/android/auditor.svg#only-light){ .twemoji }![GrapheneOS logo](/assets/img/android/auditor-dark.svg#only-dark){ .twemoji } [Auditor (Supported Devices)](https://attestation.app/)
-- ![Secure Camera logo](/assets/img/android/secure_camera.svg#only-light){ .twemoji }![Secure Camera logo](/assets/img/android/secure_camera-dark.svg#only-dark){ .twemoji } [Secure Camera](https://github.com/GrapheneOS/Camera)
-- ![Secure PDF Viewer logo](/assets/img/android/secure_pdf_viewer.svg#only-light){ .twemoji }![GrapheneOS logo](/assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ .twemoji } [Secure PDF Viewer](https://github.com/GrapheneOS/PdfViewer)
-- ![PrivacyBlur logo](/assets/img/android/privacyblur.svg){ .twemoji } [PrivacyBlur](https://privacyblur.app/)
+- ![Droid-ify logo](assets/img/android/droid-ify.png){ .twemoji } [Droid-ify (F-Droid Client)](https://github.com/Iamlooker/Droid-ify)
+- ![Orbot logo](assets/img/android/orbot.svg){ .twemoji } [Orbot (Tor Proxy)](https://orbot.app/)
+- ![Shelter logo](assets/img/android/shelter.svg){ .twemoji } [Shelter (Work Profiles)](https://gitea.angry.im/PeterCxy/Shelter)
+- ![Auditor logo](assets/img/android/auditor.svg#only-light){ .twemoji }![GrapheneOS logo](assets/img/android/auditor-dark.svg#only-dark){ .twemoji } [Auditor (Supported Devices)](https://attestation.app/)
+- ![Secure Camera logo](assets/img/android/secure_camera.svg#only-light){ .twemoji }![Secure Camera logo](assets/img/android/secure_camera-dark.svg#only-dark){ .twemoji } [Secure Camera](https://github.com/GrapheneOS/Camera)
+- ![Secure PDF Viewer logo](assets/img/android/secure_pdf_viewer.svg#only-light){ .twemoji }![GrapheneOS logo](assets/img/android/secure_pdf_viewer-dark.svg#only-dark){ .twemoji } [Secure PDF Viewer](https://github.com/GrapheneOS/PdfViewer)
+- ![PrivacyBlur logo](assets/img/android/privacyblur.svg){ .twemoji } [PrivacyBlur](https://privacyblur.app/)
 
 </div>
 
-[Learn more...](android.md)
+[Learn more :material-arrow-right:](android.md)
 
 ### Linux
 
-<div class="grid cards" markdown>
+<div class="grid cards annotate" markdown>
 
-- ![Fedora logo](/assets/img/linux-desktop/fedora-workstation.svg){ .twemoji } [Fedora Workstation](https://getfedora.org/)
-- ![openSUSE Tumbleweed logo](/assets/img/linux-desktop/opensuse-tumbleweed.svg){ .twemoji } [OpenSUSE Tumbleweed](https://get.opensuse.org/tumbleweed/)
-- ![Arch logo](/assets/img/linux-desktop/archlinux.svg){ .twemoji } [Arch Linux](https://archlinux.org/)
-- ![Fedora Silverblue logo](/assets/img/linux-desktop/fedora-silverblue.svg){ .twemoji } [Fedora Silverblue & Kinoite](https://silverblue.fedoraproject.org/)
-- ![nixOS logo](/assets/img/linux-desktop/nixos.svg){ .twemoji } [NixOS](https://nixos.org/)
-- ![Whonix logo](/assets/img/linux-desktop/whonix.svg){ .twemoji } [Whonix (Tor)](https://www.whonix.org/)
-- ![Tails logo](/assets/img/linux-desktop/tails.svg){ .twemoji } [Tails (Live Boot)](https://tails.boum.org/)
-- ![Qubes OS logo](/assets/img/qubes/qubes_os.svg){ .twemoji } [Qubes OS (Xen VM Distribution)\*](https://www.qubes-os.org/)
+- ![Fedora logo](assets/img/linux-desktop/fedora-workstation.svg){ .twemoji } [Fedora Workstation](https://getfedora.org/)
+- ![openSUSE Tumbleweed logo](assets/img/linux-desktop/opensuse-tumbleweed.svg){ .twemoji } [OpenSUSE Tumbleweed](https://get.opensuse.org/tumbleweed/)
+- ![Arch logo](assets/img/linux-desktop/archlinux.svg){ .twemoji } [Arch Linux](https://archlinux.org/)
+- ![Fedora Silverblue logo](assets/img/linux-desktop/fedora-silverblue.svg){ .twemoji } [Fedora Silverblue & Kinoite](https://silverblue.fedoraproject.org/)
+- ![nixOS logo](assets/img/linux-desktop/nixos.svg){ .twemoji } [NixOS](https://nixos.org/)
+- ![Whonix logo](assets/img/linux-desktop/whonix.svg){ .twemoji } [Whonix (Tor)](https://www.whonix.org/)
+- ![Tails logo](assets/img/linux-desktop/tails.svg){ .twemoji } [Tails (Live Boot)](https://tails.boum.org/)
+- ![Qubes OS logo](assets/img/qubes/qubes_os.svg){ .twemoji } [Qubes OS (Xen VM Distribution)](https://www.qubes-os.org/) (1)
 
 </div>
 
-[Learn more...](linux-desktop.md)
+1. Qubes uses Xen to provide strong sandboxing between multiple Linux virtual machine installations, and can run most Linux applications. [Learn more about Qubes...](qubes.md)
 
-\* Qubes uses Xen to provide strong sandboxing between multiple Linux virtual machine installations, and can run most Linux applications. [Learn more about Qubes...](qubes.md)
+[Learn more :material-arrow-right:](linux-desktop.md)
 
 ### Router Firmware
 
 <div class="grid cards" markdown>
 
-- ![OpenWrt logo](/assets/img/router/openwrt.svg#only-light){ .twemoji }![OpenWrt logo](/assets/img/router/openwrt-dark.svg#only-dark){ .twemoji } [OpenWrt](https://openwrt.org/)
-- ![pfSense logo](/assets/img/router/pfsense.svg#only-light){ .twemoji }![pfSense logo](/assets/img/router/pfsense-dark.svg#only-dark){ .twemoji } [pfSense](https://www.pfsense.org/)
+- ![OpenWrt logo](assets/img/router/openwrt.svg#only-light){ .twemoji }![OpenWrt logo](assets/img/router/openwrt-dark.svg#only-dark){ .twemoji } [OpenWrt](https://openwrt.org/)
+- ![pfSense logo](assets/img/router/pfsense.svg#only-light){ .twemoji }![pfSense logo](assets/img/router/pfsense-dark.svg#only-dark){ .twemoji } [pfSense](https://www.pfsense.org/)
 
 </div>
 
-[Learn more...](router.md)
+[Learn more :material-arrow-right:](router.md)
 
 ## Service Providers
 
@@ -100,29 +100,32 @@ For your convenience, everything we recommend is listed below with a link to the
 
 <div class="grid cards" markdown>
 
-- ![Nextcloud logo](/assets/img/cloud/nextcloud.svg){ .twemoji } [Nextcloud (Self-Hostable)](https://nextcloud.com/)
-- ![Proton Drive logo](/assets/img/cloud/protondrive.svg){ .twemoji } [Proton Drive](https://drive.protonmail.com/)
-- ![Cryptee logo](/assets/img/cloud/cryptee.svg#only-light){ .twemoji }![Cryptee logo](/assets/img/cloud/cryptee-dark.svg#only-dark){ .twemoji } [Cryptee](https://crypt.ee/)
-- ![Tahoe-LAFS logo](/assets/img/cloud/tahoe-lafs.svg#only-light){ .twemoji }![Tahoe-LAFS logo](/assets/img/cloud/tahoe-lafs-dark.svg#only-dark){ .twemoji } [Tahoe-LAFS (Advanced)](https://www.tahoe-lafs.org/)
+- ![Nextcloud logo](assets/img/cloud/nextcloud.svg){ .twemoji } [Nextcloud (Self-Hostable)](https://nextcloud.com/)
+- ![Proton Drive logo](assets/img/cloud/protondrive.svg){ .twemoji } [Proton Drive](https://drive.protonmail.com/)
+- ![Cryptee logo](assets/img/cloud/cryptee.svg#only-light){ .twemoji }![Cryptee logo](assets/img/cloud/cryptee-dark.svg#only-dark){ .twemoji } [Cryptee](https://crypt.ee/)
+- ![Tahoe-LAFS logo](assets/img/cloud/tahoe-lafs.svg#only-light){ .twemoji }![Tahoe-LAFS logo](assets/img/cloud/tahoe-lafs-dark.svg#only-dark){ .twemoji } [Tahoe-LAFS (Advanced)](https://www.tahoe-lafs.org/)
 
 </div>
 
-[Learn more...](cloud.md)
+[Learn more :material-arrow-right:](cloud.md)
 
 ### DNS
 
-We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS servers based on a variety of criteria. Some no-logging choices include [MullvadDNS](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) and [Quad9](https://quad9.net/), but we recommend you read our full page on DNS before choosing a provider. In many cases using an alternative DNS provider is not recommended. [Learn more...](dns.md)
+We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers based on a variety of criteria, such as [MullvadDNS](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) and [Quad9](https://quad9.net/) amongst others. We recommend for you to read our pages on DNS before choosing a provider. In many cases, using an alternative DNS provider is not recommended.
+<br>
+<br>
+[Learn more :material-arrow-right:](dns.md)
 
 ### Email
 
 <div class="grid cards" markdown>
 
-- ![ProtonMail logo](/assets/img/email/mini/protonmail.svg){ .twemoji } [ProtonMail](https://protonmail.com/)
-- ![Mailbox.org logo](/assets/img/email/mini/mailboxorg.svg){ .twemoji } [Mailbox.org](https://mailbox.org/)
-- ![Disroot logo](/assets/img/email/mini/disroot.svg#only-light){ .twemoji }![Disroot logo](/assets/img/email/mini/disroot-dark.svg#only-dark){ .twemoji } [Disroot](https://disroot.org/)
-- ![Tutanota logo](/assets/img/email/mini/tutanota.svg){ .twemoji } [Tutanota](https://tutanota.com/)
-- ![StartMail logo](/assets/img/email/mini/startmail.svg#only-light){ .twemoji }![StartMail logo](/assets/img/email/mini/startmail-dark.svg#only-dark){ .twemoji } [StartMail](https://startmail.com/)
-- ![CTemplar logo](/assets/img/email/mini/ctemplar.svg#only-light){ .twemoji }![CTemplar logo](/assets/img/email/mini/ctemplar-dark.svg#only-dark){ .twemoji } [CTemplar](https://ctemplar.com/)
+- ![ProtonMail logo](assets/img/email/mini/protonmail.svg){ .twemoji } [ProtonMail](https://protonmail.com/)
+- ![Mailbox.org logo](assets/img/email/mini/mailboxorg.svg){ .twemoji } [Mailbox.org](https://mailbox.org/)
+- ![Disroot logo](assets/img/email/mini/disroot.svg#only-light){ .twemoji }![Disroot logo](assets/img/email/mini/disroot-dark.svg#only-dark){ .twemoji } [Disroot](https://disroot.org/)
+- ![Tutanota logo](assets/img/email/mini/tutanota.svg){ .twemoji } [Tutanota](https://tutanota.com/)
+- ![StartMail logo](assets/img/email/mini/startmail.svg#only-light){ .twemoji }![StartMail logo](assets/img/email/mini/startmail-dark.svg#only-dark){ .twemoji } [StartMail](https://startmail.com/)
+- ![CTemplar logo](assets/img/email/mini/ctemplar.svg#only-light){ .twemoji }![CTemplar logo](assets/img/email/mini/ctemplar-dark.svg#only-dark){ .twemoji } [CTemplar](https://ctemplar.com/)
 
 </div>
 
@@ -130,8 +133,8 @@ We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS
 
 <div class="grid cards" markdown>
 
-- ![AnonAddy logo](/assets/img/email/mini/anonaddy.svg#only-light){ .twemoji }![AnonAddy logo](/assets/img/email/mini/anonaddy-dark.svg#only-dark){ .twemoji } [AnonAddy](https://anonaddy.com/)
-- ![SimpleLogin logo](/assets/img/email/mini/simplelogin.svg){ .twemoji } [SimpleLogin](https://simplelogin.io/)
+- ![AnonAddy logo](assets/img/email/mini/anonaddy.svg#only-light){ .twemoji }![AnonAddy logo](assets/img/email/mini/anonaddy-dark.svg#only-dark){ .twemoji } [AnonAddy](https://anonaddy.com/)
+- ![SimpleLogin logo](assets/img/email/mini/simplelogin.svg){ .twemoji } [SimpleLogin](https://simplelogin.io/)
 
 </div>
 
@@ -139,25 +142,25 @@ We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS
 
 <div class="grid cards" markdown>
 
-- ![Mail-in-a-Box logo](/assets/img/email/mail-in-a-box.svg){ .twemoji } [Mail-in-a-Box](https://mailinabox.email/)
-- ![mailcow logo](/assets/img/email/mailcow.svg){ .twemoji } [mailcow](https://mailcow.email/)
+- ![Mail-in-a-Box logo](assets/img/email/mail-in-a-box.svg){ .twemoji } [Mail-in-a-Box](https://mailinabox.email/)
+- ![mailcow logo](assets/img/email/mailcow.svg){ .twemoji } [mailcow](https://mailcow.email/)
 
 </div>
 
-[Learn more...](email.md)
+[Learn more :material-arrow-right:](email.md)
 
 ### Search Engines
 
 <div class="grid cards" markdown>
 
-- ![DuckDuckGo logo](/assets/img/search-engines/duckduckgo.svg){ .twemoji } [DuckDuckGo](https://duckduckgo.com/)
-- ![Startpage logo](/assets/img/search-engines/startpage.svg){ .twemoji } [Startpage](https://www.startpage.com/)
-- ![Mojeek logo](/assets/img/search-engines//mini/mojeek.svg){ .twemoji } [Mojeek](https://www.mojeek.com/)
-- ![Searx logo](/assets/img/search-engines/searx.svg){ .twemoji } [Searx](https://searx.me/)
+- ![DuckDuckGo logo](assets/img/search-engines/duckduckgo.svg){ .twemoji } [DuckDuckGo](https://duckduckgo.com/)
+- ![Startpage logo](assets/img/search-engines/startpage.svg){ .twemoji } [Startpage](https://www.startpage.com/)
+- ![Mojeek logo](assets/img/search-engines//mini/mojeek.svg){ .twemoji } [Mojeek](https://www.mojeek.com/)
+- ![Searx logo](assets/img/search-engines/searx.svg){ .twemoji } [Searx](https://searx.me/)
 
 </div>
 
-[Learn more...](search-engines.md)
+[Learn more :material-arrow-right:](search-engines.md)
 
 ### VPN Providers
 
@@ -169,17 +172,17 @@ We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS
 
     If you're looking for added **security**, you should always ensure you're connecting to websites using [HTTPS](https://en.wikipedia.org/wiki/HTTPS). A VPN is not a replacement for good security practices.
 
-    [Learn more](vpn.md)
+    [Learn more :material-arrow-right:](vpn.md)
 
 <div class="grid cards" markdown>
 
-- ![Mullvad logo](/assets/img/vpn/mini/mullvad.svg){ .twemoji } [Mullvad](https://mullvad.net/)
-- ![ProtonVPN logo](/assets/img/vpn/mini/protonvpn.svg){ .twemoji } [ProtonVPN](https://protonvpn.com/)
-- ![IVPN logo](/assets/img/vpn/mini/ivpn.svg){ .twemoji } [IVPN](https://www.ivpn.net/)
+- ![Mullvad logo](assets/img/vpn/mini/mullvad.svg){ .twemoji } [Mullvad](https://mullvad.net/)
+- ![ProtonVPN logo](assets/img/vpn/mini/protonvpn.svg){ .twemoji } [ProtonVPN](https://protonvpn.com/)
+- ![IVPN logo](assets/img/vpn/mini/ivpn.svg){ .twemoji } [IVPN](https://www.ivpn.net/)
 
 </div>
 
-[Learn more...](vpn.md)
+[Learn more :material-arrow-right:](vpn.md)
 
 ## Software
 
@@ -187,44 +190,44 @@ We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS
 
 <div class="grid cards" markdown>
 
-- ![Tutanota logo](/assets/img/calendar-contacts/tutanota.svg){ .twemoji } [Tutanota (SaaS)](https://tutanota.com/calendar)
-- ![Proton Calendar logo](/assets/img/calendar-contacts/proton-calendar.svg){ .twemoji } [Proton Calendar (SaaS)](https://calendar.protonmail.com/)
-- ![EteSync logo](/assets/img/calendar-contacts/etesync.svg){ .twemoji } [EteSync](https://www.etesync.com/)
-- ![Tutanota logo](/assets/img/calendar-contacts/nextcloud.svg){ .twemoji } [Nextcloud](https://nextcloud.com/)
-- ![DecSync CC logo](/assets/img/calendar-contacts/decsync.svg){ .twemoji } [DecSync](https://github.com/39aldo39/DecSync)
+- ![Tutanota logo](assets/img/calendar-contacts/tutanota.svg){ .twemoji } [Tutanota (SaaS)](https://tutanota.com/calendar)
+- ![Proton Calendar logo](assets/img/calendar-contacts/proton-calendar.svg){ .twemoji } [Proton Calendar (SaaS)](https://calendar.protonmail.com/)
+- ![EteSync logo](assets/img/calendar-contacts/etesync.svg){ .twemoji } [EteSync](https://www.etesync.com/)
+- ![Tutanota logo](assets/img/calendar-contacts/nextcloud.svg){ .twemoji } [Nextcloud](https://nextcloud.com/)
+- ![DecSync CC logo](assets/img/calendar-contacts/decsync.svg){ .twemoji } [DecSync CC](https://github.com/39aldo39/DecSync)
 
 </div>
 
-[Learn more...](calendar-contacts.md)
+[Learn more :material-arrow-right:](calendar-contacts.md)
 
 ### Notebooks
 
 <div class="grid cards" markdown>
 
-- ![Joplin logo](/assets/img/notebooks/joplin.svg){ .twemoji } [Joplin](https://joplinapp.org/)
-- ![Standard Notes logo](/assets/img/notebooks/standard-notes.svg){ .twemoji } [Standard Notes](https://standardnotes.org/)
+- ![Joplin logo](assets/img/notebooks/joplin.svg){ .twemoji } [Joplin](https://joplinapp.org/)
+- ![Standard Notes logo](assets/img/notebooks/standard-notes.svg){ .twemoji } [Standard Notes](https://standardnotes.org/)
 
 </div>
 
-[Learn more...](notebooks.md)
+[Learn more :material-arrow-right:](notebooks.md)
 
 ### Email Clients
 
 <div class="grid cards" markdown>
 
-- ![Thunderbird logo](/assets/img/email-clients/thunderbird.svg){ .twemoji } [Thunderbird](https://www.thunderbird.net/)
-- ![Apple Mail logo](/assets/img/email-clients/applemail.png){ .twemoji } [Apple Mail](https://support.apple.com/guide/mail/welcome/mac)
-- ![GNOME Evolution logo](/assets/img/email-clients/evolution.svg){ .twemoji } [GNOME Evolution (Linux)](https://wiki.gnome.org/Apps/Evolution)
-- ![Kontact logo](/assets/img/email-clients/kontact.svg){ .twemoji } [Kontact (Linux)](https://kontact.kde.org/)
-- ![Mailvelope logo](/assets/img/email-clients/mailvelope.svg){ .twemoji } [Mailvelope (PGP in standard webmail)](https://www.mailvelope.com/)
-- ![K-9 Mail logo](/assets/img/email-clients/k9mail.svg){ .twemoji } [K-9 Mail (Android)](https://k9mail.app/)
-- ![FairEmail logo](/assets/img/email-clients/fairemail.svg){ .twemoji } [FairEmail (Android)](https://email.faircode.eu/)
-- ![Canary Mail logo](/assets/img/email-clients/canarymail.svg){ .twemoji } [Canary Mail (iOS)](https://canarymail.io/)
-- ![NeoMutt logo](/assets/img/email-clients/mutt.svg){ .twemoji } [NeoMutt (CLI)](https://neomutt.org/)
+- ![Thunderbird logo](assets/img/email-clients/thunderbird.svg){ .twemoji } [Thunderbird](https://www.thunderbird.net/)
+- ![Apple Mail logo](assets/img/email-clients/applemail.png){ .twemoji } [Apple Mail](https://support.apple.com/guide/mail/welcome/mac)
+- ![GNOME Evolution logo](assets/img/email-clients/evolution.svg){ .twemoji } [GNOME Evolution (Linux)](https://wiki.gnome.org/Apps/Evolution)
+- ![Kontact logo](assets/img/email-clients/kontact.svg){ .twemoji } [Kontact (Linux)](https://kontact.kde.org/)
+- ![Mailvelope logo](assets/img/email-clients/mailvelope.svg){ .twemoji } [Mailvelope (PGP in standard webmail)](https://www.mailvelope.com/)
+- ![K-9 Mail logo](assets/img/email-clients/k9mail.svg){ .twemoji } [K-9 Mail (Android)](https://k9mail.app/)
+- ![FairEmail logo](assets/img/email-clients/fairemail.svg){ .twemoji } [FairEmail (Android)](https://email.faircode.eu/)
+- ![Canary Mail logo](assets/img/email-clients/canarymail.svg){ .twemoji } [Canary Mail (iOS)](https://canarymail.io/)
+- ![NeoMutt logo](assets/img/email-clients/mutt.svg){ .twemoji } [NeoMutt (CLI)](https://neomutt.org/)
 
 </div>
 
-[Learn more...](email-clients.md)
+[Learn more :material-arrow-right:](email-clients.md)
 
 ### Encryption Tools
 
@@ -232,16 +235,16 @@ We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS
 
     For encrypting your operating system drive, we typically recommend using whichever encryption tool your operating system provides, whether that is **BitLocker** on Windows, **FileVault** on macOS, or **LUKS** on Linux. These tools are available out of the box and typically utilize hardware encryption elements such as a TPM that other full-disk encryption software like VeraCrypt will not. VeraCrypt is still suitable for non-operating system disks such as external drives, especially drives that may be accessed from multiple operating systems.
 
-    [Learn more](encryption.md##operating-system-included-full-disk-encryption-fde)
+    [Learn more :material-arrow-right:](encryption.md##operating-system-included-full-disk-encryption-fde)
 
 <div class="grid cards" markdown>
 
-- ![VeraCrypt logo](/assets/img/encryption-software/veracrypt.svg#only-light){ .twemoji }![VeraCrypt logo](/assets/img/encryption-software/veracrypt-dark.svg#only-dark){ .twemoji } [VeraCrypt (FDE)](https://veracrypt.fr/)
-- ![Cryptomator logo](/assets/img/encryption-software/cryptomator.svg){ .twemoji } [Cryptomator](https://cryptomator.org/)
-- ![Picocrypt logo](/assets/img/encryption-software/picocrypt.svg){ .twemoji } [Picocrypt](https://evansu.cc/picocrypt)
-- ![Hat.sh logo](/assets/img/encryption-software/hat-sh.png#only-light){ .twemoji }![Hat.sh logo](/assets/img/encryption-software/hat-sh-dark.png#only-dark){ .twemoji } [Hat.sh (Browser-based)](https://hat.sh/)
-- ![Kryptor logo](/assets/img/encryption-software/kryptor.png){ .twemoji } [Kryptor](https://www.kryptor.co.uk/)
-- ![Tomb logo](/assets/img/encryption-software/tomb.png){ .twemoji } [Tomb](https://www.dyne.org/software/tomb)
+- ![VeraCrypt logo](assets/img/encryption-software/veracrypt.svg#only-light){ .twemoji }![VeraCrypt logo](assets/img/encryption-software/veracrypt-dark.svg#only-dark){ .twemoji } [VeraCrypt (FDE)](https://veracrypt.fr/)
+- ![Cryptomator logo](assets/img/encryption-software/cryptomator.svg){ .twemoji } [Cryptomator](https://cryptomator.org/)
+- ![Picocrypt logo](assets/img/encryption-software/picocrypt.svg){ .twemoji } [Picocrypt](https://evansu.cc/picocrypt)
+- ![Hat.sh logo](assets/img/encryption-software/hat-sh.png#only-light){ .twemoji }![Hat.sh logo](assets/img/encryption-software/hat-sh-dark.png#only-dark){ .twemoji } [Hat.sh (Browser-based)](https://hat.sh/)
+- ![Kryptor logo](assets/img/encryption-software/kryptor.png){ .twemoji } [Kryptor](https://www.kryptor.co.uk/)
+- ![Tomb logo](assets/img/encryption-software/tomb.png){ .twemoji } [Tomb](https://www.dyne.org/software/tomb)
 
 </div>
 
@@ -249,116 +252,116 @@ We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS
 
 <div class="grid cards" markdown>
 
-- ![GnuPG logo](/assets/img/encryption-software/gnupg.svg){ .twemoji } [GnuPG](https://gnupg.org)
-- ![GPG4Win logo](/assets/img/encryption-software/gpg4win.svg){ .twemoji } [GPG4Win (Windows)](https://gpg4win.org)
-- ![GPG Suite logo](/assets/img/encryption-software/gpgsuite.png){ .twemoji } [GPG Suite (macOS)](https://gpgtools.org)
-- ![OpenKeychain logo](/assets/img/encryption-software/openkeychain.svg){ .twemoji } [OpenKeychain](https://www.openkeychain.org/)
+- ![GnuPG logo](assets/img/encryption-software/gnupg.svg){ .twemoji } [GnuPG](https://gnupg.org)
+- ![GPG4Win logo](assets/img/encryption-software/gpg4win.svg){ .twemoji } [GPG4Win (Windows)](https://gpg4win.org)
+- ![GPG Suite logo](assets/img/encryption-software/gpgsuite.png){ .twemoji } [GPG Suite (macOS)](https://gpgtools.org)
+- ![OpenKeychain logo](assets/img/encryption-software/openkeychain.svg){ .twemoji } [OpenKeychain](https://www.openkeychain.org/)
 
 </div>
 
-[Learn more...](encryption.md)
+[Learn more :material-arrow-right:](encryption.md)
 
 ### File Sharing
 
 <div class="grid cards" markdown>
 
-- ![OnionShare logo](/assets/img/file-sharing-sync/onionshare.svg){ .twemoji } [OnionShare](https://onionshare.org/)
-- ![Magic Wormhole logo](/assets/img/file-sharing-sync/magic_wormhole.png){ .twemoji } [Magic Wormhole](https://magic-wormhole.readthedocs.io/)
-- ![FreedomBox logo](/assets/img/file-sharing-sync/freedombox.svg){ .twemoji } [FreedomBox](https://freedombox.org/)
-- ![Syncthing logo](/assets/img/file-sharing-sync/syncthing.svg){ .twemoji } [Syncthing](https://syncthing.net/)
-- ![git-annex logo](/assets/img/file-sharing-sync/gitannex.svg){ .twemoji } [git-annex](https://git-annex.branchable.com/)
+- ![OnionShare logo](assets/img/file-sharing-sync/onionshare.svg){ .twemoji } [OnionShare](https://onionshare.org/)
+- ![Magic Wormhole logo](assets/img/file-sharing-sync/magic_wormhole.png){ .twemoji } [Magic Wormhole](https://magic-wormhole.readthedocs.io/)
+- ![FreedomBox logo](assets/img/file-sharing-sync/freedombox.svg){ .twemoji } [FreedomBox](https://freedombox.org/)
+- ![Syncthing logo](assets/img/file-sharing-sync/syncthing.svg){ .twemoji } [Syncthing](https://syncthing.net/)
+- ![git-annex logo](assets/img/file-sharing-sync/gitannex.svg){ .twemoji } [git-annex](https://git-annex.branchable.com/)
 
 </div>
 
-[Learn more...](file-sharing.md)
+[Learn more :material-arrow-right:](file-sharing.md)
 
 ### Metadata Removal Tools
 
 <div class="grid cards" markdown>
 
-- ![MAT2 logo](/assets/img/metadata-removal/mat2.svg){ .twemoji } [MAT2](https://0xacab.org/jvoisin/mat2)
-- ![ExifCleaner logo](/assets/img/metadata-removal/exifcleaner.svg){ .twemoji } [ExifCleaner](https://exifcleaner.com/)
-- ![Scrambled Exif logo](/assets/img/metadata-removal/scrambled-exif.svg){ .twemoji } [Scrambled Exif (Android)](https://gitlab.com/juanitobananas/scrambled-exif)
-- ![Imagepipe logo](/assets/img/metadata-removal/imagepipe.svg){ .twemoji } [Imagepipe (Android)](https://codeberg.org/Starfish/Imagepipe)
-- ![Metapho logo](/assets/img/metadata-removal/metapho.jpg){ .twemoji } [Metapho (iOS)](https://zininworks.com/metapho)
-- ![ExifTool logo](/assets/img/metadata-removal/exiftool.png){ .twemoji } [ExifTool (CLI)](https://exiftool.org/)
+- ![MAT2 logo](assets/img/metadata-removal/mat2.svg){ .twemoji } [MAT2](https://0xacab.org/jvoisin/mat2)
+- ![ExifCleaner logo](assets/img/metadata-removal/exifcleaner.svg){ .twemoji } [ExifCleaner](https://exifcleaner.com/)
+- ![Scrambled Exif logo](assets/img/metadata-removal/scrambled-exif.svg){ .twemoji } [Scrambled Exif (Android)](https://gitlab.com/juanitobananas/scrambled-exif)
+- ![Imagepipe logo](assets/img/metadata-removal/imagepipe.svg){ .twemoji } [Imagepipe (Android)](https://codeberg.org/Starfish/Imagepipe)
+- ![Metapho logo](assets/img/metadata-removal/metapho.jpg){ .twemoji } [Metapho (iOS)](https://zininworks.com/metapho)
+- ![ExifTool logo](assets/img/metadata-removal/exiftool.png){ .twemoji } [ExifTool (CLI)](https://exiftool.org/)
 
 </div>
 
-[Learn more...](metadata-removal-tools.md)
+[Learn more :material-arrow-right:](metadata-removal-tools.md)
 
 ### Multi-Factor Authentication Tools
 
 <div class="grid cards" markdown>
 
-- ![YubiKeys](/assets/img/multi-factor-authentication/yubikey.png){ .twemoji } [YubiKey](https://www.yubico.com/)
-- ![Nitrokey](/assets/img/multi-factor-authentication/nitrokey.jpg){ .twemoji } [Nitrokey](https://www.nitrokey.com/)
-- ![Aegis logo](/assets/img/multi-factor-authentication/aegis.png){ .twemoji } [Aegis Authenticator](https://getaegis.app/)
-- ![Raivo OTP logo](/assets/img/multi-factor-authentication/raivo-otp.png){ .twemoji } [Raivo OTP](https://github.com/raivo-otp/ios-application)
+- ![YubiKeys](assets/img/multi-factor-authentication/yubikey.png){ .twemoji } [YubiKey](https://www.yubico.com/)
+- ![Nitrokey](assets/img/multi-factor-authentication/nitrokey.jpg){ .twemoji } [Nitrokey](https://www.nitrokey.com/)
+- ![Aegis logo](assets/img/multi-factor-authentication/aegis.png){ .twemoji } [Aegis Authenticator](https://getaegis.app/)
+- ![Raivo OTP logo](assets/img/multi-factor-authentication/raivo-otp.png){ .twemoji } [Raivo OTP](https://github.com/raivo-otp/ios-application)
 
 </div>
 
-[Learn more...](multi-factor-authentication.md)
+[Learn more :material-arrow-right:](multi-factor-authentication.md)
 
 ### Password Managers
 
 <div class="grid cards" markdown>
 
-- ![KeePassXC logo](/assets/img/password-management/keepassxc.svg){ .twemoji } [KeePassXC](https://keepassxc.org/)
-- ![KeePassDX logo](/assets/img/password-management/keepassdx.svg){ .twemoji } [KeePassDX (Android)](https://www.keepassdx.com/)
-- ![Bitwarden logo](/assets/img/password-management/bitwarden.svg){ .twemoji } [Bitwarden](https://bitwarden.com/)
-- ![Psono logo](/assets/img/password-management/psono.svg){ .twemoji } [Psono](https://psono.com/)
-- ![gopass logo](/assets/img/password-management/gopass.svg){ .twemoji } [gopass](https://www.gopass.pw/)
-- ![Vaultwarden logo](/assets/img/password-management/vaultwarden.svg#only-light){ .twemoji }![Vaultwarden logo](/assets/img/password-management/vaultwarden-dark.svg#only-dark){ .twemoji } [Vaultwarden (Bitwarden Server)](https://github.com/dani-garcia/vaultwarden)
+- ![KeePassXC logo](assets/img/password-management/keepassxc.svg){ .twemoji } [KeePassXC](https://keepassxc.org/)
+- ![KeePassDX logo](assets/img/password-management/keepassdx.svg){ .twemoji } [KeePassDX (Android)](https://www.keepassdx.com/)
+- ![Bitwarden logo](assets/img/password-management/bitwarden.svg){ .twemoji } [Bitwarden](https://bitwarden.com/)
+- ![Psono logo](assets/img/password-management/psono.svg){ .twemoji } [Psono](https://psono.com/)
+- ![gopass logo](assets/img/password-management/gopass.svg){ .twemoji } [gopass](https://www.gopass.pw/)
+- ![Vaultwarden logo](assets/img/password-management/vaultwarden.svg#only-light){ .twemoji }![Vaultwarden logo](assets/img/password-management/vaultwarden-dark.svg#only-dark){ .twemoji } [Vaultwarden (Bitwarden Server)](https://github.com/dani-garcia/vaultwarden)
 
 </div>
 
-[Learn more...](passwords.md)
+[Learn more :material-arrow-right:](passwords.md)
 
 ### Productivity Tools
 
 <div class="grid cards" markdown>
 
-- ![LibreOffice logo](/assets/img/productivity/libreoffice.svg){ .twemoji } [LibreOffice](https://www.libreoffice.org/)
-- ![OnlyOffice logo](/assets/img/productivity/onlyoffice.svg){ .twemoji } [OnlyOffice](https://www.onlyoffice.com/)
-- ![Framadate logo](/assets/img/productivity/framadate.svg){ .twemoji } [Framadate (Appointment Planning)](https://framadate.org/)
-- ![PrivateBin logo](/assets/img/productivity/privatebin.svg){ .twemoji } [PrivateBin (Pastebin)](https://privatebin.info/)
-- ![CryptPad logo](/assets/img/productivity/cryptpad.svg){ .twemoji } [CryptPad](https://cryptpad.fr/)
-- ![Write.as logo](/assets/img/productivity/writeas.svg#only-light){ .twemoji }![Write.as logo](/assets/img/productivity/writeas-dark.svg#only-dark){ .twemoji } [Write.as (Blogging Platform)](https://write.as/)
-- ![VSCodium logo](/assets/img/productivity/vscodium.svg){ .twemoji } [VSCodium (Source-Code Editor)](https://vscodium.com/)
+- ![LibreOffice logo](assets/img/productivity/libreoffice.svg){ .twemoji } [LibreOffice](https://www.libreoffice.org/)
+- ![OnlyOffice logo](assets/img/productivity/onlyoffice.svg){ .twemoji } [OnlyOffice](https://www.onlyoffice.com/)
+- ![Framadate logo](assets/img/productivity/framadate.svg){ .twemoji } [Framadate (Appointment Planning)](https://framadate.org/)
+- ![PrivateBin logo](assets/img/productivity/privatebin.svg){ .twemoji } [PrivateBin (Pastebin)](https://privatebin.info/)
+- ![CryptPad logo](assets/img/productivity/cryptpad.svg){ .twemoji } [CryptPad](https://cryptpad.fr/)
+- ![Write.as logo](assets/img/productivity/writeas.svg#only-light){ .twemoji }![Write.as logo](assets/img/productivity/writeas-dark.svg#only-dark){ .twemoji } [Write.as (Blogging Platform)](https://write.as/)
+- ![VSCodium logo](assets/img/productivity/vscodium.svg){ .twemoji } [VSCodium (Source-Code Editor)](https://vscodium.com/)
 
 </div>
 
-[Learn more...](productivity.md)
+[Learn more :material-arrow-right:](productivity.md)
 
 ### Real-Time Communication
 
 <div class="grid cards" markdown>
 
-- ![Signal logo](/assets/img/messengers/signal.svg){ .twemoji } [Signal](https://signal.org/)
-- ![Element logo](/assets/img/messengers/element.svg){ .twemoji } [Element](https://element.io/)
-- ![Briar logo](/assets/img/messengers/briar.svg){ .twemoji } [Briar (Android)](https://briarproject.org/)
-- ![Session logo](/assets/img/messengers/session.svg){ .twemoji } [Session](https://getsession.org/)
+- ![Signal logo](assets/img/messengers/signal.svg){ .twemoji } [Signal](https://signal.org/)
+- ![Element logo](assets/img/messengers/element.svg){ .twemoji } [Element](https://element.io/)
+- ![Briar logo](assets/img/messengers/briar.svg){ .twemoji } [Briar (Android)](https://briarproject.org/)
+- ![Session logo](assets/img/messengers/session.svg){ .twemoji } [Session](https://getsession.org/)
 
 </div>
 
-[Learn more...](real-time-communication.md)
+[Learn more :material-arrow-right:](real-time-communication.md)
 
 ### News Aggregators
 
 <div class="grid cards" markdown>
 
-- ![Fluent Reader](/assets/img/news-aggregators/fluent-reader.svg){ .twemoji } [Fluent Reader](https://hyliu.me/fluent-reader)
-- ![GNOME Feeds](/assets/img/news-aggregators/gfeeds.svg){ .twemoji } [GNOME Feeds](https://gfeeds.gabmus.org)
-- ![Akregator](/assets/img/news-aggregators/akregator.svg){ .twemoji } [Akregator](https://apps.kde.org/akregator)
-- ![Handy News Reader](/assets/img/news-aggregators/handy-news-reader.svg){ .twemoji } [Handy News Reader](https://github.com/yanus171/Handy-News-Reader)
-- ![NetNewsWire](/assets/img/news-aggregators/netnewswire.png){ .twemoji } [NetNewsWire](https://netnewswire.com)
-- ![Miniflux](/assets/img/news-aggregators/miniflux.svg#only-light){ .twemoji }![Miniflux logo](/assets/img/news-aggregators/miniflux-dark.svg#only-dark){ .twemoji } [Miniflux](https://miniflux.app)
-- ![Newsboat](/assets/img/news-aggregators/newsboat.svg){ .twemoji } [Newsboat](https://newsboat.org/)
+- ![Fluent Reader](assets/img/news-aggregators/fluent-reader.svg){ .twemoji } [Fluent Reader](https://hyliu.me/fluent-reader)
+- ![GNOME Feeds](assets/img/news-aggregators/gfeeds.svg){ .twemoji } [GNOME Feeds](https://gfeeds.gabmus.org)
+- ![Akregator](assets/img/news-aggregators/akregator.svg){ .twemoji } [Akregator](https://apps.kde.org/akregator)
+- ![Handy News Reader](assets/img/news-aggregators/handy-news-reader.svg){ .twemoji } [Handy News Reader](https://github.com/yanus171/Handy-News-Reader)
+- ![NetNewsWire](assets/img/news-aggregators/netnewswire.png){ .twemoji } [NetNewsWire](https://netnewswire.com)
+- ![Miniflux](assets/img/news-aggregators/miniflux.svg#only-light){ .twemoji }![Miniflux logo](assets/img/news-aggregators/miniflux-dark.svg#only-dark){ .twemoji } [Miniflux](https://miniflux.app)
+- ![Newsboat](assets/img/news-aggregators/newsboat.svg){ .twemoji } [Newsboat](https://newsboat.org/)
 
 </div>
 
-[Learn more...](news-aggregators.md)
+[Learn more :material-arrow-right:](news-aggregators.md)
 
 ### Self-Contained Networks
 
@@ -370,19 +373,19 @@ We [recommend](dns.md#why-should-i-use-encrypted-dns) a number of encrypted DNS
 
 </div>
 
-[Learn more...](self-contained-networks.md)
+[Learn more :material-arrow-right:](self-contained-networks.md)
 
 ### Video Streaming Clients
 
 <div class="grid cards" markdown>
 
-- ![FreeTube logo](/assets/img/video-streaming/freetube.svg){ .twemoji } [FreeTube (YouTube, Desktop)](https://freetubeapp.io/)
-- ![LBRY logo](/assets/img/video-streaming/lbry.svg){ .twemoji } [LBRY](https://lbry.com/)
-- ![NewPipe logo](/assets/img//video-streaming/newpipe.svg){ .twemoji } [NewPipe (YouTube, Android)](https://newpipe.net/)
-- ![NewPipe x SponsorBlock logo](/assets/img/video-streaming/newpipe.svg){ .twemoji } [NewPipe x Sponsorblock](https://github.com/polymorphicshade/NewPipe)
-- ![Invidious logo](/assets/img/video-streaming/invidious.svg#only-light){ .twemoji }![Invidious logo](/assets/img/video-streaming/invidious-dark.svg#only-dark){ .twemoji } [Invidious (YouTube, Web)](https://invidious.io/)
-- ![Piped logo](/assets/img/video-streaming/piped.svg){ .twemoji } [Piped (YouTube, Web)](https://piped.kavin.rocks/)
+- ![FreeTube logo](assets/img/video-streaming/freetube.svg){ .twemoji } [FreeTube (YouTube, Desktop)](https://freetubeapp.io/)
+- ![LBRY logo](assets/img/video-streaming/lbry.svg){ .twemoji } [LBRY](https://lbry.com/)
+- ![NewPipe logo](assets/img//video-streaming/newpipe.svg){ .twemoji } [NewPipe (YouTube, Android)](https://newpipe.net/)
+- ![NewPipe x SponsorBlock logo](assets/img/video-streaming/newpipe.svg){ .twemoji } [NewPipe x Sponsorblock](https://github.com/polymorphicshade/NewPipe)
+- ![Invidious logo](assets/img/video-streaming/invidious.svg#only-light){ .twemoji }![Invidious logo](assets/img/video-streaming/invidious-dark.svg#only-dark){ .twemoji } [Invidious (YouTube, Web)](https://invidious.io/)
+- ![Piped logo](assets/img/video-streaming/piped.svg){ .twemoji } [Piped (YouTube, Web)](https://piped.kavin.rocks/)
 
 </div>
 
-[Learn more...](video-streaming.md)
+[Learn more :material-arrow-right:](video-streaming.md)

docs/video-streaming.en.md

@@ -2,7 +2,7 @@
 title: "Video Streaming"
 icon: material/video-wireless
 ---
-The primary threat when using a video streaming platform is that your streaming habits and subscription lists could be used to profile you. You should combine these tools with a [VPN](/vpn) or [Tor](https://www.torproject.org/) to make it harder to profile your usage.
+The primary threat when using a video streaming platform is that your streaming habits and subscription lists could be used to profile you. You should combine these tools with a [VPN](vpn.md) or [Tor](https://www.torproject.org/) to make it harder to profile your usage.
 
 ## Clients
 
@@ -10,11 +10,11 @@ The primary threat when using a video streaming platform is that your streaming
 
 !!! Warning
 
-    When using Freetube, your IP address is still known to YouTube, [Invidious](https://instances.invidious.io) and the SponsorBlock instances that you use. Consider using a [VPN](/vpn) or [Tor](https://www.torproject.org) if your [threat model](threat-modeling.md) requires hiding your IP address.
+    When using FreeTube, your IP address is still known to YouTube, [Invidious](https://instances.invidious.io) and the SponsorBlock instances that you use. Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org) if your [threat model](threat-modeling.md) requires hiding your IP address.
 
 !!! recommendation
 
-    ![FreeTube logo](/assets/img/video-streaming/freetube.svg){ align=right }
+    ![FreeTube logo](assets/img/video-streaming/freetube.svg){ align=right }
 
     **FreeTube** is a free and open source desktop application for [YouTube](https://youtube.com). When using FreeTube, your subscription list and playlists are saved locally on your device.
 
@@ -37,7 +37,7 @@ The primary threat when using a video streaming platform is that your streaming
 
 !!! recommendation
 
-    ![LBRY logo](/assets/img/video-streaming/lbry.svg){ align=right }
+    ![LBRY logo](assets/img/video-streaming/lbry.svg){ align=right }
 
     **The LBRY network** is a decentralized video sharing network. It uses a [BitTorrent](https://wikipedia.org/wiki/BitTorrent)-like network to store the video content, and a [blockchain](https://wikipedia.org/wiki/Blockchain) to store the indexes for those videos. The main benefit of this design is censorship resistance.
 
@@ -53,7 +53,7 @@ The primary threat when using a video streaming platform is that your streaming
 
 !!! warning
 
-    While watching and hosting videos, your IP address is visible to the LBRY network. Consider using a [VPN](/vpn) or [Tor](https://www.torproject.org) if your [threat model](/threat-modeling) requires hiding your IP address.
+    While watching and hosting videos, your IP address is visible to the LBRY network. Consider using a [VPN](vpn.md) or [Tor](https://www.torproject.org) if your [threat model](threat-modeling) requires hiding your IP address.
 
 We recommend **against** synchronizing your wallet with LBRY Inc., as synchronizing encrypted wallets is not supported yet. If you synchronize your wallet with LBRY Inc., you have to trust them to not look at your subscription list, [LBC](https://lbry.com/faq/earn-credits) funds, or take control of your channel.
 
@@ -63,7 +63,7 @@ You can  disable *Save hosting data to help the LBRY network* option (⚙️ Set
 
 !!! recommendation
 
-    ![Newpipe logo](/assets/img//video-streaming/newpipe.svg){ align=right }
+    ![Newpipe logo](assets/img//video-streaming/newpipe.svg){ align=right }
 
     **NewPipe** is a free and open source Android application for [YouTube](https://youtube.com), [SoundCloud](https://soundcloud.com), [media.ccc.de](https://media.ccc.de), [FramaTube](https://framatube.org), and [Bandcamp](https://bandcamp.com).
 
@@ -83,7 +83,7 @@ You can  disable *Save hosting data to help the LBRY network* option (⚙️ Set
 
 !!! recommendation
 
-    ![NewPipe x SponsorBlock logo](/assets/img/video-streaming/newpipe.svg){ align=right }
+    ![NewPipe x SponsorBlock logo](assets/img/video-streaming/newpipe.svg){ align=right }
 
     **NewPipe x SponsorBlock** is a fork of [NewPipe](https://newpipe.net) with [SponsorBlock](https://sponsor.ajay.app) integrated to help you skip sponsored advertisements.
     It also has some experimental settings such as the ability to use the built-in player for local playback, an option to force fullscreen on landscape mode, and an option to disable error reporting prompts.
@@ -106,8 +106,8 @@ This fork is not endorsed by or affiliated with the upstream project. The NewPip
 
 !!! recommendation
 
-    ![Invidious logo](/assets/img/video-streaming/invidious.svg#only-light){ align=right }
-    ![Invidious logo](/assets/img/video-streaming/invidious-dark.svg#only-dark){ align=right }
+    ![Invidious logo](assets/img/video-streaming/invidious.svg#only-light){ align=right }
+    ![Invidious logo](assets/img/video-streaming/invidious-dark.svg#only-dark){ align=right }
 
     **Invidious** is a free and open source front end for YouTube that is also self-hostable. There are list of [public instances](https://instances.invidious.io). Some instances have [Tor](https://www.torproject.org) onion services support.
 
@@ -129,7 +129,7 @@ When you are using an Invidious instance, be sure to go read the Privacy Policy
 
 !!! recommendation
 
-    ![Piped logo](/assets/img/video-streaming/piped.svg){ align=right }
+    ![Piped logo](assets/img/video-streaming/piped.svg){ align=right }
 
     **Piped** is a free and open source front end for YouTube that is also self-hostable. Alternative instances can be selected from "Preferences".
 

docs/vpn.en.md

@@ -31,8 +31,8 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 !!! recommendation
 
-    ![Mullvad logo](/assets/img/vpn/mullvad.svg#only-light){ align=right }
-    ![Mullvad logo](/assets/img/vpn/mullvad-dark.svg#only-dark){ align=right }
+    ![Mullvad logo](assets/img/vpn/mullvad.svg#only-light){ align=right }
+    ![Mullvad logo](assets/img/vpn/mullvad-dark.svg#only-dark){ align=right }
 
     **Mullvad** is a fast and inexpensive VPN with a serious focus on transparency and security. They have been in operation since **2009**. Mullvad is based in Sweden and does not have a free trial.
 
@@ -92,7 +92,7 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 !!! recommendation
 
-    ![ProtonVPN logo](/assets/img/vpn/protonvpn.svg){ align=right }
+    ![ProtonVPN logo](assets/img/vpn/protonvpn.svg){ align=right }
 
     **ProtonVPN** is a strong contender in the VPN space, and they have been in operation since 2016. ProtonVPN is based in Switzerland and offers a limited free pricing tier, as well as premium options. They offer a further 14% discount for buying a 2 year subscription.
 
@@ -124,9 +124,9 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
     ProtonVPN [recommends](https://protonvpn.com/blog/wireguard/) the use of WireGuard with their service. On ProtonVPN's Windows, macOS, iOS, Android, ChromeOS, and Android TV apps, WireGuard is the default protocol; however, [support](https://protonvpn.com/support/how-to-change-vpn-protocols/) for the protocol is not present in their Linux app.
 
-??? missing "Remote Port Forwarding"
+??? warning "Remote Port Forwarding"
 
-    ProtonVPN does not currently support remote port forwarding, which may impact some applications. Especially Peer-to-Peer applications like Torrent clients.
+    ProtonVPN currently only supports remote [port forwarding](https://protonvpn.com/support/port-forwarding/) on Windows, which may impact some applications. Especially Peer-to-Peer applications like Torrent clients.
 
 ??? check "Mobile Clients"
 
@@ -140,7 +140,7 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
 !!! recommendation
 
-    ![IVPN logo](/assets/img/vpn/ivpn.svg){ align=right }
+    ![IVPN logo](assets/img/vpn/ivpn.svg){ align=right }
 
     **IVPN** is another premium VPN provider, and they have been in operation since 2009. IVPN is based in Gibraltar.
 
@@ -288,7 +288,7 @@ Must not have any marketing which is irresponsible:
 
 Responsible marketing that is both educational and useful to the consumer could include:
 
-- An accurate comparison to when Tor or other [self-contained networks](/self-contained-networks) should be used.
+- An accurate comparison to when Tor or other [self-contained networks.md](self-contained-networks) should be used.
 - Availability of the VPN provider's website over a .onion [Hidden Service](https://en.wikipedia.org/wiki/.onion)
 
 ### Additional Functionality
@@ -346,7 +346,7 @@ For use cases like these, or if you have another compelling reason, the VPN prov
 ### Sources and Further Reading
 
 1. [VPN - a Very Precarious Narrative](https://schub.io/blog/2019/04/08/very-precarious-narrative.html) by Dennis Schubert
-2. [The self-contained networks](/self-contained-networks) recommended by Privacy Guides are able to replace a VPN that allows access to services on local area network
+2. [The self-contained networks](self-contained-networks.md) recommended by Privacy Guides are able to replace a VPN that allows access to services on local area network
 3. [Slicing Onions: Part 1 – Myth-busting Tor](https://medium.com/privacyguides/slicing-onions-part-1-myth-busting-tor-9ec188ae1904) by blacklight447
 4. [Slicing Onions: Part 2 – Onion recipes; VPN not required](https://web.archive.org/web/20210116140725/https://write.privacytools.io/my-thoughts-on-security/slicing-onions-part-2-onion-recipes-vpn-not-required) by blacklight447
 5. [IVPN Privacy Guides](https://www.ivpn.net/privacy-guides)

mkdocs.yml

@@ -96,19 +96,24 @@ markdown_extensions:
           - theme/.icons
   - tables
   - footnotes
+  - toc:
+      permalink: true
 
 extra_javascript:
   - javascripts/mathjax.js
 
 nav:
   - Home: 'index.md'
-  - 'Privacy Introduction':
-    - 'threat-modeling.md'
-    - 'Technology Basics':
+  - 'Knowledge Base':
+    - 'The Basics':
+      - 'threat-modeling.md'
       - 'technology/dns.md'
-    - 'Security Basics':
       - 'security/multi-factor-authentication.md'
-    - 'Setup Guides':
+    - 'Mobile Devices':
+      - 'android/overview.md'
+      - 'android/security.md'
+      - 'android/grapheneos-vs-calyxos.md'
+    - 'Advanced':
       - 'setup/integrating-metadata-removal.md'
   - 'Recommendations':
     - 'tools.md'