@@ -355,7 +366,12 @@
|
- Quad9
+ Quad9
+ {% include badge.html
+ color="warning"
+ icon="fas fa-exclamation-triangle"
+ tooltip="Founders include the Global Cyber Alliance, composed of the City of London Police and Manhattan District Attorney's Office."
+ %}
|
Anycast (based in
diff --git a/_includes/sections/file-encryption.html b/_includes/sections/file-encryption.html
index 69c87798..ff9a1da2 100644
--- a/_includes/sections/file-encryption.html
+++ b/_includes/sections/file-encryption.html
@@ -55,10 +55,21 @@
Worth Mentioning
- - Cryptomator - Free client-side AES encryption for your cloud files. Open source software: No backdoors, no registration.
+ - Cryptomator - Free client-side AES encryption for your cloud files. Open source software: No backdoors, no registration.
+ {% include badge.html
+ color="warning"
+ icon="fas fa-exclamation-triangle"
+ link="https://github.com/cryptomator/cryptomator-android/issues/1#issuecomment-257979375"
+ tooltip="Cryptomator's mobile apps are not open-source."
+ %}
- Linux Unified Key Setup (LUKS) - A full disk encryption system for Linux using dm-crypt as the disk encryption backend. Included by default in Ubuntu. Available for Windows and Linux.
- Tomb - A simple zsh script for making LUKS containers on the commandline.
- Hat.sh - A cross-platform, serverless JavaScript web application that provides secure file encryption using the AES-256-GCM algorithm in your browser. It can also be downloaded and run offline.
- - Keka - A macOS-only, file archiver with the ability to encrypt files.
-
+ - Keka - A macOS-only, file archiver with the ability to encrypt files.
+ {% include badge.html
+ color="warning"
+ icon="fas fa-exclamation-triangle"
+ link="https://github.com/aonez/Keka#so-where-is-the-source-code"
+ tooltip="This software is no longer open source."
+ %}
diff --git a/pages/providers/dns.html b/pages/providers/dns.html
index db65a9d9..3c8718d9 100644
--- a/pages/providers/dns.html
+++ b/pages/providers/dns.html
@@ -13,10 +13,21 @@ breadcrumb: "DNS"
- DNS-over-TLS (DoT) - A security protocol for encrypted DNS on a dedicated port 853. Some providers support port 443 which generally works everywhere while port 853 is often blocked by restrictive firewalls. DoT has two modes:
- - Oppurtunistic mode: the client attempts to form a DNS-over-TLS connection to the server on port 853 without performing certificate validation. If it fails, it will use unencrypted DNS.
+ - Oppurtunistic mode: the client attempts to form a DNS-over-TLS connection to the server on port 853 without performing certificate validation. If it fails, it will use unencrypted DNS.
+ {% include badge.html
+ color="warning"
+ icon="fas fa-exclamation-triangle"
+ tooltip="In other words automatic mode leaves your DNS traffic vulnerable to SSL strip and MITM attacks."
+ %}
- Strict mode: the client connects to a specific hostname and performs certificate validation for it. If it fails, no DNS queries are made until it succeeds.
- - DNS-over-HTTPS (DoH) - Similar to DoT, but uses HTTPS instead, being indistinguishable from "normal" HTTPS traffic on port 443.
+ - DNS-over-HTTPS (DoH) - Similar to DoT, but uses HTTPS instead, being indistinguishable from "normal" HTTPS traffic on port 443.
+ {% include badge.html
+ color="warning"
+ icon="fas fa-exclamation-triangle"
+ link="https://tools.ietf.org/html/rfc8484#section-8.2"
+ tooltip="DoH contains metadata such as user-agent (which may include system information) that is sent to the DNS server."
+ %}
- DNSCrypt - An older yet robust method of encrypting DNS.
@@ -25,9 +36,20 @@ breadcrumb: "DNS"
- DoH / DoT
- - Check DNSLeakTest.com.
+ - Check DNSLeakTest.com.
+ {% include badge.html
+ color="warning"
+ icon="fas fa-exclamation-triangle"
+ tooltip="Your DNS provider may not appear with their own name, so compare the responses to what you know or can find about your DNS provider. Just ensure you don't see your ISP or old unencrypted DNS provider."
+ %}
- Check the website of your DNS provider. They may have a page for telling "you are using our DNS." Examples include AdGuard and Cloudflare.
- - If using Firefox's trusted recursive resolver (TRR), navigate to
about:networking#dns. If the TRR column says "true" for some fields, you are using DoH.
+ - If using Firefox's trusted recursive resolver (TRR), navigate to
about:networking#dns. If the TRR column says "true" for some fields, you are using DoH.
+ {% include badge.html
+ color="warning"
+ icon="fas fa-exclamation-triangle"
+ link="https://wiki.mozilla.org/Trusted_Recursive_Resolver"
+ tooltip="Some fields will say 'false' depending on the the value of network.trr.mode in about:config"
+ %}
- dnscrypt-proxy - Check dnscrypt-proxy's wiki on how to verify that your DNS is encrypted.
@@ -40,7 +62,14 @@ breadcrumb: "DNS"
- Encrypted DNS clients for desktop:
- - Firefox comes with built-in DoH support with Cloudflare set as the default resolver, but can be configured to use any DoH resolver. Currently Mozilla is conducting studies before enabling DoH by default for all US-based Firefox users.
+ - Firefox comes with built-in DoH support with Cloudflare set as the default resolver, but can be configured to use any DoH resolver.
+ {% include badge.html
+ color="warning"
+ icon="fas fa-exclamation-triangle"
+ link="https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/"
+ tooltip=""Cloudflare has agreed to collect only a limited amount of data about the DNS requests that are sent to the Cloudflare Resolver for Firefox via the Firefox browser.""
+ %}
+ Currently Mozilla is conducting studies before enabling DoH by default for all US-based Firefox users.
- DNS over HTTPS can be enabled in Menu -> Preferences (
about:preferences) -> Network Settings -> Enable DNS over HTTPS. Set "Use Provider" to "Custom", and enter your DoH provider's address.
- Advanced users may enable it in
about:config by setting network.trr.custom_uri and network.trr.uri as the address you find from the documentation of your DoH provider and network.trr.mode as 2. It may also be desirable to set network.security.esni.enabled to True in order to enable encrypted SNI and make sites supporting ESNI a bit more difficult to track.
@@ -49,9 +78,20 @@ breadcrumb: "DNS"
- Encrypted DNS clients for mobile:
|