diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index c1620144..e6b1f0b6 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -9,6 +9,9 @@ # Administration Related Files /pages/donate.html @JonahAragon @BurungHantu1605 /pages/notices.md @JonahAragon +/pages/sponsors.html @JonahAragon +/_includes/sponsors/ @JonahAragon +/assets/img/svg/3rd-party/sponsors/ @JonahAragon /README.md @JonahAragon @BurungHantu1605 /assets/js/redirects.js @JonahAragon /.well-known/ @JonahAragon @@ -19,3 +22,11 @@ /.travis.yml @JonahAragon @Shifterovich @nitrohorse /CNAME @JonahAragon /nginx/ @JonahAragon + +# WKD +/.well-known/openpgpkey/hu/mrobfoimg5wz876m7kp6spyu66941weo @Mikaela +/.well-known/openpgpkey/hu/nqspr7yd4bgs8ry43zbzpjd45p4iug5b @dawidpotocki +/.well-known/openpgpkey/hu/dnrefmbtd6i58w8xfy4imj94cmbw3u3h @dngray +/.well-known/openpgpkey/hu/rse6m7dxfdjo86qhyj6wqs1hcdcp7em4 @danarel +/.well-known/openpgpkey/hu/zt71pstaerw1jpa5ru3borqmfsnbwnf6 @nitrohorse +/.well-known/openpgpkey/hu/omn8s4nziz8zmyz6f756asto39gefr63 @JonahAragon diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 0ce5bc54..18a48127 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -95,8 +95,9 @@ See https://www.privacytools.io/providers/vpn/#criteria for more details. ## Images -- Provider logos are 200px x 70px ([example](https://github.com/privacytoolsIO/privacytools.io/blob/master/assets/img/provider/Mullvad.png)) -- Tool logos are 120px x 120px ([example](https://github.com/privacytoolsIO/privacytools.io/blob/master/assets/img/tools/Firefox.png)) +- SVG file format is strongly preferred. PNG files can be used as a fallback if images are too complex or otherwise unsuitable as a vector format. +- Provider logo dimensions are 384px x 128px ([example](https://github.com/privacytoolsIO/privacytools.io/blob/master/assets/img/svg/3rd-party/mullvad.svg)) +- Tool logo dimensions are 120px x 120px ([SVG example](https://github.com/privacytoolsIO/privacytools.io/blob/master/assets/img/svg/3rd-party/firefox_browser.svg), [PNG example](https://github.com/privacytoolsIO/privacytools.io/blob/master/assets/img/png/3rd-party/claws_mail.png)) ## Licensing diff --git a/.github/ISSUE_TEMPLATE/1_Software_Suggestion.md b/.github/ISSUE_TEMPLATE/1_Software_Suggestion.md index 2b018612..6da46aa1 100644 --- a/.github/ISSUE_TEMPLATE/1_Software_Suggestion.md +++ b/.github/ISSUE_TEMPLATE/1_Software_Suggestion.md @@ -12,3 +12,16 @@ labels: 🆕 software suggestion **URL:** ## Description + + + +## Why I am making the suggestion + + + + +## My connection with the software + + + +- [ ] I will keep the issue up-to-date if something I have said changes or I remember a connection with the software. diff --git a/.github/ISSUE_TEMPLATE/2_Software_Removal.md b/.github/ISSUE_TEMPLATE/2_Software_Removal.md index f615cd64..d806a6a6 100644 --- a/.github/ISSUE_TEMPLATE/2_Software_Removal.md +++ b/.github/ISSUE_TEMPLATE/2_Software_Removal.md @@ -7,3 +7,15 @@ labels: ❌ software removal ## Description + + +## Why I am making the suggestion + + + + +## My connection with the software + + + +- [ ] I will keep the issue up-to-date if something I have said changes or I remember a connection with the software. diff --git a/.github/ISSUE_TEMPLATE/3_Discussion.md b/.github/ISSUE_TEMPLATE/3_Discussion.md deleted file mode 100644 index dc53ae9e..00000000 --- a/.github/ISSUE_TEMPLATE/3_Discussion.md +++ /dev/null @@ -1,13 +0,0 @@ - - ---- -name: "💬 Discussion" -about: Discuss the website or any mentioned software in general. -title: "💬 Discussion | " -labels: 💬 discussion, feedback wanted ---- - - diff --git a/.github/ISSUE_TEMPLATE/4_Feature.md b/.github/ISSUE_TEMPLATE/3_Feature_Suggestion.md similarity index 57% rename from .github/ISSUE_TEMPLATE/4_Feature.md rename to .github/ISSUE_TEMPLATE/3_Feature_Suggestion.md index f4affecc..a56baa49 100644 --- a/.github/ISSUE_TEMPLATE/4_Feature.md +++ b/.github/ISSUE_TEMPLATE/3_Feature_Suggestion.md @@ -1,9 +1,8 @@ --- name: "✨ Feature Suggestion" -about: Suggest a new feature for the website. +about: Suggest a new feature/section/page for the website. title: "✨ Feature Suggestion | " labels: ✨ enhancement --- -## Description: - +## Description diff --git a/.github/ISSUE_TEMPLATE/4_Content_Correction.md b/.github/ISSUE_TEMPLATE/4_Content_Correction.md new file mode 100644 index 00000000..58533d13 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/4_Content_Correction.md @@ -0,0 +1,21 @@ +--- +name: "📝 Content Correction" +about: Report any inaccurate, incorrect, or outdated information on the website. +title: "📝 Correction | " +labels: 📝 correction +--- + +## Description + + + +## Why I am making the suggestion + + + + +## My connection with the software + + + +- [ ] I will keep the issue up-to-date if something I have said changes or I remember a connection with the software. diff --git a/.github/ISSUE_TEMPLATE/5_Website_Issues.md b/.github/ISSUE_TEMPLATE/5_Website_Issues.md index ed9d01dd..fb386eaa 100644 --- a/.github/ISSUE_TEMPLATE/5_Website_Issues.md +++ b/.github/ISSUE_TEMPLATE/5_Website_Issues.md @@ -1,10 +1,19 @@ --- name: "🌐 Website Issue" -about: Report an issue with the website. +about: Report a bug with the website. (NO CONTENT ISSUES) title: "🌐 Website Issue | " -labels: 🌐 website issue, high priority +labels: 🌐 website issue --- + + ## Description - -## Basic Information - -**Name:** -**Filtering:** -**Privacy policy:** -**Protocols:** -**Server/Location:** -**Source:** -**Type:** -**Website:** - -## Description - - - - -### Required features: - - - -* [ ] supports DoH or DoT -* [ ] supports DNSSEC -* [ ] doesn't log IP addresses during normal operation - -#### Desired features - -* [ ] supports QNAME minimization diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 00000000..b0fba705 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,7 @@ +contact_links: + - name: Services issues + url: https://github.com/privacytoolsIO/services/issues/new/choose + about: Open any issues/bug reports/requests related to our services (Mastodon, Matrix, etc) here. + - name: PrivacyTools Community + url: https://forum.privacytools.io/ + about: Please ask any generic questions on our forum. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 406faf1d..19a53c5f 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -1,4 +1,4 @@ - + ## Description @@ -6,6 +6,8 @@ Resolves: #none +- [ ] I understand that by not opening an issue about a software/service/similar addition/removal, this pull request will be closed without merging. + - [ ] I have read and understand [the contributing guidelines](https://github.com/privacytoolsIO/privacytools.io/blob/master/.github/CONTRIBUTING.md). - [ ] The project is [Free Libre](https://en.wikipedia.org/wiki/Free_software) and/or [Open Source](https://en.wikipedia.org/wiki/Open-source_software) Software diff --git a/.github/stale.yml b/.github/stale.yml new file mode 100644 index 00000000..331880c5 --- /dev/null +++ b/.github/stale.yml @@ -0,0 +1,16 @@ +# Number of days of inactivity before an issue becomes stale +daysUntilStale: 60 +# Number of days of inactivity before a stale issue is closed +daysUntilClose: 7 +# Issues with these labels will never be considered stale +exemptLabels: + - approved +# Label to use when marking an issue as stale +staleLabel: stale +# Comment to post when marking an issue as stale. Set to `false` to disable +markComment: > + This issue has been automatically marked as stale because it has not had + recent activity. It will be closed if no further activity occurs. Thank you + for your contributions. +# Comment to post when closing a stale issue. Set to `false` to disable +closeComment: false diff --git a/.gitignore b/.gitignore index e6cb179f..bb836e13 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,5 @@ font/assets/ font/_sass/ font/.fontcustom-manifest.json assets/webfonts/ptio-font-preview.html +vendor +.bundle diff --git a/.well-known/openpgpkey/hu/mrobfoimg5wz876m7kp6spyu66941weo b/.well-known/openpgpkey/hu/mrobfoimg5wz876m7kp6spyu66941weo index 29f5402f..a8a3161b 100755 Binary files a/.well-known/openpgpkey/hu/mrobfoimg5wz876m7kp6spyu66941weo and b/.well-known/openpgpkey/hu/mrobfoimg5wz876m7kp6spyu66941weo differ diff --git a/.well-known/openpgpkey/hu/omn8s4nziz8zmyz6f756asto39gefr63 b/.well-known/openpgpkey/hu/omn8s4nziz8zmyz6f756asto39gefr63 index 3d6170c5..9b051997 100755 Binary files a/.well-known/openpgpkey/hu/omn8s4nziz8zmyz6f756asto39gefr63 and b/.well-known/openpgpkey/hu/omn8s4nziz8zmyz6f756asto39gefr63 differ diff --git a/.well-known/openpgpkey/hu/zt71pstaerw1jpa5ru3borqmfsnbwnf6 b/.well-known/openpgpkey/hu/zt71pstaerw1jpa5ru3borqmfsnbwnf6 index 07d40720..eb0bd0f7 100755 Binary files a/.well-known/openpgpkey/hu/zt71pstaerw1jpa5ru3borqmfsnbwnf6 and b/.well-known/openpgpkey/hu/zt71pstaerw1jpa5ru3borqmfsnbwnf6 differ diff --git a/Gemfile.lock b/Gemfile.lock index a6b97838..2dce18a7 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -205,7 +205,7 @@ GEM jekyll-seo-tag (~> 2.1) minitest (5.11.3) multipart-post (2.1.1) - nokogiri (1.10.4) + nokogiri (1.10.8) mini_portile2 (~> 2.4.0) octokit (4.14.0) sawyer (~> 0.8.0, >= 0.5.3) diff --git a/README.md b/README.md index 35c1c602..e9156db9 100644 --- a/README.md +++ b/README.md @@ -10,18 +10,23 @@ _Encryption Against Global Mass Surveillance._ It's important for a website like PrivacyTools to be up-to-date. Keep an eye on software updates of the applications listed here. Follow recent news about providers that are recommended. We try our best to keep up but we're not perfect and the internet is changing fast. So if you find an error, or you think a provider should not be listed here, or a qualified service provider is missing or a browser plugin is not the best choice anymore or anything else... -**Talk to us please.** Join our [subreddit](https://www.reddit.com/r/privacytoolsIO/) or [our Discourse community](https://forum.privacytools.io/) and start a discussion. This is a community project and we're aiming to deliver the best information available for a better privacy. Thank you for participating. +**Talk to us!** If you want to help make privacytools.io the best website it can be, join our Matrix discussion chat at [`#dev:privacytools.io`](https://matrix.to/#/#dev:privacytools.io), where we talk about open issues and PRs in this repo, and changes to the site. You may submit any website suggestions here on GitHub [Issues](https://github.com/privacytoolsIO/privacytools.io/issues). Please refer to the [contribution guidelines](.github/CONTRIBUTING.md) and consider stopping by our chat room before submitting. Thank you. -You can submit your suggestions here on GitHub [(Issues)](https://github.com/privacytoolsIO/privacytools.io/issues) and also in our [subreddit](https://www.reddit.com/r/privacytoolsIO/). Please refer to the [Contributing Guidelines](.github/CONTRIBUTING.md) before submitting. Thank you. +If you want to discuss privacy in general, a new tool, or just something else, feel free to join [our Discourse community](https://forum.privacytools.io/) or our general Matrix room at [`#general:privacytools.io`](https://matrix.to/#/#general:privacytools.io) and start a discussion! This is a community project and we're aiming to deliver the best information available. Thank you for participating. -## Building +## Developing -1. Install [Ruby](https://www.ruby-lang.org/en/documentation/installation/) -1. Install [bundler](https://bundler.io/) by running `gem install bundler`. -1. Run `bundle install` to install the required dependencies. -1. Use `bundle exec jekyll build` to build the website. The output can be found in the `_site` directory. Live preview is also possible by running `bundle exec jekyll serve` +1. Install the latest stable version of [Ruby](https://www.ruby-lang.org/en/downloads/). +1. Install [Bundler](https://bundler.io/) v2.0.1: + * `gem install bundler -v 2.0.1` +1. Install the required dependencies: + * `bundle install` +1. Build the website (the output can be found in the `_site` directory): + * `bundle exec jekyll build` +1. Serve the website locally with live reloading: + * `bundle exec jekyll serve --incremental --livereload` -# Support privacytools.io +# Support - [Donate.](https://www.privacytools.io/donate/) - [Liberapay](https://liberapay.com/privacytools.io/donate) or [Patreon.](https://www.patreon.com/privacytools) @@ -30,6 +35,10 @@ You can submit your suggestions here on GitHub [(Issues)](https://github.com/pri - [Make suggestions on reddit.](https://www.reddit.com/r/privacytoolsIO/) - View and edit our website source code here on GitHub. +# Sponsors + +- [Safing](https://safing.io/) + # Community Translations - [繁体中文 / Chinese](https://privacytools.twngo.xyz/) - [GitHub](https://github.com/twngo/privacytools-zh) - [Español / Spanish](https://victorhck.gitlab.io/privacytools-es/) - [GitLab](https://gitlab.com/victorhck/privacytools-es) diff --git a/_includes/cardv2.html b/_includes/cardv2.html index 3f28be5b..031f52ab 100644 --- a/_includes/cardv2.html +++ b/_includes/cardv2.html @@ -61,7 +61,7 @@ {% endif %}

-
+
Website + {% if include.privacy-policy %} + + + Privacy Policy + + {% endif %} {% if include.forum %} @@ -93,7 +102,7 @@ diff --git a/_includes/footer.html b/_includes/footer.html index 3baff154..aebf3140 100644 --- a/_includes/footer.html +++ b/_includes/footer.html @@ -89,7 +89,8 @@ Privacy Statement | Notices & Disclaimers | - Brand Assets & Guidelines + Brand Assets & Guidelines | + Status Page
diff --git a/_includes/head.html b/_includes/head.html index c072a19d..8595b009 100644 --- a/_includes/head.html +++ b/_includes/head.html @@ -22,7 +22,7 @@ - {% if page.url == "/" or page.url == "/about/" %} + {% if page.url == "/" %} {% include sections/header.html %} {% include sections/resources.html %} +

Sponsors

+
+ {% include sponsors/gold.html %} +
+ {% include sections/quotes.html %} {% include sections/privacy-resources.html %} {% include sections/participate.html %} diff --git a/nginx/010-headers.conf b/nginx/010-headers.conf index 95424841..619996b6 100644 --- a/nginx/010-headers.conf +++ b/nginx/010-headers.conf @@ -3,7 +3,7 @@ add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options nosniff always; add_header Content-Security-Policy "default-src 'none'; script-src 'self' https://stats.privacytools.io; style-src 'self'; img-src 'self' data: https://*.privacytools.io; object-src 'none'; frame-src https://stats.privacytools.io; font-src 'self'; base-uri 'none'; form-action 'self' https://search.privacytools.io; frame-ancestors 'none'; manifest-src 'self';" always; add_header Strict-Transport-Security "max-age=31557600; includeSubDomains; preload"; -add_header 'Access-Control-Allow-Origin' '*'; add_header Alt-Svc 'h2="privacy2zbidut4m4jyj3ksdqidzkw3uoip2vhvhbvwxbqux5xy5obyd.onion:443"; ma=86400; persist=1'; add_header Expect-CT 'max-age=86400, enforce'; add_header Referrer-Policy "strict-origin"; +add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; diff --git a/pages/about.html b/pages/about.html index 83db939c..92158aa5 100644 --- a/pages/about.html +++ b/pages/about.html @@ -5,12 +5,16 @@ title: "About PrivacyTools" description: "About the PrivacyTools organization, and contributors to the PrivacyTools website, communities, and services." hidedesc: true --- - +
+ + + +
-

You are being watched. Private and state-sponsored organizations are monitoring and recording your online activities.

-

At PrivacyTools, we provide services, tools, and knowledge to protect your privacy against global mass surveillance, and moderate a thriving community of privacy-minded individuals like yourself to discuss and learn about new advances in protecting your online data. This website serves as the centerpiece of our organization, where we research and recommend various software solutions for our community.

-

Transparency is our strongest value, and it's what sets us apart from the rest of the "privacy recommendations" community. Editorial changes to this website and the products we recommend are always discussed on our extensive issue tracker, drafted in a public pull request open for further discussion, and logged in a comprehensive commit log dating back to our original founding date in 2015. The core team members listed below are responsible for most of the edits and final decisions to changes on this website and across our services, but this website is truly the work of hundreds contributors and fact checkers working to make sure our recommendations are solid and trustworthy.

+

You are being watched. Private and state-sponsored organizations are monitoring and recording your online activities.

+

At PrivacyTools, we provide services, tools, and knowledge to protect your privacy against global mass surveillance, and moderate a thriving community of privacy-minded individuals like yourself to discuss and learn about new advances in protecting your online data. serves as the centerpiece of our organization, where we research and recommend various software solutions for our community.

+

Transparency is our strongest value, and it's what sets us apart from the rest of the "privacy recommendations" community. Editorial changes to this website and the products we recommend are always discussed on our extensive issue tracker, drafted in a public pull request open for further discussion, and logged in a comprehensive commit log dating back to our original founding date in 2015. The core team members listed below are responsible for most of the edits and final decisions to changes on this website and across our services, but this website is truly the work of hundreds contributors and fact checkers working to make sure our recommendations are solid and trustworthy.

Additionally, we are a not-for-profit organization. We do not utilize paid recommendations or affiliate programs to make the recommendations on this website. Unfortunately this practice is very common elsewhere online, which makes it difficult to trust other review sites. We are unique in this area, in that all of our research is conducted independently, and we will never accept payments to modify, add, or remove any of our reviews or recommendations. Our finances are provided entirely by our community donors and sponsors, and are handled by the Open Collective Foundation 501(c)(3). Because we are operating as a charity in the United States, we are legally obligated to only use our funding to further our mission of spreading privacy education and promoting online services like Mastodon, Matrix, and WriteFreely. This website is a public resource, not a profit generator. To that regard, all our financial transactions (incoming and outgoing) are logged and made available to the public via our page at opencollective.com/privacytoolsio.

We take the operation of our various services very seriously, and require all participants to adhere to our Code of Conduct. For any questions or to report abuse, please see our CoC’s Enforcement section.

@@ -18,30 +22,17 @@ hidedesc: true
-

Core Contributors

+

Team Members

- -{% include team.html -avatar="burung.png" -name="Burung Hantu" -role="Founder" -bio="I founded PrivacyTools in 2015 to share resources and tools, allowing users to avoid international mass-surveillance programs." -email="dude@privacytools.io" -keys="https://keybase.io/privacytools" -mastodon="https://social.privacytools.io/@BurungHantu" -twitter="privacytoolsIO" -%} - {% include team.html avatar="jonah.png" name="Jonah Aragon" -nick="Jonah" role="Administrator" bio="I run the website and services for PrivacyTools. My goal is to spread the word about data privacy as widely as possible." -email="jonah@privacytools.io" +email="mailto:jonah@privacytools.io" website="https://www.jonaharagon.com" keys="https://keybase.io/jonaharagon" mastodon="https://social.privacytools.io/@jonah" @@ -49,13 +40,24 @@ twitter="JonahAragon" blog="jonah" %} +{% include team.html +avatar="burung.png" +name="Burung Hantu" +role="Founder" +bio="I founded PrivacyTools in 2015 to share resources and tools, allowing users to avoid international mass-surveillance programs." +keys="https://keybase.io/privacytools" +mastodon="https://social.privacytools.io/@BurungHantu" +twitter="privacytoolsIO" +%} + {% include team.html avatar="blacklight447.png" -name="blacklight447" +name="Niek de Wilde" bio="I research new privacy recommendations and moderate our communities. My expertise is endpoint security and networking." -role="Community Manager" -email="blacklight447@privacytools.io" +role="Editor-in-chief" +email="mailto:blacklight447@privacytools.io" mastodon="https://social.privacytools.io/@blacklight447" +blog="blacklight447" %} {% include team.html @@ -64,7 +66,7 @@ name="Dan Arel" role="Blogging & Education" bio="I'm an author, columnist, and privacy advocate whose work has appeared in Time, Huff Post, OpenSource, and more." website="https://danarel.com" -email="dan@privacytools.io" +email="mailto:dan@privacytools.io" keys="https://keybase.io/dan_arel" twitter="danarel" mastodon="https://mastodon.technology/@danarel" @@ -72,14 +74,15 @@ blog="danarel" %} {% include team.html -avatar="dawid.png" +avatar="dawid.svg" name="Dawid Potocki" role="Developer" bio="I'm a student interested in software development. I help improve PrivacyTools and promote using free libre software." website="https://dawidpotocki.com" -email="dawidpotocki@privacytools.io" +email="https://dawidpotocki.com/accounts/#email" keys="https://dawidpotocki.com/accounts/#pgp" mastodon="https://social.privacytools.io/@dawidpotocki" +blog="dawidpotocki" %} {% include team.html @@ -87,20 +90,12 @@ avatar="dngray.png" name="dngray" nick="Daniel Gray" bio="I liaise with and research privacy-focused services to refine our recommendations. My background is infosec and network security." -email="dngray@privacytools.io" +website="https://dngray.netlify.com" +email="https://dngray.netlify.com/email" keys="https://keybase.io/dngray" mastodon="https://social.privacytools.io/@dngray" %} -{% include team.html -avatar="mikaela.png" -name="Mikaela Suomalainen" -nick="Mikaela" -bio="I am interested in instant messengers. I review privacy tools, and participate in our forum, Matrix room, and issue tracker." -website="https://mikaela.info/" -keys="https://gitea.blesmrt.net/mikaela/shell-things/src/branch/master/.mikaela/keys" -%} - {% include team.html avatar="nitrohorse.png" name="Andreas Basurto" @@ -118,11 +113,11 @@ avatar="trai_dep.png" name="trai_dep" role="Subreddit Mod" bio="I'm the moderator at r/Privacy and r/privacytoolsIO. Day to day, I am also – irony alert – an (ethical) digital marketer." -email="trai_dep@privacytools.io" +email="mailto:trai_dep@privacytools.io" website="https://www.reddit.com/user/trai_dep" %} -
+
@@ -135,6 +130,22 @@ website="https://www.reddit.com/user/trai_dep"
+
+
+

Emeritus

+

Emeriti are honorary PrivacyTools team members who have formerly contributed to the project in a central way but are no longer currently active.

+
+
+ +
+{% include team.html +name="Mikaela Suomalainen" +website="https://mikaela.info/" +keys="https://gitea.blesmrt.net/mikaela/shell-things/src/branch/master/.mikaela/keys" +emeritus=true +%} +
+

Contact Us

@@ -144,5 +155,10 @@ website="https://www.reddit.com/user/trai_dep"

Suggest something new on our subreddit

For complete transparency, software and providers will only be considered for this website after discussions take place on our GitHub issue tracker. We of course don't make any changes in secret.

Join our Matrix room at #general:privacytools.io or join the privacytools_io Keybase team to chat with us and other members about this site and privacy in general! If you need a Matrix account, you can sign up with our own homeserver (https://chat.privacytools.io) using Riot.

+

You can also email the team at support@privacytools.io and find us on Twitter and Mastodon.

+ + +
+
diff --git a/pages/providers/email.html b/pages/providers/email.html index 974e0018..685ff5c3 100644 --- a/pages/providers/email.html +++ b/pages/providers/email.html @@ -1,27 +1,263 @@ --- layout: page permalink: /providers/email/ -title: "Best Secure Email Providers for Privacy" +title: "Private Email Providers" description: "Find a secure email provider that will keep your privacy in mind. Don't settle for ad-supported platforms. Never trust any company with your privacy, always encrypt." --- -
-
Warning
-
-

Even when using end-to-end encryption technology like GPG, email is inherently insecure and should not be trusted for sensitive communications. Metadata is always communicated in plaintext, and even when encryption is used correctly it is very easy for either party to accidentally respond to or forward a previously encrypted message in plaintext in many clients. GPG also does not easily support modern crypto functionality such as key rotation and forward secrecy.

-

We recommend the following email providers for routine notifications and messages from other services that require an email address. For communications that need to be safe and secure, you should use a dedicated instant messaging tool, such as Signal.

- Recommended Instant Messengers -
-
+{% include sections/email-warning.html %} {% include sections/email-providers.html %} -

Related Information

+
+

Our Email Provider Criteria

-
    -
  • Aging 'Privacy' Law Leaves Cloud E-Mail Open to Cops - Data stored in the cloud for longer than 6 months is considered abandoned and may be accessed by intelligence agencies without - a warrant. Learning: Use an external email client like Thunderbird or Enigmail, download your emails and store them locally. Never leave them on the server.
    • -
  • With May First/Riseup Server Seizure, FBI Overreaches Yet Again
    • -
  • Autistici/Inventati server compromised - The cryptographic services offered by the Autistici/Inventati server have been compromised on 15th June 2004. It was discovered on 21st June 2005. One year - later. During an enquiry on a single mailbox, the Postal Police may have tapped for a whole year every user's private communication going through the server autistici.org/inventati.org.
    • -
+

Please note we are not affiliated with any of the providers we recommend. This allows us to provide completely objective recommendations. We have developed a clear set of requirements for any Email provider wishing to be recommended, including implementing industry best practices, modern technology and more. We suggest you familiarize yourself with this list before choosing an Email provider, and conduct your own research to ensure the Email provider you choose is the right choice for you.

+ +
+
+
+

Jurisdiction

+

Operating outside the five/nine/fourteen-eyes countries is not necessarily a guarantee of privacy, and there are other factors to consider. However, we believe that avoiding these countries is important if you wish to avoid mass government dragnet surveillance, especially from the United States. Read our page on global mass surveillance and avoiding the US and UK to learn more about why we feel this is important.

+
+
+

Minimum to Qualify:

+
    +
  • Operating outside the USA or other Five Eyes countries.
    • +
+
+
+

Best Case:

+
    +
  • Operating outside the USA or other Fourteen Eyes countries.
    • +
  • Operating inside a country with strong consumer protection laws.
    • +
+
+ +
+

Technology

+

We regard these features as important in order to provide a safe and optimal service to users. Users should consider the provider which has the features they require.

+
+
+

Minimum to Qualify:

+
    +
  • Encrypts account data at rest.
    • +
  • Integrated webmail encryption provides convenience to users who want improve on having no E2EE encryption.
    • +
+
+
+

Best Case:

+
    +
  • Encrypts account data at rest with zero-access encryption.
    • +
  • Allow users to use their own domain name. Custom domain names are important to users because it allows them to maintain their agency from the service, should it turn bad, be acquired by another company which doesn't prioritize privacy etc.
    • +
  • Support for WKD to allow improved discovery of public OpenPGP keys via HTTP.
    GnuPG users can get a key by typing: gpg --locate-key example_user@example.com
    • +
  • Support for a temporary mailbox for external users. This is useful when you want to send an encrypted email, without sending an actual copy to your recipient. These emails usually have a limited lifespan and then are automatically deleted. They also don't require the recipient to configure any cryptography like OpenPGP.
    • +
  • Availability of the email provider's services via an onion service.
    • +
  • Subaddressing support.
    • +
  • Catch all or aliases for users who own their own domains.
    • +
  • Use of standard email access protocols such as IMAP, SMTP or JMAP. Standard access protocols ensure customers can easily download all of their email, should they want to switch to another provider.
    • +
+
+ +
+

Privacy

+

We prefer our recommended providers to collect as little data as possible.

+
+
+

Minimum to Qualify:

+
    +
  • Protect sender's IP address. Filter it from showing in the Received header field.
    • +
  • Don't require personally identifiable information (PII) besides username and password.
    • +
  • Privacy policy that meets the requirements defined by the GDPR
    • +
+
+
+

Best Case:

+
    +
  • Accepts Bitcoin, cash, and other forms of cryptocurrency and/or anonymous payment options (gift cards, etc.)
    • +
+
+ +
+

Security

+

Email servers deal with a lot of very sensitive data. We expect that providers will adopt best industry practices in order to protect their users.

+
+
+

Minimum to Qualify:

+ +
+
+

Best Case:

+
    +
  • Support for hardware authentication, ie U2F and WebAuthn. U2F and WebAuthn are more secure as they use a private key stored on a client-side hardware device to authenticate users, as opposed to a shared secret that is stored on the web server and on the client side when using TOTP. Furthermore, U2F and WebAuthn are more resistant to phishing as their authentication response is based on the authenticated domain name.
    • +
  • Zero access encryption, builds on encryption at rest. The difference being the provider does not have the decryption keys to the data they hold. This prevents a rogue employee leaking data they have access to or remote adversary from releasing data they have stolen by gaining unauthorized access to the server.
    • +
  • DNS Certification Authority Authorization (CAA) Resource Record in addition to DANE support.
    • +
  • Implementation of Authenticated Received Chain (ARC), this is useful for users who post to mailing lists RFC8617.
    • +
  • Bug-bounty programs and/or a coordinated vulnerability-disclosure process.
    • +
  • Website security standards such as:
    • + +
+
+ +
+

Trust

+

You wouldn't trust your finances to someone with a fake identity, so why trust them with your email? We require our recommended providers to be public about their ownership or leadership. We also would like to see frequent transparency reports, especially in regard to how government requests are handled.

+
+
+

Minimum to Qualify:

+
    +
  • Public-facing leadership or ownership.
    • +
+
+
+

Best Case:

+
    +
  • Public-facing leadership.
    • +
  • Frequent transparency reports.
    • +
+
+ +
+

Marketing

+

With the email providers we recommend we like to see responsible marketing.

+
+
+

Minimum to Qualify:

+
    +
  • Must self host analytics (no Google Analytics etc). The provider's site must also comply with DNT (Do Not Track) for those users who want to opt-out.
    • +
+

Must not have any marketing which is irresponsible:

+
    +
  • Claims of "unbreakable encryption". Encryption should be used with the intention that it may not be secret in the future when the technology exists to crack it.
    • +
  • Making guarantees of protecting anonymity 100%. When someone makes a claim that something is 100% it means there is no certainty for failure. We know users can quite easily deanonymize themselves in a number of ways, e.g.:
    • +
      +
    • Reusing personal information e.g. (email accounts, unique pseudonyms etc) that they accessed without anonymity software (Tor, VPN etc)
      • +
    • Browser fingerprinting
      • +
    +
+
+
+

Best Case:

+
    +
  • Clear and easy to read documentation. This includes things like, setting up 2FA, email clients, OpenPGP, etc.
    • +
+
+ +
+

Additional Functionality

+

While not strictly requirements, there are some factors we looked into when determining which providers to recommend.

+
+
+
+
+ +

Email encryption

+
+
+
+

What is end-to-end encryption (E2EE) encryption in email?

+

End-to-end encryption (E2EE) is a way of encrypting email contents so that nobody but the recipient(s) can read the email message.

+

How can I encrypt my email?

+

The standard way to do email E2EE and have it work between different email providers is with OpenPGP. There are different implementations of the OpenPGP standard, the most common being GnuPG and OpenPGP.js.

+

There is another standard that was popular with business called S/MIME, however it requires a certificate issued from a Certificate Authority (not all of them issue S/MIME certificates). It has support in G Suite Enterprise/Education and Office 365 Business or Exchange Server 2016, 2019.

+

What software can I use to get E2EE?

+

Email providers which allow you to use standard access protocols like IMAP and SMTP can be used with any of the email clients we recommend. This can be less secure as you are now relying on email providers to ensure that their encryption implementation works and has not been compromised in anyway.

+
+
+

How do I protect my private keys?

+

A smartcard (such as a Yubikey or Nitrokey) works by receiving an encrypted email message from a device (phone, tablet, computer etc) running an email/webmail client. The message is then decrypted by the smartcard and the decrypted content is sent back to the device.

+

It is advantageous for the decryption to occur on the smartcard so as to avoid possibly exposing your private key to a compromised device.

+
+
+
+ +

Email metadata

+
+
+
+

Who can see the email metadata?

+

Email metadata is able to be seen by your email client software (or webmail) and any servers relaying the message from you to any recipients. Sometimes email servers will also use external parties to protect against spam.

+

What is email metadata?

+

Email software will often show some visible headers that you may have seen such as: To, From, Cc, Date, Subject. +

+

When is email metadata used?

+

Client software may use it to show who a message is from and what time it was received. Servers may use it to determine where an email message must be sent, among other purposes not transparent to the user.

+
+
+

Where is the email metadata?

+

Email metadata is stored in the message header of the email message.

+

Why can't email metadata be E2EE?

+

Email metadata is is cruicial to the most basic functionality of email (where it came from, and where it has to go). E2EE was not built into the email protocols originally and is also optional, therefore, only the message content is protected.

+

How is my metadata protected?

+

When emails travel between email providers an encrypted connection is negotiated using Opportunistic TLS. This protects the metadata from outside observers, but as it is not E2EE, server administrators can snoop on the metadata of an email.

+
+
+
+ +
+ +

Email cloaking services

+
+ + AnonAddy + +

AnonAddy lets users create aliases that forward to their email address. Can be self-hosted. Source code on GitHub.

+
+ +

Self-hosting Email

+
+

Advanced users may consider setting up their own email server. Mailservers require attention and continuous maintenance in order to keep things secure and mail delivery reliable.

+

Combined software solutions

+ + Mail-in-a-Box + +
+

Mail-in-a-Box is an automated setup script for deploying a mail server on Ubuntu. Its goal is to make it easier for users to set up their own mail server.

+ + Mailcow + +

Mailcow is a more advanced mail server perfect for those with a bit more Linux experience. It has everything you need in a Docker container: A mailserver with DKIM support, antivirus and spam monitoring, webmail and ActiveSync with SOGo, and web-based administration with 2FA support. Mailcow Dockerized docs

+ +

For a more manual approach we've picked out these two articles.

+ +
+ +

Related Email Articles

+
+
+ +
+
diff --git a/pages/providers/vpn.html b/pages/providers/vpn.html index d3452744..6cf05899 100644 --- a/pages/providers/vpn.html +++ b/pages/providers/vpn.html @@ -55,6 +55,7 @@ breadcrumb: "VPN"
  • OpenVPN support.
  • Killswitch built in to clients.
    • +
  • If VPN cients are provided, they should be open source, like the VPN software they generally have built into them. We believe that source code availability provides greater transparency to the user about what their device is actually doing. Ideally we like to see these applications available in F-Droid.
@@ -62,7 +63,7 @@ breadcrumb: "VPN"
  • OpenVPN and WireGuard support.
  • Killswitch with highly configurable options (enable/disable on certain networks, on boot, etc.)
    • -
  • Easy-to-use VPN clients, especially open-source. Even better if the Android version is also available in F-Droid.
    • +
  • Easy-to-use VPN clients
  • Supports IPv6. We expect that servers will allow incoming connections via IPv6 and allow users to access services hosted on IPv6 addresses.
  • Capability of remote port forwarding assists in creating connections when using P2P (Peer-to-Peer) filesharing software, Freenet, or hosting a server (e.g., Mumble).
@@ -229,7 +230,6 @@ breadcrumb: "VPN"