From b51bed24605fc5cdba0d309dcd0dbcf8d97615db Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 13:53:30 -0700 Subject: [PATCH 01/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/cloud.md | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/docs/cloud.md b/docs/cloud.md index 333234d4..1e42baf5 100644 --- a/docs/cloud.md +++ b/docs/cloud.md @@ -10,7 +10,7 @@ cover: cloud.webp - [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange } - [:material-server-network: Service Providers](basics/common-threats.md#privacy-from-service-providers){ .pg-teal } -Many **cloud storage providers** require your full trust that they will not look at your files. The alternatives listed below eliminate the need for trust by implementing secure E2EE. +Many **cloud storage providers** require your full trust that they will not look at your files. The alternatives listed below eliminate the need for trust by implementing secure end-to-end encryption. If these alternatives do not fit your needs, we suggest you look into using encryption software like [Cryptomator](encryption.md#cryptomator-cloud) with another cloud provider. Using Cryptomator in conjunction with **any** cloud provider (including these) may be a good idea to reduce the risk of encryption flaws in a provider's native clients. @@ -27,7 +27,9 @@ Nextcloud is [still a recommended tool](document-collaboration.md#nextcloud) for ![Proton Drive logo](assets/img/cloud/protondrive.svg){ align=right } -**Proton Drive** is an encrypted cloud storage provider from the popular encrypted email provider [Proton Mail](email.md#proton-mail). The initial free storage is limited to 2 GB, but with the completion of [certain steps](https://proton.me/support/more-free-storage-existing-users), additional storage can be obtained up to 5 GB. +**Proton Drive** is an encrypted cloud storage provider from the popular encrypted email provider [Proton Mail](email.md#proton-mail). + +The initial free storage is limited to 2 GB, but with the completion of [certain steps](https://proton.me/support/more-free-storage-existing-users), additional storage can be obtained up to 5 GB. [:octicons-home-16: Homepage](https://proton.me/drive){ .md-button .md-button--primary } [:octicons-eye-16:](https://proton.me/drive/privacy-policy){ .card-link title="Privacy Policy" } @@ -46,9 +48,7 @@ Nextcloud is [still a recommended tool](document-collaboration.md#nextcloud) for -The Proton Drive web application has been independently audited by Securitum in [2021](https://proton.me/community/open-source). - -Proton Drive's brand new mobile clients have not yet been publicly audited by a third party. +The Proton Drive web application has been independently audited by Securitum in [2021](https://proton.me/community/open-source), but the brand new mobile clients have not yet been publicly audited by a third party. ## Tresorit @@ -83,7 +83,9 @@ Tresorit has received a number of independent security audits: - Computest discovered two vulnerabilities which have been resolved. - [2019](https://tresorit.com/blog/ernst-young-review-verifies-tresorits-security-architecture): Penetration Testing by Ernst & Young. - This review analyzed the full source code of Tresorit and validated that the implementation matches the concepts described in Tresorit's [white paper](https://prodfrontendcdn.azureedge.net/202208011608/tresorit-encryption-whitepaper.pdf). - - Ernst & Young additionally tested the web, mobile, and desktop clients: "Test results found no deviation from Tresorit’s data confidentiality claims." + - Ernst & Young additionally tested the web, mobile, and desktop clients. They concluded: + + > Test results found no deviation from Tresorit’s data confidentiality claims. [^1]: [ISO/IEC 27001](https://en.wikipedia.org/wiki/ISO/IEC_27001):2013 compliance relates to the company's [information security management system](https://en.wikipedia.org/wiki/Information_security_management) and covers the sales, development, maintenance and support of their cloud services. @@ -95,32 +97,35 @@ They have also received the Digital Trust Label, a certification from the [Swiss ![Peergos logo](assets/img/cloud/peergos.svg){ align=right } -**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant end-to-end encryption and ensures all data about your files remains private. It is built on top of [IPFS (InterPlanetary File System)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship){ .pg-blue-gray }. +**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant end-to-end encryption and ensures all data about your files remains private. [:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary } [:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" } [:octicons-info-16:](https://book.peergos.org){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/Peergos/Peergos){ .card-link title="Source Code" } +[:octicons-heart-16:](https://github.com/peergos/peergos#support){ .card-link title="Contribute" }
Downloads -- [:octicons-globe-16: Web](https://peergos.net) - [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases) - [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases) - [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases) +- [:octicons-browser-16: Web](https://peergos.net)
+Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship){ .pg-blue-gray }. + Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working. Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface. Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed. -An Android app is not available, but it is [in the works](https://discuss.privacyguides.net/t/peergos-private-storage-sharing-social-media-and-application-platform/11825/25). The current workaround is to use the mobile [PWA](https://peergos.net) instead. +To use Peergos on mobile devices, you can use the mobile [PWA](https://peergos.net) in lieu of a native app. ## Criteria @@ -128,7 +133,7 @@ An Android app is not available, but it is [in the works](https://discuss.privac ### Minimum Requirements -- Must enforce end-to-end encryption. +- Must enforce E2EE. - Must offer a free plan or trial period for testing. - Must support TOTP or FIDO2 multifactor authentication, or passkey logins. - Must offer a web interface which supports basic file management functionality. @@ -139,8 +144,8 @@ An Android app is not available, but it is [in the works](https://discuss.privac Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page. - Clients should be open source. -- Clients should be audited in their entirety by an independent third-party. +- Clients should be audited in their entirety by an independent third party. - Should offer native clients for Linux, Android, Windows, macOS, and iOS. - These clients should integrate with native OS tools for cloud storage providers, such as Files app integration on iOS, or DocumentsProvider functionality on Android. -- Should support easy file-sharing with other users. +- Should support easy file sharing with other users. - Should offer at least basic file preview and editing functionality on the web interface. From 13fef84b6a2f8b67f02b1e652f5f523e95f657b9 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 14:04:35 -0700 Subject: [PATCH 02/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/document-collaboration.md | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/docs/document-collaboration.md b/docs/document-collaboration.md index 839c011b..0ba8d98a 100644 --- a/docs/document-collaboration.md +++ b/docs/document-collaboration.md @@ -1,18 +1,16 @@ --- title: "Document Collaboration" icon: material/account-group -description: Most online office suites do not support E2EE, meaning the cloud provider has access to everything you do. +description: Most online office suites do not support end-to-end encryption, meaning the cloud provider has access to everything you do. cover: document-collaboration.webp --- Protects against the following threat(s): - [:material-server-network: Service Providers](basics/common-threats.md#privacy-from-service-providers){ .pg-teal } -Most online office suites do not support E2EE, meaning the cloud provider has access to everything you do. The provider's privacy policy may legally protect your rights, but it does not provide technical access constraints. +Most online office suites do not support end-to-end encryption, meaning the cloud provider has access to everything you do. The provider's privacy policy may legally protect your rights, but it does not provide technical access constraints. -## Collaboration Platforms - -### Nextcloud +## Nextcloud
@@ -47,19 +45,24 @@ We don't recommend using the [E2EE App](https://apps.nextcloud.com/apps/end_to_e
-### CryptPad +## CryptPad
![CryptPad logo](assets/img/document-collaboration/cryptpad.svg){ align=right } -**CryptPad** is a private-by-design alternative to popular office tools. All content on this web service is end-to-end encrypted and can be shared with other users easily. [:material-star-box: Read our latest CryptPad review.](https://www.privacyguides.org/articles/2025/02/07/cryptpad-review/) +**CryptPad** is a private-by-design alternative to popular office tools. All content on this web service is E2EE and can be shared with other users easily. + +The CryptPad team hosts a [public instance](https://cryptpad.fr). You can also use other public instances. + +[:material-star-box: Read our latest CryptPad review.](https://www.privacyguides.org/articles/2025/02/07/cryptpad-review/) [:octicons-home-16: Homepage](https://cryptpad.fr){ .md-button .md-button--primary } +[:octicons-server-16:](https://cryptpad.org/instances){ .card-link title="Public Instances" } [:octicons-eye-16:](https://cryptpad.fr/pad/#/2/pad/view/GcNjAWmK6YDB3EO2IipRZ0fUe89j43Ryqeb4fjkjehE){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.cryptpad.fr){ .card-link title=Documentation} +[:octicons-info-16:](https://docs.cryptpad.fr){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/xwiki-labs/cryptpad){ .card-link title="Source Code" } -[:octicons-heart-16:](https://opencollective.com/cryptpad){ .card-link title=Contribute } +[:octicons-heart-16:](https://opencollective.com/cryptpad){ .card-link title="Contribute" } @@ -78,7 +81,7 @@ In general, we define collaboration platforms as full-fledged suites which could - Must have sync clients for Linux, macOS, and Windows. - Must support document and spreadsheet editing. - Must support real-time document collaboration. -- Must support exporting documents to standard document formats (e.g. ODF). +- Must support exporting documents to standard document formats (e.g., ODF). #### Best-Case From 44c316fa2c0588fb0fdadd86c31885e50d7a2241 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 14:17:35 -0700 Subject: [PATCH 03/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/file-sharing.md | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/docs/file-sharing.md b/docs/file-sharing.md index 4ff921aa..993b995e 100644 --- a/docs/file-sharing.md +++ b/docs/file-sharing.md @@ -20,19 +20,21 @@ If you already use [Proton Drive](cloud.md#proton-drive)[^1] or have a [Bitwarde ![Send logo](assets/img/file-sharing-sync/send.svg){ align=right } -**Send** is a fork of Mozilla's discontinued Firefox Send service which allows you to send files to others with a link. Files are encrypted on your device so that they cannot be read by the server, and they can be optionally password-protected as well. The maintainer of Send hosts a [public instance](https://send.vis.ee). You can use other public instances, or you can host Send yourself. +**Send** is a fork of Mozilla's discontinued Firefox Send service which allows you to send files to others with a link. Files are encrypted on your device so that they cannot be read by the server, and they can be optionally password-protected as well. + +The maintainer of Send hosts a [public instance](https://send.vis.ee). You can use other public instances, or you can host Send yourself. [:octicons-home-16: Homepage](https://send.vis.ee){ .md-button .md-button--primary } -[:octicons-server-16:](https://github.com/timvisee/send-instances){ .card-link title="Public Instances"} -[:octicons-info-16:](https://github.com/timvisee/send#readme){ .card-link title=Documentation} +[:octicons-server-16:](https://github.com/timvisee/send-instances){ .card-link title="Public Instances" } +[:octicons-info-16:](https://github.com/timvisee/send#readme){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/timvisee/send){ .card-link title="Source Code" } -[:octicons-heart-16:](https://github.com/sponsors/timvisee){ .card-link title=Contribute } +[:octicons-heart-16:](https://github.com/sponsors/timvisee){ .card-link title="Contribute" }
-Send can be used via its web interface or via the [ffsend](https://github.com/timvisee/ffsend) CLI. If you are familiar with the command-line and send files frequently, we recommend using the CLI client to avoid JavaScript-based encryption. You can specify the `--host` flag to use a specific server: +You can use Send via its web interface or via the [ffsend](https://github.com/timvisee/ffsend) CLI. If you are familiar with the command line and send files frequently, we recommend using the command line tool to avoid JavaScript-based encryption. You can specify the `--host` flag to use a specific server: ```bash ffsend upload --host https://send.vis.ee/ FILE @@ -48,7 +50,7 @@ ffsend upload --host https://send.vis.ee/ FILE [:octicons-home-16: Homepage](https://onionshare.org){ .md-button .md-button--primary } [:simple-torbrowser:](http://lldan5gahapx5k7iafb3s4ikijc4ni7gx5iywdflkba5y2ezyg6sjgyd.onion){ .card-link title="Onion Service" } -[:octicons-info-16:](https://docs.onionshare.org){ .card-link title=Documentation} +[:octicons-info-16:](https://docs.onionshare.org){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/onionshare/onionshare){ .card-link title="Source Code" }
@@ -133,12 +135,12 @@ We don't recommend using the [E2EE App](https://apps.nextcloud.com/apps/end_to_e ![Syncthing logo](assets/img/file-sharing-sync/syncthing.svg){ align=right } -**Syncthing** is an open-source peer-to-peer continuous file synchronization utility. It is used to synchronize files between two or more devices over the local network or the internet. Syncthing does not use a centralized server; it uses the [Block Exchange Protocol](https://docs.syncthing.net/specs/bep-v1.html#bep-v1) to transfer data between devices. All data is encrypted using TLS. +**Syncthing** is an open-source, peer-to-peer, continuous file synchronization utility. It is used to synchronize files between two or more devices over the local network or the internet. [:octicons-home-16: Homepage](https://syncthing.net){ .md-button .md-button--primary } -[:octicons-info-16:](https://docs.syncthing.net){ .card-link title=Documentation} +[:octicons-info-16:](https://docs.syncthing.net){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/syncthing){ .card-link title="Source Code" } -[:octicons-heart-16:](https://syncthing.net/donations){ .card-link title=Contribute } +[:octicons-heart-16:](https://syncthing.net/donations){ .card-link title="Contribute" }
Downloads @@ -152,6 +154,8 @@ We don't recommend using the [E2EE App](https://apps.nextcloud.com/apps/end_to_e +Syncthing does not use a centralized server; it uses the [Block Exchange Protocol](https://docs.syncthing.net/specs/bep-v1.html#bep-v1) to transfer data between devices. All data is encrypted using TLS. + ### Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. @@ -169,5 +173,5 @@ Our best-case criteria represents what we would like to see from the perfect pro - Should have mobile clients for iOS and Android which at least support document previews. - Should support photo backups from iOS and Android, and optionally support file/folder sync on Android. -[^1]: Proton Drive allows you to [share files or folders](https://proton.me/support/drive-shareable-link) by generating a shareable public link or sending a unique link to a designated email address. Public links can be protected with a password, set to expire, and completely revoked, while links shared via email can have custom permissions and be similarly revoked. Per Proton Drive's [privacy policy](https://proton.me/drive/privacy-policy), file contents, file and folder names, and thumbnail previews are end-to-end encrypted. -[^2]: With a [premium](https://bitwarden.com/help/about-bitwarden-plans/#compare-personal-plans) subscription, [Bitwarden Send](https://bitwarden.com/products/send) allows you to share files and text securely with [end-to-end encryption](https://bitwarden.com/help/send-encryption). A [password](https://bitwarden.com/help/send-privacy/#send-passwords) can be required along with the Send link. Bitwarden Send also features [automatic deletion](https://bitwarden.com/help/send-lifespan). +[^1]: Proton Drive allows you to [share files or folders](https://proton.me/support/drive-shareable-link) by generating a shareable public link or sending a unique link to a designated email address. Public links can be protected with a password, set to expire, and completely revoked, while links shared via email can have custom permissions and be similarly revoked. Per Proton Drive's [privacy policy](https://proton.me/drive/privacy-policy), file contents, file and folder names, and thumbnail previews are E2EE. +[^2]: With a [premium](https://bitwarden.com/help/about-bitwarden-plans/#compare-personal-plans) subscription, [Bitwarden Send](https://bitwarden.com/products/send) allows you to share files and text [securely with E2EE](https://bitwarden.com/help/send-encryption). A [password](https://bitwarden.com/help/send-privacy/#send-passwords) can be required along with the Send link. Bitwarden Send also features [automatic deletion](https://bitwarden.com/help/send-lifespan). From 9c2b08029c472e77d5ec0c27eec75eedeec1aa2d Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 14:35:11 -0700 Subject: [PATCH 04/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/frontends.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/frontends.md b/docs/frontends.md index 20d25318..03593e88 100644 --- a/docs/frontends.md +++ b/docs/frontends.md @@ -22,11 +22,13 @@ When you are using an instance run by someone else, make sure to read the privac ![Redlib logo](assets/img/frontends/redlib.svg){ align=right } -**Redlib** is an open-source frontend to the [Reddit](https://reddit.com) website that is also self-hostable. You can access Redlib through a number of public instances. +**Redlib** is an open-source frontend to the [Reddit](https://reddit.com) website. + +You can access Redlib through a number of public instances, with some that offer a [Tor](tor.md) onion service. [:octicons-repo-16: Repository](https://github.com/redlib-org/redlib){ .md-button .md-button--primary } [:octicons-server-16:](https://github.com/redlib-org/redlib-instances/blob/main/instances.md){ .card-link title="Public Instances" } -[:octicons-info-16:](https://github.com/redlib-org/redlib?tab=readme-ov-file#table-of-contents){ .card-link title="Documentation" } +[:octicons-info-16:](https://github.com/redlib-org/redlib#table-of-contents){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/redlib-org/redlib){ .card-link title="Source Code" } @@ -34,7 +36,7 @@ When you are using an instance run by someone else, make sure to read the privac

Note

-The [Old Reddit](https://old.reddit.com) website doesn't require as much JavaScript as the new Reddit website does, but it has recently blocked access to IP addresses reserved for public VPNs. You can use Old Reddit in conjunction with the [Tor](tor.md) Onion that was [launched in October 2022](https://forum.torproject.org/t/reddit-onion-service-launch/5305) at [https://old.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion](https://old.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion). +The [Old Reddit](https://old.reddit.com) website doesn't require as much JavaScript as the new Reddit website does, but it has recently blocked access to IP addresses reserved for public VPNs. You can access Old Reddit through their [Tor](tor.md) onion service [launched in October 2022](https://forum.torproject.org/t/reddit-onion-service-launch/5305) at [https://old.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion](https://old.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.onion).
@@ -123,7 +125,7 @@ Invidious is useful if you want to disable JavaScript in your browser, such as [ Piped requires JavaScript in order to function and there are a number of public instances. [:octicons-repo-16: Repository](https://github.com/TeamPiped/Piped){ .md-button .md-button--primary } -[:octicons-server-16:](https://github.com/TeamPiped/Piped/wiki/Instances){ .card-link title="Public Instances" } +[:octicons-server-16:](https://github.com/TeamPiped/documentation/blob/main/content/docs/public-instances/index.md){ .card-link title="Public Instances" } [:octicons-info-16:](https://docs.piped.video/docs){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/TeamPiped/Piped){ .card-link title="Source Code" } [:octicons-heart-16:](https://github.com/TeamPiped/Piped#donations){ .card-link title="Contribute" } @@ -182,7 +184,7 @@ By default, FreeTube blocks all YouTube advertisements. In addition, FreeTube op ![Yattee logo](assets/img/frontends/yattee.svg){ align=right } -**Yattee** is a free and open-source privacy oriented video player for iOS, tvOS, and macOS for [YouTube](https://youtube.com). Due to App Store restrictions, you will need to take a few [extra steps](https://web.archive.org/web/20230330122839/https://gonzoknows.com/posts/Yattee) before you can use Yattee to watch YouTube. Yattee allows you to connect to instances of [Invidious](#invidious) or [Piped](#piped). +**Yattee** is a free and open-source, privacy-oriented video player for iOS, tvOS, and macOS for [YouTube](https://youtube.com). Due to App Store restrictions, you will need to take a few [extra steps](https://web.archive.org/web/20230330122839/https://gonzoknows.com/posts/Yattee) before you can use Yattee to watch YouTube. Yattee allows you to connect to instances of [Invidious](#invidious) or [Piped](#piped). When using Yattee, your subscription list is saved locally on your device. @@ -276,7 +278,7 @@ Your subscription list and playlists are saved locally on your Android device.

Warning

-When using NewPipe, your IP address will be visible to the video providers used. Consider using a [VPN](vpn.md) or [Tor](tor.md) if your [threat model](basics/threat-modeling.md) requires hiding your IP address. +When using NewPipe, your IP address will be visible to the video providers you access. Consider using a [VPN](vpn.md) or [Tor](tor.md) if your [threat model](basics/threat-modeling.md) requires hiding your IP address.
From af5a99221a70fdc2b9bb9a6a33691b0e1b4989ed Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 14:39:52 -0700 Subject: [PATCH 05/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/language-tools.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/language-tools.md b/docs/language-tools.md index 160d8923..41d58143 100644 --- a/docs/language-tools.md +++ b/docs/language-tools.md @@ -9,7 +9,7 @@ cover: language-tools.webp - [:material-server-network: Service Providers](basics/common-threats.md#privacy-from-service-providers){ .pg-teal } - [:material-account-cash: Surveillance Capitalism](basics/common-threats.md#surveillance-as-a-business-model){ .pg-brown } -Text inputted to grammar, spelling, and style checkers, as well as translation services, can contain sensitive information which may be stored on their servers for an indefinite amount of time and sold to third parties. The language tools listed on this page do not store your submitted text to a server, and can be self-hosted and used offline for maximum control of your data. +Text inputted to grammar, spelling, and style checkers, as well as translation services, can contain sensitive information which may be stored on their servers for an indefinite amount of time and sold to third parties. The language tools listed on this page do not store your submitted text on a server and can be self-hosted and used offline for maximum control of your data. ## LanguageTool @@ -32,7 +32,7 @@ Text inputted to grammar, spelling, and style checkers, as well as translation s - [:fontawesome-brands-windows: Windows](https://languagetool.org/windows-desktop) - [:simple-apple: macOS](https://languagetool.org/mac-desktop) - [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/languagetool) -- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/grammar-and-spell-checker/oldceeleldhonbafppcapldpdifcinji) +- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/oldceeleldhonbafppcapldpdifcinji) - [:fontawesome-brands-edge: Edge](https://microsoftedge.microsoft.com/addons/detail/hfjadhjooeceemgojogkhlppanjkbobc) - [:simple-safari: Safari](https://apps.apple.com/app/id1534275760) From b238bb008b4815dc13d21a7b673ec06402350801 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 14:41:15 -0700 Subject: [PATCH 06/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/language-tools.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/language-tools.md b/docs/language-tools.md index 41d58143..bc280d8f 100644 --- a/docs/language-tools.md +++ b/docs/language-tools.md @@ -22,7 +22,7 @@ Text inputted to grammar, spelling, and style checkers, as well as translation s [:octicons-home-16: Homepage](https://languagetool.org){ .md-button .md-button--primary } [:octicons-eye-16:](https://languagetool.org/legal/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://languagetooler.freshdesk.com/en/support/solutions){ .card-link title=Documentation} +[:octicons-info-16:](https://languagetooler.freshdesk.com/en/support/solutions){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/languagetool-org){ .card-link title="Source Code" }
From c9ee1bfa47eb1b2676f285a0a9eab324625a4577 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 14:51:25 -0700 Subject: [PATCH 07/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/news-aggregators.md | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/docs/news-aggregators.md b/docs/news-aggregators.md index 54c755d8..02500346 100644 --- a/docs/news-aggregators.md +++ b/docs/news-aggregators.md @@ -41,7 +41,7 @@ A **news aggregator** is software which aggregates digital content from online n ![NewsFlash logo](assets/img/news-aggregators/newsflash.png){ align=right } -**NewsFlash** is an open-source, modern, and easy-to-use news feed reader for Linux. It can be used offline or used with services like [Nextcloud News](https://apps.nextcloud.com/apps/news) or [Inoreader](https://inoreader.com). It has a search feature and a pre-defined list of sources that you can add directly. +**NewsFlash** is an open-source, modern, and easy-to-use news feed reader for Linux. It can be used offline or with services like [Nextcloud News](https://apps.nextcloud.com/apps/news) or [Inoreader](https://inoreader.com). It has a search feature and a pre-defined list of sources that you can add directly. [:octicons-repo-16: Repository](https://gitlab.com/news-flash/news_flash_gtk){ .md-button .md-button--primary } [:octicons-code-16:](https://gitlab.com/news-flash/news_flash_gtk){ .card-link title="Source Code" } @@ -61,7 +61,9 @@ A **news aggregator** is software which aggregates digital content from online n ![Feeder logo](assets/img/news-aggregators/feeder.png){ align=right } -**Feeder** is a modern RSS client for Android that has many [features](https://github.com/spacecowboy/Feeder#features) and works well with folders of RSS feeds. It supports [RSS](https://en.wikipedia.org/wiki/RSS), [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)), [RDF](https://en.wikipedia.org/wiki/RDF%2FXML), and [JSON Feed](https://en.wikipedia.org/wiki/JSON_Feed). +**Feeder** is a modern RSS client for Android that has many [features](https://github.com/spacecowboy/Feeder#features) and works well with folders of RSS feeds. + +It supports [RSS](https://en.wikipedia.org/wiki/RSS), [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)), [RDF](https://en.wikipedia.org/wiki/RDF%2FXML), and [JSON Feed](https://en.wikipedia.org/wiki/JSON_Feed). [:octicons-repo-16: Repository](https://github.com/spacecowboy/Feeder){ .md-button .md-button--primary } [:octicons-code-16:](https://github.com/spacecowboy/Feeder){ .card-link title="Source Code" } @@ -84,10 +86,12 @@ A **news aggregator** is software which aggregates digital content from online n ![Miniflux logo](assets/img/news-aggregators/miniflux.svg#only-light){ align=right } ![Miniflux logo](assets/img/news-aggregators/miniflux-dark.svg#only-dark){ align=right } -**Miniflux** is a web-based news aggregator that you can self-host. It supports [RSS](https://en.wikipedia.org/wiki/RSS), [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)), [RDF](https://en.wikipedia.org/wiki/RDF%2FXML), and [JSON Feed](https://en.wikipedia.org/wiki/JSON_Feed). +**Miniflux** is a web-based news aggregator that you can self-host. + +It supports [RSS](https://en.wikipedia.org/wiki/RSS), [Atom](https://en.wikipedia.org/wiki/Atom_(Web_standard)), [RDF](https://en.wikipedia.org/wiki/RDF%2FXML), and [JSON Feed](https://en.wikipedia.org/wiki/JSON_Feed). [:octicons-home-16: Homepage](https://miniflux.app){ .md-button .md-button--primary } -[:octicons-info-16:](https://miniflux.app/docs/index){ .card-link title="Documentation" } +[:octicons-info-16:](https://miniflux.app/docs/index#user-guide){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/miniflux/v2){ .card-link title="Source Code" } [:octicons-heart-16:](https://miniflux.app/#donations){ .card-link title="Contribute" } @@ -99,7 +103,9 @@ A **news aggregator** is software which aggregates digital content from online n ![NetNewsWire logo](assets/img/news-aggregators/netnewswire.png){ align=right } -**NetNewsWire** is a free and open-source feed reader for macOS and iOS with a focus on a native design and feature set. It supports the typical feed formats alongside built-in support for Reddit feeds. +**NetNewsWire** is a free and open-source feed reader for macOS and iOS with a focus on a native design and feature set. + +It supports conventional feed formats and includes built-in support for Reddit feeds. [:octicons-home-16: Homepage](https://netnewswire.com){ .md-button .md-button--primary } [:octicons-eye-16:](https://netnewswire.com/privacypolicy){ .card-link title="Privacy Policy" } @@ -125,7 +131,7 @@ A **news aggregator** is software which aggregates digital content from online n **Newsboat** is an RSS/Atom feed reader for the text console. It's an actively maintained fork of [Newsbeuter](https://en.wikipedia.org/wiki/Newsbeuter). It is very lightweight and ideal for use over [Secure Shell](https://en.wikipedia.org/wiki/Secure_Shell). [:octicons-home-16: Homepage](https://newsboat.org){ .md-button .md-button--primary } -[:octicons-info-16:](https://newsboat.org/releases/2.37/docs/newsboat.html){ .card-link title="Documentation" } +[:octicons-info-16:](https://newsboat.org/releases/2.38/docs/newsboat.html){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/newsboat/newsboat){ .card-link title="Source Code" } @@ -163,7 +169,7 @@ You can subscribe to YouTube channels without logging in and associating usage i

Example

-To subscribe to a YouTube channel with an RSS client, first look for its [channel code](https://support.google.com/youtube/answer/6180214). The channel code can be found on the about page of the YouTube channel you wish to subscribe to, under: **About** → **Share** → **Copy channel ID**. Replace `[CHANNEL ID]` below: +To subscribe to a YouTube channel with an RSS client, first look for its [channel code](https://support.google.com/youtube/answer/6180214). The channel code can be found in the expanded description (i.e., the "About" section) of the YouTube channel you wish to subscribe to: **About** → **Share channel** → **Copy channel ID**. Replace `[CHANNEL ID]` below: ```text https://youtube.com/feeds/videos.xml?channel_id=[CHANNEL ID] From b0c6d56f290c0630cd3995c72092c15e4848aff1 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 15:24:48 -0700 Subject: [PATCH 08/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/notebooks.md | 53 +++++++++++++++++++++++++++-------------------- 1 file changed, 30 insertions(+), 23 deletions(-) diff --git a/docs/notebooks.md b/docs/notebooks.md index 21cf57b5..ef5a7b66 100644 --- a/docs/notebooks.md +++ b/docs/notebooks.md @@ -1,7 +1,7 @@ --- title: "Notebooks" icon: material/notebook-edit-outline -description: These encrypted note-taking apps let you keep track of your notes without giving them to a third-party. +description: These encrypted note-taking apps let you keep track of your notes without giving them to a third party. cover: notebooks.webp --- Protects against the following threat(s): @@ -10,7 +10,7 @@ cover: notebooks.webp Keep track of your notes and journals without giving them to a third party. -If you are currently using an application like Evernote, Google Keep, or Microsoft OneNote, we suggest you pick an alternative here that supports E2EE. +If you are currently using an application like Evernote, Google Keep, or Microsoft OneNote, we suggest you pick an alternative here that supports end-to-end encryption. ## Cloud-based @@ -20,13 +20,15 @@ If you are currently using an application like Evernote, Google Keep, or Microso ![Standard Notes logo](assets/img/notebooks/standard-notes.svg){ align=right } -**Standard Notes** is a simple and private notes app that makes your notes easy and available everywhere you are. It features E2EE on every platform, and a powerful desktop experience with themes and custom editors. It has also been [independently audited](https://standardnotes.com/help/2/has-standard-notes-completed-a-third-party-security-audit). +**Standard Notes** is a simple and private notes app that features cross-platform sync for seamless use. It features E2EE on every platform, and a powerful desktop experience with themes and custom editors. + +Standard Notes has also undergone multiple [independent audits](https://standardnotes.com/help/2/has-standard-notes-completed-a-third-party-security-audit). [:octicons-home-16: Homepage](https://standardnotes.com){ .md-button .md-button--primary } [:octicons-eye-16:](https://standardnotes.com/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://standardnotes.com/help){ .card-link title=Documentation} +[:octicons-info-16:](https://standardnotes.com/help){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/standardnotes){ .card-link title="Source Code" } -[:octicons-heart-16:](https://standardnotes.com/donate){ .card-link title=Contribute } +[:octicons-heart-16:](https://standardnotes.com/donate){ .card-link title="Contribute" }
Downloads @@ -37,7 +39,7 @@ If you are currently using an application like Evernote, Google Keep, or Microso - [:fontawesome-brands-windows: Windows](https://standardnotes.com) - [:simple-apple: macOS](https://standardnotes.com) - [:simple-linux: Linux](https://standardnotes.com) -- [:octicons-globe-16: Web](https://app.standardnotes.com) +- [:octicons-browser-16: Web](https://app.standardnotes.com)
@@ -51,13 +53,15 @@ Standard Notes has [joined Proton AG](https://standardnotes.com/blog/joining-for ![Notesnook logo](assets/img/notebooks/notesnook.svg){ align=right } -**Notesnook** is a free (as in speech) & open-source note-taking app focused on user privacy & ease of use. It features end-to-end encryption on all platforms with a powerful sync to take your notes on the go. You can easily import your notes from Evernote, OneNote & a lot of other apps using their [official importer](https://importer.notesnook.com). +**Notesnook** is a free (as in speech) and open-source E2EE note-taking app focused on user privacy and ease-of-use. + +It features sync functionality that allows you to access your notes on multiple platforms. You can easily import your notes from Evernote, OneNote, and other apps using their [official importer](https://importer.notesnook.com). [:octicons-home-16: Homepage](https://notesnook.com){ .md-button .md-button--primary } [:octicons-eye-16:](https://notesnook.com/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://help.notesnook.com){ .card-link title=Documentation} +[:octicons-info-16:](https://help.notesnook.com){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/streetwriters/notesnook){ .card-link title="Source Code" } -[:octicons-heart-16:](https://github.com/streetwriters/notesnook/blob/master/CONTRIBUTING.md){ .card-link title=Contribute } +[:octicons-heart-16:](https://opencollective.com/notesnook){ .card-link title="Contribute" }
Downloads @@ -69,8 +73,8 @@ Standard Notes has [joined Proton AG](https://standardnotes.com/blog/joining-for - [:simple-apple: macOS](https://notesnook.com/downloads) - [:simple-linux: Linux](https://notesnook.com/downloads) - [:simple-firefoxbrowser: Firefox](https://notesnook.com/notesnook-web-clipper) -- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/notesnook-web-clipper/kljhpemdlcnjohmfmkogahelkcidieaj) -- [:octicons-globe-16: Web](https://app.notesnook.com) +- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/kljhpemdlcnjohmfmkogahelkcidieaj) +- [:octicons-browser-16: Web](https://app.notesnook.com) - [:simple-flathub: Flathub](https://flathub.org/apps/com.notesnook.Notesnook)
@@ -83,13 +87,15 @@ Standard Notes has [joined Proton AG](https://standardnotes.com/blog/joining-for ![Joplin logo](assets/img/notebooks/joplin.svg){ align=right } -**Joplin** is a free, open-source, and fully-featured note-taking and to-do application which can handle numerous markdown notes organized into notebooks and tags. It offers E2EE and can sync through Nextcloud, Dropbox, and more. It also offers easy import from Evernote and plain-text notes. +**Joplin** is a free, open-source, and fully-featured E2EE note-taking and to-do application which can handle numerous markdown notes organized into notebooks and tags. + +It can sync through Nextcloud, Dropbox, and more. It also offers easy import from Evernote and plain-text notes. [:octicons-home-16: Homepage](https://joplinapp.org){ .md-button .md-button--primary } [:octicons-eye-16:](https://joplinapp.org/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://joplinapp.org/help){ .card-link title=Documentation} +[:octicons-info-16:](https://joplinapp.org/help){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/laurent22/joplin){ .card-link title="Source Code" } -[:octicons-heart-16:](https://joplinapp.org/donate){ .card-link title=Contribute } +[:octicons-heart-16:](https://joplinapp.org/donate){ .card-link title="Contribute" }
Downloads @@ -101,14 +107,13 @@ Standard Notes has [joined Proton AG](https://standardnotes.com/blog/joining-for - [:simple-apple: macOS](https://joplinapp.org/#desktop-applications) - [:simple-linux: Linux](https://joplinapp.org/#desktop-applications) - [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/joplin-web-clipper) -- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/joplin-web-clipper/alofnhikmmkdbbbgpnglcpdollgjjfek) +- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/alofnhikmmkdbbbgpnglcpdollgjjfek)
-Joplin does not [support](https://github.com/laurent22/joplin/issues/289) password/PIN protection for the application itself or individual notes and notebooks. However, your data is still encrypted in transit and at the sync location using your master key. -Since January 2023, Joplin [supports biometrics](https://github.com/laurent22/joplin/commit/f10d9f75b055d84416053fab7e35438f598753e9) app lock for Android and iOS. +Joplin [does not support](https://github.com/laurent22/joplin/issues/289) password/PIN protection for the application itself or individual notes and notebooks. However, your data is still encrypted in transit and at the sync location using your master key. Since January 2023, Joplin [supports biometrics app lock](https://github.com/laurent22/joplin/commit/f10d9f75b055d84416053fab7e35438f598753e9) for Android and iOS. ### Cryptee @@ -117,11 +122,13 @@ Since January 2023, Joplin [supports biometrics](https://github.com/laurent22/jo ![Cryptee logo](./assets/img/notebooks/cryptee.svg#only-light){ align=right } ![Cryptee logo](./assets/img/notebooks/cryptee-dark.svg#only-dark){ align=right } -**Cryptee** is an open-source, web-based E2EE document editor and photo storage application. Cryptee is a PWA, which means that it works seamlessly across all modern devices without requiring native apps for each respective platform. +**Cryptee** is an open-source, web-based E2EE document editor and photo storage application. + +Cryptee offers 100 MB of storage for free, with paid options if you need more. Sign-up doesn't require an e-mail or other personally identifiable information. [:octicons-home-16: Homepage](https://crypt.ee){ .md-button .md-button--primary } [:octicons-eye-16:](https://crypt.ee/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://crypt.ee/help){ .card-link title=Documentation} +[:octicons-info-16:](https://crypt.ee/help){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/cryptee){ .card-link title="Source Code" }
@@ -133,7 +140,7 @@ Since January 2023, Joplin [supports biometrics](https://github.com/laurent22/jo -Cryptee offers 100 MB of storage for free, with paid options if you need more. Sign-up doesn't require an e-mail or other personally identifiable information. +Cryptee is a PWA, which means that it works seamlessly across all modern devices without requiring native apps for each respective platform. ## Local notebooks @@ -143,12 +150,12 @@ Cryptee offers 100 MB of storage for free, with paid options if you need more. ![Org-mode logo](assets/img/notebooks/org-mode.svg){ align=right } -**Org-mode** is a [major mode](https://gnu.org/software/emacs/manual/html_node/elisp/Major-Modes.html) for GNU Emacs. Org-mode is for keeping notes, maintaining to-do lists, planning projects, and authoring documents with a fast and effective plain-text system. Synchronization is possible with [file synchronization](file-sharing.md#file-sync) tools. +**Org-mode** is a [major mode](https://gnu.org/software/emacs/manual/html_node/elisp/Major-Modes.html) for GNU Emacs. Org-mode is for keeping notes, maintaining to-do lists, planning projects, and authoring documents with a fast and effective plain-text system. File synchronization is possible with tools like [Syncthing](file-sharing.md#syncthing-p2p). [:octicons-home-16: Homepage](https://orgmode.org){ .md-button .md-button--primary } -[:octicons-info-16:](https://orgmode.org/manuals.html){ .card-link title=Documentation} +[:octicons-info-16:](https://orgmode.org/manuals.html){ .card-link title="Documentation" } [:octicons-code-16:](https://git.savannah.gnu.org/cgit/emacs/org-mode.git){ .card-link title="Source Code" } -[:octicons-heart-16:](https://liberapay.com/bzg){ .card-link title=Contribute } +[:octicons-heart-16:](https://liberapay.com/bzg){ .card-link title="Contribute" }
From c13b6a9ad6365090dbc0ff5971513eba2f0b40bb Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 15:37:46 -0700 Subject: [PATCH 09/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/passwords.md | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/docs/passwords.md b/docs/passwords.md index e5b65b28..7dac7fef 100644 --- a/docs/passwords.md +++ b/docs/passwords.md @@ -127,14 +127,14 @@ schema: **Password managers** allow you to securely store and manage passwords and other credentials with the use of a master password. -[Introduction to Passwords :material-arrow-right-drop-circle:](./basics/passwords-overview.md) +[Introduction to Passwords :material-arrow-right-drop-circle:](basics/passwords-overview.md)

Info

Built-in password managers in software like browsers and operating systems are sometimes not as good as dedicated password manager software. The advantage of a built-in password manager is good integration with the software, but it can often be very simple and lack privacy and security features that standalone offerings have. -For example, the password manager in Microsoft Edge doesn't offer E2EE at all. Google's password manager has [optional](https://support.google.com/accounts/answer/11350823) E2EE, and [Apple's](https://support.apple.com/HT202303) offers E2EE by default. +For example, the password manager in Microsoft Edge doesn't offer end-to-end encryption at all. Google's password manager has [optional](https://support.google.com/accounts/answer/11350823) E2EE, and [Apple's](https://support.apple.com/HT202303) offers E2EE by default.
@@ -166,15 +166,15 @@ These password managers sync your passwords to a cloud server for easy accessibi - [:simple-linux: Linux](https://bitwarden.com/download) - [:simple-flathub: Flathub](https://flathub.org/apps/details/com.bitwarden.desktop) - [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/bitwarden-password-manager) -- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/bitwarden-free-password-m/nngceckbapebfimnlniiiahkandclblb) +- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/nngceckbapebfimnlniiiahkandclblb) - [:fontawesome-brands-edge: Edge](https://microsoftedge.microsoft.com/addons/detail/jbkfoedolllekgbhcbcoahefnbanhhlh) -- [:simple-safari: Safari](https://apps.apple.com/us/app/bitwarden/id1352778147) +- [:simple-safari: Safari](https://apps.apple.com/app/id1352778147)
-Bitwarden uses [PBKDF2](https://bitwarden.com/help/kdf-algorithms/#pbkdf2) as its key derivation function (KDF) algorithm by default. It also offers [Argon2](https://bitwarden.com/help/kdf-algorithms/#argon2id), which is more secure, as an alternative. You can change your account's KDF algorithm in the web vault. +Bitwarden uses [PBKDF2](https://bitwarden.com/help/kdf-algorithms/#pbkdf2) as its key derivation function (KDF) algorithm by default. It also offers [Argon2](https://bitwarden.com/help/kdf-algorithms/#argon2id), which is more secure, as an alternative. You can change your account's KDF algorithm in the web vault: - [x] Select **Settings > Security > Keys > KDF algorithm > Argon2id** @@ -204,11 +204,11 @@ Bitwarden's server-side code is [open source](https://github.com/bitwarden/serve Downloads - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=proton.android.pass) -- [:simple-appstore: App Store](https://apps.apple.com/us/app/proton-pass-password-manager/id6443490629) +- [:simple-appstore: App Store](https://apps.apple.com/app/id6443490629) - [:fontawesome-brands-windows: Windows](https://proton.me/pass/download) - [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/proton-pass) -- [:simple-googlechrome: Chrome](https://chromewebstore.google.com/detail/proton-pass-free-password/ghmbeldphafepmbegfdlkpapadhbakde) -- [:fontawesome-brands-edge: Edge](https://chromewebstore.google.com/detail/proton-pass-free-password/ghmbeldphafepmbegfdlkpapadhbakde) +- [:simple-googlechrome: Chrome](https://chromewebstore.google.com/detail/ghmbeldphafepmbegfdlkpapadhbakde) +- [:fontawesome-brands-edge: Edge](https://microsoftedge.microsoft.com/addons/detail/gcllgfdnfnllodcaambdaknbipemelie) - [:octicons-browser-16: Web](https://pass.proton.me)
@@ -229,7 +229,9 @@ All issues were addressed and fixed shortly after the [report](https://res.cloud ![1Password logo](assets/img/password-management/1password.svg){ align=right } -**1Password** is a password manager with a strong focus on security and ease-of-use that allows you to store passwords, passkeys, credit cards, software licenses, and any other sensitive information in a secure digital vault. Your vault is hosted on 1Password's servers for a [monthly fee](https://1password.com/sign-up). 1Password is [audited](https://support.1password.com/security-assessments) on a regular basis and provides exceptional customer support. 1Password is closed source; however, the security of the product is thoroughly documented in their [security white paper](https://1passwordstatic.com/files/security/1password-white-paper.pdf). +**1Password** is a password manager with a strong focus on security and ease-of-use that allows you to store passwords, passkeys, credit cards, software licenses, and any other sensitive information in a secure digital vault. Your vault is hosted on 1Password's servers for a [monthly fee](https://1password.com/sign-up). + +1Password is [audited](https://support.1password.com/security-assessments) on a regular basis and provides exceptional customer support. 1Password is closed source; however, the security of the product is thoroughly documented in their [security white paper](https://1passwordstatic.com/files/security/1password-white-paper.pdf). [:octicons-home-16: Homepage](https://1password.com){ .md-button .md-button--primary } [:octicons-eye-16:](https://1password.com/legal/privacy){ .card-link title="Privacy Policy" } @@ -244,16 +246,16 @@ All issues were addressed and fixed shortly after the [report](https://res.cloud - [:simple-apple: macOS](https://1password.com/downloads/mac) - [:simple-linux: Linux](https://1password.com/downloads/linux) - [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/1password-x-password-manager) -- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/1password-%E2%80%93-password-mana/aeblfdkhhhdcdjpifhhbdiojplfjncoa) +- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/aeblfdkhhhdcdjpifhhbdiojplfjncoa) - [:fontawesome-brands-edge: Edge](https://microsoftedge.microsoft.com/addons/detail/dppgmdbiimibapkepcbdbmkaabgiofem) -- [:simple-safari: Safari](https://apps.apple.com/us/app/1password-for-safari/id1569813296) +- [:simple-safari: Safari](https://apps.apple.com/app/id1569813296) - [:octicons-browser-16: Web](https://my.1password.com/signin)
-Traditionally, 1Password has offered the best password manager user experience for people using macOS and iOS; however, it has now achieved feature parity across all platforms. 1Password's clients boast many features geared towards families and less technical people, such as an intuitive UI for ease of use and navigation, as well as advanced functionality. Notably, nearly every feature of 1Password is available within its native mobile or desktop clients. +Traditionally, 1Password has offered the best password manager user experience for people using macOS and iOS; however, it has now achieved feature parity across all platforms. 1Password's clients boast many features geared towards families and less technical people, such as an intuitive UI for ease-of-use and navigation, as well as advanced functionality. Notably, nearly every feature of 1Password is available within its native mobile or desktop clients. Your 1Password vault is secured with both your master password and a randomized 34-character security key to encrypt your data on their servers. This security key adds a layer of protection to your data because your data is secured with high entropy regardless of your master password. Many other password manager solutions are entirely reliant on the strength of your master password to secure your data. @@ -276,7 +278,7 @@ Your 1Password vault is secured with both your master password and a randomized - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.psono.psono) - [:simple-appstore: App Store](https://apps.apple.com/app/id1545581224) - [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/psono-pw-password-manager) -- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/psonopw-password-manager/eljmjmgjkbmpmfljlmklcfineebidmlo) +- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/eljmjmgjkbmpmfljlmklcfineebidmlo) - [:simple-docker: Docker Hub](https://hub.docker.com/r/psono/psono-client) @@ -330,9 +332,9 @@ These options allow you to manage an encrypted password database locally. - [:fontawesome-brands-windows: Windows](https://keepassxc.org/download/#windows) - [:simple-apple: macOS](https://keepassxc.org/download/#mac) - [:simple-linux: Linux](https://keepassxc.org/download/#linux) -- [:simple-flathub: Flatpak](https://flathub.org/apps/details/org.keepassxc.KeePassXC) +- [:simple-flathub: Flathub](https://flathub.org/apps/details/org.keepassxc.KeePassXC) - [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/keepassxc-browser) -- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/keepassxc-browser/oboonakemofpalcgghocfoadofidjkkk) +- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/oboonakemofpalcgghocfoadofidjkkk) @@ -346,7 +348,7 @@ KeePassXC stores its export data as [CSV](https://en.wikipedia.org/wiki/Comma-se ![KeePassDX logo](assets/img/password-management/keepassdx.svg){ align=right } -**KeePassDX** is a lightweight password manager for Android; it allows for editing encrypted data in a single file in KeePass format and can fill in forms securely. The [pro version](https://play.google.com/store/apps/details?id=com.kunzisoft.keepass.pro) of the app allows you to unlock cosmetic content and non-standard protocol features, but more importantly, it helps and encourages development. +**KeePassDX** is a lightweight password manager for Android; it allows for editing encrypted data in a single file in KeePass format and can fill in forms securely. [:octicons-home-16: Homepage](https://keepassdx.com){ .md-button .md-button--primary } [:octicons-info-16:](https://github.com/Kunzisoft/KeePassDX/wiki){ .card-link title="Documentation" } @@ -363,6 +365,8 @@ KeePassXC stores its export data as [CSV](https://en.wikipedia.org/wiki/Comma-se +The [pro version](https://play.google.com/store/apps/details?id=com.kunzisoft.keepass.pro) of the app allows you to unlock cosmetic content and non-standard protocol features, but more importantly, it helps and encourages development. + ### gopass (CLI)
From 4d776542befa1707f96023df6348ef1758e72448 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 15:42:29 -0700 Subject: [PATCH 10/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/notebooks.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/notebooks.md b/docs/notebooks.md index ef5a7b66..64d92e22 100644 --- a/docs/notebooks.md +++ b/docs/notebooks.md @@ -72,10 +72,10 @@ It features sync functionality that allows you to access your notes on multiple - [:fontawesome-brands-windows: Windows](https://notesnook.com/downloads) - [:simple-apple: macOS](https://notesnook.com/downloads) - [:simple-linux: Linux](https://notesnook.com/downloads) +- [:simple-flathub: Flathub](https://flathub.org/apps/com.notesnook.Notesnook) - [:simple-firefoxbrowser: Firefox](https://notesnook.com/notesnook-web-clipper) - [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/kljhpemdlcnjohmfmkogahelkcidieaj) - [:octicons-browser-16: Web](https://app.notesnook.com) -- [:simple-flathub: Flathub](https://flathub.org/apps/com.notesnook.Notesnook) @@ -134,7 +134,7 @@ Cryptee offers 100 MB of storage for free, with paid options if you need more.
Downloads -- [:octicons-globe-16: PWA](https://crypt.ee/download) +- [:octicons-browser-16: Web](https://crypt.ee/download)
From 0dd9d6a94bbe87dafb7ac3becdfdc812610600df Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 15:45:59 -0700 Subject: [PATCH 11/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/pastebins.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/pastebins.md b/docs/pastebins.md index 4f4e37d0..bf033ed2 100644 --- a/docs/pastebins.md +++ b/docs/pastebins.md @@ -16,11 +16,11 @@ cover: pastebins.webp ![PrivateBin logo](assets/img/pastebins/privatebin.svg){ align=right } -**PrivateBin** is a minimalist, open-source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256-bit AES. It is the improved version of ZeroBin. +**PrivateBin** is a minimalist, open-source, online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256-bit AES. It is the improved version of ZeroBin. [:octicons-home-16: Homepage](https://privatebin.info){ .md-button .md-button--primary } [:octicons-server-16:](https://privatebin.info/directory){ .card-link title="Public Instances"} -[:octicons-info-16:](https://github.com/PrivateBin/PrivateBin/wiki/FAQ){ .card-link title=Documentation} +[:octicons-info-16:](https://github.com/PrivateBin/PrivateBin/wiki/FAQ){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/PrivateBin/PrivateBin){ .card-link title="Source Code" }
@@ -48,11 +48,11 @@ cover: pastebins.webp ### Minimum Requirements - Must be open source. -- Must implement "zero-trust" end-to-end encryption. +- Must implement "zero-trust" E2EE. - Must support password-protected files. ### Best-Case Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page. -- Should have a published audit from a reputable, independent third-party. +- Should have a published audit from a reputable, independent third party. From b5330dbd2f65524febdf17c902d30dd356b50e85 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 15:53:58 -0700 Subject: [PATCH 12/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/photo-management.md | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/docs/photo-management.md b/docs/photo-management.md index 4bf2fc0e..aa1212bf 100644 --- a/docs/photo-management.md +++ b/docs/photo-management.md @@ -1,7 +1,7 @@ --- title: "Photo Management" icon: material/image -description: Photo management tools to keep your personal photos safe from the prying eyes of cloud storage providers and other unauthorized access. +description: These photo management tools keep your personal photos safe from the prying eyes of cloud storage providers and other unauthorized parties. cover: photo-management.webp --- Protects against the following threat(s): @@ -18,24 +18,26 @@ Most cloud **photo management solutions** like Google Photos, Flickr, and Amazon ![Ente logo](assets/img/photo-management/ente.svg#only-light){ align=right } ![Ente logo](assets/img/photo-management/ente-dark.svg#only-dark){ align=right } -**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open-source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). The free plan offers 5 GB of storage as long as you use the service at least once a year. +**Ente Photos** is an end-to-end encrypted photo backup service which supports automatic backups on iOS and Android. Their code is fully open source, both on the client side and on the server side. It is also [self-hostable](https://github.com/ente-io/ente/tree/main/server#self-hosting). + +The free plan offers 5 GB of storage as long as you use the service at least once a year. [:octicons-home-16: Homepage](https://ente.io){ .md-button .md-button--primary } [:octicons-eye-16:](https://ente.io/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://ente.io/faq){ .card-link title=Documentation} +[:octicons-info-16:](https://ente.io/faq){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/ente-io/ente){ .card-link title="Source Code" }
Downloads - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=io.ente.photos) -- [:simple-android: Android](https://ente.io/download) - [:simple-appstore: App Store](https://apps.apple.com/app/id1542026904) - [:simple-github: GitHub](https://github.com/ente-io/ente/releases?q=photos) +- [:simple-android: Android](https://ente.io/download) - [:fontawesome-brands-windows: Windows](https://ente.io/download) - [:simple-apple: macOS](https://ente.io/download) - [:simple-linux: Linux](https://ente.io/download) -- [:octicons-globe-16: Web](https://web.ente.io) +- [:octicons-browser-16: Web](https://web.ente.io)
@@ -50,18 +52,19 @@ Ente Photos underwent an [audit by Cure53](https://ente.io/blog/cryptography-aud ![Stingle logo](assets/img/photo-management/stingle.png#only-light){ align=right } ![Stingle logo](assets/img/photo-management/stingle-dark.png#only-dark){ align=right } -**Stingle** is a gallery and camera application with built-in, end-to-end encrypted backup and sync functionality for your photos and videos. Storage starts at 1 GB for free accounts on their cloud, or you can host your own Stingle API server for total independence. +**Stingle** is a gallery and camera application with built-in, E2EE backup and sync functionality for your photos and videos. + +Storage starts at 1 GB for free accounts on their cloud, or you can host your own Stingle API server for total independence. [:octicons-home-16: Homepage](https://stingle.org){ .md-button .md-button--primary } [:octicons-eye-16:](https://stingle.org/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://stingle.org/faq){ .card-link title=Documentation} +[:octicons-info-16:](https://stingle.org/faq){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/stingle){ .card-link title="Source Code" }
Downloads - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=org.stingle.photos) -- [:simple-android: Android](https://f-droid.org/en/packages/org.stingle.photos) - [:simple-appstore: App Store](https://apps.apple.com/app/id1582535448) - [:simple-github: GitHub](https://github.com/stingle/stingle-photos-android/releases) @@ -97,7 +100,7 @@ Ente Photos underwent an [audit by Cure53](https://ente.io/blog/cryptography-aud ### Minimum Requirements -- Cloud-hosted providers must enforce end-to-end encryption. +- Cloud-hosted providers must enforce E2EE. - Must offer a free plan or trial period for testing. - Must support TOTP or FIDO2 multifactor authentication, or passkey logins. - Must offer a web interface which supports basic file management functionality. @@ -106,4 +109,4 @@ Ente Photos underwent an [audit by Cure53](https://ente.io/blog/cryptography-aud ### Best Case -- Should have a published audit from a reputable, independent third-party. +- Should have a published audit from a reputable, independent third party. From 4b224a4f85546e4419855ce53a8bcf80bb98c117 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 16:26:35 -0700 Subject: [PATCH 13/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/real-time-communication.md | 69 +++++++++++++++------------------ 1 file changed, 31 insertions(+), 38 deletions(-) diff --git a/docs/real-time-communication.md b/docs/real-time-communication.md index c30235d5..5596b0df 100644 --- a/docs/real-time-communication.md +++ b/docs/real-time-communication.md @@ -12,7 +12,7 @@ cover: real-time-communication.webp - [:material-eye-outline: Mass Surveillance](basics/common-threats.md#mass-surveillance-programs){ .pg-blue } - [:material-account-cash: Surveillance Capitalism](basics/common-threats.md#surveillance-as-a-business-model){ .pg-brown } -These are our recommendations for encrypted **real-time communication**. These come in the form of many [types of communication networks](./advanced/communication-network-types.md). +These are our recommendations for encrypted **real-time communication**. These come in the form of many [types of communication networks](advanced/communication-network-types.md). [:material-movie-open-play-outline: Video: It's time to stop using SMS](https://www.privacyguides.org/videos/2025/01/24/its-time-to-stop-using-sms-heres-why/){ .md-button } @@ -26,7 +26,7 @@ These messengers are great for securing your sensitive communications. ![Signal logo](assets/img/messengers/signal.svg){ align=right } -**Signal** is a mobile app developed by Signal Messenger LLC. The app provides instant messaging and calls secured with the Signal Protocol, an extremely secure encryption protocol which supports forward secrecy[^1] and post-compromise security.[^2] +**Signal** is a mobile app developed by Signal Messenger LLC. The app provides instant messaging and calls secured with the Signal protocol, an extremely secure encryption protocol which supports forward secrecy[^1] and post-compromise security.[^2] [:octicons-home-16: Homepage](https://signal.org){ .md-button .md-button--primary } [:octicons-eye-16:](https://signal.org/legal/#privacy-policy){ .card-link title="Privacy Policy" } @@ -76,7 +76,7 @@ If you use Android and your threat model requires protecting against [:material- ![Molly logo](assets/img/messengers/molly.svg){ align=right } -**Molly** is an alternative Signal client for Android which allows you to encrypt the local database with a passphrase at rest, to have unused RAM data securely shredded, to route your connection via Tor, and [more](https://blog.privacyguides.org/2022/07/07/signal-configuration-and-hardening#privacy-and-security-features). It also has usability improvements including scheduled backups, automatic locking, [UnifiedPush](https://unifiedpush.org) support, and the ability to use your Android phone as a linked device instead of the primary device for a Signal account. +**Molly** is an alternative Signal client for Android which allows you to encrypt the local database with a passphrase at rest, to have unused RAM data securely shredded, to route your connection via Tor, and [more](https://blog.privacyguides.org/2022/07/07/signal-configuration-and-hardening#privacy-and-security-features). It also has usability improvements including scheduled backups, automatic locking, and the ability to use your Android phone as a linked device instead of the primary device for a Signal account. [:octicons-home-16: Homepage](https://molly.im){ .md-button .md-button--primary } [:octicons-eye-16:](https://signal.org/legal/#privacy-policy){ .card-link title="Privacy Policy" } @@ -99,17 +99,15 @@ Molly is updated every two weeks to include the latest features and bug fixes fr Note that you are trusting multiple parties by using Molly, as you now need to trust the Signal team *and* the Molly team to deliver safe and timely updates. -There is a version of Molly called **Molly-FOSS** which removes proprietary code like the Google services used by both Signal and Molly, at the expense of some features like battery-saving push notifications via Google Play Services. You can regain push notifications without Google Play Services in either version of Molly with [UnifiedPush](https://unifiedpush.org), but it requires running a separate program called [Mollysocket](https://github.com/mollyim/mollysocket) on another device to function. Mollysocket can either be self-hosted on a separate computer or server (VPS), or alternatively a public Mollysocket instance can be used ([step-by-step tutorial, in German](https://kuketz-blog.de/messenger-wechsel-von-signal-zu-molly-unifiedpush-mollysocket-ntfy)). +There is a version of Molly called **Molly-FOSS** which removes proprietary code like the Google services used by both Signal and Molly, at the expense of some features like battery-saving push notifications via Google Play Services. You can regain push notifications without Google Play Services in either version of Molly with [UnifiedPush](https://unifiedpush.org). Using this notification delivery method requires access to a [MollySocket](https://github.com/mollyim/mollysocket) server, but you can choose a public MollySocket instance for this.[^3] -All versions of Molly provide the same security improvements. - -Molly and Molly-FOSS support [reproducible builds](https://github.com/mollyim/mollyim-android/tree/main/reproducible-builds), meaning it's possible to confirm that the compiled APKs match the source code. +All versions of Molly provide the same security improvements. Molly and Molly-FOSS support [reproducible builds](https://github.com/mollyim/mollyim-android/tree/main/reproducible-builds), meaning it's possible to confirm that the compiled APKs match the source code. ### SimpleX Chat
-![Simplex logo](assets/img/messengers/simplex.svg){ align=right } +![SimpleX Chat logo](assets/img/messengers/simplex.svg){ align=right } **SimpleX Chat** is an instant messenger that doesn't depend on any unique identifiers such as phone numbers or usernames. Its decentralized network makes SimpleX Chat an effective tool against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship){ .pg-blue-gray }. @@ -132,7 +130,7 @@ Molly and Molly-FOSS support [reproducible builds](https://github.com/mollyim/mo
-SimpleX provides direct messaging, group chats, and E2EE calls secured with the [SimpleX Messaging Protocol](https://github.com/simplex-chat/simplexmq/blob/stable/protocol/simplex-messaging.md), which uses double ratchet encryption with quantum resistance. Additionally, SimpleX Chat provides metadata protection by using unidirectional ["simplex queues"](https://github.com/simplex-chat/simplexmq/blob/stable/protocol/simplex-messaging.md#simplex-queue) to deliver messages. +SimpleX Chat provides direct messaging, group chats, and E2EE calls secured with the [SimpleX Messaging Protocol](https://github.com/simplex-chat/simplexmq/blob/stable/protocol/simplex-messaging.md), which uses double ratchet encryption with quantum resistance. Additionally, SimpleX Chat provides metadata protection by using unidirectional ["simplex queues"](https://github.com/simplex-chat/simplexmq/blob/stable/protocol/simplex-messaging.md#simplex-queue) to deliver messages. To participate in conversations on SimpleX Chat, you must scan a QR code or click an invite link. This allows you to verify a contact out-of-band, which protects against man-in-the-middle attacks by network providers. Your data can be exported and imported onto another device, as there are no central servers where this is backed up. @@ -146,13 +144,13 @@ SimpleX Chat was independently audited in [July 2024](https://simplex.chat/blog/ ![Briar logo](assets/img/messengers/briar.svg){ align=right } -**Briar** is an encrypted instant messenger that [connects](https://briarproject.org/how-it-works) to other clients using the Tor Network, making it an effective tool at circumventing [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship){ .pg-blue-gray }. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar’s local mesh mode can be useful when internet availability is a problem. +**Briar** is an encrypted instant messenger that [connects](https://briarproject.org/how-it-works) to other clients using the [Tor network](alternative-networks.md#tor), making it an effective tool at circumventing [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship){ .pg-blue-gray }. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar’s local mesh mode can be useful when internet availability is a problem. [:octicons-home-16: Homepage](https://briarproject.org){ .md-button .md-button--primary } [:octicons-eye-16:](https://briarproject.org/privacy-policy){ .card-link title="Privacy Policy" } [:octicons-info-16:](https://code.briarproject.org/briar/briar/-/wikis/home){ .card-link title="Documentation" } [:octicons-code-16:](https://code.briarproject.org/briar/briar){ .card-link title="Source Code" } -[:octicons-heart-16:](https://briarproject.org){ .card-link title="Donation options are listed on the bottom of the homepage" } +[:octicons-heart-16:](https://code.briarproject.org/briar/briar#donate){ .card-link title="Contribute" }
Downloads @@ -168,12 +166,10 @@ SimpleX Chat was independently audited in [July 2024](https://simplex.chat/blog/ To add a contact on Briar, you must both add each other first. You can either exchange `briar://` links or scan a contact’s QR code if they are nearby. +Briar has a fully [published specification](https://code.briarproject.org/briar/briar-spec). Briar supports forward secrecy[^1] by using the Bramble [Handshake](https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BHP.md) and [Transport](https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BTP.md) protocols. + The client software was independently [audited](https://briarproject.org/news/2017-beta-released-security-audit), and the anonymous routing protocol uses the Tor network which has also been audited. -Briar has a fully [published specification](https://code.briarproject.org/briar/briar-spec). - -Briar supports forward secrecy[^1] by using the Bramble [Handshake](https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BHP.md) and [Transport](https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BTP.md) protocol. - ## Additional Options
@@ -189,7 +185,7 @@ These messengers do not have forward secrecy[^1], and while they fulfill certain ![Element logo](assets/img/messengers/element.svg){ align=right } -**Element** is the flagship client for the [Matrix](https://matrix.org/docs/chat_basics/matrix-for-im) protocol, an [open standard](https://spec.matrix.org/latest) for secure decentralized real-time communication. +**Element** is the flagship client for the [Matrix](https://matrix.org/docs/chat_basics/matrix-for-im) protocol, an [open standard](https://spec.matrix.org/latest) for secure, decentralized, real-time communication. Messages and files shared in private rooms (those which require an invite) are by default E2EE, as are one-to-one voice and video calls. @@ -207,19 +203,17 @@ Messages and files shared in private rooms (those which require an invite) are b - [:fontawesome-brands-windows: Windows](https://element.io/download) - [:simple-apple: macOS](https://element.io/download) - [:simple-linux: Linux](https://element.io/download) -- [:octicons-globe-16: Web](https://app.element.io) +- [:octicons-browser-16: Web](https://app.element.io)
-Profile pictures, reactions, and nicknames are not encrypted. +With the integration of [Element Call](https://element.io/blog/we-have-lift-off-element-x-call-and-server-suite-are-ready) into Element's web app, desktop apps, and its [rewritten mobile apps](https://element.io/blog/element-x-experience-the-future-of-element), group VoIP and video calls are E2EE by default. Profile pictures, reactions, and nicknames are not encrypted. -With the integration of [Element Call](https://element.io/blog/we-have-lift-off-element-x-call-and-server-suite-are-ready) into Element's web app, desktop apps, and its [rewritten mobile apps](https://element.io/blog/element-x-experience-the-future-of-element), group VoIP and video calls are E2EE by default. +The [Olm cryptographic ratchet](https://matrix.org/docs/matrix-concepts/end-to-end-encryption) used by Matrix is an implementation of Signal’s [Double Ratchet algorithm](https://signal.org/docs/specifications/doubleratchet). The Matrix protocol itself [theoretically supports forward secrecy](https://gitlab.matrix.org/matrix-org/olm/blob/master/docs/megolm.md#partial-forward-secrecy)[^1], however this is [not currently supported in Element](https://github.com/vector-im/element-web/issues/7101) due to it breaking some aspects of the user experience such as key backups and shared message history. The specification for the Matrix protocol can be found in their [documentation](https://spec.matrix.org/latest). -The Matrix protocol itself [theoretically supports forward secrecy](https://gitlab.matrix.org/matrix-org/olm/blob/master/docs/megolm.md#partial-forward-secrecy)[^1], however this is [not currently supported in Element](https://github.com/vector-im/element-web/issues/7101) due to it breaking some aspects of the user experience such as key backups and shared message history. - -The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last) in 2016. The specification for the Matrix protocol can be found in their [documentation](https://spec.matrix.org/latest). The [Olm cryptographic ratchet](https://matrix.org/docs/matrix-concepts/end-to-end-encryption) used by Matrix is an implementation of Signal’s [Double Ratchet algorithm](https://signal.org/docs/specifications/doubleratchet). +The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last) in 2016. ### Session @@ -229,7 +223,7 @@ The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matr **Session** is a decentralized messenger with a focus on private, secure, and anonymous communications. Session offers support for direct messages, group chats, and voice calls. -Session uses the decentralized [Oxen Service Node Network](https://oxen.io) to store and route messages. Every encrypted message is routed through three nodes in the Oxen Service Node Network, making it virtually impossible for the nodes to compile meaningful information on those using the network. +One-on-one chats and closed groups (which allow for up to 100 members) are E2EE. It is also possible to [set up](https://docs.oxen.io/oxen-docs/products-built-on-oxen/session/guides/open-group-setup) or join open groups which can host thousands of members, but messages in these open groups are **not** E2EE between participants. [:octicons-home-16: Homepage](https://getsession.org){ .md-button .md-button--primary } [:octicons-eye-16:](https://getsession.org/privacy-policy){ .card-link title="Privacy Policy" } @@ -250,38 +244,37 @@ Session uses the decentralized [Oxen Service Node Network](https://oxen.io) to s -Session allows for E2EE in one-on-one chats or closed groups which allow for up to 100 members. It is also possible to [set up](https://docs.oxen.io/oxen-docs/products-built-on-oxen/session/guides/open-group-setup) or join open groups which can host thousands of members, but messages in these open groups are **not** end-to-end encrypted between participants. +Session uses the decentralized [Oxen Service Node Network](https://oxen.io) to store and route messages. Every encrypted message is routed through three nodes in the Oxen Service Node Network, making it virtually impossible for the nodes to compile meaningful information on those using the network. -Session was previously based on Signal Protocol before replacing it with their own in December 2020. Session Protocol does [not](https://getsession.org/blog/session-protocol-technical-information) support forward secrecy.[^1] +Session was previously based on the Signal protocol before replacing it with their own in December 2020. The Session protocol does [not](https://getsession.org/blog/session-protocol-technical-information) support forward secrecy.[^1] Session has a [white paper](https://arxiv.org/pdf/2002.04609.pdf) describing the technical details of the app and protocol. Oxen requested an independent audit for Session in March 2020. The audit [concluded](https://getsession.org/session-code-audit) in April 2021: > The overall security level of this application is good and makes it usable for privacy-concerned people. -Session has a [white paper](https://arxiv.org/pdf/2002.04609.pdf) describing the technical details of the app and protocol. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. ### Minimum Requirements -- Has open-source clients. -- Does not require sharing personal identifiers (phone numbers or emails in particular) with contacts. -- Uses E2EE for private messages by default. -- Supports E2EE for all messages. -- Has been independently audited. +- Must have open-source clients. +- Must not require sharing personal identifiers (phone numbers or emails in particular) with contacts. +- Must use E2EE for private messages by default. +- Must support E2EE for all messages. +- Must have a published audit from a reputable, independent third party. ### Best-Case Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page. -- Supports forward secrecy[^1] -- Supports Future Secrecy (Post-Compromise Security)[^2] -- Has open-source servers. -- Decentralized, i.e. [federated or P2P](advanced/communication-network-types.md). -- Uses E2EE for all messages by default. -- Supports Linux, macOS, Windows, Android, and iOS. +- Should support forward secrecy[^1] +- Should support Future Secrecy (Post-Compromise Security)[^2] +- Should have open-source servers. +- Should use a decentralized network, i.e. [federated or P2P](advanced/communication-network-types.md). +- Should use E2EE for all messages by default. +- Should support Linux, macOS, Windows, Android, and iOS. [^1]: [Forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy) is where keys are rotated very frequently, so that if the current encryption key is compromised, it does not expose **past** messages as well. [^2]: Future Secrecy (or Post-Compromise Security) is a feature where an attacker is prevented from decrypting **future** messages after compromising a private key, unless they compromise more session keys in the future as well. This effectively forces the attacker to intercept all communication between parties, since they lose access as soon as a key exchange occurs that is not intercepted. +[^3]: You may refer to this step-by-step tutorial in German on how to set up UnifiedPush as the notification provider for Molly: [https://kuketz-blog.de/messenger-wechsel-von-signal-zu-molly-unifiedpush-mollysocket-ntfy](https://kuketz-blog.de/messenger-wechsel-von-signal-zu-molly-unifiedpush-mollysocket-ntfy). From cd9384840f6abf4f5b06ec9be257fd3414dfc5e3 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 16:29:41 -0700 Subject: [PATCH 14/35] style: Formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/tools.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/tools.md b/docs/tools.md index abbff243..e40cb862 100644 --- a/docs/tools.md +++ b/docs/tools.md @@ -488,9 +488,9 @@ For encrypting your OS drive, we typically recommend using the encryption tool y - ![drip. logo](assets/img/health-and-wellness/drip.png){ .twemoji loading=lazy } [drip.](health-and-wellness.md#drip) - ![Euki logo](assets/img/health-and-wellness/euki.svg){ .twemoji loading=lazy } [Euki](health-and-wellness.md#euki) -- ![Apple Health logo](assets/img/health-and-wellness/apple-health.svg#only-light){ .twemoji loading=lazy } ![Apple Health logo](assets/img/health-and-wellness/apple-health-dark.svg#only-dark){ .twemoji loading=lazy }[Apple Health](health-and-wellness.md#apple-health) +- ![Apple Health logo](assets/img/health-and-wellness/apple-health.svg#only-light){ .twemoji loading=lazy } ![Apple Health logo](assets/img/health-and-wellness/apple-health-dark.svg#only-dark){ .twemoji loading=lazy } [Apple Health](health-and-wellness.md#apple-health) - ![Gadgetbridge logo](assets/img/health-and-wellness/gadgetbridge.svg#only-light){ .twemoji loading=lazy }![Gadgetbridge logo](assets/img/health-and-wellness/gadgetbridge-dark.svg#only-dark){ .twemoji loading=lazy } [Gadgetbridge](health-and-wellness.md#gadgetbridge) -- ![Apple Health logo](assets/img/health-and-wellness/apple-health.svg#only-light){ .twemoji loading=lazy } ![Apple Health logo](assets/img/health-and-wellness/apple-health-dark.svg#only-dark){ .twemoji loading=lazy }[Apple Health Records](health-and-wellness.md#apple-health-records) +- ![Apple Health logo](assets/img/health-and-wellness/apple-health.svg#only-light){ .twemoji loading=lazy } ![Apple Health logo](assets/img/health-and-wellness/apple-health-dark.svg#only-dark){ .twemoji loading=lazy } [Apple Health Records](health-and-wellness.md#apple-health-records) - ![CommonHealth logo](assets/img/health-and-wellness/commonhealth.png){ .twemoji loading=lazy } [CommonHealth](health-and-wellness.md#commonhealth) From 05f433ef38f2d5929b44c81ee73ac4f866d3e074 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 16:34:17 -0700 Subject: [PATCH 15/35] style: Capitalize "Markdown" Signed-off-by: redoomed1 --- docs/notebooks.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/notebooks.md b/docs/notebooks.md index 64d92e22..e1c4f5a0 100644 --- a/docs/notebooks.md +++ b/docs/notebooks.md @@ -87,7 +87,7 @@ It features sync functionality that allows you to access your notes on multiple ![Joplin logo](assets/img/notebooks/joplin.svg){ align=right } -**Joplin** is a free, open-source, and fully-featured E2EE note-taking and to-do application which can handle numerous markdown notes organized into notebooks and tags. +**Joplin** is a free, open-source, and fully-featured E2EE note-taking and to-do application which can handle numerous Markdown notes organized into notebooks and tags. It can sync through Nextcloud, Dropbox, and more. It also offers easy import from Evernote and plain-text notes. From 41ea53ccc40e812942445cc252bd95c919cbfb9b Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 16:39:28 -0700 Subject: [PATCH 16/35] style: Consistency and formatting fixes on recommendation pages Signed-off-by: redoomed1 --- docs/meta/admonitions.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/meta/admonitions.md b/docs/meta/admonitions.md index af1ab973..90161d50 100644 --- a/docs/meta/admonitions.md +++ b/docs/meta/admonitions.md @@ -3,7 +3,7 @@ title: Admonitions description: A guide for website contributors on creating admonitions. --- -**Admonitions** (or "call-outs") are a choice writers can use to include side content in an article without interrupting the document flow. +**Admonitions** (or "call-outs") are tools that writers can use to include side content in a page of the website without interrupting the flow of the content.

Example Admonition

@@ -41,7 +41,7 @@ ENCLOSED TEXT
``` -The `TITLE` must be specified, if you don't want a specific title you can set it to the same text as the `TYPE` (see below) in title case, e.g. `Note`. The `ENCLOSED TEXT` should be Markdown formatted. +The `TITLE` must be specified; if you don't want a specific title you can set it to the same text as the `TYPE` (see below) in title case, e.g. `Note`. The `ENCLOSED TEXT` should be Markdown formatted. ### Regular types @@ -166,11 +166,11 @@ This format is used to generate recommendation cards. Notably it is missing the ![PhotoPrism logo](assets/img/photo-management/photoprism.svg){ align=right } -**PhotoPrism** is a self-hostable platform for managing photos. It supports album syncing and sharing as well as a variety of other [features](https://photoprism.app/features). It does not include E2EE, so it's best hosted on a server that you trust and is under your control. +**PhotoPrism** is a self-hostable platform for managing photos. It supports album syncing and sharing as well as a variety of other [features](https://photoprism.app/features). It does not include end-to-end encryption, so it's best hosted on a server that you trust and is under your control. [:octicons-home-16: Homepage](https://photoprism.app){ .md-button .md-button--primary } [:octicons-eye-16:](https://photoprism.app/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://photoprism.app/kb){ .card-link title=Documentation} +[:octicons-info-16:](https://photoprism.app/kb){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/photoprism){ .card-link title="Source Code" }
@@ -189,11 +189,11 @@ This format is used to generate recommendation cards. Notably it is missing the ![PhotoPrism logo](../assets/img/photo-management/photoprism.svg){ align=right } -**PhotoPrism** is a self-hostable platform for managing photos. It supports album syncing and sharing as well as a variety of other [features](https://photoprism.app/features). It does not include E2EE, so it's best hosted on a server that you trust and is under your control. +**PhotoPrism** is a self-hostable platform for managing photos. It supports album syncing and sharing as well as a variety of other [features](https://photoprism.app/features). It does not include end-to-end encryption, so it's best hosted on a server that you trust and is under your control. [:octicons-home-16: Homepage](https://photoprism.app){ .md-button .md-button--primary } [:octicons-eye-16:](https://photoprism.app/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://photoprism.app/kb){ .card-link title=Documentation} +[:octicons-info-16:](https://photoprism.app/kb){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/photoprism){ .card-link title="Source Code" }
@@ -209,7 +209,7 @@ This format is used to generate recommendation cards. Notably it is missing the #### `downloads` -This is a special type of collapsible admonition, used to generate the download links section. It is only used within recommendation cards, as shown in the example above. +This is a special type of collapsible admonition which is used to generate sections containing download links. It is only used within recommendation cards, as shown in the example above. ```markdown title="Downloads Section"
@@ -217,7 +217,7 @@ This is a special type of collapsible admonition, used to generate the download - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=ch.protonmail.android) - [:simple-appstore: App Store](https://apps.apple.com/app/id979659905) -- [:simple-github: GitHub](https://github.com/ProtonMail/proton-mail-android/releases) +- [:simple-github: GitHub](https://github.com/ProtonMail/android-mail/releases) - [:fontawesome-brands-windows: Windows](https://proton.me/mail/bridge#download) - [:simple-apple: macOS](https://proton.me/mail/bridge#download) - [:simple-linux: Linux](https://proton.me/mail/bridge#download) @@ -233,7 +233,7 @@ This is a special type of collapsible admonition, used to generate the download - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=ch.protonmail.android) - [:simple-appstore: App Store](https://apps.apple.com/app/id979659905) -- [:simple-github: GitHub](https://github.com/ProtonMail/proton-mail-android/releases) +- [:simple-github: GitHub](https://github.com/ProtonMail/android-mail/releases) - [:fontawesome-brands-windows: Windows](https://proton.me/mail/bridge#download) - [:simple-apple: macOS](https://proton.me/mail/bridge#download) - [:simple-linux: Linux](https://proton.me/mail/bridge#download) @@ -245,7 +245,7 @@ This is a special type of collapsible admonition, used to generate the download ## Old Format -Throughout the site, you may see some admonitions formatted similarly to these examples: +Throughout the site, you may see some admonitions formatted like the following examples: ``` markdown title="Admonition" !!! note @@ -289,6 +289,6 @@ massa, nec semper lorem quam in massa. -**This format is no longer used going forward,** because it is incompatible with newer versions of our translation software at Crowdin. When adding a new page to the site, only the newer HTML-based format should be used. +**This format is no longer used going forward** because it is incompatible with newer versions of our translation software at Crowdin. When adding a new page to the site, only the newer, HTML-based format should be used. -There is no rush to convert admonitions with the old format to the new format. Pages currently using this formatting should continue to work, but we will be updating them to use the newer HTML-based format above over time as we continue to update the site. +There is no rush to convert admonitions with the old format to the new format. Pages currently using this formatting should continue to work, but we will be updating them to use the newer, HTML-based format above over time as we continue to update the site. From cfc44e4bba651369479ff105d5e89e9f3a01e3cb Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 20:15:12 -0700 Subject: [PATCH 17/35] style: Remove duplicate word Signed-off-by: redoomed1 --- docs/cloud.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/cloud.md b/docs/cloud.md index 1e42baf5..0a067f19 100644 --- a/docs/cloud.md +++ b/docs/cloud.md @@ -125,7 +125,7 @@ Running a local version of Peergos alongside a registered account on their paid, Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed. -To use Peergos on mobile devices, you can use the mobile [PWA](https://peergos.net) in lieu of a native app. +To use Peergos on mobile devices, you can use the [PWA](https://peergos.net) in lieu of a native app. ## Criteria From 8020a795f07f246d94b791ce7dc4b74ce882ce77 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 20:21:06 -0700 Subject: [PATCH 18/35] style: Revert some wording changes on Admonitions meta page Signed-off-by: redoomed1 --- docs/meta/admonitions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/meta/admonitions.md b/docs/meta/admonitions.md index 90161d50..e53b5505 100644 --- a/docs/meta/admonitions.md +++ b/docs/meta/admonitions.md @@ -3,7 +3,7 @@ title: Admonitions description: A guide for website contributors on creating admonitions. --- -**Admonitions** (or "call-outs") are tools that writers can use to include side content in a page of the website without interrupting the flow of the content. +**Admonitions** (or "call-outs") are tools that writers can use to include side content in an article without interrupting the document flow.

Example Admonition

From 68091691c648ddfb59586804e38d4d4a2da2cc6b Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 20:24:51 -0700 Subject: [PATCH 19/35] style: Reverse order Signed-off-by: redoomed1 --- docs/news-aggregators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/news-aggregators.md b/docs/news-aggregators.md index 02500346..23f7b69d 100644 --- a/docs/news-aggregators.md +++ b/docs/news-aggregators.md @@ -41,7 +41,7 @@ A **news aggregator** is software which aggregates digital content from online n ![NewsFlash logo](assets/img/news-aggregators/newsflash.png){ align=right } -**NewsFlash** is an open-source, modern, and easy-to-use news feed reader for Linux. It can be used offline or with services like [Nextcloud News](https://apps.nextcloud.com/apps/news) or [Inoreader](https://inoreader.com). It has a search feature and a pre-defined list of sources that you can add directly. +**NewsFlash** is an open-source, modern, and easy-to-use news feed reader for Linux. It can be used offline or with services like [Inoreader](https://inoreader.com) or [Nextcloud News](https://apps.nextcloud.com/apps/news). It has a search feature and a pre-defined list of sources that you can add directly. [:octicons-repo-16: Repository](https://gitlab.com/news-flash/news_flash_gtk){ .md-button .md-button--primary } [:octicons-code-16:](https://gitlab.com/news-flash/news_flash_gtk){ .card-link title="Source Code" } From 62fad1b4cf77056fe6310d8ef88d870d5dafff0d Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Fri, 21 Mar 2025 21:24:06 -0700 Subject: [PATCH 20/35] style: Consistency and formatting fixes across the board Signed-off-by: redoomed1 --- docs/dns.md | 48 +++++++++++++++++++++++++----------------------- 1 file changed, 25 insertions(+), 23 deletions(-) diff --git a/docs/dns.md b/docs/dns.md index 6c98b95b..1af02042 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -22,17 +22,19 @@ These are our favorite public DNS resolvers based on their privacy and security |---|---|---|---|---|---| | [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | -| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:octicons-link-external-24:](https://docs.controld.com/docs/macos-platform) | +| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:octicons-link-external-24:](https://docs.controld.com/docs/ios-platform "iOS") [:octicons-link-external-24:](https://docs.controld.com/docs/macos-platform#manual-setup-profile "macOS") | | [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | -| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice, malware blocking by default. | Yes [:octicons-link-external-24:](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | +| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice, malware blocking by default. | Yes [:octicons-link-external-24:](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted) "iOS") [:octicons-link-external-24:](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted) "macOS") | -[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard-dns.io/en/privacy.html](https://adguard-dns.io/en/privacy.html) -[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) -[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) -[^4]: dns0.eu collects some data for their threat intelligence feeds, to monitor for newly registered/observed/active domains and other bulk data. That data is shared with some [partners](https://docs.dns0.eu/data-feeds/introduction) for e.g. security research. They do not collect any Personally Identifiable Information. [https://dns0.eu/privacy](https://dns0.eu/privacy) -[^5]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours. [https://adguard-dns.io/en/privacy.html](https://adguard-dns.io/en/privacy.html) +> We need this information to identify and block new trackers and threats. +> We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters. +[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) +[^3]: Control D only logs specific account data for Premium resolvers with custom DNS profiles. Free resolvers do not retain any data. [https://controld.com/privacy](https://controld.com/privacy) +[^4]: dns0.eu collects some data for their threat intelligence feeds to monitor for newly registered/observed/active domains and other bulk data. That data is shared with some [partners](https://docs.dns0.eu/data-feeds/introduction) for e.g. security research. They do not collect any personally identifiable information. [https://dns0.eu/privacy](https://dns0.eu/privacy) +[^5]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy](https://mullvad.net/en/help/no-logging-data-policy) +[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared for purposes like furthering their security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) ## Self-Hosted DNS Filtering @@ -91,18 +93,18 @@ These DNS filtering solutions offer a web dashboard where you can customize the [:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } [:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
Downloads -- [:fontawesome-brands-windows: Windows](https://docs.controld.com/docs/gui-setup-utility) -- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) -- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) - [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) - [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases) +- [:fontawesome-brands-windows: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
@@ -118,17 +120,17 @@ These DNS filtering solutions offer a web dashboard where you can customize the [:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } [:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-info-16:](https://help.nextdns.io){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
Downloads +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) - [:fontawesome-brands-windows: Windows](https://github.com/nextdns/nextdns/wiki/Windows) - [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) - [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) -- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) -- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
@@ -155,7 +157,7 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad [:octicons-home-16: Homepage](https://rethinkdns.com){ .md-button .md-button--primary } [:octicons-eye-16:](https://rethinkdns.com/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.rethinkdns.com){ .card-link title=Documentation} +[:octicons-info-16:](https://docs.rethinkdns.com){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/celzero/rethink-app){ .card-link title="Source Code" }
@@ -179,9 +181,9 @@ While RethinkDNS takes up the Android VPN slot, you can still use a VPN or Orbot **dnscrypt-proxy** is a DNS proxy with support for [DNSCrypt](advanced/dns-overview.md#dnscrypt), [DNS-over-HTTPS](advanced/dns-overview.md#dns-over-https-doh), and [Anonymized DNS](https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS). [:octicons-repo-16: Repository](https://github.com/DNSCrypt/dnscrypt-proxy){ .md-button .md-button--primary } -[:octicons-info-16:](https://github.com/DNSCrypt/dnscrypt-proxy/wiki){ .card-link title=Documentation} +[:octicons-info-16:](https://github.com/DNSCrypt/dnscrypt-proxy/wiki){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/DNSCrypt/dnscrypt-proxy){ .card-link title="Source Code" } -[:octicons-heart-16:](https://opencollective.com/dnscrypt/contribute){ .card-link title=Contribute } +[:octicons-heart-16:](https://opencollective.com/dnscrypt/contribute){ .card-link title="Contribute" }
Downloads @@ -209,10 +211,10 @@ All DNS products must support: - [DNSSEC](advanced/dns-overview.md#what-is-dnssec). - [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Anonymizing [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disabling it by default. Additionally, all public providers: -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. -- Must not log any personal data to disk - - As noted in our footnotes, some providers collect query information for example, for purposes like security research, but in that case that data must not be associated with any PII such as IP address, etc. +- Must not log any personal data to disk. + - As noted in our footnotes, some providers collect query information for purposes like security research, but in that case the data must not be associated with any PII such as IP address, etc. +- Should support [anycast](https://en.wikipedia.org/wiki/Anycast) or geo-steering. From cfc9bb9d172139427af3a2a583eff62e2b5b8ac7 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 22 Mar 2025 07:35:57 -0700 Subject: [PATCH 21/35] style: Reformat footnotes and some parts of DNS table Signed-off-by: redoomed1 --- docs/dns.md | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/docs/dns.md b/docs/dns.md index 1af02042..6cce26a4 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -22,19 +22,31 @@ These are our favorite public DNS resolvers based on their privacy and security |---|---|---|---|---|---| | [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | -| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:octicons-link-external-24:](https://docs.controld.com/docs/ios-platform "iOS") [:octicons-link-external-24:](https://docs.controld.com/docs/macos-platform#manual-setup-profile "macOS") | +| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:simple/apple: iOS](https://docs.controld.com/docs/ios-platform) [:material/apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | | [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | | [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | -| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice, malware blocking by default. | Yes [:octicons-link-external-24:](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted) "iOS") [:octicons-link-external-24:](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted) "macOS") | +| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes [:simple/apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) [:material/apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | -[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours. [https://adguard-dns.io/en/privacy.html](https://adguard-dns.io/en/privacy.html) -> We need this information to identify and block new trackers and threats. -> We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters. -[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) -[^3]: Control D only logs specific account data for Premium resolvers with custom DNS profiles. Free resolvers do not retain any data. [https://controld.com/privacy](https://controld.com/privacy) -[^4]: dns0.eu collects some data for their threat intelligence feeds to monitor for newly registered/observed/active domains and other bulk data. That data is shared with some [partners](https://docs.dns0.eu/data-feeds/introduction) for e.g. security research. They do not collect any personally identifiable information. [https://dns0.eu/privacy](https://dns0.eu/privacy) -[^5]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy](https://mullvad.net/en/help/no-logging-data-policy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared for purposes like furthering their security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^1]: + AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours. + > We need this information to identify and block new trackers and threats. + > We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters. + AdGuard DNS: [*Privacy Policy*](https://adguard-dns.io/en/privacy.html) +[^2]: + Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. + 1.1.1.1 Public DNS Resolver: [*Cloudflare’s commitment to privacy*](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) +[^3]: + Control D only logs specific account data for Premium resolvers with custom DNS profiles. Free resolvers do not retain any data. + Control D: [*Privacy Policy*](https://controld.com/privacy) +[^4]: + dns0.eu collects some data for their threat intelligence feeds to monitor for newly registered/observed/active domains and other bulk data. That data is shared with some [partners](https://docs.dns0.eu/data-feeds/introduction) for e.g. security research. They do not collect any personally identifiable information. + DNS.eu: [*Privacy Policy*](https://dns0.eu/privacy) +[^5]: + Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. + Mullvad: [*No-logging of user activity policy*](https://mullvad.net/en/help/no-logging-data-policy) +[^6]: + Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared for purposes like furthering their security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. + Quad9: [Data and Privacy Policy](https://quad9.net/privacy/policy) ## Self-Hosted DNS Filtering From 829a978e2fd8a453b84b8e747b4f0db946421d8b Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 22 Mar 2025 08:04:52 -0700 Subject: [PATCH 22/35] style: Fix icon syntax and test footnote formatting Signed-off-by: redoomed1 --- docs/dns.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/dns.md b/docs/dns.md index 6cce26a4..6467ab06 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -22,30 +22,36 @@ These are our favorite public DNS resolvers based on their privacy and security |---|---|---|---|---|---| | [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | -| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:simple/apple: iOS](https://docs.controld.com/docs/ios-platform) [:material/apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | +| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) [:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | | [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | | [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | -| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes [:simple/apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) [:material/apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | +| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes [:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) [:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours. > We need this information to identify and block new trackers and threats. > We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters. + AdGuard DNS: [*Privacy Policy*](https://adguard-dns.io/en/privacy.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. + 1.1.1.1 Public DNS Resolver: [*Cloudflare’s commitment to privacy*](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs specific account data for Premium resolvers with custom DNS profiles. Free resolvers do not retain any data. + Control D: [*Privacy Policy*](https://controld.com/privacy) [^4]: dns0.eu collects some data for their threat intelligence feeds to monitor for newly registered/observed/active domains and other bulk data. That data is shared with some [partners](https://docs.dns0.eu/data-feeds/introduction) for e.g. security research. They do not collect any personally identifiable information. + DNS.eu: [*Privacy Policy*](https://dns0.eu/privacy) [^5]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. + Mullvad: [*No-logging of user activity policy*](https://mullvad.net/en/help/no-logging-data-policy) [^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared for purposes like furthering their security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. + Quad9: [Data and Privacy Policy](https://quad9.net/privacy/policy) ## Self-Hosted DNS Filtering From 1e9283fc1a1f32b15a76896a8908c465ee30a5ea Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 22 Mar 2025 08:12:11 -0700 Subject: [PATCH 23/35] style: Test spacing Signed-off-by: redoomed1 --- docs/dns.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/dns.md b/docs/dns.md index 6467ab06..40747ba2 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -22,7 +22,7 @@ These are our favorite public DNS resolvers based on their privacy and security |---|---|---|---|---|---| | [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | -| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) [:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | +| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) [:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | | [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | | [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | | [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes [:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) [:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | From 11940bb3fed871da6698fd4699bf815c75920923 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 22 Mar 2025 08:25:30 -0700 Subject: [PATCH 24/35] style: Test formatting Signed-off-by: redoomed1 --- docs/dns.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/dns.md b/docs/dns.md index 40747ba2..da48871f 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -22,10 +22,14 @@ These are our favorite public DNS resolvers based on their privacy and security |---|---|---|---|---|---| | [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | -| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) [:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | +| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes + [:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) + [:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | | [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | | [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | -| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes [:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) [:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | +| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes + [:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) + [:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours. @@ -52,7 +56,7 @@ These are our favorite public DNS resolvers based on their privacy and security [^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared for purposes like furthering their security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. - Quad9: [Data and Privacy Policy](https://quad9.net/privacy/policy) + Quad9: [*Data and Privacy Policy*](https://quad9.net/privacy/policy) ## Self-Hosted DNS Filtering From d60c74a2a5a49cd7e6b891213568b61accafdcab Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 22 Mar 2025 08:47:17 -0700 Subject: [PATCH 25/35] style: Revert to original format Signed-off-by: redoomed1 --- docs/dns.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/docs/dns.md b/docs/dns.md index da48871f..c29cce13 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -22,14 +22,10 @@ These are our favorite public DNS resolvers based on their privacy and security |---|---|---|---|---|---| | [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | -| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes - [:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) - [:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | +| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) [:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | | [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | | [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | -| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes - [:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) - [:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | +| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes [:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) [:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours. From 2095eb63c6e11016fe92b3beed293daa47601cec Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 22 Mar 2025 08:54:08 -0700 Subject: [PATCH 26/35] style: Test spacing Signed-off-by: redoomed1 --- docs/dns.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/dns.md b/docs/dns.md index c29cce13..c503777b 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -22,10 +22,10 @@ These are our favorite public DNS resolvers based on their privacy and security |---|---|---|---|---|---| | [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | -| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) [:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | +| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) [:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | | [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | | [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | -| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes [:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) [:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | +| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes [:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) [:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours. From de773260c7614e73f4f9e2e3bf7e6e5285b2703b Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 22 Mar 2025 09:00:12 -0700 Subject: [PATCH 27/35] style: Test HTML line break Signed-off-by: redoomed1 --- docs/dns.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/dns.md b/docs/dns.md index c503777b..8682eed9 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -22,10 +22,10 @@ These are our favorite public DNS resolvers based on their privacy and security |---|---|---|---|---|---| | [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | | [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | -| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:simple-apple: iOS](https://docs.controld.com/docs/ios-platform) [:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | +| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes
[:simple-apple: iOS](https://docs.controld.com/docs/ios-platform)
[:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | | [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | | [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | -| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes [:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted)) [:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | +| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes
[:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted))
[:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours. From 1674f11a7685d4878b42bf885a81b6d37341d34b Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 22 Mar 2025 09:15:34 -0700 Subject: [PATCH 28/35] style: Add line breaks for protocol lists Signed-off-by: redoomed1 --- docs/dns.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/dns.md b/docs/dns.md index 8682eed9..f54f4194 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -20,12 +20,12 @@ These are our favorite public DNS resolvers based on their privacy and security | DNS Provider | Protocols | Logging / Privacy Policy | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | |---|---|---|---|---|---| -| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | -| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes
[:simple-apple: iOS](https://docs.controld.com/docs/ios-platform)
[:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | -| [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | -| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes
[:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted))
[:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext
DoH/3
DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | +| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext
DoH/3
DoT
DoQ | No[^3] | No | Based on server choice. | Yes
[:simple-apple: iOS](https://docs.controld.com/docs/ios-platform)
[:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | +| [**dns0.eu**](https://dns0.eu) | Cleartext
DoH/3
DoH
DoT
DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH
DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | +| [**Quad9**](https://quad9.net) | Cleartext
DoH
DoT
DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes
[:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted))
[:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours. From 31b392724926b88d2c010c88f4ae9abf489dbaf1 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 22 Mar 2025 17:17:53 -0700 Subject: [PATCH 29/35] style: Reword DNS criteria Signed-off-by: redoomed1 --- docs/dns.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/dns.md b/docs/dns.md index f54f4194..41c89c20 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -225,14 +225,14 @@ The anonymized DNS feature does [not](advanced/dns-overview.md#why-shouldnt-i-us **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -All DNS products must support: +All DNS products... -- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Anonymizing [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disabling it by default. +- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- Must support [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Must anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. -Additionally, all public providers: +Additionally, all public providers... - Must not log any personal data to disk. - - As noted in our footnotes, some providers collect query information for purposes like security research, but in that case the data must not be associated with any PII such as IP address, etc. + - As noted in the footnotes, some providers collect query information for purposes like security research, but in that case the data must not be associated with any PII such as IP address, etc. - Should support [anycast](https://en.wikipedia.org/wiki/Anycast) or geo-steering. From 16e681eb1b4ecddb38ccc4f210a1a8d72312d218 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 22 Mar 2025 17:42:54 -0700 Subject: [PATCH 30/35] refactor: Revert extraneous changes (included in #2975) Signed-off-by: redoomed1 --- docs/dns.md | 68 +++++++++++++++++++---------------------------------- 1 file changed, 24 insertions(+), 44 deletions(-) diff --git a/docs/dns.md b/docs/dns.md index 41c89c20..200369f8 100644 --- a/docs/dns.md +++ b/docs/dns.md @@ -20,39 +20,19 @@ These are our favorite public DNS resolvers based on their privacy and security | DNS Provider | Protocols | Logging / Privacy Policy | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | |---|---|---|---|---|---| -| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext
DoH/3
DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | -| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext
DoH/3
DoT
DoQ | No[^3] | No | Based on server choice. | Yes
[:simple-apple: iOS](https://docs.controld.com/docs/ios-platform)
[:material-apple-finder: macOS](https://docs.controld.com/docs/macos-platform#manual-setup-profile) | -| [**dns0.eu**](https://dns0.eu) | Cleartext
DoH/3
DoH
DoT
DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH
DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://github.com/mullvad/encrypted-dns-profiles) | -| [**Quad9**](https://quad9.net) | Cleartext
DoH
DoT
DNSCrypt | Anonymized[^6] | Optional | Based on server choice. Malware blocking is included by default. | Yes
[:simple-apple: iOS](https://docs.quad9.net/Setup_Guides/iOS/iOS_14_and_later_(Encrypted))
[:material-apple-finder: macOS](https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_(Encrypted)) | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Anonymized[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | Yes [:octicons-link-external-24:](https://adguard-dns.io/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | Cleartext DoH/3 DoT | Anonymized[^2] | No | Based on server choice. | No [:octicons-link-external-24:](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846) | +| [**Control D Free DNS**](https://controld.com/free-dns) | Cleartext DoH/3 DoT DoQ | No[^3] | No | Based on server choice. | Yes [:octicons-link-external-24:](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | Cleartext DoH/3 DoH DoT DoQ | Anonymized[^4] | Anonymized | Based on server choice. | Yes [:octicons-link-external-24:](https://dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | DoH DoT | No[^5] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | Yes [:octicons-link-external-24:](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | Cleartext DoH DoT DNSCrypt | Anonymized[^6] | Optional | Based on server choice, malware blocking by default. | Yes [:octicons-link-external-24:](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -[^1]: - AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested within the last 24 hours. - > We need this information to identify and block new trackers and threats. - > We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters. - - AdGuard DNS: [*Privacy Policy*](https://adguard-dns.io/en/privacy.html) -[^2]: - Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. - - 1.1.1.1 Public DNS Resolver: [*Cloudflare’s commitment to privacy*](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) -[^3]: - Control D only logs specific account data for Premium resolvers with custom DNS profiles. Free resolvers do not retain any data. - - Control D: [*Privacy Policy*](https://controld.com/privacy) -[^4]: - dns0.eu collects some data for their threat intelligence feeds to monitor for newly registered/observed/active domains and other bulk data. That data is shared with some [partners](https://docs.dns0.eu/data-feeds/introduction) for e.g. security research. They do not collect any personally identifiable information. - - DNS.eu: [*Privacy Policy*](https://dns0.eu/privacy) -[^5]: - Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. - - Mullvad: [*No-logging of user activity policy*](https://mullvad.net/en/help/no-logging-data-policy) -[^6]: - Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared for purposes like furthering their security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. - - Quad9: [*Data and Privacy Policy*](https://quad9.net/privacy/policy) +[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard-dns.io/en/privacy.html](https://adguard-dns.io/en/privacy.html) +[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) +[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) +[^4]: dns0.eu collects some data for their threat intelligence feeds, to monitor for newly registered/observed/active domains and other bulk data. That data is shared with some [partners](https://docs.dns0.eu/data-feeds/introduction) for e.g. security research. They do not collect any Personally Identifiable Information. [https://dns0.eu/privacy](https://dns0.eu/privacy) +[^5]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) +[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) ## Self-Hosted DNS Filtering @@ -117,12 +97,12 @@ These DNS filtering solutions offer a web dashboard where you can customize the
Downloads -- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) -- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) - [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases) - [:fontawesome-brands-windows: Windows](https://docs.controld.com/docs/gui-setup-utility) - [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) - [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
@@ -144,11 +124,11 @@ These DNS filtering solutions offer a web dashboard where you can customize the
Downloads -- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) -- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) - [:fontawesome-brands-windows: Windows](https://github.com/nextdns/nextdns/wiki/Windows) - [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) - [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
@@ -225,14 +205,14 @@ The anonymized DNS feature does [not](advanced/dns-overview.md#why-shouldnt-i-us **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -All DNS products... +All DNS products must support: -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- Must support [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Must anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. -Additionally, all public providers... +Additionally, all public providers: -- Must not log any personal data to disk. - - As noted in the footnotes, some providers collect query information for purposes like security research, but in that case the data must not be associated with any PII such as IP address, etc. -- Should support [anycast](https://en.wikipedia.org/wiki/Anycast) or geo-steering. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +- Must not log any personal data to disk + - As noted in our footnotes, some providers collect query information for example, for purposes like security research, but in that case that data must not be associated with any PII such as IP address, etc. From d06180c9ec73bd1b8f641d74fbb48fd28c1c9ecc Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 29 Mar 2025 16:31:14 -0700 Subject: [PATCH 31/35] refactor: Replace current Llamafile logo The new logo is directly downloaded from Llamafile's Github repository. Signed-off-by: redoomed1 --- theme/assets/img/ai-chat/llamafile.svg | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/theme/assets/img/ai-chat/llamafile.svg b/theme/assets/img/ai-chat/llamafile.svg index cbbe7827..b716e8ae 100644 --- a/theme/assets/img/ai-chat/llamafile.svg +++ b/theme/assets/img/ai-chat/llamafile.svg @@ -1,2 +1,14 @@ - - + + + + + + + + + + + + + + From b42e3fd65479c3757d31ef019b2c027c9c1e7caf Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 5 Apr 2025 14:14:29 -0700 Subject: [PATCH 32/35] refactor: Revert Peergos-specific changes (implemented in #2992) Signed-off-by: redoomed1 --- docs/cloud.md | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/docs/cloud.md b/docs/cloud.md index 0a067f19..3a286ae2 100644 --- a/docs/cloud.md +++ b/docs/cloud.md @@ -97,35 +97,32 @@ They have also received the Digital Trust Label, a certification from the [Swiss ![Peergos logo](assets/img/cloud/peergos.svg){ align=right } -**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant end-to-end encryption and ensures all data about your files remains private. +**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant end-to-end encryption and ensures all data about your files remains private. It is built on top of [IPFS (InterPlanetary File System)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship){ .pg-blue-gray }. [:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary } [:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" } [:octicons-info-16:](https://book.peergos.org){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/Peergos/Peergos){ .card-link title="Source Code" } -[:octicons-heart-16:](https://github.com/peergos/peergos#support){ .card-link title="Contribute" }
Downloads +- [:octicons-globe-16: Web](https://peergos.net) - [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases) - [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases) - [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases) -- [:octicons-browser-16: Web](https://peergos.net)
-Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship){ .pg-blue-gray }. - Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working. Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface. Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed. -To use Peergos on mobile devices, you can use the [PWA](https://peergos.net) in lieu of a native app. +An Android app is not available, but it is [in the works](https://discuss.privacyguides.net/t/peergos-private-storage-sharing-social-media-and-application-platform/11825/25). The current workaround is to use the mobile [PWA](https://peergos.net) instead. ## Criteria From 5956d9c198d06822ff61eb47edf8a0e436d5a843 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sat, 5 Apr 2025 14:41:04 -0700 Subject: [PATCH 33/35] refactor: Revert https://github.com/privacyguides/privacyguides.org/commit/d06180c9ec73bd1b8f641d74fbb48fd28c1c9ecc Signed-off-by: redoomed1 --- theme/assets/img/ai-chat/llamafile.svg | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/theme/assets/img/ai-chat/llamafile.svg b/theme/assets/img/ai-chat/llamafile.svg index b716e8ae..cbbe7827 100644 --- a/theme/assets/img/ai-chat/llamafile.svg +++ b/theme/assets/img/ai-chat/llamafile.svg @@ -1,14 +1,2 @@ - - - - - - - - - - - - - - + + From cb2b019634de35064804838deb1b528e265ed8a7 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sun, 6 Apr 2025 10:30:01 -0700 Subject: [PATCH 34/35] style: Make minor grammar changes Signed-off-by: redoomed1 --- docs/advanced/tor-overview.md | 42 +++++++++++++++++------------------ 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/docs/advanced/tor-overview.md b/docs/advanced/tor-overview.md index 474196f2..494753ff 100644 --- a/docs/advanced/tor-overview.md +++ b/docs/advanced/tor-overview.md @@ -10,7 +10,7 @@ description: Tor is a free to use, decentralized network designed for using the [:material-movie-open-play-outline: Video: Why You Need Tor](https://www.privacyguides.org/videos/2025/03/02/why-you-need-tor/){ .md-button } -Tor works by routing your internet traffic through volunteer-operated servers, instead of making a direct connection to the site you're trying to visit. This obfuscates where the traffic is coming from, and no server in the connection path is able to see the full path of where the traffic is coming from and going to, meaning even the servers you are using to connect cannot break your anonymity. +Tor works by routing your internet traffic through volunteer-operated servers instead of making a direct connection to the site you're trying to visit. This obfuscates where the traffic is coming from, and no server in the connection path is able to see the full path of where the traffic is coming from and going to, meaning even the servers you are using to connect cannot break your anonymity. [:octicons-home-16:](https://torproject.org){ .card-link title=Homepage } [:simple-torbrowser:](http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion){ .card-link title="Onion Service" } @@ -35,13 +35,13 @@ Because we already [generally recommend](../basics/vpn-overview.md) that the vas Connecting directly to Tor will make your connection stand out to any local network administrators or your ISP. Detecting and correlating this traffic [has been done](https://edition.cnn.com/2013/12/17/justice/massachusetts-harvard-hoax) in the past by network administrators to identify and deanonymize specific Tor users on their network. On the other hand, connecting to a VPN is almost always less suspicious, because commercial VPN providers are used by everyday consumers for a variety of mundane tasks like bypassing geo-restrictions, even in countries with heavy internet restrictions. -Therefore, you should make an effort to hide your IP address **before** connecting to the Tor network. You can do this by simply connecting to a VPN (through a client installed on your computer) and then accessing [Tor](../tor.md) as normal, through Tor Browser for example. This creates a connection chain like: +Therefore, you should make an effort to hide your IP address **before** connecting to the Tor network. You can do this by simply connecting to a VPN (through a client installed on your computer) and then accessing [Tor](../tor.md) as normal (e.g., through Tor Browser). This creates a connection chain like so: - [x] You → VPN → Tor → Internet From your ISP's perspective, it looks like you're accessing a VPN normally (with the associated cover that provides you). From your VPN's perspective, they can see that you are connecting to the Tor network, but nothing about what websites you're accessing. From Tor's perspective, you're connecting normally, but in the unlikely event of some sort of Tor network compromise, only your VPN's IP would be exposed, and your VPN would *additionally* have to be compromised to deanonymize you. -This is **not** censorship circumvention advice, because if Tor is blocked entirely by your ISP, your VPN likely is as well. Rather, this recommendation aims to make your traffic blend in better with commonplace VPN user traffic, and provide you with some level of plausible deniability by obscuring the fact that you're connecting to Tor from your ISP. +This is **not** censorship circumvention advice because if Tor is blocked entirely by your ISP, your VPN likely is as well. Rather, this recommendation aims to make your traffic blend in better with commonplace VPN user traffic, and provide you with some level of plausible deniability by obscuring the fact that you're connecting to Tor from your ISP. --- @@ -51,7 +51,7 @@ We **very strongly discourage** combining Tor with a VPN in any other manner. Do - You → VPN → Tor → VPN → Internet - Any other configuration -Some VPN providers and other publications will occasionally recommend these **bad** configurations to evade Tor bans (exit nodes being blocked by websites) in some places. [Normally](https://support.torproject.org/#about_change-paths), Tor frequently changes your circuit path through the network. When you choose a permanent *destination* VPN (connecting to a VPN server *after* Tor), you're eliminating this advantage and drastically harming your anonymity. +Some VPN providers and other publications will occasionally recommend these **bad** configurations to evade Tor bans (i.e., exit nodes being blocked by websites) in some places. [Normally](https://support.torproject.org/#about_change-paths), Tor frequently changes your circuit path through the network. When you choose a permanent *destination* VPN (connecting to a VPN server *after* Tor), you're eliminating this advantage and drastically harming your anonymity. Setting up bad configurations like these is difficult to do accidentally, because it usually involves either setting up custom proxy settings inside Tor Browser, or setting up custom proxy settings inside your VPN client which routes your VPN traffic through the Tor Browser. As long as you avoid these non-default configurations, you're probably fine. @@ -60,7 +60,7 @@ Setting up bad configurations like these is difficult to do accidentally, becaus

VPN/SSH Fingerprinting

-The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns. +The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited because all websites have specific traffic patterns. Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind. @@ -68,11 +68,11 @@ If you still believe that pluggable transports (bridges) provide additional prot
-Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. +Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. To reiterate, though, you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network in most cases. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g., Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels. ## What Tor is Not -The Tor network is not the perfect privacy protection tool in all cases, and has a number of drawbacks which should be carefully considered. These things should not discourage you from using Tor if it is appropriate for your needs, but they are still things to think about when deciding which solution is most appropriate for you. +The Tor network is not the perfect privacy protection tool in all cases and has a number of drawbacks which should be carefully considered. These things should not discourage you from using Tor if it is appropriate for your needs, but they are still things to think about when deciding which solution is most appropriate for you. ### Tor is not a free VPN @@ -80,26 +80,26 @@ The release of the *Orbot* mobile app has lead many people to describe Tor as a Unlike Tor exit nodes, VPN providers are usually not *actively* [malicious](#caveats). Because Tor exit nodes can be created by anybody, they are hotspots for network logging and modification. In 2020, many Tor exit nodes were documented to be downgrading HTTPS traffic to HTTP in order to [hijack cryptocurrency transactions](https://therecord.media/thousands-of-tor-exit-nodes-attacked-cryptocurrency-users-over-the-past-year). Other exit node attacks such as replacing downloads via unencrypted channels with malware have also been observed. HTTPS does mitigate these threats to an extent. -As we've alluded to already, Tor is also easily identifiable on the network. Unlike an actual VPN provider, using Tor will make you stick out as a person likely attempting to evade authorities. In a perfect world, Tor would be seen by network administrators and authorities as a tool with many uses (like how VPNs are viewed), but in reality the perception of Tor is still far less legitimate than the perception of commercial VPNs, so using a real VPN provides you with plausible deniability, e.g. "I was just using it to watch Netflix," etc. +As we've alluded to already, Tor is also easily identifiable on the network. Unlike an actual VPN provider, using Tor will make you stick out as a person likely attempting to evade authorities. In a perfect world, Tor would be seen by network administrators and authorities as a tool with many uses (like how VPNs are viewed), but in reality the perception of Tor is still far less legitimate than the perception of commercial VPNs. As such, using a real VPN provides you with plausible deniability, e.g. "I was just using it to watch Netflix," etc. ### Tor usage is not undetectable -**Even if you use bridges and pluggable transports,** the Tor Project provides no tools to hide the fact that you are using Tor from your ISP. Even using obfuscated "pluggable transports" or non-public bridges do not hide the fact that you are using a private communications channel. The most popular pluggable transports like obfs4 (which obfuscates your traffic to "look like nothing") and meek (which uses domain fronting to camouflage your traffic) can be [detected](https://hackerfactor.com/blog/index.php?/archives/889-Tor-0day-Burning-Bridges.html) with fairly standard traffic analysis techniques. Snowflake has similar issues, and can be [easily detected](https://hackerfactor.com/blog/index.php?/archives/944-Tor-0day-Snowflake.html) *before* a Tor connection is even established. +**Even if you use bridges and pluggable transports,** the Tor Project doesn't provide any tools to hide the fact that you are using Tor from your ISP. Even using obfuscated "pluggable transports" or non-public bridges do not hide the fact that you are using a private communications channel. The most popular pluggable transports like obfs4 (which obfuscates your traffic to "look like nothing") and meek (which uses domain fronting to camouflage your traffic) can be [detected](https://hackerfactor.com/blog/index.php?/archives/889-Tor-0day-Burning-Bridges.html) with fairly standard traffic analysis techniques. Snowflake has similar issues, and can be [easily detected](https://hackerfactor.com/blog/index.php?/archives/944-Tor-0day-Snowflake.html) *before* a Tor connection is even established. -Pluggable transports other than these three do exist, but typically rely on security through obscurity to evade detection. They aren't impossible to detect, they are just used by so few people that it's not worth the effort building detectors for them. They shouldn't be relied upon if you specifically are being monitored. +Pluggable transports other than these three do exist, but typically rely on security through obscurity to evade detection. They aren't impossible to detect—they are just used by so few people that it's not worth the effort building detectors for them. They shouldn't be relied upon if you specifically are being monitored. It is critical to understand the difference between bypassing censorship and evading detection. It is easier to accomplish the former because of the many real-world limitations on what network censors can realistically do en masse, but these techniques do not hide the fact that you—*specifically* you—are using Tor from an interested party monitoring your network. ### Tor Browser is not the most *secure* browser -Anonymity can often be at odds with security: Tor's anonymity requires every user to be identical, which creates a monoculture (the same bugs are present across all Tor Browser users). As a cybersecurity rule of thumb, monocultures are generally regarded as bad: Security through diversity (which Tor lacks) provides natural segmentation by limiting vulnerabilities to smaller groups, and is therefore usually desirable, but this diversity is also less good for anonymity. +Anonymity can often be at odds with security: Tor's anonymity requires every user to be identical, which creates a monoculture (e.g., the same bugs are present across all Tor Browser users). As a cybersecurity rule of thumb, monocultures are generally regarded as bad: Security through diversity (which Tor lacks) provides natural segmentation by limiting vulnerabilities to smaller groups, and is therefore usually desirable, but this diversity is also less good for anonymity. Additionally, Tor Browser is based on Firefox's Extended Support Release builds, which only receives patches for vulnerabilities considered *Critical* and *High* (not *Medium* and *Low*). This means that attackers could (for example): 1. Look for new Critical/High vulnerabilities in Firefox nightly or beta builds, then check if they are exploitable in Tor Browser (this vulnerability period can last weeks). 2. Chain *multiple* Medium/Low vulnerabilities together until they get the level of access they're looking for (this vulnerability period can last months or longer). -Those at risk of browser vulnerabilities should consider additional protections to defend against Tor Browser exploits, such as using Whonix in [Qubes](../os/qubes-overview.md) to contain your Tor browsing in a secure VM and protect against leaks. +Those at risk of browser vulnerabilities should consider additional protections to defend against Tor Browser exploits, such as using Whonix in [Qubes](../os/qubes-overview.md) to contain your Tor browsing in a secure virtual machine and protect against leaks. ## Path Building to Clearnet Services @@ -121,7 +121,7 @@ The entry node, often called the guard node, is the first node to which your Tor Unlike the other nodes, the Tor client will randomly select an entry node and stick with it for two to three months to protect you from certain attacks.[^1] -[^1]: The first relay in your circuit is called an "entry guard" or "guard". It is a fast and stable relay that remains the first one in your circuit for 2-3 months in order to protect against a known anonymity-breaking attack. The rest of your circuit changes with every new website you visit, and all together these relays provide the full privacy protections of Tor. For more information on how guard relays work, see this [blog post](https://blog.torproject.org/improving-tors-anonymity-changing-guard-parameters) and [paper](https://www-users.cs.umn.edu/~hoppernj/single_guard.pdf) on entry guards. ([https://support.torproject.org/tbb/tbb-2/](https://support.torproject.org/tbb/tbb-2)) +[^1]: The first relay in your circuit is called an "entry guard" or "guard". It is a fast and stable relay that remains the first one in your circuit for 2-3 months in order to protect against a known anonymity-breaking attack. The rest of your circuit changes with every new website you visit, and all together these relays provide the full privacy protections of Tor. For more information on how guard relays work, see this [blog post](https://blog.torproject.org/improving-tors-anonymity-changing-guard-parameters) and [paper](https://www-users.cs.umn.edu/~hoppernj/single_guard.pdf) on entry guards. ([https://support.torproject.org/tbb/tbb-2](https://support.torproject.org/tbb/tbb-2)) ### The Middle Node @@ -135,13 +135,13 @@ The exit node is the point in which your web traffic leaves the Tor network and The exit node will be chosen at random from all available Tor nodes ran with an exit relay flag.[^2] -[^2]: Relay flag: a special (dis-)qualification of relays for circuit positions (for example, "Guard", "Exit", "BadExit"), circuit properties (for example, "Fast", "Stable"), or roles (for example, "Authority", "HSDir"), as assigned by the directory authorities and further defined in the directory protocol specification. ([https://metrics.torproject.org/glossary.html](https://metrics.torproject.org/glossary.html)) +[^2]: Relay flag: a special (dis-)qualification of relays for circuit positions (for example, "Guard", "Exit", "BadExit"), circuit properties (for example, "Fast", "Stable"), or roles (for example, "Authority", "HSDir"), as assigned by the directory authorities and further defined in the directory protocol specification. ([https://metrics.torproject.org/glossary.html](https://metrics.torproject.org/glossary.html#relay-flag)) ## Path Building to Onion Services "Onion Services" (also commonly referred to as "hidden services") are websites which can only be accessed by the Tor browser. These websites have a long randomly generated domain name ending with `.onion`. -Connecting to an Onion Service in Tor works very similarly to connecting to a clearnet service, but your traffic is routed through a total of **six** nodes before reaching the destination server. Just like before however, only three of these nodes are contributing to *your* anonymity, the other three nodes protect *the Onion Service's* anonymity, hiding the website's true IP and location in the same manner that Tor Browser is hiding yours. +Connecting to an Onion Service in Tor works very similarly to connecting to a clearnet service, but your traffic is routed through a total of **six** nodes before reaching the destination server. Just like before, however, only three of these nodes are contributing to *your* anonymity, the other three nodes protect *the Onion Service's* anonymity, hiding the website's true IP and location in the same manner that Tor Browser is hiding yours.
![Tor path showing your traffic being routed through your three Tor nodes plus three additional Tor nodes which hide the website's identity](../assets/img/how-tor-works/tor-path-hidden-service.svg#only-light) @@ -151,15 +151,15 @@ Connecting to an Onion Service in Tor works very similarly to connecting to a cl ## Encryption -Tor encrypts each packet (a block of transmitted data) three times with the keys from the exit, middle, and entry node—in that order. +Tor encrypts each packet (a block of transmitted data) three times with the keys from the exit, middle, and entry node in that order. Once Tor has built a circuit, data transmission is done as follows: -1. Firstly: when the packet arrives at the entry node, the first layer of encryption is removed. In this encrypted packet, the entry node will find another encrypted packet with the middle node’s address. The entry node will then forward the packet to the middle node. +1. Firstly: When the packet arrives at the entry node, the first layer of encryption is removed. In this encrypted packet, the entry node will find another encrypted packet with the middle node’s address. The entry node will then forward the packet to the middle node. -2. Secondly: when the middle node receives the packet from the entry node, it too will remove a layer of encryption with its key, and this time finds an encrypted packet with the exit node's address. The middle node will then forward the packet to the exit node. +2. Secondly: When the middle node receives the packet from the entry node, it too will remove a layer of encryption with its key, and this time finds an encrypted packet with the exit node's address. The middle node will then forward the packet to the exit node. -3. Lastly: when the exit node receives its packet, it will remove the last layer of encryption with its key. The exit node will see the destination address and forward the packet to that address. +3. Lastly: When the exit node receives its packet, it will remove the last layer of encryption with its key. The exit node will see the destination address and forward the packet to that address. Below is an alternative diagram showing the process. Each node removes its own layer of encryption, and when the destination server returns data, the same process happens entirely in reverse. For example, the exit node does not know who you are, but it does know which node it came from, and so it adds its own layer of encryption and sends it back. @@ -189,7 +189,7 @@ If you wish to use Tor for browsing the web, we only recommend the **official** Tor bridges are commonly touted as an alternative method to hiding Tor usage from an ISP, instead of a VPN (as we suggest using if possible). Something to consider is that while bridges may provide adequate censorship circumvention, this is only a *transient* benefit. They do not adequately protect you from your ISP discovering you connected to Tor in the *past* with historical traffic log analysis. -To illustrate this point, consider the following scenario: You connect to Tor via a bridge, and your ISP doesn’t detect it because they are not doing sophisticated analysis of your traffic, so things are working as intended. Now, 4 months go by, and the IP of your bridge has been made public. This is a very common occurrence with bridges, they are discovered and blocked relatively frequently, just not immediately. +To illustrate this point, consider the following scenario: You connect to Tor via a bridge, and your ISP doesn’t detect it because they are not doing sophisticated analysis of your traffic, so things are working as intended. Now, 4 months go by, and the IP of your bridge has been made public. This is a very common occurrence with bridges; they are discovered and blocked relatively frequently, just not immediately. Your ISP wants to identify Tor users 4 months ago, and with their limited metadata logging they can see that you connected to an IP address which was later revealed to be a Tor bridge. You have virtually no other excuse to be making such a connection, so the ISP can say with very high confidence that you were a Tor user at that time. @@ -197,7 +197,7 @@ Contrast this with our recommended scenario, where you connect to Tor via a VPN. Because your ISP almost certainly is not capturing all packet-level data and storing it forever, they have no way of determining what you connected to with that VPN *after* the fact with an advanced technique like deep packet inspection, and therefore you have plausible deniability. -Therefore, bridges provide the most benefit when circumventing internet censorship *in the moment*, but they are not an adequate substitute for **all** the benefits that using a VPN alongside Tor can provide. Again, this is not advice *against* using Tor bridges, you should just be aware of these limitations while making your decision. In some cases bridges may be the *only* option (if all VPN providers are blocked, for instance), so you can still use them in those circumstances with this limitation in mind. +Therefore, bridges provide the most benefit when circumventing internet censorship *in the moment*, but they are not an adequate substitute for **all** the benefits that using a VPN alongside Tor can provide. Again, this is not advice *against* using Tor bridges—you should just be aware of these limitations while making your decision. In some cases bridges may be the *only* option (if all VPN providers are blocked, for instance), so you can still use them in those circumstances with this limitation in mind. If you think that a bridge can aid in defending against fingerprinting or other advanced network analysis more than a VPN's encrypted tunnel already can, you always have the option to use a bridge in conjunction with a VPN as well. That way you are still protected by the pluggable transport's obfuscation techniques even if an adversary gains some level of visibility into your VPN tunnel. If you decide to go this route, we recommend connecting to an obfs4 bridge behind your VPN for optimal fingerprinting protection, rather than meek or Snowflake. From 2a9b23947a9e499e9c2d882f204561c11a5e4f23 Mon Sep 17 00:00:00 2001 From: redoomed1 Date: Sun, 6 Apr 2025 10:41:29 -0700 Subject: [PATCH 35/35] style: Add line break and make other minor changes Signed-off-by: redoomed1 --- docs/tor.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/tor.md b/docs/tor.md index b18c98fe..9d17e8ee 100644 --- a/docs/tor.md +++ b/docs/tor.md @@ -42,7 +42,7 @@ Before connecting to Tor, please ensure you've read our [overview](advanced/tor- There are a variety of ways to connect to the Tor network from your device, the most commonly used being the **Tor Browser**, a fork of Firefox designed for [:material-incognito: anonymous](basics/common-threats.md#anonymity-vs-privacy){ .pg-purple } browsing for desktop computers and Android. -Some of these apps are better than others, and again making a determination comes down to your threat model. If you are a casual Tor user who is not worried about your ISP collecting evidence against you, using apps like [Orbot](#orbot) or mobile browser apps to access the Tor network is probably fine. Increasing the number of people who use Tor on an everyday basis helps reduce the bad stigma of Tor, and lowers the quality of "lists of Tor users" that ISPs and governments may compile. +Some of these apps are better than others; making a determination comes down to your threat model. If you are a casual Tor user who is not worried about your ISP collecting evidence against you, using apps like [Orbot](#orbot) or mobile browser apps to access the Tor network is probably fine. Increasing the number of people who use Tor on an everyday basis helps reduce the bad stigma of Tor, and lowers the quality of "lists of Tor users" that ISPs and governments may compile. If more complete anonymity is paramount to your situation, you should **only** be using the desktop Tor Browser client, ideally in a [Whonix](desktop.md#whonix) + [Qubes](desktop.md#qubes-os) configuration. Mobile browsers are less common on Tor (and more fingerprintable as a result), and other configurations are not as rigorously tested against deanonymization. @@ -52,13 +52,13 @@ If more complete anonymity is paramount to your situation, you should **only** b ![Tor Browser logo](assets/img/browsers/tor.svg){ align=right } -**Tor Browser** is the choice if you need anonymity, as it provides you with access to the Tor network and bridges, and it includes default settings and extensions that are automatically configured by the default security levels: *Standard*, *Safer* and *Safest*. +**Tor Browser** is the top choice if you need anonymity, as it provides you with access to the Tor network and bridges, and it includes default settings and extensions that are automatically configured by the default security levels: *Standard*, *Safer* and *Safest*. [:octicons-home-16: Homepage](https://torproject.org){ .md-button .md-button--primary } [:simple-torbrowser:](http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion){ .card-link title="Onion Service" } -[:octicons-info-16:](https://tb-manual.torproject.org){ .card-link title=Documentation } +[:octicons-info-16:](https://tb-manual.torproject.org){ .card-link title="Documentation" } [:octicons-code-16:](https://gitlab.torproject.org/tpo/applications/tor-browser){ .card-link title="Source Code" } -[:octicons-heart-16:](https://donate.torproject.org){ .card-link title=Contribute } +[:octicons-heart-16:](https://donate.torproject.org){ .card-link title="Contribute" }
Downloads @@ -130,13 +130,15 @@ On iOS, Orbot has some limitations that could potentially cause crashes or leaks ![Onion Browser logo](assets/img/self-contained-networks/onion_browser.svg){ align=right } -**Onion Browser** is an open-source browser that lets you browse the web anonymously over the Tor network on iOS devices and is endorsed by the [Tor Project](https://support.torproject.org/glossary/onion-browser). [:material-star-box: Read our latest Onion Browser review.](https://www.privacyguides.org/articles/2024/09/18/onion-browser-review/) +**Onion Browser** is an open-source browser that lets you browse the web anonymously over the Tor network on iOS devices and is endorsed by the [Tor Project](https://support.torproject.org/glossary/onion-browser). + +[:material-star-box: Read our latest Onion Browser review.](https://www.privacyguides.org/articles/2024/09/18/onion-browser-review/) [:octicons-home-16: Homepage](https://onionbrowser.com){ .md-button .md-button--primary } [:octicons-eye-16:](https://onionbrowser.com/privacy-policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://onionbrowser.com/faqs){ .card-link title=Documentation} +[:octicons-info-16:](https://onionbrowser.com/faqs){ .card-link title="Documentation" } [:octicons-code-16:](https://github.com/OnionBrowser/OnionBrowser){ .card-link title="Source Code" } -[:octicons-heart-16:](https://onionbrowser.com/donate){ .card-link title=Contribute } +[:octicons-heart-16:](https://onionbrowser.com/donate){ .card-link title="Contribute" }
Downloads