mirror of
https://github.com/privacyguides/privacyguides.org.git
synced 2024-12-18 12:24:35 -05:00
Markdown conversion (#529)
Co-authored-by: Daniel Gray <dng@disroot.org>
This commit is contained in:
Jonah Aragon
Daniel Gray
parent
842b58e42a
commit
806b0b97d7
@ -4,7 +4,7 @@ items:
|
||||
- type: link
|
||||
title: Cloud Storage
|
||||
icon: fad fa-cloud
|
||||
file: _evergreen/cloud.html
|
||||
file: _pages/providers/cloud.md
|
||||
- type: link
|
||||
title: DNS Servers
|
||||
icon: fad fa-map-signs
|
||||
@ -16,7 +16,7 @@ items:
|
||||
- type: link
|
||||
title: Search Engines
|
||||
icon: fad fa-search-location
|
||||
file: _evergreen/search-engines.html
|
||||
file: _pages/providers/search-engines.md
|
||||
- type: link
|
||||
title: Social Networks
|
||||
icon: fad fa-thumbs-up
|
||||
|
||||
@ -4,7 +4,7 @@ items:
|
||||
- type: link
|
||||
title: Browsers
|
||||
icon: fad fa-browser
|
||||
file: _evergreen/browsers.html
|
||||
file: _evergreen/browsers.md
|
||||
- type: link
|
||||
title: Operating Systems (Legacy)
|
||||
icon: fad fa-compact-disc
|
||||
@ -47,7 +47,7 @@ items:
|
||||
- type: link
|
||||
title: Real-Time Communication
|
||||
icon: fad fa-comments-alt
|
||||
file: _evergreen/real-time-communication.html
|
||||
file: _pages/software/real-time-communication.md
|
||||
- type: link
|
||||
title: Self-Contained Networks
|
||||
icon: fad fa-chart-network
|
||||
@ -55,4 +55,4 @@ items:
|
||||
- type: link
|
||||
title: Video Streaming
|
||||
icon: fad fa-video
|
||||
file: _evergreen/video-streaming.html
|
||||
file: _pages/software/video-streaming.md
|
||||
|
||||
@ -4,4 +4,4 @@ items:
|
||||
- type: link
|
||||
title: Android
|
||||
icon: fab fa-android
|
||||
file: _evergreen/android.html
|
||||
file: _evergreen/android.md
|
||||
@ -4,4 +4,4 @@ items:
|
||||
- type: link
|
||||
title: Threat Modeling
|
||||
icon: fad fa-bullseye-arrow
|
||||
file: _evergreen/threat-modeling.html
|
||||
file: _evergreen/threat-modeling.md
|
||||
|
||||
@ -2,14 +2,14 @@ title: Orbot
|
||||
type: Recommendation
|
||||
logo: /assets/img/android/orbot.svg
|
||||
description: |
|
||||
<strong>Orbot</strong> is a free proxy app that routes your connections through the Tor Network.
|
||||
**Orbot** is a free proxy app that routes your connections through the Tor Network.
|
||||
|
||||
Orbot can proxy individual apps if they support SOCKS or HTTP proxying. It can also proxy all your network connections using the <a href="https://developer.android.com/reference/android/net/VpnService">VpnService</a> and can be used with the VPN killswitch (⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN).
|
||||
Orbot can proxy individual apps if they support SOCKS or HTTP proxying. It can also proxy all your network connections using the [VpnService](https://developer.android.com/reference/android/net/VpnService) and can be used with the VPN killswitch (⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN).
|
||||
|
||||
For resistance against traffic analysis attacks, consider enabling <em>Isolate Destination Address</em> ( ⁝ →Settings → Connectivity). This will use a completely different Tor Circuit (different middle relay and exit nodes) for every domain you connect to.
|
||||
For resistance against traffic analysis attacks, consider enabling *Isolate Destination Address* ( ⁝ →Settings → Connectivity). This will use a completely different Tor Circuit (different middle relay and exit nodes) for every domain you connect to.
|
||||
|
||||
<h4>Notes</h4>
|
||||
Orbot is often outdated on the Guardian Project's <a href="https://guardianproject.info/fdroid">F-Droid repository</a> and <a href="https://play.google.com/store/apps/details?id=org.torproject.android">Google Play</a> so consider downloading directly from the <a href="https://github.com/guardianproject/orbot">GitHub repository</a> instead.
|
||||
#### Notes
|
||||
Orbot is often outdated on the Guardian Project's [F-Droid repository](https://guardianproject.info/fdroid) and [Google Play](https://play.google.com/store/apps/details?id=org.torproject.android) so consider downloading directly from the [GitHub repository](https://github.com/guardianproject/orbot) instead.
|
||||
|
||||
All versions are signed using the same signature so they should be compatible with each other.
|
||||
website: 'https://guardianproject.info/apps/org.torproject.android'
|
||||
|
||||
@ -2,11 +2,11 @@ title: Shelter
|
||||
type: Recommendation
|
||||
logo: /assets/img/android/shelter.svg
|
||||
description: |
|
||||
<strong>Shelter</strong> is an app that helps you leverage the Android work profile to isolate other apps.
|
||||
**Shelter** is an app that helps you leverage the Android work profile to isolate other apps.
|
||||
|
||||
Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager (<a href="https://source.android.com/devices/architecture/modular-system/documentsui">DocumentsUI</a>).
|
||||
Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager ([DocumentsUI](https://source.android.com/devices/architecture/modular-system/documentsui)).
|
||||
|
||||
<h4>Notes</h4>
|
||||
#### Notes
|
||||
CalyxOS includes a device controller so we recommend using their built in work profile instead.
|
||||
website: 'https://gitea.angry.im/PeterCxy/Shelter'
|
||||
downloads:
|
||||
|
||||
@ -2,20 +2,19 @@ title: Auditor
|
||||
type: Recommendation
|
||||
logo: /assets/img/android/auditor.svg
|
||||
description: |
|
||||
<strong>Auditor</strong> is an app which leverages hardware security features to provide device integrity monitoring for <a href="https://attestation.app/about#device-support">supported devices</a>. It currently works with GrapheneOS and the stock operating system. It performs attestation and intrusion detection by:
|
||||
<ul>
|
||||
<li>Using a <a href="https://en.wikipedia.org/wiki/Trust_on_first_use">Trust On First Use (TOFU)</a> model between an <em>auditor</em> and <em>auditee</em>, the pair establish a private key in the <a href="https://source.android.com/security/keystore/">hardware-backed keystore</a> of the <em>Auditor</em>.</li>
|
||||
<li>The <em>auditor</em> can either be another instance of the Auditor app or the <a href="https://attestation.app">Remote Attestation Service</a>.</li>
|
||||
<li>The <em>auditor</em> records the current state and configuration of the <em>auditee</em>.</li>
|
||||
<li>Should tampering with the operating system of the <em>auditee</em> after the pairing is complete, the auditor will be aware of the change in the device state and configurations.</li>
|
||||
<li>The user will be alerted to the change.</li>
|
||||
</ul>
|
||||
**Auditor** is an app which leverages hardware security features to provide device integrity monitoring for [supported devices](https://attestation.app/about#device-support). It currently works with GrapheneOS and the stock operating system. It performs attestation and intrusion detection by:
|
||||
|
||||
* Using a [Trust On First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) model between an *auditor* and *auditee*, the pair establish a private key in the [hardware-backed keystore](https://source.android.com/security/keystore/) of the *Auditor*.
|
||||
* The *auditor* can either be another instance of the Auditor app or the [Remote Attestation Service](https://attestation.app).
|
||||
* The *auditor* records the current state and configuration of the *auditee*.
|
||||
* Should tampering with the operating system of the *auditee* after the pairing is complete, the auditor will be aware of the change in the device state and configurations.
|
||||
* The user will be alerted to the change.
|
||||
|
||||
No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring.
|
||||
|
||||
If your <a href="/threat-modeling/">threat model</a> requires privacy you could consider using Orbot or a VPN to hide your IP address from the attestation service.
|
||||
If your [threat model](/threat-modeling/) requires privacy you could consider using Orbot or a VPN to hide your IP address from the attestation service.
|
||||
|
||||
To make sure that your hardware and operating system is genuine, <a href="https://grapheneos.org/install/web#verifying-installation">perform local attestation</a> immediately after the device has been installed and prior to any internet connection.
|
||||
To make sure that your hardware and operating system is genuine, [perform local attestation](https://grapheneos.org/install/web#verifying-installation) immediately after the device has been installed and prior to any internet connection.
|
||||
|
||||
website: 'https://attestation.app'
|
||||
privacy_policy: 'https://attestation.app/privacy-policy'
|
||||
|
||||
@ -3,15 +3,15 @@ type: Recommendation
|
||||
logo: /assets/img/android/grapheneos.svg
|
||||
logo_dark: /assets/img/android/grapheneos-dark.svg
|
||||
description: |
|
||||
<strong>GrapheneOS</strong> is the best choice when it comes to privacy and security.
|
||||
**GrapheneOS** is the best choice when it comes to privacy and security.
|
||||
|
||||
GrapheneOS has a lot of security hardening and privacy improvements. It has a <a href="https://github.com/GrapheneOS/hardened_malloc">hardened memory allocator</a>, network and sensor permissions, and various other <a href="https://grapheneos.org/features">security features</a>. GrapheneOS also comes with full firmware updates and signed builds, so <a href="https://source.android.com/security/verifiedboot">verified boot</a> is fully supported.
|
||||
GrapheneOS has a lot of security hardening and privacy improvements. It has a [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), network and sensor permissions, and various other [security features](https://grapheneos.org/features). GrapheneOS also comes with full firmware updates and signed builds, so [verified boot](https://source.android.com/security/verifiedboot) is fully supported.
|
||||
|
||||
Notably, GrapheneOS supports <a href="https://grapheneos.org/usage#sandboxed-play-services">Sandboxed Play Services</a>. Google Play Services can be run fully sandboxed like a regular user app and contained in a work profile or user <a href="/android/#android-security-privacy">profile</a> of your choice. This means that you can run apps dependant on Play Services, such as those that require push notifications using Google's <a href="https://firebase.google.com/docs/cloud-messaging/">Firebase Cloud Messaging</a> service. GrapheneOS allows you to take advantage of most <a href="https://en.wikipedia.org/wiki/Google_Play_Services">Google Play Services</a> whilst having full user control over their permissions and access.
|
||||
Notably, GrapheneOS supports [Sandboxed Play Services](https://grapheneos.org/usage#sandboxed-play-services). Google Play Services can be run fully sandboxed like a regular user app and contained in a work profile or user [profile](/android/#android-security-privacy) of your choice. This means that you can run apps dependant on Play Services, such as those that require push notifications using Google's [Firebase Cloud Messaging](https://firebase.google.com/docs/cloud-messaging/) service. GrapheneOS allows you to take advantage of most [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) whilst having full user control over their permissions and access.
|
||||
|
||||
Currently, only <a href="https://grapheneos.org/faq#device-support">Pixel phones</a> meet its hardware security requirement and are supported.
|
||||
Currently, only [Pixel phones](https://grapheneos.org/faq#device-support) meet its hardware security requirement and are supported.
|
||||
|
||||
<h4>Notes</h4>
|
||||
#### Notes
|
||||
GrapheneOS's "extended support" devices do not have full security patches (firmware updates) due to the original equipment manufacturer (OEM) discontinuing support. These devices cannot be considered completely secure.
|
||||
website: 'https://grapheneos.org/'
|
||||
privacy_policy: 'https://grapheneos.org/faq#privacy-policy'
|
||||
|
||||
@ -2,20 +2,20 @@ title: CalyxOS
|
||||
type: Recommendation
|
||||
logo: /assets/img/android/calyxos.svg
|
||||
description: |
|
||||
<strong>CalyxOS</strong> is a decent alternative to GrapheneOS.
|
||||
**CalyxOS** is a decent alternative to GrapheneOS.
|
||||
|
||||
It has some privacy features on top of AOSP, such as the <a href="https://calyxos.org/docs/tech/datura-details"> Datura firewall</a>, <a href="https://signal.org">Signal</a> integration in the dialer app, and a built in panic button. CalyxOS also comes with firmware updates and signed builds, so <a href="https://source.android.com/security/verifiedboot">verified boot</a> is fully supported.
|
||||
It has some privacy features on top of AOSP, such as the [Datura firewall](https://calyxos.org/docs/tech/datura-details), [Signal](https://signal.org) integration in the dialer app, and a built in panic button. CalyxOS also comes with firmware updates and signed builds, so [verified boot](https://source.android.com/security/verifiedboot) is fully supported.
|
||||
|
||||
To accomodate users who need Google Play Services, CalyxOS optionally includes <a href="https://microg.org/">MicroG</a>. With MicroG, CalyxOS also bundles in the <a href="https://location.services.mozilla.com/">Mozilla</a> and <a href="https://github.com/n76/DejaVu">DejaVu</a> location services.
|
||||
To accomodate users who need Google Play Services, CalyxOS optionally includes [MicroG](https://microg.org/). With MicroG, CalyxOS also bundles in the [Mozilla](https://location.services.mozilla.com/) and [DejaVu](https://github.com/n76/DejaVu) location services.
|
||||
|
||||
Currently, CalyxOS <a href="https://calyxos.org/docs/guide/device-support/">supports</a> Google Pixel phones and the Xiaomi Mi A2. For legacy devices, CalyxOS offers "extended support" for much longer than GrapheneOS, making it a good choice once GrapheneOS has dropped support.
|
||||
Currently, CalyxOS [supports](https://calyxos.org/docs/guide/device-support/) Google Pixel phones and the Xiaomi Mi A2. For legacy devices, CalyxOS offers "extended support" for much longer than GrapheneOS, making it a good choice once GrapheneOS has dropped support.
|
||||
|
||||
<h4>Notes</h4>
|
||||
#### Notes
|
||||
CalyxOS's "extended support" does not have full security patches due to the original equipment manufacturer (OEM) discontinuing support, therefore they cannot be considered completely secure.
|
||||
|
||||
With the Xiaomi Mi A2, CalyxOS does not distribute the latest firmware. Newer versions of the firmware prevented the device from performing verified boot.
|
||||
|
||||
The Datura firewall can leak in some circumstances (see <a href="https://gitlab.com/CalyxOS/calyxos/-/issues/572">#572</a> and <a href="https://gitlab.com/CalyxOS/calyxos/-/issues/581">#581</a>).
|
||||
The Datura firewall can leak in some circumstances (see [#572](https://gitlab.com/CalyxOS/calyxos/-/issues/572) and [#581](https://gitlab.com/CalyxOS/calyxos/-/issues/581)).
|
||||
website: 'https://calyxos.org'
|
||||
privacy_policy: 'https://calyxinstitute.org/legal/privacy-policy'
|
||||
downloads:
|
||||
|
||||
@ -2,22 +2,22 @@ title: DivestOS
|
||||
type: Recommendation
|
||||
logo: /assets/img/android/divestos.svg
|
||||
description: |
|
||||
<strong>DivestOS</strong> is a <a href="https://en.wikipedia.org/wiki/Fork_(software_development)#Forking_of_free_and_open-source_software">soft-fork</a> of <a href="https://lineageos.org/">LineageOS</a>.
|
||||
**DivestOS** is a [soft-fork](https://en.wikipedia.org/wiki/Fork_(software_development)#Forking_of_free_and_open-source_software) of [LineageOS](https://lineageos.org/).
|
||||
|
||||
DivestOS inherits many <a href="https://divestos.org/index.php?page=devices&base=LineageOS">supported devices</a> from LineageOS. It has signed builds, making it possible to have <a href="https://source.android.com/security/verifiedboot">verified boot</a> on some non-Pixel devices.
|
||||
DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
|
||||
|
||||
DivestOS has automated kernel vulnerability (<a href="https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures">CVE</a>) <a href="https://gitlab.com/divested-mobile/cve_checker">patching</a>, fewer proprietary blobs, a custom <a href="https://divested.dev/index.php?page=dnsbl">hosts</a> file, along with bundled <a href="https://www.f-droid.org">F-Droid</a> as the app store. It also includes <a href="https://github.com/microg/UnifiedNlp">UnifedNlp</a> for network location and some hardening with <a href="https://gitlab.com/divested-mobile/mulch">Mulch Webview</a>. DivestOS also includes kernel patches from GrapheneOS and enables security features in <a href="https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L698">defconfig</a>.
|
||||
DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, a custom [hosts](https://divested.dev/index.php?page=dnsbl) file, along with bundled [F-Droid](https://www.f-droid.org) as the app store. It also includes [UnifedNlp](https://github.com/microg/UnifiedNlp) for network location and some hardening with [Mulch Webview](https://gitlab.com/divested-mobile/mulch). DivestOS also includes kernel patches from GrapheneOS and enables security features in [defconfig](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L698).
|
||||
|
||||
DivestOS also inherits LineageOS's <a href="https://reddit.com/comments/c4a6f7">iptables</a> network access feature. You can deny network access to an individual application by pressing and holding on the app's icon (App info → Data and Network → Uncheck "Network Access").
|
||||
DivestOS also inherits LineageOS's [iptables](https://reddit.com/comments/c4a6f7) network access feature. You can deny network access to an individual application by pressing and holding on the app's icon (App info → Data and Network → Uncheck "Network Access").
|
||||
|
||||
DivestOS 16.0 and 17.1 has GrapheneOS's <a href="https://github.com/GrapheneOS/hardened_malloc">hardened memory allocator</a>. There are plans to port this to DivestOS 18.1.
|
||||
DivestOS 16.0 and 17.1 has GrapheneOS's [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc). There are plans to port this to DivestOS 18.1.
|
||||
|
||||
<h4>Notes</h4>
|
||||
DivestOS firmware update <a href="https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS">status</a> varies across the devices it supports. For Pixel phones, we still recommend using GrapheneOS or CalyxOS. For other supported devices, DivestOS is a good alternative.
|
||||
#### Notes
|
||||
DivestOS firmware update [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) varies across the devices it supports. For Pixel phones, we still recommend using GrapheneOS or CalyxOS. For other supported devices, DivestOS is a good alternative.
|
||||
|
||||
Like CalyxOS's firewall, the network access toggle can also leak in <a href="https://gitlab.com/LineageOS/issues/android/-/issues/3228">some</a> situations.
|
||||
Like CalyxOS's firewall, the network access toggle can also leak in [some](https://gitlab.com/LineageOS/issues/android/-/issues/3228) situations.
|
||||
|
||||
Not all of the supported devices have <a href="https://source.android.com/security/verifiedboot">verified boot</a> and some perform it better than others.
|
||||
Not all of the supported devices have [verified boot](https://source.android.com/security/verifiedboot) and some perform it better than others.
|
||||
|
||||
website: 'https://divestos.org'
|
||||
website_tor: 'http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion'
|
||||
|
||||
@ -2,7 +2,7 @@ title: Nextcloud
|
||||
type: Recommendation
|
||||
logo: /assets/img/cloud/nextcloud.svg
|
||||
description: |
|
||||
<strong>Nextcloud</strong> is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control. It also comes with experimental end-to-end encryption (E2EE).
|
||||
**Nextcloud** is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control. It also comes with experimental end-to-end encryption (E2EE).
|
||||
|
||||
We recommend checking if your Nextcloud provider supports E2EE, otherwise you have to trust the provider to not look at your files.
|
||||
|
||||
|
||||
@ -2,11 +2,11 @@ title: Proton Drive
|
||||
type: Recommendation
|
||||
logo: /assets/img/cloud/protondrive.svg
|
||||
description: |
|
||||
<strong>Proton Drive</strong> is an end-to-end encrypted (E2EE) general file storage service by the popular encrypted email provider <a href="https://protonmail.com">ProtonMail</a>.
|
||||
**Proton Drive** is an end-to-end encrypted (E2EE) general file storage service by the popular encrypted email provider [ProtonMail](https://protonmail.com).
|
||||
|
||||
Proton Drive is currently in beta and only is only available through a web client.
|
||||
|
||||
When using a web client, you are placing trust in the server to send you proper JavaScript code to derive the decryption key and authentication token locally in your browser. A compromised server can send you malicious JavaScript code to steal your master password and decrypt your data. If this does not fit your <a href="/threat-modeling/">threat model</a>, consider using an alternative.
|
||||
When using a web client, you are placing trust in the server to send you proper JavaScript code to derive the decryption key and authentication token locally in your browser. A compromised server can send you malicious JavaScript code to steal your master password and decrypt your data. If this does not fit your [threat model](/threat-modeling/), consider using an alternative.
|
||||
|
||||
website: 'https://protonmail.com'
|
||||
privacy_policy: 'https://protonmail.com/privacy-policy'
|
||||
|
||||
@ -3,7 +3,7 @@ type: Recommendation
|
||||
logo: /assets/img/cloud/tahoe-lafs.svg
|
||||
logo_dark: /assets/img/cloud/tahoe-lafs-dark.svg
|
||||
description: |
|
||||
<strong>Tahoe-LAFS</strong> is a free and open decentralized cloud storage system. It distributes your data across multiple servers. Even if some of the servers fail or are taken over by an attacker, the entire file store continues to function correctly, preserving your privacy and security. The servers used as storage pools do not have access to your data.
|
||||
**Tahoe-LAFS** is a free and open decentralized cloud storage system. It distributes your data across multiple servers. Even if some of the servers fail or are taken over by an attacker, the entire file store continues to function correctly, preserving your privacy and security. The servers used as storage pools do not have access to your data.
|
||||
|
||||
Due to the complexity of the system and the amount of nodes needed to set it up, Tahoe-LAFS is only recommended for seasoned system administrators.
|
||||
website: 'https://www.tahoe-lafs.org/'
|
||||
|
||||
@ -2,16 +2,16 @@ title: DuckDuckGo
|
||||
type: Recommendation
|
||||
logo: /assets/img/search-engines/duckduckgo.svg
|
||||
description: |
|
||||
<strong>DuckDuckGo</strong> is a popular search engine and is the default for the Tor Browser.
|
||||
**DuckDuckGo** is a popular search engine and is the default for the Tor Browser.
|
||||
|
||||
DuckDuckGo has a <a href="https://duckduckgo.com/lite">lite</a> and <a href="https://duckduckgo.com/html">html</a> only version, both of which <a href="https://help.duckduckgo.com/features/non-javascript">do not require JavaScript</a> and can be used with their <a href="https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion">Tor onion address</a> (append <a href="https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/lite">/lite</a> or <a href="https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/html">/html</a> for the respective version).
|
||||
DuckDuckGo has a [lite](https://duckduckgo.com/lite) and [html](https://duckduckgo.com/html) only version, both of which [do not require JavaScript](https://help.duckduckgo.com/features/non-javascript) and can be used with their [Tor onion address](https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion) (append [/lite](https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/lite) or [/html](https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/html) for the respective version).
|
||||
|
||||
DuckDuckGo uses its own crawler and various <a href="https://help.duckduckgo.com/results/sources">other sources</a> to provide its search data.
|
||||
DuckDuckGo uses its own crawler and various [other sources](https://help.duckduckgo.com/results/sources) to provide its search data.
|
||||
|
||||
<h4>Notes</h4>
|
||||
#### Notes
|
||||
The company is based in the <span class="flag-icon flag-icon-us"></span> USA.
|
||||
|
||||
Their <a href="https://duckduckgo.com/privacy">Privacy Policy</a> states they do log your search query, but not your IP or any other identifying information.
|
||||
Their [Privacy Policy](https://duckduckgo.com/privacy) states they do log your search query, but not your IP or any other identifying information.
|
||||
|
||||
website: 'https://duckduckgo.com'
|
||||
website_tor: 'https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion'
|
||||
|
||||
@ -2,16 +2,16 @@ title: Startpage
|
||||
type: Recommendation
|
||||
logo: /assets/img/search-engines/startpage.svg
|
||||
description: |
|
||||
<strong>Startpage</strong> is a search engine that provides Google search results. It is a very convenient way to get Google search results without experiencing dark patterns such as difficult captchas or being refused access because you used a <a href="/providers/vpn">VPN</a> or <a href="https://www.torproject.org/download/">Tor</a>.
|
||||
**Startpage** is a search engine that provides Google search results. It is a very convenient way to get Google search results without experiencing dark patterns such as difficult captchas or being refused access because you used a [VPN](/providers/vpn) or [Tor](https://www.torproject.org/download/).
|
||||
|
||||
<h4>Notes</h4>
|
||||
#### Notes
|
||||
Startpage's majority shareholder is System1 who is an adtech company. We don't think that is an issue as they have their own Privacy Policy.
|
||||
|
||||
The Privacy Guides team reached out to Startpage <a href="https://web.archive.org/web/20210118031008/https://blog.privacytools.io/relisting-startpage/">back in 2020</a> for clarification and was satisfied by the answers we received.
|
||||
The Privacy Guides team reached out to Startpage [back in 2020](https://web.archive.org/web/20210118031008/https://blog.privacytools.io/relisting-startpage/) for clarification and was satisfied by the answers we received.
|
||||
|
||||
Startpage is based in the <span class="flag-icon flag-icon-nl"></span> Netherlands.
|
||||
|
||||
According to their <a href="https://www.startpage.com/en/privacy-policy/">Privacy Policy</a>, they only log details such as\: operating system, type of browser and language. They do not log your IP address, search queries or other identifying information.
|
||||
According to their [Privacy Policy](https://www.startpage.com/en/privacy-policy/), they only log details such as: operating system, type of browser and language. They do not log your IP address, search queries or other identifying information.
|
||||
|
||||
Startpage proxies Google Search so Google does have access to your search queries.
|
||||
|
||||
|
||||
@ -2,12 +2,12 @@ title: Mojeek
|
||||
type: Recommendation
|
||||
logo: /assets/img/search-engines/mojeek.svg
|
||||
description: |
|
||||
<strong>Mojeek</strong> is another privacy friendly search engine. They use their own crawler to provide search data.
|
||||
**Mojeek** is another privacy friendly search engine. They use their own crawler to provide search data.
|
||||
|
||||
<h4>Notes</h4>
|
||||
#### Notes
|
||||
The company is based in the <span class="flag-icon flag-icon-gb"></span> UK.
|
||||
|
||||
According to their <a href="https://www.mojeek.com/about/privacy/">Privacy Policy</a>, they log the originating country, time, page requested, and referral data of each query. IP addresses are not logged.
|
||||
According to their [Privacy Policy](https://www.mojeek.com/about/privacy/), they log the originating country, time, page requested, and referral data of each query. IP addresses are not logged.
|
||||
|
||||
website: 'https://www.mojeek.com'
|
||||
privacy_policy: 'https://www.mojeek.com/about/privacy'
|
||||
|
||||
@ -2,9 +2,9 @@ title: Searx
|
||||
type: Recommendation
|
||||
logo: /assets/img/search-engines/searx.svg
|
||||
description: |
|
||||
<strong>Searx</strong> is an <a href="https://github.com/asciimoo/searx">open-source</a>, self-hostable, metasearch engine, aggregating the results of other search engines while not storing information about its users. There is a <a href="https://searx.space/">list of public instances</a>.
|
||||
**Searx** is an [open-source](https://github.com/asciimoo/searx), self-hostable, metasearch engine, aggregating the results of other search engines while not storing information about its users. There is a [list of public instances](https://searx.space/).
|
||||
|
||||
<h4>Notes</h4>
|
||||
#### Notes
|
||||
Searx is a proxy between the user and the search engines it aggregates from. Your search queries will still be sent to the search engines that Searx gets its results from.
|
||||
|
||||
When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting Searx, as other people looking up illegal content on your instance could draw unwanted attention from authorities.
|
||||
|
||||
@ -2,31 +2,32 @@ title: Firefox Desktop
|
||||
type: Recommendation
|
||||
logo: /assets/img/browsers/firefox.svg
|
||||
description: |
|
||||
<strong>Firefox</strong> has some really strong privacy settings such as <a href="https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop">Enhanced Tracking Protection</a> which can help block various <a href="https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop#w_what-enhanced-tracking-protection-blocks">types of tracking</a>.
|
||||
**Firefox** has some really strong privacy settings such as [Enhanced Tracking Protection](https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop) which can help block various [types of tracking](https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop#w_what-enhanced-tracking-protection-blocks).
|
||||
|
||||
These options can be found in the <em>Privacy & Security</em> settings page ( ≡ → Settings → Privacy & Security).
|
||||
<h5><strong>Enhanced Tracking Protection (ETP)</strong>.</h5>
|
||||
These options can be found in the *Privacy & Security* settings page ( ≡ → Settings → Privacy & Security).
|
||||
|
||||
##### **Enhanced Tracking Protection (ETP)**
|
||||
<ul style="list-style-type:none;padding-left:0;">
|
||||
<li>Select: <strong>Strict</strong></li>
|
||||
</ul>
|
||||
|
||||
<h5><strong>HTTPS-Only Mode</strong></h5>
|
||||
##### **HTTPS-Only Mode**
|
||||
<ul style="list-style-type:none;padding-left:0;">
|
||||
<li>Select: <strong>Enable HTTPS-Only Mode in all windows</strong>.</li>
|
||||
</ul>
|
||||
|
||||
<h5><strong>Sanitizing on close</strong></h5>
|
||||
##### **Sanitizing on close**
|
||||
<ul style="list-style-type:none;padding-left:0;">
|
||||
<li>Select: <strong>Delete cookies and site data when Firefox is closed</strong></li>
|
||||
</ul>
|
||||
You can still stay logged into websites by allowing exceptions.
|
||||
|
||||
<h4>Extensions</h4>
|
||||
We normally do not recommend installing any extensions, as they have privileged access within your browser. We make an exception for <a href="/browsers/#additional-resources">uBlock Origin</a>,
|
||||
a popular content blocker and 🏆️ <a href="https://support.mozilla.org/kb/add-on-badges#w_recommended-extensions">Recommended Extension</a> by Mozilla.
|
||||
#### Extensions
|
||||
We normally do not recommend installing any extensions, as they have privileged access within your browser. We make an exception for [uBlock Origin](/browsers/#additional-resources),
|
||||
a popular content blocker and 🏆️ [Recommended Extension](https://support.mozilla.org/kb/add-on-badges#w_recommended-extensions) by Mozilla.
|
||||
|
||||
<h4>Arkenfox (advanced)</h4>
|
||||
The <a href="https://github.com/arkenfox/user.js">Arkenfox project</a> provides a set of carefully considered options for Firefox. These options are quite strict but a few are subjective and can sometimes cause a website to not work properly. You can easily change these settings to suit your needs. We <strong>strongly recommend</strong> reading through the <a href="https://github.com/arkenfox/user.js/wiki">basics</a> section. Arkenfox also enables <a href="https://support.mozilla.org/en-US/kb/containers#w_for-advanced-users">container</a> support.
|
||||
#### Arkenfox (advanced)
|
||||
The [Arkenfox project](https://github.com/arkenfox/user.js) provides a set of carefully considered options for Firefox. These options are quite strict but a few are subjective and can sometimes cause a website to not work properly. You can easily change these settings to suit your needs. We **strongly recommend** reading through the [basics](https://github.com/arkenfox/user.js/wiki) section. Arkenfox also enables [container](https://support.mozilla.org/en-US/kb/containers#w_for-advanced-users) support.
|
||||
|
||||
website: 'https://firefox.com'
|
||||
privacy_policy: 'https://www.mozilla.org/privacy/firefox'
|
||||
|
||||
@ -2,16 +2,16 @@ title: Bromite
|
||||
type: Recommendation
|
||||
logo: /assets/img/browsers/bromite.svg
|
||||
description: |
|
||||
<strong>Bromite</strong> is a Chromium-based browser with privacy and security enhancements, built-in ad blocking and some fingerprinting randomization.
|
||||
**Bromite** is a Chromium-based browser with privacy and security enhancements, built-in ad blocking and some fingerprinting randomization.
|
||||
|
||||
These options can be found in <em>Privacy and Security</em> ( ⁝ → ⚙️ Settings → Privacy and Security)
|
||||
These options can be found in *Privacy and Security* ( ⁝ → ⚙️ Settings → Privacy and Security)
|
||||
|
||||
<h5><strong>HTTPS-Only Mode</strong></h5>
|
||||
##### **HTTPS-Only Mode**
|
||||
<ul style="list-style-type:none;padding-left:0;">
|
||||
<li>Select: <strong>Always use secure connections</strong>.</li>
|
||||
</ul>
|
||||
|
||||
<h5><strong>Always on Incognito mode</strong></h5>
|
||||
##### **Always on Incognito mode**
|
||||
<ul style="list-style-type:none;padding-left:0;">
|
||||
<li>Select: <strong>Open links in incognito tabs always</strong>.</li>
|
||||
<li>Select: <strong>Close all open tabs on exit</strong>.</li>
|
||||
|
||||
@ -2,14 +2,14 @@ title: Firefox iOS
|
||||
type: Recommendation
|
||||
logo: /assets/img/browsers/firefox-ios.svg
|
||||
description: |
|
||||
<strong>Firefox</strong> iOS includes <a href="https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop">Tracking Protection</a> which lets you select the blocklists Cookies, Tracking Content, Cryptominers, Fingerprinters and Redirect trackers.
|
||||
**Firefox** iOS includes [Tracking Protection](https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-ios) which lets you select the blocklists Cookies, Tracking Content, Cryptominers, Fingerprinters and Redirect trackers.
|
||||
|
||||
<h5><strong>Tracking Protection</strong></h5>
|
||||
##### **Tracking Protection**
|
||||
<ul style="list-style-type:none;padding-left:0;">
|
||||
<li>Select: <strong>Strict</strong> ( ≡ → ⚙️ Settings → Tracking Protection).</li>
|
||||
</ul>
|
||||
|
||||
<h5><strong>Sanitizing on close</strong></h5>
|
||||
##### **Sanitizing on close**
|
||||
Firefox iOS does not have have an option to clear cache on quit so you must do it manually. ( ≡ → ⚙️ Settings → Data Management).
|
||||
|
||||
website: 'https://firefox.com'
|
||||
@ -2,14 +2,14 @@ title: Firefox Focus iOS
|
||||
type: Recommendation
|
||||
logo: /assets/img/browsers/firefox_focus.svg
|
||||
description: |
|
||||
<strong>Firefox</strong> Focus iOS includes <a href="https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-ios">Tracking Protection</a> which lets you select the blocklists ad trackers, analytic trackers, social trackers and other content tracking.
|
||||
**Firefox** Focus iOS includes [Tracking Protection](https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-ios) which lets you select the blocklists ad trackers, analytic trackers, social trackers and other content tracking.
|
||||
|
||||
Focus also destroys browsing history on quit automatically which is a good way of automatically clearing cookies and website data regularly which is helpful to prevent tracking.
|
||||
|
||||
<h5><strong>Sanitizing on close</strong></h5>
|
||||
##### **Sanitizing on close**
|
||||
Focus sanitizies all data on close by default. Pressing on the <img alt="iOS Garbage Bin icon" width="16" height="16" src="/assets/img/browsers/ios-trash.svg"/> will immediately destroy all cookies and website data for the entire session.
|
||||
|
||||
<h4>Notes</h4>
|
||||
#### Notes
|
||||
Focus only lets you open one tab at a time.
|
||||
|
||||
website: 'https://firefox.com'
|
||||
@ -2,12 +2,12 @@ title: uBlock Origin
|
||||
type: Recommendation
|
||||
logo: /assets/img/browsers/ublock_origin.svg
|
||||
description: |
|
||||
<strong>uBlock Origin</strong> is a popular content blocker that could help you block ads, trackers, and fingerprinting scripts.
|
||||
**uBlock Origin** is a popular content blocker that could help you block ads, trackers, and fingerprinting scripts.
|
||||
|
||||
We suggest enabling all of the <a href="https://github.com/gorhill/uBlock/wiki/Dashboard:-Filter-lists">filter lists</a> under the "Ads", "Privacy" and "Malware domains". The "Annoyances" and "Multipurpose" lists can also be enabled, but they may break some social media functions. The <em>AdGuard URL Tracking Protection</em> filter list makes extensions like CleanURLs and NeatURLs redundant.
|
||||
We suggest enabling all of the [filter lists](https://github.com/gorhill/uBlock/wiki/Dashboard:-Filter-lists) under the "Ads", "Privacy" and "Malware domains". The "Annoyances" and "Multipurpose" lists can also be enabled, but they may break some social media functions. The *AdGuard URL Tracking Protection* filter list makes extensions like CleanURLs and NeatURLs redundant.
|
||||
|
||||
We also suggest adding the <a href="https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt">Actually Legitimate URL Shortener Tool</a> list and any of the regional lists that might apply to your browsing habits. Additional filter lists do slow things down, so only apply the languages that you use.
|
||||
We also suggest adding the [Actually Legitimate URL Shortener Tool](https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt) list and any of the regional lists that might apply to your browsing habits. Additional filter lists do slow things down, so only apply the languages that you use.
|
||||
|
||||
uBlock Origin also has different <a href="https://github.com/gorhill/uBlock/wiki/Blocking-mode">blocking modes</a>. The easy mode <a href="https://www.ranum.com/security/computer_security/editorials/dumb/">might not</a> necessarily keep you safe from every tracker out there, whereas the more advanced modes let you control exactly what needs to run.
|
||||
uBlock Origin also has different [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). The easy mode [might not](https://www.ranum.com/security/computer_security/editorials/dumb/) necessarily keep you safe from every tracker out there, whereas the more advanced modes let you control exactly what needs to run.
|
||||
website: 'https://addons.mozilla.org/firefox/addon/ublock-origin/'
|
||||
privacy_policy: 'https://github.com/gorhill/uBlock/wiki/Privacy-policy'
|
||||
|
||||
@ -2,7 +2,7 @@ title: Terms of Service; Didn't Read
|
||||
type: Recommendation
|
||||
logo: /assets/img/browsers/terms_of_service_didnt_read.svg
|
||||
description: |
|
||||
<strong>Terms of Service; Didn't Read</strong> grades websites based on their terms of service agreements and privacy policies. It also gives short summaries of those agreements. The analysis and ratings are published transparently by a community of reviewers.
|
||||
**Terms of Service; Didn't Read** grades websites based on their terms of service agreements and privacy policies. It also gives short summaries of those agreements. The analysis and ratings are published transparently by a community of reviewers.
|
||||
|
||||
We do not recommend installing ToS;DR as a browser extension. The same information is provided on their website.
|
||||
website: 'https://tosdr.org/'
|
||||
|
||||
@ -3,10 +3,10 @@ type: Recommendation
|
||||
info: Provides Anonymity
|
||||
logo: /assets/img/browsers/tor.svg
|
||||
description: |
|
||||
<strong>Tor Browser</strong> is the choice if you need anonymity. This browser provides you with access to the Tor Bridges and Tor Network, along with extensions that can be automatically configured to fit its three security levels - <em>Standard</em>, <em>Safer</em> and <em>Safest</em>. We recommend that you do not change any of Tor Browser's default configurations outside of the standard security levels.
|
||||
**Tor Browser** is the choice if you need anonymity. This browser provides you with access to the Tor Bridges and Tor Network, along with extensions that can be automatically configured to fit its three security levels - *Standard*, *Safer* and *Safest*. We recommend that you do not change any of Tor Browser's default configurations outside of the standard security levels.
|
||||
|
||||
<h4>Extensions</h4>
|
||||
You should <strong>never</strong> install any additional extensions on Tor Browser, including the ones we suggest for Firefox. Browser extensions make you stand out from other Tor users and your browser easier to <a href="https://support.torproject.org/glossary/browser-fingerprinting">fingerprint</a>.
|
||||
#### Extensions
|
||||
You should **never** install any additional extensions on Tor Browser, including the ones we suggest for Firefox. Browser extensions make you stand out from other Tor users and your browser easier to [fingerprint](https://support.torproject.org/glossary/browser-fingerprinting).
|
||||
|
||||
website: 'https://www.torproject.org/'
|
||||
website_tor: 'http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/'
|
||||
|
||||
@ -4,18 +4,19 @@ logo: /assets/img/messengers/signal.svg
|
||||
labels: 'color==info::icon==fas fa-fw fa-wifi::text==Centralized::tooltip==All communications pass through a single host. |
|
||||
color==info::icon==fas fa-fw fa-phone::text==VoIP::tooltip==Voice or video calls are supported.'
|
||||
description: |
|
||||
<strong>Signal</strong> is a mobile app developed by Signal Messenger LLC. The app provides instant messaging, as well as voice and video calling.
|
||||
**Signal** is a mobile app developed by Signal Messenger LLC. The app provides instant messaging, as well as voice and video calling.
|
||||
|
||||
All communications are E2EE. Contact lists are encrypted using your login PIN and the server does not have access to it. Personal profiles are also encrypted and only shared with contacts who add you.
|
||||
|
||||
Signal has minimal metadata when <a href="https://signal.org/blog/sealed-sender/">Sealed Sender</a> is enabled. The sender address is encrypted along with the message body, and only the recipient address is visible to the server.
|
||||
Signal has minimal metadata when [Sealed Sender](https://signal.org/blog/sealed-sender/) is enabled. The sender address is encrypted along with the message body, and only the recipient address is visible to the server.
|
||||
|
||||
<h4>Notes</h4>
|
||||
<p>Signal requires your phone number as a personal identifier.</p>
|
||||
<p><a href="https://signal.org/blog/sealed-sender/">Sealed Sender</a> is only enabled for users on your contact list but can be enabled for all recipients with the increased risk of receiving spam.</p>
|
||||
#### Notes
|
||||
Signal requires your phone number as a personal identifier.
|
||||
|
||||
<h4>Technical information</h4>
|
||||
The protocol was independently <a href="https://eprint.iacr.org/2016/1013.pdf">audited</a> in 2016. The specification for the Signal protocol can be founded in their <a href="https://signal.org/docs/">documentation</a>.
|
||||
[Sealed Sender](https://signal.org/blog/sealed-sender/) is only enabled for users on your contact list but can be enabled for all recipients with the increased risk of receiving spam.
|
||||
|
||||
#### Technical information
|
||||
The protocol was independently [audited](https://eprint.iacr.org/2016/1013.pdf) in 2016. The specification for the Signal protocol can be founded in their [documentation](https://signal.org/docs/).
|
||||
website: 'https://signal.org'
|
||||
privacy_policy: 'https://signal.org/legal'
|
||||
downloads:
|
||||
|
||||
@ -5,19 +5,19 @@ labels: 'color==info::icon==fas fa-fw fa-wifi::text==Federated::tooltip==Your co
|
||||
color==info::icon==fas fa-fw fa-wifi::text==P2P::tooltip==One-on-one voice and video calls are peer-to-peer (option can be disabled). |
|
||||
color==info::icon==fas fa-fw fa-phone::text==VoIP::tooltip==Voice or video calls are supported.'
|
||||
description: |
|
||||
<strong>Element</strong> is the reference client for the <a href="https://matrix.org/docs/guides/introduction">Matrix</a> protocol, an <a href="https://matrix.org/docs/spec">open standard</a> for secure decentralized real-time communication.
|
||||
**Element** is the reference client for the [Matrix](https://matrix.org/docs/guides/introduction) protocol, an [open standard](https://matrix.org/docs/spec) for secure decentralized real-time communication.
|
||||
|
||||
Messages and files shared in private rooms (those which require an invite) are by default E2EE as are 1 to 1 voice and video calls.
|
||||
|
||||
<h4>Notes</h4>
|
||||
#### Notes
|
||||
Profile pictures, reactions, and nicknames are not encrypted.
|
||||
|
||||
Group voice and video calls are <a href="https://github.com/vector-im/element-web/issues/12878">not</a> E2EE, and use Jitsi, but this is expected to change with <a href="https://github.com/matrix-org/matrix-doc/pull/3401">Native Group VoIP Signalling</a>. Group calls have <a href="https://github.com/vector-im/element-web/issues/13074">no authentication</a> currently, meaning that non room participants can also join the calls. We recommend that you do not use this feature for private meetings.
|
||||
Group voice and video calls are [not](https://github.com/vector-im/element-web/issues/12878) E2EE, and use Jitsi, but this is expected to change with [Native Group VoIP Signalling](https://github.com/matrix-org/matrix-doc/pull/3401). Group calls have [no authentication](https://github.com/vector-im/element-web/issues/13074) currently, meaning that non room participants can also join the calls. We recommend that you do not use this feature for private meetings.
|
||||
|
||||
When using <a href="https://github.com/vector-im/element-web">element-web</a>, you must trust the server hosting the Element client. If your <a href="/threat-modeling">threat model</a> requires stronger protection then use a desktop or mobile client instead.
|
||||
When using [element-web](https://github.com/vector-im/element-web), you must trust the server hosting the Element client. If your [threat model](/threat-modeling) requires stronger protection then use a desktop or mobile client instead.
|
||||
|
||||
<h4>Technical information</h4>
|
||||
The protocol was independently <a href="https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last">audited</a> in 2016. The specification for the Matrix protocol can be found in their <a href="https://spec.matrix.org/latest/">documentation</a>. The <a href="https://matrix.org/docs/projects/other/olm">Olm</a> cryptographic ratchet used by Matrix is an implementation of Signal's <a href="https://signal.org/docs/specifications/doubleratchet/">Double Ratchet algorithm</a>.
|
||||
#### Technical information
|
||||
The protocol was independently [audited](https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption-security-assessment-released-and-implemented-cross-platform-on-riot-at-last) in 2016. The specification for the Matrix protocol can be found in their [documentation](https://spec.matrix.org/latest/). The [Olm](https://matrix.org/docs/projects/other/olm) cryptographic ratchet used by Matrix is an implementation of Signal's [Double Ratchet algorithm](https://signal.org/docs/specifications/doubleratchet/).
|
||||
|
||||
website: 'https://element.io'
|
||||
privacy_policy: 'https://element.io/privacy'
|
||||
|
||||
@ -4,17 +4,17 @@ logo: /assets/img/messengers/briar.svg
|
||||
labels: 'color==info::icon==fas fa-fw fa-wifi::text==P2P::tooltip==Senders and recipients connect directly with no middlemen (can be disabled). |
|
||||
color==info::icon==fas fa-fw fa-wifi::text==Anonymous Routing::tooltip==Senders and recipients are hidden in the network, no one can know they communicate together (can be disabled).'
|
||||
description: |
|
||||
<strong>Briar</strong> is an encrypted instant messenger that <a href="https://briarproject.org/how-it-works/">connects</a> to other clients using the Tor Network. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar's local mesh mode can be useful when internet availability is a problem.
|
||||
**Briar** is an encrypted instant messenger that [connects](https://briarproject.org/how-it-works/) to other clients using the Tor Network. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar's local mesh mode can be useful when internet availability is a problem.
|
||||
|
||||
<h4>Notes</h4>
|
||||
To <a href="https://briarproject.org/manual/">add a contact</a> on Briar, you must both add each other first. You can either exchange <code>briar://</code> links or scan a contact's QR code if they are nearby.
|
||||
#### Notes
|
||||
To [add a contact](https://briarproject.org/manual/) on Briar, you must both add each other first. You can either exchange `briar://` links or scan a contact's QR code if they are nearby.
|
||||
|
||||
<h4>Technical information</h4>
|
||||
The client software was independently <a href="https://briarproject.org/news/2017-beta-released-security-audit/">audited</a> and the anonymous routing protocol uses the Tor network which has also been audited.
|
||||
#### Technical information
|
||||
The client software was independently [audited](https://briarproject.org/news/2017-beta-released-security-audit/) and the anonymous routing protocol uses the Tor network which has also been audited.
|
||||
|
||||
Briar has a fully <a href="https://code.briarproject.org/briar/briar-spec">published specification</a>.
|
||||
Briar has a fully [published specification](https://code.briarproject.org/briar/briar-spec).
|
||||
|
||||
Briar supports perfect forward secrecy by using the Bramble <a href="https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BHP.md">Handshake</a> and <a href="https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BTP.md">Transport</a> protocol.
|
||||
Briar supports perfect forward secrecy by using the Bramble [Handshake](https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BHP.md) and [Transport](https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BTP.md) protocol.
|
||||
website: 'https://briarproject.org'
|
||||
privacy_policy: 'https://briarproject.org/privacy-policy'
|
||||
downloads:
|
||||
|
||||
@ -3,17 +3,17 @@ type: Recommendation
|
||||
logo: /assets/img/messengers/session.svg
|
||||
labels: 'color==info::icon==fas fa-fw fa-wifi::text==Anonymous Routing::tooltip==Senders and recipients are hidden in the network, no one can know they communicate together.'
|
||||
description: |
|
||||
<strong>Session</strong> is an encrypted instant messenger that uses three random <a href="https://getsession.org/blog/onion-requests-session-new-message-routing-solution"> service nodes</a> to route messages anonymously on the <a href="https://oxen.io">Oxen Network</a>.
|
||||
**Session** is an encrypted instant messenger that uses three random [service nodes](https://getsession.org/blog/onion-requests-session-new-message-routing-solution) to route messages anonymously on the [Oxen Network](https://oxen.io).
|
||||
|
||||
Session allows for E2EE in one-to-one or closed rooms that allow up to 100 members.
|
||||
|
||||
Open rooms have no restriction on the number of members, but anyone can join.
|
||||
|
||||
<h4>Notes</h4>
|
||||
Session does <a href="https://getsession.org/blog/session-protocol-technical-information">not</a> support forward secrecy. The key pair for each conversation is not rotated.
|
||||
#### Notes
|
||||
Session does [not](https://getsession.org/blog/session-protocol-technical-information) support forward secrecy. The key pair for each conversation is not rotated.
|
||||
|
||||
<h4>Technical information</h4>
|
||||
Session was independently <a href="https://getsession.org/session-code-audit/">audited</a> in 2020. The protocol is described in a <a href="https://arxiv.org/abs/2002.04609">whitepaper</a>.
|
||||
#### Technical information
|
||||
Session was independently [audited](https://getsession.org/session-code-audit/) in 2020. The protocol is described in a [whitepaper](https://arxiv.org/abs/2002.04609).
|
||||
|
||||
website: 'https://getsession.org/'
|
||||
privacy_policy: 'https://getsession.org/privacy-policy'
|
||||
|
||||
@ -2,12 +2,12 @@ title: FreeTube
|
||||
type: Recommendation
|
||||
logo: /assets/img/video-streaming/freetube.svg
|
||||
description: |
|
||||
<strong>FreeTube</strong> is a free and open source desktop application for <a href="https://youtube.com">YouTube</a>. When using FreeTube, your subscription list and playlists are saved locally on your device.
|
||||
**FreeTube** is a free and open source desktop application for [YouTube](https://youtube.com). When using FreeTube, your subscription list and playlists are saved locally on your device.
|
||||
|
||||
FreeTube also features <a href="https://sponsor.ajay.app">SponsorBlock</a> to help you skip sponsored advertisements. All YouTube advertisements are also blocked by default.
|
||||
FreeTube also features [SponsorBlock](https://sponsor.ajay.app) to help you skip sponsored advertisements. All YouTube advertisements are also blocked by default.
|
||||
|
||||
<h4>Notes</h4>
|
||||
When using Freetube, your IP address is still known to YouTube, <a href="https://instances.invidious.io">Invidious</a> and the SponsorBlock instances that you use. Consider using a <a href='/providers/vpn'>VPN</a> or <a href="https://www.torproject.org">Tor</a> if your <a href="/threat-modeling">threat model</a> requires hiding your IP address.
|
||||
#### Notes
|
||||
When using Freetube, your IP address is still known to YouTube, [Invidious](https://instances.invidious.io) and the SponsorBlock instances that you use. Consider using a [VPN](/providers/vpn) or [Tor](https://www.torproject.org) if your [threat model](/threat-modeling) requires hiding your IP address.
|
||||
|
||||
website: 'https://freetubeapp.io'
|
||||
privacy_policy: 'https://freetubeapp.io/privacy.php'
|
||||
|
||||
@ -2,18 +2,18 @@ title: LBRY
|
||||
type: Recommendation
|
||||
logo: /assets/img/video-streaming/lbry.svg
|
||||
description: |
|
||||
<strong>The LBRY network</strong> is a decentralized video sharing network. It uses a <a href="https://wikipedia.org/wiki/BitTorrent">BitTorrent</a>-like network to store the video content, and a <a href="https://wikipedia.org/wiki/Blockchain">blockchain</a> to store the indexes for those videos. The main benefit of this design is censorship resistance.
|
||||
**The LBRY network** is a decentralized video sharing network. It uses a [BitTorrent](https://wikipedia.org/wiki/BitTorrent)-like network to store the video content, and a [blockchain](https://wikipedia.org/wiki/Blockchain) to store the indexes for those videos. The main benefit of this design is censorship resistance.
|
||||
|
||||
<strong>The LBRY desktop client</strong> helps you stream videos from the LBRY network, and stores your subscription list in your own LBRY wallet.
|
||||
**The LBRY desktop client** helps you stream videos from the LBRY network, and stores your subscription list in your own LBRY wallet.
|
||||
|
||||
<h4>Notes</h4>
|
||||
We recommend <strong>against</strong> synchronizing your wallet with LBRY Inc., as synchronizing encrypted wallets is not supported yet. If you synchronize your wallet with LBRY Inc., you have to trust them to not look at your subscription list, <a href="https://lbry.com/faq/earn-credits">LBC</a> funds, or take control of your channel.
|
||||
#### Notes
|
||||
We recommend **against** synchronizing your wallet with LBRY Inc., as synchronizing encrypted wallets is not supported yet. If you synchronize your wallet with LBRY Inc., you have to trust them to not look at your subscription list, [LBC](https://lbry.com/faq/earn-credits) funds, or take control of your channel.
|
||||
|
||||
Only the <strong>LBRY desktop client</strong> is recommended. The <a href="https://odysee.com">Odysee</a> website and the LBRY clients in F-Droid, Play Store and the AppStore have mandatory synchronization and telemetry.
|
||||
Only the **LBRY desktop client** is recommended. The [Odysee](https://odysee.com) website and the LBRY clients in F-Droid, Play Store and the AppStore have mandatory synchronization and telemetry.
|
||||
|
||||
While watching and hosting videos, your IP address is visible to the LBRY network. Consider using a <a href='/providers/vpn'>VPN</a> or <a href="https://www.torproject.org">Tor</a> if your <a href="/threat-modeling">threat model</a> requires hiding your IP address.
|
||||
While watching and hosting videos, your IP address is visible to the LBRY network. Consider using a [VPN](/providers/vpn) or [Tor](https://www.torproject.org) if your [threat model](/threat-modeling) requires hiding your IP address.
|
||||
|
||||
You can also disable <em>Save hosting data to help the LBRY network</em> option (⚙️ Settings → Advanced Settings) to avoid exposing your IP address and watched videos when using LBRY for a prolonged period of time.
|
||||
You can also disable *Save hosting data to help the LBRY network* option (⚙️ Settings → Advanced Settings) to avoid exposing your IP address and watched videos when using LBRY for a prolonged period of time.
|
||||
|
||||
website: 'https://lbry.com/'
|
||||
privacy_policy: 'https://lbry.com/privacypolicy'
|
||||
|
||||
@ -2,11 +2,11 @@ title: NewPipe
|
||||
type: Recommendation
|
||||
logo: /assets/img/video-streaming/newpipe.svg
|
||||
description: |
|
||||
<strong>NewPipe</strong> is a free and open source Android application for <a href="https://youtube.com">YouTube</a>, <a href="https://soundcloud.com">SoundCloud</a>, <a href="https://media.ccc.de">media.ccc.de</a>, <a href="https://framatube.org">FramaTube</a> and <a href="https://bandcamp.com">Bandcamp</a>.
|
||||
**NewPipe** is a free and open source Android application for [YouTube](https://youtube.com), [SoundCloud](https://soundcloud.com), [media.ccc.de](https://media.ccc.de), [FramaTube](https://framatube.org) and [Bandcamp](https://bandcamp.com).
|
||||
Your subscription list and playlists are saved locally on your Android device.
|
||||
|
||||
<h4>Notes</h4>
|
||||
NewPipe is available on the main <a href="https://www.f-droid.org">F-Droid</a>'s repository. We recommend that you use the NewPipe's own <a href="https://newpipe.net/FAQ/tutorials/install-add-fdroid-repo">F-Droid repository</a> instead to get faster updates. Sometimes YouTube changes their website and the official repository has new updates sooner.
|
||||
#### Notes
|
||||
NewPipe is available on the main [F-Droid](https://www.f-droid.org)'s repository. We recommend that you use the NewPipe's own [F-Droid repository](https://newpipe.net/FAQ/tutorials/install-add-fdroid-repo) instead to get faster updates. Sometimes YouTube changes their website and the official repository has new updates sooner.
|
||||
website: 'https://newpipe.net'
|
||||
privacy_policy: 'https://newpipe.net/legal/privacy'
|
||||
downloads:
|
||||
|
||||
@ -2,11 +2,11 @@ title: NewPipe x SponsorBlock
|
||||
type: Recommendation
|
||||
logo: /assets/img/video-streaming/newpipe.svg
|
||||
description: |
|
||||
<strong>NewPipe x SponsorBlock</strong> is a fork of <a href="https://newpipe.net">NewPipe</a> with <a href="https://sponsor.ajay.app">SponsorBlock</a> integrated to help you skip sponsored advertisements.
|
||||
**NewPipe x SponsorBlock** is a fork of [NewPipe](https://newpipe.net) with [SponsorBlock](https://sponsor.ajay.app) integrated to help you skip sponsored advertisements.
|
||||
It also has some experimental settings such as the ability to use the built-in player for local playback, an option to force fullscreen on landscape mode, and an option to disable error reporting prompts.
|
||||
|
||||
<h4>Notes</h4>
|
||||
This fork is not endorsed by or affiliated with the upstream project. The NewPipe team has <a href="https://github.com/TeamNewPipe/NewPipe/pull/3205">rejected</a> integration with SponsorBlock and thus this fork is created to provide this functionality.
|
||||
#### Notes
|
||||
This fork is not endorsed by or affiliated with the upstream project. The NewPipe team has [rejected](https://github.com/TeamNewPipe/NewPipe/pull/3205) integration with SponsorBlock and thus this fork is created to provide this functionality.
|
||||
downloads:
|
||||
- icon: fab fa-android
|
||||
url: 'https://apt.izzysoft.de/fdroid/index/apk/org.polymorphicshade.newpipe'
|
||||
|
||||
@ -3,10 +3,10 @@ type: Recommendation
|
||||
logo: /assets/img/video-streaming/invidious.svg
|
||||
logo_dark: /assets/img/video-streaming/invidious-dark.svg
|
||||
description: |
|
||||
<strong>Invidious</strong> is a free and open source front end for YouTube that is also self-hostable. There are list of <a href="https://instances.invidious.io">public instances</a>. Some instances have <a href="https://www.torproject.org">Tor</a> onion services support.
|
||||
**Invidious** is a free and open source front end for YouTube that is also self-hostable. There are list of [public instances](https://instances.invidious.io). Some instances have [Tor](https://www.torproject.org) onion services support.
|
||||
|
||||
<h4>Notes</h4>
|
||||
Invidious does not proxy the video stream through its server by default. Videos watched through Invidious will still make direct connections to Google's servers (googlevideo.com), however, some instances support video proxying. This can be enabled by adding <code>&local=true</code> to the URL.
|
||||
#### Notes
|
||||
Invidious does not proxy the video stream through its server by default. Videos watched through Invidious will still make direct connections to Google's servers (googlevideo.com), however, some instances support video proxying. This can be enabled by adding `&local=true` to the URL.
|
||||
|
||||
When self-hosting, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting Invidious, as other peoples' usage will be linked to your hosting.
|
||||
|
||||
|
||||
5
_includes/card.html
Normal file
5
_includes/card.html
Normal file
@ -0,0 +1,5 @@
|
||||
<div class="card my-5">
|
||||
<div class="card-body">
|
||||
{{ include.content | default: markdown_text | markdownify }}
|
||||
</div>
|
||||
</div>
|
||||
@ -5,6 +5,6 @@
|
||||
<p class="card-text text-danger">When using end-to-end encryption (E2EE) technology like <a href="https://en.wikipedia.org/wiki/Pretty_Good_Privacy">OpenPGP</a>, email will still have some metadata that is not encrypted in the header of the email. <a href="/providers/email/#metadata">Read more about email metadata.</a></p>
|
||||
<p class="card-text text-danger">OpenPGP also does not support <a href="https://en.wikipedia.org/wiki/Forward_secrecy">Forward secrecy</a>, which means if either your or the recipient's private key is ever stolen, <strong>all</strong> previous messages encrypted with it will be exposed. <a href="/providers/email/#email-encryption">How do I protect my private keys?</a></p>
|
||||
<p class="card-text text-info">Rather than use email for prolonged conversations, consider using a medium that does support Forward secrecy.</p>
|
||||
<a href="/real-time-communication/" class="btn btn-outline-info">Recommended Instant Messengers</a>
|
||||
<a href="/software/real-time-communication/" class="btn btn-outline-info">Recommended Instant Messengers</a>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
8
_includes/media-left.html
Normal file
8
_includes/media-left.html
Normal file
@ -0,0 +1,8 @@
|
||||
<div class="d-flex">
|
||||
<div class="flex-shrink-0">
|
||||
<img src="{{ include.src }}" width="{{ include.width | default: 150 }}" height="{{ include.height | default: 150 }}" alt="{{ include.alt }}" />
|
||||
</div>
|
||||
<div class="flex-grow-1 ms-3">
|
||||
{{ include.text | markdownify }}
|
||||
</div>
|
||||
</div>
|
||||
@ -3,9 +3,9 @@ layout: default
|
||||
---
|
||||
<div class="container my-5">
|
||||
<h1>{{ page.title }}</h1>
|
||||
{% if page.description %}<p class="lead">
|
||||
{{ page.description }}
|
||||
</p>{% endif %}
|
||||
{% if page.description %}<div class="lead">
|
||||
{{ page.description | markdownify }}
|
||||
</div>{% endif %}
|
||||
{{ content }}
|
||||
{% include hr.html %}
|
||||
{% include footer.html %}
|
||||
|
||||
@ -35,8 +35,10 @@ layout: default
|
||||
</div>
|
||||
</div>
|
||||
<div class="container my-5">
|
||||
<div class="w-75 mx-auto">
|
||||
{{ content }}
|
||||
<div class="row justify-content-md-center">
|
||||
<div class="col-lg-7">
|
||||
{{ content }}
|
||||
</div>
|
||||
</div>
|
||||
{% if page.canonical or page.cover_src_publisher %}<hr class="m-5" />
|
||||
{% if page.cover_src_publisher %}<p><em>Cover photo: <a href="{{ page.cover_src }}">{{ page.cover_src_publisher }}</a>. Used with permission.</em></p>{% endif %}
|
||||
|
||||
@ -1,176 +0,0 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Android
|
||||
mathjax: true
|
||||
description: "Android is a secure operating system that has strong <a href='https://source.android.com/security/app-sandbox'>app sandboxing</a>, <a href='https://source.android.com/security/verifiedboot'>verified boot</a>, and a robust <a href='https://developer.android.com/guide/topics/permissions/overview'>permission</a> control system.
|
||||
|
||||
The main privacy concern with most Android devices is that they usually include <a href='https://developers.google.com/android/guides/overview'>Google Play Services</a>. This component is proprietary, closed source, has a privileged role on your phone and may collect private user information. It is not a part of the <a href='https://source.android.com/'>Android Open Source Project (AOSP)</a> nor is it included with the below derivatives."
|
||||
---
|
||||
|
||||
<h2 id="mobile-only-recommendations" class="anchor">
|
||||
<a href="#aosp-derivatives"><i class="fas fa-link anchor-icon"></i></a>
|
||||
AOSP Derivatives
|
||||
</h2>
|
||||
|
||||
{% for item_hash in site.data.operating-systems.android %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
|
||||
<h2 id="android-security-privacy" class="anchor">
|
||||
<a href="#android-security-privacy"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Android security and privacy features
|
||||
</h2>
|
||||
|
||||
<h5><strong>User Profiles</strong></h5>
|
||||
|
||||
<p>Multiple user profiles (Settings → System → Multiple users) are the simplest way to isolate in Android. With user profiles you can limit a user from making calls, SMS or installing apps on the device. Each profile is encrypted using its own encryption key and cannot access the data of any other profiles. Even the device owner cannot view the data of other profiles without knowing their password. Multiple user profiles is a more secure method of isolation.</p>
|
||||
|
||||
<h5><strong>Work Profile</strong></h5>
|
||||
<p><a href="https://support.google.com/work/android/answer/6191949">Work profiles</a> are another way to isolate individual apps and may be more convenient than separate user profiles.</p>
|
||||
|
||||
<p>A <strong>device controller</strong> such as <a href="/android/#recommended-apps">Shelter</a> is required, unless you're using CalyxOS which includes one.</p>
|
||||
|
||||
<p>The work profile is dependent on a device controller to function. Features such as <em>File Shuttle</em> and <em>contact search blocking</em> or any kind of isolation features must be implemented by the controller. The user must also fully trust the device controller app, as it has full access to the data inside of the work profile.</p>
|
||||
|
||||
<p>This method is generally less secure than a secondary user profile; however, it does allow you the convenience of running apps in both the work and personal profiles simultaneously.</p>
|
||||
|
||||
<h5><strong>Verified Boot</strong></h5>
|
||||
<p><a href='https://source.android.com/security/verifiedboot'>Verified boot</a> is an important part of the Android security model. It provides protection against <a href="https://en.wikipedia.org/wiki/Evil_maid_attack">Evil maid</a> attacks, malware persistence, and ensures security updates cannot be downgraded with <a href="https://source.android.com/security/verifiedboot/verified-boot#rollback-protection">rollback protection</a>.</p>
|
||||
|
||||
<p>Android 10 and above has moved away from full disk encryption (FDE) to more flexible <a href="https://source.android.com/security/encryption/file-based">file based </a> encryption.</p>
|
||||
|
||||
<p>Each user's data is encrypted using their own unique encryption key, and the operating system files are left unencrypted. Verified boot ensures the integrity of the operating system files preventing an adversary with physical access from tampering or installing malware on the device. In the unlikely case that malware is able to exploit other parts of the system and gain higher privileged access, verified boot will prevent and revert changes to the system partition upon reboot of the device.</p>
|
||||
|
||||
<p>Unfortunately, original equipment manufacturers (OEMs) are only obliged to support verified boot on their stock Android distribution. Only a few OEMs such as Google support custom Android Verified Boot (AVB) key enrollment on their devices. Some AOSP derivatives such as LineageOS or /e/ OS do not support verified boot even on hardware with verified boot support for third party operating systems. We recommend that you check for support <strong>before</strong> purchasing a new device. AOSP derivatives which do not support verified boot are <strong>not</strong> recommended.</p>
|
||||
|
||||
<h5><strong>VPN Killswitch</strong></h5>
|
||||
<p>Android 7 and above supports a VPN killswitch and it is available without the need to install third party apps. This feature can prevent leaks if the VPN is disconnected. It can be found in (⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN).</p>
|
||||
|
||||
<h5><strong>Global Toggles</strong></h5>
|
||||
<p>Modern Android devices have global toggles for disabling <a href="https://en.wikipedia.org/wiki/Bluetooth">Bluetooth</a> and location services. Android 12 introduced toggles for the camera and microphone. When not in use, we recommend disabling these features. Apps cannot use disabled features (even if granted individual permission) until renabled.</p>
|
||||
|
||||
<h2 id="recommended-apps" class="anchor">
|
||||
<a href="#recommended-apps"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Recommended Apps
|
||||
</h2>
|
||||
|
||||
{% for item_hash in site.data.operating-systems.android-applications %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
|
||||
<h2 id="general-recommendations" class="anchor">
|
||||
<a href="#general-recommendations"><i class="fas fa-link anchor-icon"></i></a>
|
||||
General Recommendations
|
||||
</h2>
|
||||
|
||||
<h5><strong>Android Rooting</strong></h5>
|
||||
<p>Rooting Android phones can decrease security significantly as it weakens the complete Android security model. This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful <a href='https://source.android.com/security/verifiedboot'>verified boot</a>. Apps that require root will also modify the system partition meaning that verified boot would have to remain disabled. Having root exposed directly in the user interface also increases the <a href="https://en.wikipedia.org/wiki/Attack_surface">attack surface</a> and may assist in <a href="https://en.wikipedia.org/wiki/Privilege_escalation">privilege escalation</a> vulnerabilities and <a href="https://en.wikipedia.org/wiki/Security-Enhanced_Linux">SELinux</a> policy bypasses.</p>
|
||||
|
||||
<p>Adblockers (AdAway) which modify the <a href="https://en.wikipedia.org/wiki/Hosts_(file)">hosts file</a> and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest encrypted <a href="/providers/dns/">DNS</a> or <a href="/providers/vpn/">VPN</a> server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.</p>
|
||||
|
||||
<p>AFWall+ works based on the <a href="#graphene-calyxos">packet filtering approach</a> and is bypassable in some situations.</p>
|
||||
|
||||
<p>We do not believe that the security sacrifices made by rooting a phone are worth the questionable privacy benefits of those apps.</p>
|
||||
|
||||
<h5><strong>Firmware Updates</strong></h5>
|
||||
|
||||
<p>Firmware updates are critical for maintaining security and without them your device cannot be secure. Original equipment manufacturers (OEMs) - phone manufacturers have support agreements with their partners to provide the closed source components for a limited support period. These are detailed in the monthly <a href="https://source.android.com/security/bulletin">Android Security Bulletins</a>.</p>
|
||||
|
||||
<p>As the components of the phone such as the processor and radio technologies rely on closed source components, the updates must be provided by the respective manufacturers. Therefore it is important that you purchase a device within an active support cycle. <a href="https://www.qualcomm.com/news/releases/2020/12/16/qualcomm-and-google-announce-collaboration-extend-android-os-support-and">Qualcomm</a> and <a href="https://news.samsung.com/us/samsung-galaxy-security-extending-updates-knox/">Samsung</a> support their devices for 4 years while cheaper products often have shorter support. With the introduction of the <a href=https://support.google.com/pixelphone/answer/4457705>Pixel 6</a>, Google now makes their own system on chip (SoC) and they will provide 5 years of support.</p>
|
||||
|
||||
<p>Fairphone claims that they will support their device for <a href="https://arstechnica.com/gadgets/2021/09/fairphone-4-has-an-incredible-5-year-warranty-aims-for-6-years-of-updates/">6 years</a>. However, as they use Qualcomm SoC there has been some <a href="https://twitter.com/DanielMicay/status/1444028533186117633">skepticism</a> surrounding that claim.</p>
|
||||
|
||||
<p>Devices that have reached their end-of-life (EoL) and are no longer supported by the SoC manufacturer, cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.</p>
|
||||
|
||||
<h5><strong>Android versions</strong></h5>
|
||||
<p>It's also important to make sure that you're not using an <a href="https://endoflife.date/android">end-of-life</a> version of Android. Newer versions of Android not only receive security updates for the operating system but also important privacy enhancing updates too. For example, <a href="https://developer.android.com/about/versions/10/privacy/changes">prior to Android 10</a>, any user apps with the <a href="https://developer.android.com/reference/android/Manifest.permission#READ_PHONE_STATE"><code>READ_PHONE_STATE</code></a> permission could access sensitive and unique serial numbers of your phone such as <a href="https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity">IMEI</a>, <a href="https://en.wikipedia.org/wiki/Mobile_equipment_identifier">MEID</a>, your SIM card's <a href="https://en.wikipedia.org/wiki/International_mobile_subscriber_identity">IMSI</a>, whereas now they must be system apps to do so. System apps are only shipped by the OEM or Android distribution.</p>
|
||||
|
||||
<h5><strong>Android Permissions</strong></h5>
|
||||
<p><a href="https://developer.android.com/guide/topics/permissions/overview">Permissions on Android</a> grant users control over what apps are allowed to access. Google regularly makes <a href="https://developer.android.com/about/versions/11/privacy/permissions">improvements</a> on the permission system in each successive version. All user installed apps are strictly <a href="https://source.android.com/security/app-sandbox">sandboxed</a>, therefore there is no need to install any antivirus apps. The savings you make from not purchasing or subscribing to security apps is better spent on paying for a supported device in the future.</p>
|
||||
|
||||
<p>Should you want to run an app that you're unsure about consider using a user or work <a href="/android/#android-security-privacy">profile</a>.</p>
|
||||
|
||||
<h5><strong>SafetyNet and Play Integrity API</strong></h5>
|
||||
<p><a href="https://developer.android.com/training/safetynet/attestation">SafetyNet</a> and the <a href="https://developer.android.com/google/play/integrity">Play Integrity APIs</a> are generally used for <a href="https://grapheneos.org/usage#banking-apps">banking apps</a>. Many banking apps will work fine in GrapheneOS with sandboxed Play services, however some non-financal apps have their own crude anti-tampering mechanisms which might fail. GrapheneOS passes the <code>basicIntegrity</code> check, but not the certification check <code>ctsProfileMatch</code>. Devices with Android 8 or later have hardware attestation support which cannot be bypassed without leaked keys or serious vulnerabilities.</p>
|
||||
|
||||
<p>As for Google Wallet, we don't recommend this due to their <a href="https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en">privacy policy</a>, which states you must opt-out if you don't want your credit rating and personal information shared with affiliate marketing services.</p>
|
||||
|
||||
<h5><strong>Android Device Shopping</strong></h5>
|
||||
<p>Google Pixels are known to have good security and properly support <a href="https://source.android.com/security/verifiedboot">verified boot</a>. Some other phones such as the Fairphone and Oneplus devices also support custom Android verified boot (AVB) key enrollment. However, there have been issues with their older models. In the past they were using <a href="https://social.coop/@dazinism/105346943304083054">test keys</a> or not doing proper verification, making verified boot on those devices useless.</p>
|
||||
|
||||
<p>Avoid buying phones from mobile network operators. These often have a <strong>locked bootloader</strong> and do not support <a href="https://source.android.com/devices/bootloader/locking_unlocking">OEM unlocking</a>. These phone variants will prevent you from installing any kind of alternative Android distribution. Phones that cannot be unlocked will often have an <a href="https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity">IMEI</a> starting with "35", that includes phones from purchased from Verizon, Telus, Rogers, EE etc.</p>
|
||||
|
||||
<p>Be very <strong>careful</strong> about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen there's a possibility of <a href="https://www.gsma.com/security/resources/imei-blacklisting/">IMEI blacklisting</a>. There is also a risk involved with you being associated with the activity of the previous owner.</p>
|
||||
|
||||
We have these general tips:
|
||||
<ul>
|
||||
<li>If you're after a bargain on a Pixel device, we suggest buying an "<strong>a</strong>" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.</li>
|
||||
<li>Consider price beating options and specials offered at <a href="https://en.wikipedia.org/wiki/Brick_and_mortar">brick and mortar</a> stores.</li>
|
||||
<li>Look at online community bargain sites in your country. These can alert you to good sales.</li>
|
||||
<li>The price per day for a device can be calculated as \({\text {EoL Date}-\text{Current Date} \over \text{Cost}}\). Google provides a <a href="https://support.google.com/nexus/answer/4457705">list</a> of their supported devices.</li>
|
||||
<li>Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.</li>
|
||||
<li>Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper <a href="https://source.android.com/security/verifiedboot">verified boot</a> support and firmware updates. These devices also have no way for you to check whether they've been tampered with.</li>
|
||||
<li>In short, if a device or Android distribution is not listed here, there is probably a good reason, so check our <a href="https://github.com/privacyguides/privacyguides.org/discussions">discussions</a> page.</li>
|
||||
</ul>
|
||||
|
||||
<p>The installation of GrapheneOS on a Pixel phone is easy with their <a href="https://grapheneos.org/install/web">web installer</a>. If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the <a href="https://shop.nitrokey.com/shop">NitroPhone</a> as they come preloaded with GrapheneOS from the reputable <a href="https://www.nitrokey.com/about">Nitrokey</a> company. The GrapheneOS project is not currently affiliated with any vendor and cannot ensure the quality or security of their products.</p>
|
||||
|
||||
<p>A <a href="https://calyxinstitute.org/membership/calyxos">CalyxOS membership</a> also entitles you to a device preloaded with CalyxOS.</p>
|
||||
|
||||
<h2 id="graphene-calyxos" class="anchor">
|
||||
<a href="#graphene-calyxos"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Security comparison of GrapheneOS and CalyxOS
|
||||
</h2>
|
||||
|
||||
<h5><strong>Profiles</strong></h5>
|
||||
<p>CalyxOS includes a device controller app so there is no need to install a third party app like <a href="/android/#recommended-apps">Shelter</a>. GrapheneOS plans to introduce nested profile support with better isolation in the future.</p>
|
||||
|
||||
<p>GrapheneOS extends the <a href="/android/#android-security-privacy">user profile</a> feature allowing a user to press an "End Session" button. This button clears the encryption key from memory. There are plans to add a <a href="https://github.com/GrapheneOS/os-issue-tracker/issues/88">cross profile notifications system</a> in the future.</p>
|
||||
|
||||
<h5><strong>INTERNET permission vs packet filtering</strong></h5>
|
||||
<p><a href="https://en.wikipedia.org/wiki/Firewall_(computing)#Packet_filter">Packet filter</a> based solutions such <a href="https://calyxos.org/docs/tech/datura-details">Datura Firewall</a>, <a href="https://gitlab.com/LineageOS/issues/android/-/issues/3228">LineageOS</a> (DivestOS), AFWall+ and NetGuard, are not ideal as they can leak and don't prevent an app from proxying a network request through another app using an <a href="https://developer.android.com/guide/components/intents-filters">intent</a>.</p>
|
||||
|
||||
<p>Android has a built-in <a href="https://developer.android.com/training/basics/network-ops/connecting"><code>INTERNET</code></a> permission. This is enforced by the operating system. On AOSP and most of its derivatives, it is treated as an install time permission. GrapheneOS changes it to <a href="https://en.wikipedia.org/wiki/Runtime_(program_lifecycle_phase)">runtime</a> permission, meaning that it can be revoked to deny internet access to a specific app.</p>
|
||||
|
||||
<p>The <a href="https://developer.android.com/training/basics/network-ops/connecting"><code>INTERNET</code></a> permission is a strong way of controlling internet access. It also blocks direct access to the internet and access to other APIs that rely on the <a href="https://developer.android.com/training/basics/network-ops/connecting"><code>INTERNET</code></a> permission. The only way for an app to circumvent it is for it to communicate with another app that has been granted <a href="https://developer.android.com/training/basics/network-ops/connecting"><code>INTERNET</code></a> permission via mutual consent. Such communication can be prevented by putting apps into seperate profiles.</p>
|
||||
|
||||
<p>Some apps might crash if their <a href="https://developer.android.com/training/basics/network-ops/connecting"><code>INTERNET</code></a> permission is revoked. CalyxOS instead uses a <a href="https://calyxos.org/docs/tech/datura-details">firewall</a> to achieve a similar outcome however, in some circumstances CalyxOS's approach may leak (<a href="https://gitlab.com/CalyxOS/calyxos/-/issues/572">#572</a>, <a href="https://gitlab.com/CalyxOS/calyxos/-/issues/581">#581</a>).
|
||||
|
||||
<h5><strong>Sandboxed Play Services vs Privileged MicroG</strong></h5>
|
||||
<p>When Google Play services are used on GrapheneOS, they run as a user app and are contained within a user or work profile.</p>
|
||||
|
||||
<p>Sandboxed Play Services are confined using the highly restrictive, default <a href="https://source.android.com/security/selinux/concepts"><code>untrusted_app</code></a> domain provided by <a href="https://en.wikipedia.org/wiki/Security-Enhanced_Linux">SELinux</a>. Permissions for apps to use Play Services can be revoked at any time by the user.</p>
|
||||
|
||||
<p>MicroG is a reimplementation of Google Play Services. This means it needs to be updated every time Android has a major version update (or the Android API changes). It also needs to run in the highly privileged <a href="https://source.android.com/security/selinux/concepts"><code>system_app</code></a> SELinux domain like the normal Play Services and is less secure than the Sandboxed Play Service approach. We do not believe MicroG provides any privacy advantages over Sandboxed Play Services except for the option to <em>shift trust</em> of the location backend from Google to another provider such as Mozilla or DejaVu.</p>
|
||||
|
||||
<h5><strong>Privileged App Extensions</strong></h5>
|
||||
|
||||
<p>Android 12 comes with special support for seamless app updates with <a href="https://android-developers.googleblog.com/2020/09/listening-to-developer-feedback-to.html">third party app stores</a>. The popular Free and Open Source Software (FOSS) repository <a href="https://f-droid.org">F-Droid</a> doesn't implement this feature and requires a <a href="https://f-droid.org/en/packages/org.fdroid.fdroid.privileged">privileged extension</a> to be included with the Android distribution in order to have unattended app installation.</p>
|
||||
|
||||
<p>GrapheneOS doesn't compromise on security, therefore they do not include the F-Droid extension therefore, users have to confirm all updates manually if they want to use F-Droid. GrapheneOS officially recommends <a href="https://grapheneos.org/usage#sandboxed-play-services">Sandboxed Play Services</a> instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like <a href="/video-streaming/">NewPipe</a>).</p>
|
||||
|
||||
<p>CalyxOS includes the <a href="https://f-droid.org/en/packages/org.fdroid.fdroid.privileged">privileged extension</a>, which may lower device security. Seamless app updates should be possible with <a href="https://auroraoss.com">Aurora Store</a> in Android 12.</p>
|
||||
|
||||
<h5><strong>Additional Hardening</strong></h5>
|
||||
<p>GrapheneOS improves upon <a href="https://source.android.com/">AOSP</a> security with:</p>
|
||||
|
||||
<ul>
|
||||
<li><strong>Hardened WebView:</strong> Vanadium WebView requires <a href="https://en.wikipedia.org/wiki/64-bit_computing">64-bit</a> processes on the <a href="https://developer.android.com/reference/android/webkit/WebView">WebView</a> process and disables legacy <a href="https://en.wikipedia.org/wiki/32-bit_computing">32-bit</a> processes. It uses hardened compiler options such as <a href="https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html"><code>-fwrapv</code></a> and <a href="https://gcc.gnu.org/onlinedocs/gcc-4.9.3/gcc/Optimize-Options.html"><code>-fstack-protector-strong</code></a>, which can help protect against <a href="https://en.wikipedia.org/wiki/Stack_buffer_overflow">stack buffer overflows</a>. <a href="https://en.wikipedia.org/wiki/API">API</a>s such as the <a href="https://chromestatus.com/feature/4537134732017664">battery status API</a> are disabled for privacy reasons. All system apps on GrapheneOS use the Vanadium WebView which means user installed apps that use WebView will also benefit from Vanadium's hardening. The <a href="https://github.com/GrapheneOS/Vanadium/tree/12/patches">Vanadium patch set</a> is a lot more comprehensive than CalyxOS's <a href="https://gitlab.com/CalyxOS/chromium-patches">Chromium patch set</a> which is derived from it.</li>
|
||||
|
||||
<li><strong>Hardened Kernel:</strong> GrapheneOS kernel includes some hardening from the <a href="https://github.com/GrapheneOS/linux-hardened">linux-hardened</a> project and the <a href="https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project">Kernel Self Protection Project (KSPP)</a>. CalyxOS uses the <a href="https://calyxos.org/docs/development/build/kernel/">same kernel</a> as regular Android with some minor modifications.</li>
|
||||
|
||||
<li><strong>Hardened Memory Allocator:</strong> GrapheneOS uses the <a href="https://github.com/GrapheneOS/hardened_malloc">hardened malloc</a> subproject as its memory allocator. This focuses on hardening against <a href="https://en.wikipedia.org/wiki/Memory_corruption">memory heap corruption</a>. CalyxOS uses the default AOSP <a href="https://source.android.com/devices/tech/debug/scudo">Scudo Malloc</a>, which is generally <a href="https://twitter.com/danielmicay/status/1033671709197398016">less effective</a>. Hardened Malloc has uncovered vulnerabilities in AOSP which have been <a href="https://github.com/GrapheneOS/platform_system_core/commit/be11b59725aa6118b0e1f0712572e835c3d50746">fixed</a> by GrapheneOS such as <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-0703">CVE-2021-0703</a>.</li>
|
||||
|
||||
<li><strong>Secure Exec Spawning:</strong> GrapheneOS <a href="https://en.wikipedia.org/wiki/Spawn_(computing)">spawns</a> fresh processes as opposed to using the <a href="https://ayusch.com/android-internals-the-android-os-boot-process">Zygote model</a> used by AOSP and CalyxOS. The Zygote model weakens <a href="https://en.wikipedia.org/wiki/Address_space_layout_randomization">Address Space Layout Randomization</a> (ASLR) and is considered <a href="https://wenke.gtisc.gatech.edu/papers/morula.pdf">less secure</a>. Creating <a href="https://grapheneos.org/usage#exec-spawning">fresh processes</a> is safer but will have some performance penalty when launching a new application. These penalties are not really noticeable unless you have an <a href="https://support.google.com/nexus/answer/4457705">old device</a> with slow storage such as the Pixel 3a/3a XL as it has <a href="https://en.wikipedia.org/wiki/MultiMediaCard#eMMC">eMMC</a>.</li>
|
||||
</ul>
|
||||
<p><strong>Please note that these are just a few examples and are not an extensive list of GrapheneOS's hardening</strong>.</p>
|
||||
168
collections/_evergreen/android.md
Normal file
168
collections/_evergreen/android.md
Normal file
@ -0,0 +1,168 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Android
|
||||
mathjax: true
|
||||
description: |
|
||||
Android is a secure operating system that has strong [app sandboxing](https://source.android.com/security/app-sandbox), [verified boot](https://source.android.com/security/verifiedboot), and a robust [permission](https://developer.android.com/guide/topics/permissions/overview) control system.
|
||||
|
||||
The main privacy concern with most Android devices is that they usually include [Google Play Services](https://developers.google.com/android/guides/overview). This component is proprietary, closed source, has a privileged role on your phone and may collect private user information. It is not a part of the [Android Open Source Project](https://source.android.com/) (AOSP) nor is it included with the below derivatives.
|
||||
---
|
||||
|
||||
## AOSP Derivatives
|
||||
|
||||
{% for item_hash in site.data.operating-systems.android %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
|
||||
## Android security and privacy features
|
||||
|
||||
### User Profiles
|
||||
|
||||
Multiple user profiles (Settings → System → Multiple users) are the simplest way to isolate in Android. With user profiles you can limit a user from making calls, SMS or installing apps on the device. Each profile is encrypted using its own encryption key and cannot access the data of any other profiles. Even the device owner cannot view the data of other profiles without knowing their password. Multiple user profiles is a more secure method of isolation.
|
||||
|
||||
### Work Profile
|
||||
|
||||
[Work Profiles](https://support.google.com/work/android/answer/6191949) are another way to isolate individual apps and may be more convenient than separate user profiles.
|
||||
|
||||
A **device controller** such as [Shelter](#recommended-apps) is required, unless you're using CalyxOS which includes one.
|
||||
|
||||
The work profile is dependent on a device controller to function. Features such as *File Shuttle* and *contact search blocking* or any kind of isolation features must be implemented by the controller. The user must also fully trust the device controller app, as it has full access to the data inside of the work profile.
|
||||
|
||||
This method is generally less secure than a secondary user profile; however, it does allow you the convenience of running apps in both the work and personal profiles simultaneously.
|
||||
|
||||
### Verified Boot
|
||||
|
||||
[Verified boot](https://source.android.com/security/verifiedboot) is an important part of the Android security model. It provides protection against [Evil maid](https://en.wikipedia.org/wiki/Evil_maid_attack) attacks, malware persistence, and ensures security updates cannot be downgraded with [rollback protection](https://source.android.com/security/verifiedboot/verified-boot#rollback-protection).
|
||||
|
||||
Android 10 and above has moved away from full-disk encryption (FDE) to more flexible [file-based encryption](https://source.android.com/security/encryption/file-based).
|
||||
|
||||
Each user's data is encrypted using their own unique encryption key, and the operating system files are left unencrypted. Verified boot ensures the integrity of the operating system files preventing an adversary with physical access from tampering or installing malware on the device. In the unlikely case that malware is able to exploit other parts of the system and gain higher privileged access, verified boot will prevent and revert changes to the system partition upon reboot of the device.
|
||||
|
||||
Unfortunately, original equipment manufacturers (OEMs) are only obliged to support verified boot on their stock Android distribution. Only a few OEMs such as Google support custom Android Verified Boot (AVB) key enrollment on their devices. Some AOSP derivatives such as LineageOS or /e/ OS do not support verified boot even on hardware with verified boot support for third party operating systems. We recommend that you check for support **before** purchasing a new device. AOSP derivatives which do not support verified boot are **not** recommended.
|
||||
|
||||
### VPN Killswitch
|
||||
|
||||
Android 7 and above supports a VPN killswitch and it is available without the need to install third party apps. This feature can prevent leaks if the VPN is disconnected. It can be found in ⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN.
|
||||
|
||||
### Global Toggles
|
||||
|
||||
Modern Android devices have global toggles for disabling [Bluetooth](https://en.wikipedia.org/wiki/Bluetooth) and location services. Android 12 introduced toggles for the camera and microphone. When not in use, we recommend disabling these features. Apps cannot use disabled features (even if granted individual permission) until renabled.
|
||||
|
||||
## Recommended Apps
|
||||
|
||||
{% for item_hash in site.data.operating-systems.android-applications %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
|
||||
## General Recommendations
|
||||
|
||||
### Avoid Root
|
||||
|
||||
Rooting Android phones can decrease security significantly as it weakens the complete Android security model. This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful [verified boot](https://source.android.com/security/verifiedboot). Apps that require root will also modify the system partition meaning that verified boot would have to remain disabled. Having root exposed directly in the user interface also increases the [attack surface](https://en.wikipedia.org/wiki/Attack_surface) of your device and may assist in [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation) vulnerabilities and [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) policy bypasses.
|
||||
|
||||
Adblockers (AdAway) which modify the <a href="https://en.wikipedia.org/wiki/Hosts_(file)">hosts file</a> and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest encrypted <a href="/providers/dns/">DNS</a> or <a href="/providers/vpn/">VPN</a> server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.
|
||||
|
||||
AFWall+ works based on the <a href="#graphene-calyxos">packet filtering approach</a> and is bypassable in some situations.
|
||||
|
||||
We do not believe that the security sacrifices made by rooting a phone are worth the questionable privacy benefits of those apps.
|
||||
|
||||
### Firmware Updates
|
||||
|
||||
Firmware updates are critical for maintaining security and without them your device cannot be secure. Original equipment manufacturers (OEMs) - phone manufacturers have support agreements with their partners to provide the closed source components for a limited support period. These are detailed in the monthly [Android Security Bulletins](https://source.android.com/security/bulletin).
|
||||
|
||||
As the components of the phone such as the processor and radio technologies rely on closed source components, the updates must be provided by the respective manufacturers. Therefore it is important that you purchase a device within an active support cycle. [Qualcomm](https://www.qualcomm.com/news/releases/2020/12/16/qualcomm-and-google-announce-collaboration-extend-android-os-support-and) and [Samsung](https://news.samsung.com/us/samsung-galaxy-security-extending-updates-knox/) support their devices for 4 years while cheaper products often have shorter support. With the introduction of the [Pixel 6](https://support.google.com/pixelphone/answer/4457705), Google now makes their own system on chip (SoC) and they will provide 5 years of support.
|
||||
|
||||
Devices that have reached their end-of-life (EoL) and are no longer supported by the SoC manufacturer, cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.
|
||||
|
||||
### Android versions
|
||||
|
||||
It's also important to make sure that you're not using an [end-of-life](https://endoflife.date/android) version of Android. Newer versions of Android not only receive security updates for the operating system but also important privacy enhancing updates too. For example, [prior to Android 10](https://developer.android.com/about/versions/10/privacy/changes), any user apps with the [`READ_PHONE_STATE`](https://developer.android.com/reference/android/Manifest.permission#READ_PHONE_STATE) permission could access sensitive and unique serial numbers of your phone such as [IMEI](https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity), [MEID](https://en.wikipedia.org/wiki/Mobile_equipment_identifier), your SIM card's [IMSI](https://en.wikipedia.org/wiki/International_mobile_subscriber_identity), whereas now they must be system apps to do so. System apps are only shipped by the OEM or Android distribution.
|
||||
|
||||
### Android Permissions
|
||||
|
||||
[Permissions on Android](https://developer.android.com/guide/topics/permissions/overview) grant users control over what apps are allowed to access. Google regularly makes [improvements](https://developer.android.com/about/versions/11/privacy/permissions) on the permission system in each successive version. All user installed apps are strictly [sandboxed](https://source.android.com/security/app-sandbox), therefore there is no need to install any antivirus apps. The savings you make from not purchasing or subscribing to security apps is better spent on paying for a supported device in the future.
|
||||
|
||||
Should you want to run an app that you're unsure about consider using a user or work [profile](/android/#android-security-privacy).
|
||||
|
||||
### SafetyNet and Play Integrity API
|
||||
|
||||
[SafetyNet](https://developer.android.com/training/safetynet/attestation) and the [Play Integrity APIs](https://developer.android.com/google/play/integrity) are generally used for [banking apps](https://grapheneos.org/usage#banking-apps). Many banking apps will work fine in GrapheneOS with sandboxed Play services, however some non-financal apps have their own crude anti-tampering mechanisms which might fail. GrapheneOS passes the `basicIntegrity` check, but not the certification check `ctsProfileMatch`. Devices with Android 8 or later have hardware attestation support which cannot be bypassed without leaked keys or serious vulnerabilities.
|
||||
|
||||
As for Google Wallet, we don't recommend this due to their [privacy policy](https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en), which states you must opt-out if you don't want your credit rating and personal information shared with affiliate marketing services.
|
||||
|
||||
### Android Device Shopping
|
||||
|
||||
Google Pixels are known to have good security and properly support [verified boot](https://source.android.com/security/verifiedboot). Some other phones such as the Fairphone and Oneplus devices also support custom Android verified boot (AVB) key enrollment. However, there have been issues with their older models. In the past they were using [test keys](https://social.coop/@dazinism/105346943304083054) or not doing proper verification, making verified boot on those devices useless.
|
||||
|
||||
Avoid buying phones from mobile network operators. These often have a **locked bootloader** and do not support [OEM unlocking](https://source.android.com/devices/bootloader/locking_unlocking). These phone variants will prevent you from installing any kind of alternative Android distribution. Phones that cannot be unlocked will often have an [IMEI](https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity) starting with "35", that includes phones from purchased from Verizon, Telus, Rogers, EE etc.
|
||||
|
||||
Be very **careful** about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen there's a possibility of [IMEI blacklisting](https://www.gsma.com/security/resources/imei-blacklisting/). There is also a risk involved with you being associated with the activity of the previous owner.
|
||||
|
||||
We have these general tips:
|
||||
|
||||
* If you're after a bargain on a Pixel device, we suggest buying an "**a**" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
|
||||
* Consider price beating options and specials offered at [brick and mortar](https://en.wikipedia.org/wiki/Brick_and_mortar) stores.
|
||||
* Look at online community bargain sites in your country. These can alert you to good sales.
|
||||
* The price per day for a device can be calculated as \\({\\text {EoL Date}-\\text{Current Date} \\over \\text{Cost}}\\). Google provides a [list](https://support.google.com/nexus/answer/4457705) of their supported devices.
|
||||
* Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.
|
||||
* Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper [verified boot](https://source.android.com/security/verifiedboot) support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
|
||||
* In short, if a device or Android distribution is not listed here, there is probably a good reason, so check our [discussions](https://github.com/privacyguides/privacyguides.org/discussions) page.
|
||||
|
||||
The installation of GrapheneOS on a Pixel phone is easy with their [web installer](https://grapheneos.org/install/web). If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the [NitroPhone](https://shop.nitrokey.com/shop) as they come preloaded with GrapheneOS from the reputable [Nitrokey](https://www.nitrokey.com/about) company. The GrapheneOS project is not currently affiliated with any vendor and cannot ensure the quality or security of their products.
|
||||
|
||||
A [CalyxOS membership](https://calyxinstitute.org/membership/calyxos) also entitles you to a device preloaded with CalyxOS.
|
||||
|
||||
## Security comparison of GrapheneOS and CalyxOS
|
||||
|
||||
### Profiles
|
||||
|
||||
CalyxOS includes a device controller app so there is no need to install a third party app like [Shelter](/android/#recommended-apps). GrapheneOS plans to introduce nested profile support with better isolation in the future.
|
||||
|
||||
GrapheneOS extends the [user profile](/android/#android-security-privacy) feature allowing a user to press an "End Session" button. This button clears the encryption key from memory. There are plans to add a [cross profile notifications system](https://github.com/GrapheneOS/os-issue-tracker/issues/88) in the future.
|
||||
|
||||
### INTERNET permission vs packet filtering
|
||||
|
||||
[Packet filter](https://en.wikipedia.org/wiki/Firewall_(computing)#Packet_filter) based solutions such [Datura Firewall](https://calyxos.org/docs/tech/datura-details), [LineageOS](https://gitlab.com/LineageOS/issues/android/-/issues/3228) (DivestOS), AFWall+ and NetGuard, are not ideal as they can leak and don't prevent an app from proxying a network request through another app using an [intent](https://developer.android.com/guide/components/intents-filters).
|
||||
|
||||
Android has a built-in [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission. This is enforced by the operating system. On AOSP and most of its derivatives, it is treated as an install time permission. GrapheneOS changes it to [runtime](https://en.wikipedia.org/wiki/Runtime_(program_lifecycle_phase)) permission, meaning that it can be revoked to deny internet access to a specific app.
|
||||
|
||||
The [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission is a strong way of controlling internet access. It also blocks direct access to the internet and access to other APIs that rely on the [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission. The only way for an app to circumvent it is for it to communicate with another app that has been granted [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission via mutual consent. Such communication can be prevented by putting apps into seperate profiles.
|
||||
|
||||
Some apps might crash if their [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) permission is revoked. CalyxOS instead uses a [firewall](https://calyxos.org/docs/tech/datura-details) to achieve a similar outcome however, in some circumstances CalyxOS's approach may leak ([#572](https://gitlab.com/CalyxOS/calyxos/-/issues/572), [#581](https://gitlab.com/CalyxOS/calyxos/-/issues/581)).
|
||||
|
||||
### Sandboxed Play Services vs Privileged MicroG
|
||||
|
||||
When Google Play services are used on GrapheneOS, they run as a user app and are contained within a user or work profile.
|
||||
|
||||
Sandboxed Play Services are confined using the highly restrictive, default [`untrusted_app`](https://source.android.com/security/selinux/concepts) domain provided by [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux). Permissions for apps to use Play Services can be revoked at any time by the user.
|
||||
|
||||
MicroG is a reimplementation of Google Play Services. This means it needs to be updated every time Android has a major version update (or the Android API changes). It also needs to run in the highly privileged [`system_app`](https://source.android.com/security/selinux/concepts) SELinux domain like the normal Play Services and is less secure than the Sandboxed Play Service approach. We do not believe MicroG provides any privacy advantages over Sandboxed Play Services except for the option to _shift trust_ of the location backend from Google to another provider such as Mozilla or DejaVu.
|
||||
|
||||
### Privileged App Extensions
|
||||
|
||||
Android 12 comes with special support for seamless app updates with [third party app stores](https://android-developers.googleblog.com/2020/09/listening-to-developer-feedback-to.html). The popular Free and Open Source Software (FOSS) repository [F-Droid](https://f-droid.org) doesn't implement this feature and requires a [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged) to be included with the Android distribution in order to have unattended app installation.
|
||||
|
||||
GrapheneOS doesn't compromise on security, therefore they do not include the F-Droid extension therefore, users have to confirm all updates manually if they want to use F-Droid. GrapheneOS officially recommends [Sandboxed Play Services](https://grapheneos.org/usage#sandboxed-play-services) instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like [NewPipe](/software/video-streaming/)).
|
||||
|
||||
CalyxOS includes the [privileged extension](https://f-droid.org/en/packages/org.fdroid.fdroid.privileged), which may lower device security. Seamless app updates should be possible with [Aurora Store](https://auroraoss.com) in Android 12.
|
||||
|
||||
### Additional Hardening
|
||||
|
||||
GrapheneOS improves upon [AOSP](https://source.android.com/) security with:
|
||||
|
||||
* **Hardened WebView:** Vanadium WebView requires [64-bit](https://en.wikipedia.org/wiki/64-bit_computing) processes on the [WebView](https://developer.android.com/reference/android/webkit/WebView) process and disables legacy [32-bit](https://en.wikipedia.org/wiki/32-bit_computing) processes. It uses hardened compiler options such as [`-fwrapv`](https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html) and [`-fstack-protector-strong`](https://gcc.gnu.org/onlinedocs/gcc-4.9.3/gcc/Optimize-Options.html), which can help protect against [stack buffer overflows](https://en.wikipedia.org/wiki/Stack_buffer_overflow). [API](https://en.wikipedia.org/wiki/API)s such as the [battery status API](https://chromestatus.com/feature/4537134732017664) are disabled for privacy reasons. All system apps on GrapheneOS use the Vanadium WebView which means user installed apps that use WebView will also benefit from Vanadium's hardening. The [Vanadium patch set](https://github.com/GrapheneOS/Vanadium/tree/12/patches) is a lot more comprehensive than CalyxOS's [Chromium patch set](https://gitlab.com/CalyxOS/chromium-patches) which is derived from it.
|
||||
* **Hardened Kernel:** GrapheneOS kernel includes some hardening from the [linux-hardened](https://github.com/GrapheneOS/linux-hardened) project and the [Kernel Self Protection Project (KSPP)](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). CalyxOS uses the [same kernel](https://calyxos.org/docs/development/build/kernel/) as regular Android with some minor modifications.
|
||||
* **Hardened Memory Allocator:** GrapheneOS uses the [hardened malloc](https://github.com/GrapheneOS/hardened_malloc) subproject as its memory allocator. This focuses on hardening against [memory heap corruption](https://en.wikipedia.org/wiki/Memory_corruption). CalyxOS uses the default AOSP [Scudo Malloc](https://source.android.com/devices/tech/debug/scudo), which is generally [less effective](https://twitter.com/danielmicay/status/1033671709197398016). Hardened Malloc has uncovered vulnerabilities in AOSP which have been [fixed](https://github.com/GrapheneOS/platform_system_core/commit/be11b59725aa6118b0e1f0712572e835c3d50746) by GrapheneOS such as [CVE-2021-0703](https://nvd.nist.gov/vuln/detail/CVE-2021-0703).
|
||||
* **Secure Exec Spawning:** GrapheneOS [spawns](https://en.wikipedia.org/wiki/Spawn_(computing)) fresh processes as opposed to using the [Zygote model](https://ayusch.com/android-internals-the-android-os-boot-process) used by AOSP and CalyxOS. The Zygote model weakens [Address Space Layout Randomization](https://en.wikipedia.org/wiki/Address_space_layout_randomization) (ASLR) and is considered [less secure](https://wenke.gtisc.gatech.edu/papers/morula.pdf). Creating [fresh processes](https://grapheneos.org/usage#exec-spawning) is safer but will have some performance penalty when launching a new application. These penalties are not really noticeable unless you have an [old device](https://support.google.com/nexus/answer/4457705) with slow storage such as the Pixel 3a/3a XL as it has [eMMC](https://en.wikipedia.org/wiki/MultiMediaCard#eMMC).
|
||||
|
||||
**Please note that these are just a few examples and are not an extensive list of GrapheneOS's hardening**.
|
||||
@ -1,13 +1,11 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Browser Recommendations
|
||||
description: "These are our current web browser recommendations and settings you can use to preserve your privacy. We recommend keeping extensions to a minimum: they have privileged access within your browser, require you to trust the developer, can make you <a href='https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint'>stand out</a>, and <a href='https://groups.google.com/a/chromium.org/g/chromium-extensions/c/0ei-UCHNm34/m/lDaXwQhzBAAJ'>weaken</a> site isolation."
|
||||
description: |
|
||||
These are our current web browser recommendations and settings you can use to preserve your privacy. We recommend keeping extensions to a minimum: they have privileged access within your browser, require you to trust the developer, can make you [stand out](https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint), and [weaken](https://groups.google.com/a/chromium.org/g/chromium-extensions/c/0ei-UCHNm34/m/lDaXwQhzBAAJ) site isolation.
|
||||
---
|
||||
|
||||
<h2 id="general-recommendations" class="anchor">
|
||||
<a href="#general-recommendations"><i class="fas fa-link anchor-icon"></i></a>
|
||||
General Recommendations
|
||||
</h2>
|
||||
## General Recommendations
|
||||
|
||||
{% for item_hash in site.data.software.browsers %}
|
||||
{% assign item = item_hash[1] %}
|
||||
@ -18,10 +16,7 @@ General Recommendations
|
||||
|
||||
{% endfor %}
|
||||
|
||||
<h2 id="desktop-only-recommendations" class="anchor">
|
||||
<a href="#desktop-only-recommendations"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Desktop Only Recommendations
|
||||
</h2>
|
||||
## Desktop Browser Recommendations
|
||||
|
||||
{% for item_hash in site.data.software.browsers-desktop %}
|
||||
{% assign item = item_hash[1] %}
|
||||
@ -32,10 +27,7 @@ Desktop Only Recommendations
|
||||
|
||||
{% endfor %}
|
||||
|
||||
<h2 id="mobile-only-recommendations" class="anchor">
|
||||
<a href="#mobile-only-recommendations"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Mobile Only Recommendations
|
||||
</h2>
|
||||
## Mobile Browser Recommendations
|
||||
|
||||
<p>On Android, Mozilla's engine <a href="https://mozilla.github.io/geckoview/">GeckoView</a> has yet to support <a href="https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture">site isolation</a> or enable <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1565196">isolatedProcess</a>. Firefox Android also doesn't yet have <a href="https://github.com/mozilla-mobile/fenix/issues/16952#issuecomment-907960218">HTTPS-Only mode</a> built-in. These features are supported in Bromite as it uses <a href="https://developer.android.com/reference/android/webkit/WebView">Chromium WebView</a> which is included in all Android operating systems. We do not recommend Firefox or any Gecko based browsers at this time.</p>
|
||||
|
||||
@ -50,10 +42,7 @@ Mobile Only Recommendations
|
||||
|
||||
{% endfor %}
|
||||
|
||||
<h2 id="additional-resources" class="anchor">
|
||||
<a href="#additional-resources"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Additional Resources
|
||||
</h2>
|
||||
## Additional Resources
|
||||
|
||||
{% for item_hash in site.data.software.browsers-resources %}
|
||||
{% assign item = item_hash[1] %}
|
||||
@ -1,16 +0,0 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Cloud Storage
|
||||
description: "If you are currently using a Cloud Storage Service like Dropbox, Google Drive, Microsoft OneDrive or Apple iCloud, you are putting complete trust in your service provider to not look at your files.
|
||||
|
||||
Consider reducing the need to trust your provider, by using an alternative below that supports <a href='https://wikipedia.org/wiki/End-to-end_encryption'>end-to-end-encryption (E2EE)</a>."
|
||||
---
|
||||
|
||||
{% for item_hash in site.data.providers.cloud %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
@ -1,168 +0,0 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Real-Time Communication
|
||||
description: "We only recommend messengers that support strong <a href='https://en.wikipedia.org/wiki/End-to-end_encryption'>end-to-end encryption (E2EE)</a> and have been been independently <a href='https://en.wikipedia.org/wiki/Information_security_audit#The_audited_systems'>audited</a> to ensure their cryptography works as intended. The selection listed here is <a href='https://en.wikipedia.org/wiki/Free_and_open-source_software'>free and open-source</a> software, ensuring that the code can be verified by experts now and in the future."
|
||||
---
|
||||
|
||||
<h2 id="im" class="anchor">
|
||||
<a href="#im"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Encrypted Instant Messengers
|
||||
</h2>
|
||||
|
||||
{% for item_hash in site.data.software.messengers %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
|
||||
<h2 id="network-types" class="anchor">
|
||||
<a href="#network-types"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Types of communication networks
|
||||
</h2>
|
||||
|
||||
<p>There are several network architectures commonly used to relay messages between users. These networks can provide different different privacy guarantees, which is why it's worth considering your <a href="https://en.wikipedia.org/wiki/Threat_model">threat model</a> when making a decision about which app to use.</p>
|
||||
|
||||
<h3 id="centralized" class="anchor">
|
||||
<a href="#centralized"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Centralized
|
||||
</h3>
|
||||
|
||||
<div class="clearfix">
|
||||
<img src="/assets/img/layout/network-centralized.svg" width="150" height="150" class="img-fluid float-left ml-2" style="float: left" alt="Centralized network" />
|
||||
<p>Centralized messengers are those where all participants are on the same server or network of servers controlled by the same organization.</p>
|
||||
<p>Some self-hosted messengers allow you to set up your own server. Self-hosting can provide additional privacy guarantees such as no usage logs or limited access to metadata (data about who is talking to whom etc). Self-hosted centralized messengers are isolated and everyone must be on the same server to communicate.</p>
|
||||
</div>
|
||||
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<h4>Advantages</h4>
|
||||
<ul>
|
||||
<li>New features and changes can be implemented more quickly.</li>
|
||||
<li>Easier to get started with and to find contacts.</li>
|
||||
<li>Most mature and stable features ecosystems, as they are easier to program in a centralized software.</li>
|
||||
<li>Privacy issues may be reduced when you trust a server that you're self-hosting.</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h4>Disadvantages</h4>
|
||||
<ul>
|
||||
<li>Can include <a href="https://drewdevault.com/2018/08/08/Signal.html">restricted control or access</a>. This can include things like:</li>
|
||||
<ul>
|
||||
<li>Being <a href="https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165">forbidden from connecting third-party clients</a> to the centralized network that might provide for greater customization or better user experience. Often defined in Terms and Conditions of usage.</li>
|
||||
<li>Poor or no documentation for third-party developers.</li>
|
||||
</ul>
|
||||
<li>The <a href="https://blog.privacytools.io/delisting-wire">ownership</a>, privacy policy, and operations of the service can change easily when a single entity controls it, potentially compromising the service later on.</li>
|
||||
<li>Self hosting requires effort and knowledge of how to set up a service.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<h3 id="federated" class="anchor">
|
||||
<a href="#federated"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Federated
|
||||
</h3>
|
||||
|
||||
<div class="clearfix">
|
||||
<img src="/assets/img/layout/network-decentralized.svg" width="200" class="img-fluid float-left ml-2" style="float: left" alt="Decentralized network" />
|
||||
<p>Federated messengers use multiple, independent, decentralized servers that are able to talk to each other (email is one example of a federated service). Federation allows system administrators to control their own server and still be a part of the larger communications network.</p>
|
||||
<p>When self-hosted, users of a federated server can discover and communicate with users of other servers, although some servers may choose to remain private by being non-federated (e.g., work team server).</p>
|
||||
</div>
|
||||
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>Allows for greater control over your own data when running your own server.</li>
|
||||
<li>Allows you to choose who to trust your data with by choosing between multiple "public" servers.</li>
|
||||
<li>Often allows for third party clients which can provide a more native, customized, or accessible experience.</li>
|
||||
<li>Server software can be verified that it matches public source code, assuming you have access to the server or you trust the person who does (e.g., a family member)</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Adding new features is more complex, because these features need to be standardized and tested to ensure they work with all servers on the network.</li>
|
||||
<li>Due to the previous point, features can be lacking, or incomplete or working in unexpected ways compared to centralized platforms, such as message relay when offline or message deletion.</li>
|
||||
<li>Some metadata may be available (e.g., information like "who is talking to whom," but not actual message content if E2EE is used).</li>
|
||||
<li>Federated servers generally require trusting your server's administrator. They may be a hobbyist or otherwise not a "security professional," and may not serve standard documents like a privacy policy or terms of service detailing how your data is utilized.</li>
|
||||
<li>Server administrators sometimes choose to block other servers, which are a source of unmoderated abuse or break general rules of accepted behavior. This will hinder your ability to communicate with users on those servers.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<h3 id="peer-to-peer" class="anchor">
|
||||
<a href="#peer-to-peer"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Peer-to-Peer (P2P)
|
||||
</h3>
|
||||
|
||||
<div class="clearfix">
|
||||
<p>
|
||||
<img src="/assets/img/layout/network-distributed.svg" width="150" height="150" class="img-fluid float-left ml-2" style="float: left" alt="Distributed network" />
|
||||
<a href="https://en.wikipedia.org/wiki/Peer-to-peer">Peer-to-peer</a> messengers connect to a <a href="https://en.wikipedia.org/wiki/Distributed_networking">distributed network</a> of nodes to relay messages to the recipient without a third-party server. Clients (peers) usually find each other through the use of a <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this include <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a> (used with technologies like <a href="https://en.wikipedia.org/wiki/BitTorrent_(protocol)">torrents</a> and <a href="https://en.wikipedia.org/wiki/InterPlanetary_File_System">IPFS</a>, for example). Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social network protocol). Once a peer has found a route to its contact via any of these methods, a direct connection between them is made. Although messages are usually encrypted, an observer can still deduce the location and identity of the sender and recipient.
|
||||
</p>
|
||||
<p>P2P networks do not use servers, as users communicate directly between each others, and hence cannot be self-hosted. However, some additional services may rely on centralized servers, such as users discovery or offline messages relaying, which can benefit from self-hosting.</p>
|
||||
</div>
|
||||
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>Minimal information is exposed to third parties.</li>
|
||||
<li>Modern P2P platforms implement end-to-end encryption by default. There are no servers that could potentially intercept and decrypt your transmissions, unlike centralized and federated models.</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Reduced feature set:</li>
|
||||
<ul>
|
||||
<li>Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online.</li>
|
||||
<li>Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network to learn about who is online.</li>
|
||||
<li>Some common messenger features may not be implemented or incompletely, such as message deletion.</li>
|
||||
</ul>
|
||||
<li>Your <a href="https://en.wikipedia.org/wiki/IP_address">IP address</a> and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a <a href="/providers/vpn">VPN</a> or <a href="/software/networks">self contained network</a>, such as <a href="https://www.torproject.org">Tor</a> or <a href="https://geti2p.net/">I2P</a>. Many countries have some form of mass surveillance and/or metadata retention.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<h3 id="anonymous-routing" class="anchor">
|
||||
<a href="#anonymous-routing"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Anonymous Routing
|
||||
</h3>
|
||||
|
||||
<div class="clearfix">
|
||||
<p><img src="/assets/img/layout/network-anonymous-routing.svg" width="150" height="150" class="img-fluid float-left ml-2" style="float: left" alt="Anonymous routing network" />
|
||||
A messenger using <a href="https://doi.org/10.1007/978-1-4419-5906-5_628">anonymous routing</a> hides either the identity of the sender, the receiver, or evidence that they have been communicating. Ideally, a messenger should hide all three.</p>
|
||||
<p>There are <a href="https://doi.org/10.1145/3182658">many different ways</a> to implement anonymous routing. One of the most famous is <a href="https://en.wikipedia.org/wiki/Onion_routing">onion routing</a> (e.g., <a href="https://en.wikipedia.org/wiki/Tor_(anonymity_network)">Tor</a>), which communicates encrypted messages through a virtual <a href="https://en.wikipedia.org/wiki/Overlay_network">overlay network</a> that hides the location of each node as well as the recipient and sender of each message. The sender and recipient never interact directly, and only meet through a secret rendezvous node, so that there is no leak of IP addresses nor physical location. Nodes cannot decrypt messages nor the final destination, only the recipient can. Each intermediary node can only decrypt a part that indicates where to send the still encrypted message next, until it arrives at the recipient who can fully decrypt it, hence the "onion layers".</p>
|
||||
<p>Self-hosting a node in an anonymous routing network does not provide the hoster with additional privacy benefits, but rather contributes to the whole network's resilience against identification attacks for everyone's benefit.</p>
|
||||
</div>
|
||||
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>Minimal to no information is exposed to other parties.</li>
|
||||
<li>Messages can be relayed in a decentralized manner even if one of the parties is offline.</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Slow message propagation.</li>
|
||||
<li>Often limited to fewer media types, mostly text since the network is slow.</li>
|
||||
<li>Less reliable if nodes are selected by randomized routing, some nodes may be very far from the sender and receiver, adding latency or even failing to transmit messages if one of the nodes goes offline.</li>
|
||||
<li>More complex to get started as the creation and secured backup of a cryptographic private key is required.</li>
|
||||
<li>Just like other decentralized platforms, adding features is more complex for developers than on a centralized platform, hence features may be lacking or incompletely implemented, such as offline message relaying or message deletion.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
@ -1,18 +0,0 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Search Engines
|
||||
description: "Use a search engine that doesn't build an advertising profile based on your searches.
|
||||
|
||||
The recommendations here are based on the merits of each service's privacy policy. There is <strong>no guarantee</strong> that these privacy policies are honored.
|
||||
|
||||
Consider using a <a href='/providers/vpn'>VPN</a> or <a href='https://www.torproject.org/'>Tor</a> if your threat model requires hiding your IP address from the search provider."
|
||||
---
|
||||
|
||||
{% for item_hash in site.data.providers.search-engines %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
@ -1,104 +0,0 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: What are threat models?
|
||||
---
|
||||
|
||||
<p>Balancing security, privacy, and usability is one of the first and most difficult tasks you’ll face on your privacy journey. Everything is a trade-off: The more secure something is, the more restricting or inconvenient it generally is, et cetera. Often people find that the problem with the tools they see recommended is they’re just too hard to start using!</p>
|
||||
|
||||
<p>If you wanted to use the <strong>most</strong> secure tools available, you’d have to sacrifice <em>a lot</em> of usability. And even then, <mark>nothing is ever fully secure.</mark> There’s <strong>high</strong> security, but never <strong>full</strong> security. That’s why threat models are important.</p>
|
||||
|
||||
<p><strong>So, what are these threat models anyways?</strong></p>
|
||||
|
||||
<p><mark>A threat model is a list of the most probable threats to your security/privacy endeavors.</mark> Since it’s impossible to protect yourself against <strong>every</strong> attack(er), you should focus on the <strong>most probable</strong> threats. In computer security, a threat is a potential event that could undermine your efforts to stay private and secure.</p>
|
||||
|
||||
<p>By focusing on the threats that matter to you, this narrows down your thinking about the protection you need, so you can choose the tools that are right for the job.</p>
|
||||
|
||||
<h2>Examples of threat models</h2>
|
||||
|
||||
<ul>
|
||||
<li>An investigative journalist’s threat model might be <span class="text-muted">(protecting themselves against)</span> a foreign government.</li>
|
||||
<li>A company’s manager’s threat model might be <span class="text-muted">(protecting themselves against)</span> a hacker hired by competition to do corporate espionage.</li>
|
||||
<li>The average citizen’s threat model might be <span class="text-muted">(hiding their data from)</span> large tech corporations.</li>
|
||||
</ul>
|
||||
|
||||
<h2>Creating your threat model</h2>
|
||||
|
||||
<p>To identify what could happen to the things you value and determine from whom you need to protect them, you want to answer these five questions:</p>
|
||||
|
||||
<ol>
|
||||
<li>What do I want to protect?</li>
|
||||
<li>Who do I want to protect it from?</li>
|
||||
<li>How likely is it that I will need to protect it?</li>
|
||||
<li>How bad are the consequences if I fail?</li>
|
||||
<li>How much trouble am I willing to go through to try to prevent potential consequences?</li>
|
||||
</ol>
|
||||
|
||||
<div class="card">
|
||||
<div class="card-body">
|
||||
<h4>Example: Protecting your belongings</h4>
|
||||
<ul><li>To demonstrate how these questions work, let’s build a plan to keep your house and possessions safe.</li></ul>
|
||||
|
||||
<h5>What do you want to protect? (Or, <em>what do you have that is worth protecting?</em>)</h5>
|
||||
<ul><li>Your assets might include jewelry, electronics, important documents, or photos.</li></ul>
|
||||
|
||||
<h5>Who do you want to protect it from?</h5>
|
||||
<ul><li>Your adversaries might include burglars, roommates, or guests.</li></ul>
|
||||
|
||||
<h5>How likely is it that you will need to protect it?</h5>
|
||||
<ul><li>Does your neighborhood have a history of burglaries? How trustworthy are your roommates/guests? What are the capabilities of your adversaries? What are the risks you should consider?</li></ul>
|
||||
|
||||
<h5>How bad are the consequences if you fail?</h5>
|
||||
<ul><li>Do you have anything in your house that you cannot replace? Do you have the time or money to replace these things? Do you have insurance that covers goods stolen from your home?</li></ul>
|
||||
|
||||
<h5>How much trouble are you willing to go through to prevent these consequences?</h5>
|
||||
<ul><li>Are you willing to buy a safe for sensitive documents? Can you afford to buy a high-quality lock? Do you have time to open a security box at your local bank and keep your valuables there?</li></ul>
|
||||
|
||||
<p>Only once you have asked yourself these questions will you be in a position to assess what measures to take. If your possessions are valuable, but the probability of a break-in is low, then you may not want to invest too much money in a lock. But, if the probability of a break-in is high, you’ll want to get the best lock on the market, and consider adding a security system.</p>
|
||||
<p>Making a security plan will help you to understand the threats that are unique to you and to evaluate your assets, your adversaries, and your adversaries’ capabilities, along with the likelihood of risks you face.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p class="mt-3">Now, let's take a closer look at the questions in our list:</p>
|
||||
|
||||
<h3>What do I want to protect?</h3>
|
||||
<p>An “asset” is something you value and want to protect. In the context of digital security, <mark>an asset is usually some kind of information</mark>. For example, your emails, contact lists, instant messages, location, and files are all possible assets. Your devices themselves may also be assets.</p>
|
||||
<p><em>Make a list of your assets: data that you keep, where it’s kept, who has access to it, and what stops others from accessing it.</em></p>
|
||||
|
||||
<h3>Who do I want to protect it from?</h3>
|
||||
<p>To answer this question, it’s important to identify who might want to target you or your information. <mark>A person or entity that poses a threat to your assets is an “adversary.”</mark> Examples of potential adversaries are your boss, your former partner, your business competition, your government, or a hacker on a public network.</p>
|
||||
<p><em>Make a list of your adversaries, or those who might want to get ahold of your assets. Your list may include individuals, a government agency, or corporations.</em></p>
|
||||
<p>Depending on who your adversaries are, under some circumstances this list might be something you want to destroy after you’re done security planning.</p>
|
||||
|
||||
<h3>How likely is it that I will need to protect it?</h3>
|
||||
<p><mark>Risk is the likelihood that a particular threat against a particular asset will actually occur.</mark> It goes hand-in-hand with capability. While your mobile phone provider has the capability to access all of your data, the risk of them posting your private data online to harm your reputation is low.</p>
|
||||
<p>It is important to distinguish between what might happen and the probability it may happen. For instance, there is a threat that your building might collapse, but the risk of this happening is far greater in San Francisco (where earthquakes are common) than in Stockholm (where they are not).</p>
|
||||
<p>Assessing risks is both a personal and a subjective process. Many people find certain threats unacceptable no matter the likelihood they will occur because the mere presence of the threat at any likelihood is not worth the cost. In other cases, people disregard high risks because they don’t view the threat as a problem.</p>
|
||||
<p><em>Write down which threats you are going to take seriously, and which may be too rare or too harmless (or too difficult to combat) to worry about.</em></p>
|
||||
|
||||
<h3>How bad are the consequences if I fail?</h3>
|
||||
<p>There are many ways that an adversary could gain access to your data. For example, an adversary can read your private communications as they pass through the network, or they can delete or corrupt your data.</p>
|
||||
<p><mark>The motives of adversaries differ widely, as do their tactics.</mark> A government trying to prevent the spread of a video showing police violence may be content to simply delete or reduce the availability of that video. In contrast, a political opponent may wish to gain access to secret content and publish that content without you knowing.</p>
|
||||
<p>Security planning involves understanding how bad the consequences could be if an adversary successfully gains access to one of your assets. To determine this, you should consider the capability of your adversary. For example, your mobile phone provider has access to all your phone records. A hacker on an open Wi-Fi network can access your unencrypted communications. Your government might have stronger capabilities.</p>
|
||||
<p><em>Write down what your adversary might want to do with your private data.</em></p>
|
||||
|
||||
<h3>How much trouble am I willing to go through to try to prevent potential consequences?</h3>
|
||||
<p><mark>There is no perfect option for security.</mark> Not everyone has the same priorities, concerns, or access to resources. Your risk assessment will allow you to plan the right strategy for you, balancing convenience, cost, and privacy.</p>
|
||||
<p>For example, an attorney representing a client in a national security case may be willing to go to greater lengths to protect communications about that case, such as using encrypted email, than a mother who regularly emails her daughter funny cat videos.</p>
|
||||
<p><em>Write down what options you have available to you to help mitigate your unique threats. Note if you have any financial constraints, technical constraints, or social constraints.</em></p>
|
||||
|
||||
<hr class="m-5" />
|
||||
|
||||
<div class="row">
|
||||
<div class="col-12 col-lg-6">
|
||||
<h2>Further reading</h2>
|
||||
<ul>
|
||||
<li><a href="https://en.wikipedia.org/wiki/Threat_model">Wikipedia: Threat model</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-12 col-lg-6">
|
||||
<h2>Sources</h2>
|
||||
<ul>
|
||||
<li><a href="https://ssd.eff.org/en/module/your-security-plan">EFF Surveillance Self Defense: Your Security Plan</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
124
collections/_evergreen/threat-modeling.md
Normal file
124
collections/_evergreen/threat-modeling.md
Normal file
@ -0,0 +1,124 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: What are threat models?
|
||||
---
|
||||
|
||||
Balancing security, privacy, and usability is one of the first and most difficult tasks you'll face on your privacy journey. Everything is a trade-off: The more secure something is, the more restricting or inconvenient it generally is, et cetera. Often people find that the problem with the tools they see recommended is they're just too hard to start using!
|
||||
|
||||
If you wanted to use the **most** secure tools available, you'd have to sacrifice _a lot_ of usability. And even then, <mark>nothing is ever fully secure.</mark> There's **high** security, but never **full** security. That's why threat models are important.
|
||||
|
||||
**So, what are these threat models anyways?**
|
||||
|
||||
<mark>A threat model is a list of the most probable threats to your security/privacy endeavors.</mark> Since it's impossible to protect yourself against **every** attack(er), you should focus on the **most probable** threats. In computer security, a threat is a potential event that could undermine your efforts to stay private and secure.
|
||||
|
||||
By focusing on the threats that matter to you, this narrows down your thinking about the protection you need, so you can choose the tools that are right for the job.
|
||||
|
||||
Examples of threat models
|
||||
-------------------------
|
||||
|
||||
* An investigative journalist's threat model might be <span class="text-muted">(protecting themselves against)</span> a foreign government.
|
||||
* A company's manager's threat model might be <span class="text-muted">(protecting themselves against)</span> a hacker hired by competition to do corporate espionage.
|
||||
* The average citizen's threat model might be <span class="text-muted">(hiding their data from)</span> large tech corporations.
|
||||
|
||||
Creating your threat model
|
||||
--------------------------
|
||||
|
||||
To identify what could happen to the things you value and determine from whom you need to protect them, you want to answer these five questions:
|
||||
|
||||
1. What do I want to protect?
|
||||
2. Who do I want to protect it from?
|
||||
3. How likely is it that I will need to protect it?
|
||||
4. How bad are the consequences if I fail?
|
||||
5. How much trouble am I willing to go through to try to prevent potential consequences?
|
||||
|
||||
{% capture markdown_text %}
|
||||
#### Example: Protecting your belongings
|
||||
|
||||
* To demonstrate how these questions work, let's build a plan to keep your house and possessions safe.
|
||||
|
||||
##### What do you want to protect? (Or, _what do you have that is worth protecting?_)
|
||||
|
||||
* Your assets might include jewelry, electronics, important documents, or photos.
|
||||
|
||||
##### Who do you want to protect it from?
|
||||
|
||||
* Your adversaries might include burglars, roommates, or guests.
|
||||
|
||||
##### How likely is it that you will need to protect it?
|
||||
|
||||
* Does your neighborhood have a history of burglaries? How trustworthy are your roommates/guests? What are the capabilities of your adversaries? What are the risks you should consider?
|
||||
|
||||
##### How bad are the consequences if you fail?
|
||||
|
||||
* Do you have anything in your house that you cannot replace? Do you have the time or money to replace these things? Do you have insurance that covers goods stolen from your home?
|
||||
|
||||
##### How much trouble are you willing to go through to prevent these consequences?
|
||||
|
||||
* Are you willing to buy a safe for sensitive documents? Can you afford to buy a high-quality lock? Do you have time to open a security box at your local bank and keep your valuables there?
|
||||
|
||||
Only once you have asked yourself these questions will you be in a position to assess what measures to take. If your possessions are valuable, but the probability of a break-in is low, then you may not want to invest too much money in a lock. But, if the probability of a break-in is high, you'll want to get the best lock on the market, and consider adding a security system.
|
||||
|
||||
Making a security plan will help you to understand the threats that are unique to you and to evaluate your assets, your adversaries, and your adversaries' capabilities, along with the likelihood of risks you face.
|
||||
{% endcapture %}
|
||||
{% include card.html %}
|
||||
|
||||
Now, let's take a closer look at the questions in our list:
|
||||
|
||||
### What do I want to protect?
|
||||
|
||||
An “asset” is something you value and want to protect. In the context of digital security, <mark>an asset is usually some kind of information.</mark> For example, your emails, contact lists, instant messages, location, and files are all possible assets. Your devices themselves may also be assets.
|
||||
|
||||
_Make a list of your assets: data that you keep, where it's kept, who has access to it, and what stops others from accessing it._
|
||||
|
||||
### Who do I want to protect it from?
|
||||
|
||||
To answer this question, it's important to identify who might want to target you or your information. <mark>A person or entity that poses a threat to your assets is an “adversary.”</mark> Examples of potential adversaries are your boss, your former partner, your business competition, your government, or a hacker on a public network.
|
||||
|
||||
_Make a list of your adversaries, or those who might want to get ahold of your assets. Your list may include individuals, a government agency, or corporations._
|
||||
|
||||
Depending on who your adversaries are, under some circumstances this list might be something you want to destroy after you're done security planning.
|
||||
|
||||
### How likely is it that I will need to protect it?
|
||||
|
||||
<mark>Risk is the likelihood that a particular threat against a particular asset will actually occur.</mark> It goes hand-in-hand with capability. While your mobile phone provider has the capability to access all of your data, the risk of them posting your private data online to harm your reputation is low.
|
||||
|
||||
It is important to distinguish between what might happen and the probability it may happen. For instance, there is a threat that your building might collapse, but the risk of this happening is far greater in San Francisco (where earthquakes are common) than in Stockholm (where they are not).
|
||||
|
||||
Assessing risks is both a personal and a subjective process. Many people find certain threats unacceptable no matter the likelihood they will occur because the mere presence of the threat at any likelihood is not worth the cost. In other cases, people disregard high risks because they don't view the threat as a problem.
|
||||
|
||||
_Write down which threats you are going to take seriously, and which may be too rare or too harmless (or too difficult to combat) to worry about._
|
||||
|
||||
### How bad are the consequences if I fail?
|
||||
|
||||
There are many ways that an adversary could gain access to your data. For example, an adversary can read your private communications as they pass through the network, or they can delete or corrupt your data.
|
||||
|
||||
<mark>The motives of adversaries differ widely, as do their tactics.</mark> A government trying to prevent the spread of a video showing police violence may be content to simply delete or reduce the availability of that video. In contrast, a political opponent may wish to gain access to secret content and publish that content without you knowing.
|
||||
|
||||
Security planning involves understanding how bad the consequences could be if an adversary successfully gains access to one of your assets. To determine this, you should consider the capability of your adversary. For example, your mobile phone provider has access to all your phone records. A hacker on an open Wi-Fi network can access your unencrypted communications. Your government might have stronger capabilities.
|
||||
|
||||
_Write down what your adversary might want to do with your private data._
|
||||
|
||||
### How much trouble am I willing to go through to try to prevent potential consequences?
|
||||
|
||||
<mark>There is no perfect option for security.</mark> Not everyone has the same priorities, concerns, or access to resources. Your risk assessment will allow you to plan the right strategy for you, balancing convenience, cost, and privacy.
|
||||
|
||||
For example, an attorney representing a client in a national security case may be willing to go to greater lengths to protect communications about that case, such as using encrypted email, than a mother who regularly emails her daughter funny cat videos.
|
||||
|
||||
_Write down what options you have available to you to help mitigate your unique threats. Note if you have any financial constraints, technical constraints, or social constraints._
|
||||
|
||||
{% include hr.html %}
|
||||
|
||||
<div class="row">
|
||||
<div class="col-12 col-lg-6">
|
||||
<h2>Further reading</h2>
|
||||
<ul>
|
||||
<li><a href="https://en.wikipedia.org/wiki/Threat_model">Wikipedia: Threat model</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-12 col-lg-6">
|
||||
<h2>Sources</h2>
|
||||
<ul>
|
||||
<li><a href="https://ssd.eff.org/en/module/your-security-plan">EFF Surveillance Self Defense: Your Security Plan</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
@ -1,35 +0,0 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Video Streaming
|
||||
description: "The primary threat when using a video streaming platform is that your streaming habits and subscription lists could be used to profile you. You should combine these tools with a <a href='/providers/vpn/'>VPN</a> or <a href='https://www.torproject.org/'>Tor</a> to make it harder to profile your usage."
|
||||
---
|
||||
|
||||
<h2 id="clients" class="anchor">
|
||||
<a href="#clients"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Client
|
||||
</h2>
|
||||
|
||||
{% for item_hash in site.data.software.video-streaming-clients %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
|
||||
<h2 id="web-based-front-ends" class="anchor">
|
||||
<a href="#web-based-front-ends"><i class="fas fa-link anchor-icon"></i></a>
|
||||
Web based front ends
|
||||
</h2>
|
||||
|
||||
<p>The recommended frontend below is useful if you want to disable JavaScript in your browser. It does not provide privacy by itself and we don't recommend logging into any accounts. It can be used with a <a href='/providers/vpn/'>VPN</a> or <a href='https://www.torproject.org/'>Tor</a>.</p>
|
||||
|
||||
{% for item_hash in site.data.software.video-streaming-front-ends %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
17
collections/_pages/providers/cloud.md
Normal file
17
collections/_pages/providers/cloud.md
Normal file
@ -0,0 +1,17 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Cloud Storage
|
||||
description: |
|
||||
If you are currently using a Cloud Storage Service like Dropbox, Google Drive, Microsoft OneDrive or Apple iCloud, you are putting complete trust in your service provider to not look at your files.
|
||||
|
||||
Consider reducing the need to trust your provider, by using an alternative below that supports [end-to-end encryption](https://wikipedia.org/wiki/End-to-end_encryption) (E2EE).
|
||||
---
|
||||
|
||||
{% for item_hash in site.data.providers.cloud %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
19
collections/_pages/providers/search-engines.md
Normal file
19
collections/_pages/providers/search-engines.md
Normal file
@ -0,0 +1,19 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Search Engines
|
||||
description: |
|
||||
Use a search engine that doesn't build an advertising profile based on your searches.
|
||||
|
||||
The recommendations here are based on the merits of each service's privacy policy. There is **no guarantee** that these privacy policies are honored.
|
||||
|
||||
Consider using a [VPN](/providers/vpn) or [Tor](https://www.torproject.org/) if your threat model requires hiding your IP address from the search provider.
|
||||
---
|
||||
|
||||
{% for item_hash in site.data.providers.search-engines %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
158
collections/_pages/software/real-time-communication.md
Normal file
158
collections/_pages/software/real-time-communication.md
Normal file
@ -0,0 +1,158 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Real-Time Communication
|
||||
description: |
|
||||
We only recommend messengers that support strong [end-to-end encryption](https://en.wikipedia.org/wiki/End-to-end_encryption) (E2EE) and have been been independently [audited](https://en.wikipedia.org/wiki/Information_security_audit#The_audited_systems) to ensure their cryptography works as intended. The selection listed here is [free and open-source software](https://en.wikipedia.org/wiki/Free_and_open-source_software) (FOSS), ensuring that the code can be verified by experts now and in the future.
|
||||
---
|
||||
|
||||
## Encrypted Instant Messengers
|
||||
|
||||
{% for item_hash in site.data.software.messengers %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
|
||||
## Types of Communication Networks
|
||||
|
||||
There are several network architectures commonly used to relay messages between users. These networks can provide different different privacy guarantees, which is why it's worth considering your [threat model](https://en.wikipedia.org/wiki/Threat_model) when making a decision about which app to use.
|
||||
|
||||
### Centralized Networks
|
||||
|
||||
{% capture markdown_text %}
|
||||
Centralized messengers are those where all participants are on the same server or network of servers controlled by the same organization.
|
||||
|
||||
Some self-hosted messengers allow you to set up your own server. Self-hosting can provide additional privacy guarantees such as no usage logs or limited access to metadata (data about who is talking to whom). Self-hosted centralized messengers are isolated and everyone must be on the same server to communicate.
|
||||
{% endcapture %}
|
||||
{% include media-left.html text=markdown_text src="/assets/img/layout/network-centralized.svg" alt="Centralized network" %}
|
||||
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<h4>Advantages</h4>
|
||||
<ul>
|
||||
<li>New features and changes can be implemented more quickly.</li>
|
||||
<li>Easier to get started with and to find contacts.</li>
|
||||
<li>Most mature and stable features ecosystems, as they are easier to program in a centralized software.</li>
|
||||
<li>Privacy issues may be reduced when you trust a server that you're self-hosting.</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h4>Disadvantages</h4>
|
||||
<ul>
|
||||
<li>Can include <a href="https://drewdevault.com/2018/08/08/Signal.html">restricted control or access</a>. This can include things like:</li>
|
||||
<ul>
|
||||
<li>Being <a href="https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165">forbidden from connecting third-party clients</a> to the centralized network that might provide for greater customization or better user experience. Often defined in Terms and Conditions of usage.</li>
|
||||
<li>Poor or no documentation for third-party developers.</li>
|
||||
</ul>
|
||||
<li>The <a href="https://blog.privacytools.io/delisting-wire">ownership</a>, privacy policy, and operations of the service can change easily when a single entity controls it, potentially compromising the service later on.</li>
|
||||
<li>Self hosting requires effort and knowledge of how to set up a service.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
### Federated Networks
|
||||
|
||||
{% capture markdown_text %}
|
||||
Federated messengers use multiple, independent, decentralized servers that are able to talk to each other (email is one example of a federated service). Federation allows system administrators to control their own server and still be a part of the larger communications network.
|
||||
|
||||
When self-hosted, users of a federated server can discover and communicate with users of other servers, although some servers may choose to remain private by being non-federated (e.g., work team server).
|
||||
{% endcapture %}
|
||||
{% include media-left.html text=markdown_text src="/assets/img/layout/network-decentralized.svg" alt="Decentralized network" %}
|
||||
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>Allows for greater control over your own data when running your own server.</li>
|
||||
<li>Allows you to choose who to trust your data with by choosing between multiple "public" servers.</li>
|
||||
<li>Often allows for third party clients which can provide a more native, customized, or accessible experience.</li>
|
||||
<li>Server software can be verified that it matches public source code, assuming you have access to the server or you trust the person who does (e.g., a family member)</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Adding new features is more complex, because these features need to be standardized and tested to ensure they work with all servers on the network.</li>
|
||||
<li>Due to the previous point, features can be lacking, or incomplete or working in unexpected ways compared to centralized platforms, such as message relay when offline or message deletion.</li>
|
||||
<li>Some metadata may be available (e.g., information like "who is talking to whom," but not actual message content if E2EE is used).</li>
|
||||
<li>Federated servers generally require trusting your server's administrator. They may be a hobbyist or otherwise not a "security professional," and may not serve standard documents like a privacy policy or terms of service detailing how your data is utilized.</li>
|
||||
<li>Server administrators sometimes choose to block other servers, which are a source of unmoderated abuse or break general rules of accepted behavior. This will hinder your ability to communicate with users on those servers.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
### Peer-to-Peer (P2P) Networks
|
||||
|
||||
{% capture markdown_text %}
|
||||
[P2P](https://en.wikipedia.org/wiki/Peer-to-peer) messengers connect to a [distributed network](https://en.wikipedia.org/wiki/Distributed_networking) of nodes to relay a message to the recepient without a third-party server.
|
||||
|
||||
Clients (peers) usually find each other through the use of a [distributed computing](https://en.wikipedia.org/wiki/Distributed_computing) network. Examples of this include [Distributed Hash Tables](https://en.wikipedia.org/wiki/Distributed_hash_table) (DHT), used by [torrents](https://en.wikipedia.org/wiki/BitTorrent_(protocol)) and [IPFS](https://en.wikipedia.org/wiki/InterPlanetary_File_System) for example. Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the [Scuttlebutt](https://www.scuttlebutt.nz) social network protocol).
|
||||
|
||||
Once a peer has found a route to its contact via any of these methods, a direct connection between them is made. Although messages are usually encrypted, an observer can still deduce the location and identity of the sender and recipient.
|
||||
|
||||
P2P networks do not use servers, as users communicate directly between each others, and hence cannot be self-hosted. However, some additional services may rely on centralized servers, such as users discovery or offline messages relaying, which can benefit from self-hosting.
|
||||
{% endcapture %}
|
||||
{% include media-left.html text=markdown_text src="/assets/img/layout/network-distributed.svg" alt="Distributed network" %}
|
||||
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>Minimal information is exposed to third parties.</li>
|
||||
<li>Modern P2P platforms implement end-to-end encryption by default. There are no servers that could potentially intercept and decrypt your transmissions, unlike centralized and federated models.</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Reduced feature set:</li>
|
||||
<ul>
|
||||
<li>Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online.</li>
|
||||
<li>Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network to learn about who is online.</li>
|
||||
<li>Some common messenger features may not be implemented or incompletely, such as message deletion.</li>
|
||||
</ul>
|
||||
<li>Your <a href="https://en.wikipedia.org/wiki/IP_address">IP address</a> and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a <a href="/providers/vpn">VPN</a> or <a href="/software/networks">self contained network</a>, such as <a href="https://www.torproject.org">Tor</a> or <a href="https://geti2p.net/">I2P</a>. Many countries have some form of mass surveillance and/or metadata retention.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
### Anonymous Routing
|
||||
|
||||
{% capture markdown_text %}
|
||||
A messenger using [anonymous routing](https://doi.org/10.1007/978-1-4419-5906-5_628) hides either the identity of the sender, the receiver, or evidence that they have been communicating. Ideally, a messenger should hide all three.
|
||||
|
||||
There are [many](https://doi.org/10.1145/3182658) different ways to implement anonymous routing. One of the most famous is [onion routing](https://en.wikipedia.org/wiki/Onion_routing) (i.e. [Tor](https://en.wikipedia.org/wiki/Tor_(anonymity_network))), which communicates encrypted messages through a virtual [overlay network](https://en.wikipedia.org/wiki/Overlay_network) that hides the location of each node as well as the recipient and sender of each message. The sender and recipient never interact directly, and only meet through a secret rendezvous node, so that there is no leak of IP addresses nor physical location. Nodes cannot decrypt messages nor the final destination, only the recipient can. Each intermediary node can only decrypt a part that indicates where to send the still encrypted message next, until it arrives at the recipient who can fully decrypt it, hence the "onion layers".
|
||||
|
||||
Self-hosting a node in an anonymous routing network does not provide the hoster with additional privacy benefits, but rather contributes to the whole network's resilience against identification attacks for everyone's benefit.
|
||||
{% endcapture %}
|
||||
{% include media-left.html text=markdown_text src="/assets/img/layout/network-anonymous-routing.svg" alt="Anonymous routing network" %}
|
||||
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<h3>Advantages</h3>
|
||||
<ul>
|
||||
<li>Minimal to no information is exposed to other parties.</li>
|
||||
<li>Messages can be relayed in a decentralized manner even if one of the parties is offline.</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-md-6">
|
||||
<h3>Disadvantages</h3>
|
||||
<ul>
|
||||
<li>Slow message propagation.</li>
|
||||
<li>Often limited to fewer media types, mostly text since the network is slow.</li>
|
||||
<li>Less reliable if nodes are selected by randomized routing, some nodes may be very far from the sender and receiver, adding latency or even failing to transmit messages if one of the nodes goes offline.</li>
|
||||
<li>More complex to get started as the creation and secured backup of a cryptographic private key is required.</li>
|
||||
<li>Just like other decentralized platforms, adding features is more complex for developers than on a centralized platform, hence features may be lacking or incompletely implemented, such as offline message relaying or message deletion.</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
30
collections/_pages/software/video-streaming.md
Normal file
30
collections/_pages/software/video-streaming.md
Normal file
@ -0,0 +1,30 @@
|
||||
---
|
||||
layout: evergreen
|
||||
title: Video Streaming
|
||||
description: |
|
||||
The primary threat when using a video streaming platform is that your streaming habits and subscription lists could be used to profile you. You should combine these tools with a [VPN](/providers/vpn/) or [Tor](https://www.torproject.org/) to make it harder to profile your usage.
|
||||
---
|
||||
|
||||
## Client
|
||||
|
||||
{% for item_hash in site.data.software.video-streaming-clients %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
|
||||
## Web-based Frontends
|
||||
|
||||
The recommended frontend below is useful if you want to disable JavaScript in your browser. It does not provide privacy by itself and we don't recommend logging into any accounts.
|
||||
|
||||
{% for item_hash in site.data.software.video-streaming-front-ends %}
|
||||
{% assign item = item_hash[1] %}
|
||||
|
||||
{% if item.type == "Recommendation" %}
|
||||
{% include recommendation-card.html %}
|
||||
{% endif %}
|
||||
|
||||
{% endfor %}
|
||||
@ -74,6 +74,6 @@ Once you add your server, that’s it! In the Outline clients it’s just a matt
|
||||
|
||||
### Conclusion
|
||||
|
||||
That should be all you need to get your very own VPN up and running! **Do not share your access key with anyone**, this is the key starting with `ss://`. If you want to grant other users access to your server, click “Add a new key” in Outline Manager and give them a new, unique key. If you share a key, anyone with knowledge of that key will be able to see all the traffic of anyone else using the key. It should go without saying, but don’t send people keys over unencrypted channels: No Facebook Messenger, no emails. Stick with [Signal, Wire, or Briar]({% link _evergreen/real-time-communication.html %}) if you don’t have a secure app already.
|
||||
That should be all you need to get your very own VPN up and running! **Do not share your access key with anyone**, this is the key starting with `ss://`. If you want to grant other users access to your server, click “Add a new key” in Outline Manager and give them a new, unique key. If you share a key, anyone with knowledge of that key will be able to see all the traffic of anyone else using the key. It should go without saying, but don’t send people keys over unencrypted channels: No Facebook Messenger, no emails. Stick with [Signal, Wire, or Briar]({% link _pages/software/real-time-communication.md %}) if you don’t have a secure app already.
|
||||
|
||||
With Outline, there is no need to worry about the security of your server. Everything is set to automatically update with no intervention required! Another thing to note: The port on your Outline server is randomly generated. This is so the port can’t be easily blocked by nation/ISP level censors, however, this VPN may not function on some networks that only allow access to port 80/443, or on servers that only allow traffic on certain ports. These are edge-cases, but something to keep in mind, and if they apply you may need to look for more technical options.
|
||||
|
||||
18
index.html
18
index.html
@ -19,28 +19,28 @@ layout: default
|
||||
<div class="container my-5 p-5">
|
||||
|
||||
<div class="row">
|
||||
<div class="col-lg-10 col-12 text-end">
|
||||
<div class="col-2 d-none d-lg-block">
|
||||
{% include svg/phone-like-icon.svg %}
|
||||
</div>
|
||||
<div class="col-lg-8 col-12">
|
||||
<h2 class="mt-4">Why should I care?</h2>
|
||||
<h5 class="mt-2">“I have nothing to hide. Why should I care about my privacy?”</h5>
|
||||
<p class="mt-2">Much like the right to interracial marriage, woman's suffrage, freedom of speech, and many others, we didn't always have the right to privacy. In several dictatorships, many still don't. Generations before ours fought for our right to privacy. <mark>Privacy is a human right inherent to all of us</mark>, that we are entitled to without discrimination.</p>
|
||||
<p>You shouldn't confuse privacy with secrecy. We know what happens in the bathroom, but you still close the door. That's because you want privacy, not secrecy. <strong>Everyone</strong> has something to hide, privacy is something that makes you human.</p>
|
||||
</div>
|
||||
<div class="col-2 d-none d-lg-block">
|
||||
{% include svg/phone-like-icon.svg %}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row mt-5">
|
||||
<div class="col-2 d-none d-lg-block">
|
||||
{% include svg/plan-icon.svg %}
|
||||
</div>
|
||||
<div class="col-lg-10 col-12">
|
||||
<div class="row mt-5 justify-content-md-end">
|
||||
<div class="col-lg-8 col-12 text-end">
|
||||
<h2 class="mt-4">What should I do?</h2>
|
||||
<h5 class="mt-2">First, you need to make a plan.</h5>
|
||||
<p class="mt-2">Trying to protect <strong>all</strong> your data from <strong>everyone</strong> all the time is impractical, expensive, and exhausting. But, don't worry! Security is a process, and by thinking ahead you can put together a plan that's right for <strong>you</strong>. Security isn't just about the tools you use or the software you download. Rather, it begins with understanding the unique threats you face, and how you can counter them.</p>
|
||||
<p><mark>This process of identifying threats and defining countermeasures is called <strong>threat modeling</strong></mark>, and it forms the basis of every good security and privacy plan.</p>
|
||||
<a href="/threat-modeling/" class="btn btn-primary mt-2">Learn More About Threat Modeling</a>
|
||||
</div>
|
||||
<div class="col-2 d-none d-lg-block">
|
||||
{% include svg/plan-icon.svg %}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user