From fbbb7ab44a5592df84058600b94d903e541af389 Mon Sep 17 00:00:00 2001 From: Tommy Date: Mon, 20 Dec 2021 00:45:41 +0000 Subject: [PATCH] Revamping the Android section (#390) Co-authored-by: Daniel Nathan Gray Signed-off-by: Freddy --- .github/workflows/tests.yml | 7 +- Gemfile | 1 + Gemfile.lock | 9 +- _data/nav/1_home.yml | 3 - .../nav/{2_providers.yml => 1_providers.yml} | 0 _data/nav/{3_software.yml => 2_software.yml} | 2 +- _data/nav/3._operating_systems.yml | 7 + .../android-applications/1_orbot.yml | 24 +++ .../android-applications/2_shelter.yml | 20 ++ .../android-applications/3_auditor.yml | 26 +++ .../android/1_grapheneos.yml | 19 ++ _data/operating-systems/android/2_calyxos.yml | 25 +++ .../operating-systems/android/3_divestos.yml | 29 +++ _data/software/browsers-desktop/1_firefox.yml | 12 +- _data/software/browsers-mobile/1_bromite.yml | 2 +- _data/software/browsers-mobile/3_firefox.yml | 4 +- .../browsers-mobile/4_firefox_focus.yml | 4 +- _includes/legacy/sections/android-addons.html | 33 ---- .../sections/android-operating-systems.html | 32 ---- _includes/legacy/sections/ios-addons.html | 8 - _layouts/default.html | 1 + assets/img/android/auditor.svg | 2 + .../3rd-party => android}/calyxos.svg | 0 .../3rd-party => android}/divestos.svg | 0 .../3rd-party => android}/grapheneos-dark.svg | 0 .../3rd-party => android}/grapheneos.svg | 0 .../3rd-party => android}/orbot.svg | 0 assets/img/android/shelter.svg | 2 + assets/img/legacy_png/3rd-party/netguard.png | Bin 17661 -> 0 bytes collections/_evergreen/android.html | 175 ++++++++++++++++++ legacy_pages/os.html | 4 - package-lock.json | 13 +- package.json | 5 +- 33 files changed, 367 insertions(+), 102 deletions(-) delete mode 100644 _data/nav/1_home.yml rename _data/nav/{2_providers.yml => 1_providers.yml} (100%) rename _data/nav/{3_software.yml => 2_software.yml} (97%) create mode 100644 _data/nav/3._operating_systems.yml create mode 100644 _data/operating-systems/android-applications/1_orbot.yml create mode 100644 _data/operating-systems/android-applications/2_shelter.yml create mode 100644 _data/operating-systems/android-applications/3_auditor.yml create mode 100644 _data/operating-systems/android/1_grapheneos.yml create mode 100644 _data/operating-systems/android/2_calyxos.yml create mode 100644 _data/operating-systems/android/3_divestos.yml delete mode 100644 _includes/legacy/sections/android-addons.html delete mode 100644 _includes/legacy/sections/android-operating-systems.html create mode 100644 assets/img/android/auditor.svg rename assets/img/{legacy_svg/3rd-party => android}/calyxos.svg (100%) rename assets/img/{legacy_svg/3rd-party => android}/divestos.svg (100%) rename assets/img/{legacy_svg/3rd-party => android}/grapheneos-dark.svg (100%) rename assets/img/{legacy_svg/3rd-party => android}/grapheneos.svg (100%) rename assets/img/{legacy_svg/3rd-party => android}/orbot.svg (100%) create mode 100644 assets/img/android/shelter.svg delete mode 100644 assets/img/legacy_png/3rd-party/netguard.png create mode 100644 collections/_evergreen/android.html diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 30d815f3..8022eeca 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -122,17 +122,12 @@ jobs: restore-keys: | ${{ runner.os }}-htmlproofer- ${{ runner.os }}-htmlproofer - - name: Check All External Links (Informational, Soft-Fail) + - name: Check External Links (Informational, Soft-Fail) uses: chabad360/htmlproofer@v1.1 with: directory: ${{ github.workspace }}/_site arguments: --assume-extension --external_only --internal-domains privacyguides.org,www.privacyguides.org --timeframe 30d --url-ignore '/https:\/\/developers\.cloudflare\.com\//,/https:\/\/github\.com\/privacyguides\/privacyguides\.org\/(edit|tree|blob)\/main/,/https:\/\/support\.(startmail|yubico)\.com\//' continue-on-error: true - - name: Check External Links (Only 4XX) - uses: chabad360/htmlproofer@v1.1 - with: - directory: ${{ github.workspace }}/_site - arguments: --assume-extension --external_only --only_4xx --http-status-ignore 429 --internal-domains privacyguides.org,www.privacyguides.org --timeframe 30d --url-ignore '/https:\/\/developers\.cloudflare\.com\//,/https:\/\/github\.com\/privacyguides\/privacyguides\.org\/(edit|tree|blob)\/main/' https: name: "Require HTTPS Internal Images" diff --git a/Gemfile b/Gemfile index 73c34c22..5dbb4f76 100644 --- a/Gemfile +++ b/Gemfile @@ -11,6 +11,7 @@ end # Jekyll 3.9.0 now requires this explicitly installed, apparently gem "kramdown-parser-gfm", "~> 1.1" gem "webrick", "~> 1.7" +gem 'eventmachine', '1.3.0.dev.1', git: 'https://github.com/eventmachine/eventmachine', branch: 'master' # Windows does not include zoneinfo files, so bundle the tzinfo-data gem gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw, :jruby] diff --git a/Gemfile.lock b/Gemfile.lock index 7556eb17..141d793a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,3 +1,10 @@ +GIT + remote: https://github.com/eventmachine/eventmachine + revision: 8e1d6b11fd8400593af035a7a0d203d24c10c9b0 + branch: master + specs: + eventmachine (1.3.0.dev.1) + GEM remote: https://rubygems.org/ specs: @@ -9,7 +16,6 @@ GEM em-websocket (0.5.2) eventmachine (>= 0.12.9) http_parser.rb (~> 0.6.0) - eventmachine (1.2.7) ffi (1.15.4) forwardable-extended (2.6.0) http_parser.rb (0.6.0) @@ -70,6 +76,7 @@ PLATFORMS ruby DEPENDENCIES + eventmachine (= 1.3.0.dev.1)! jekyll (~> 4.2) jekyll-brotli (~> 2.3) jekyll-feed (~> 0.6) diff --git a/_data/nav/1_home.yml b/_data/nav/1_home.yml deleted file mode 100644 index 9271f9b6..00000000 --- a/_data/nav/1_home.yml +++ /dev/null @@ -1,3 +0,0 @@ -type: link -title: Home -file: index.html diff --git a/_data/nav/2_providers.yml b/_data/nav/1_providers.yml similarity index 100% rename from _data/nav/2_providers.yml rename to _data/nav/1_providers.yml diff --git a/_data/nav/3_software.yml b/_data/nav/2_software.yml similarity index 97% rename from _data/nav/3_software.yml rename to _data/nav/2_software.yml index 6f5b4900..a864aa5c 100644 --- a/_data/nav/3_software.yml +++ b/_data/nav/2_software.yml @@ -6,7 +6,7 @@ items: icon: fad fa-browser file: _evergreen/browsers.html - type: link - title: Operating Systems + title: Operating Systems (Legacy) icon: fad fa-compact-disc file: legacy_pages/os.html - type: divider diff --git a/_data/nav/3._operating_systems.yml b/_data/nav/3._operating_systems.yml new file mode 100644 index 00000000..133e4fbd --- /dev/null +++ b/_data/nav/3._operating_systems.yml @@ -0,0 +1,7 @@ +type: dropdown +title: Operating Systems +items: + - type: link + title: Android + icon: fab fa-android + file: _evergreen/android.html diff --git a/_data/operating-systems/android-applications/1_orbot.yml b/_data/operating-systems/android-applications/1_orbot.yml new file mode 100644 index 00000000..1941da49 --- /dev/null +++ b/_data/operating-systems/android-applications/1_orbot.yml @@ -0,0 +1,24 @@ +title: Orbot +type: Recommendation +logo: /assets/img/android/orbot.svg +description: | + Orbot is a free proxy app that routes your connections through the Tor Network. + + Orbot can proxy individual apps if they support SOCKS or HTTP proxying. It can also proxy all your network connections using the VpnService and can be used with the VPN killswitch (⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN). + + For resistance against traffic analysis attacks, consider enabling Isolate Destination Address ( ⁝ →Settings → Connectivity). This will use a completely different Tor Circuit (different middle relay and exit nodes) for every domain you connect to. + +

Notes

+ Orbot is often outdated on the Guardian Project's F-Droid repository and Google Play so consider downloading directly from the GitHub repository instead. + + All versions are signed using the same signature so they should be compatible with each other. +website: 'https://guardianproject.info/apps/org.torproject.android' +downloads: + - icon: fab fa-android + url: 'https://guardianproject.info/fdroid' + - icon: fab fa-google-play + url: 'https://play.google.com/store/apps/details?id=org.torproject.android' + - icon: fab fa-github + url: 'https://github.com/guardianproject/orbot' + - icon: fab fa-gitlab + url: 'https://gitlab.com/guardianproject/orbot' diff --git a/_data/operating-systems/android-applications/2_shelter.yml b/_data/operating-systems/android-applications/2_shelter.yml new file mode 100644 index 00000000..2f819b40 --- /dev/null +++ b/_data/operating-systems/android-applications/2_shelter.yml @@ -0,0 +1,20 @@ +title: Shelter +type: Recommendation +logo: /assets/img/android/shelter.svg +description: | + Shelter is an app that helps you leverage the Android work profile to isolate other apps. + + Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager (DocumentsUI). + +

Notes

+ CalyxOS includes a device controller so we recommend using their built in work profile instead. +website: 'https://gitea.angry.im/PeterCxy/Shelter' +downloads: + - icon: fab fa-android + url: 'https://f-droid.org/en/packages/net.typeblog.shelter' + - icon: fab fa-google-play + url: 'https://play.google.com/store/apps/details?id=net.typeblog.shelter' + - icon: fab fa-github + url: 'https://github.com/PeterCxy/Shelter' + - icon: fab fa-git + url: 'https://gitea.angry.im/PeterCxy/Shelter' diff --git a/_data/operating-systems/android-applications/3_auditor.yml b/_data/operating-systems/android-applications/3_auditor.yml new file mode 100644 index 00000000..4bb9cf7f --- /dev/null +++ b/_data/operating-systems/android-applications/3_auditor.yml @@ -0,0 +1,26 @@ +title: Auditor +type: Recommendation +logo: /assets/img/android/auditor.svg +description: | + Auditor is an app which leverages hardware security features to provide device integrity monitoring for supported devices. It currently works with GrapheneOS and the stock operating system. It performs attestation and intrusion detection by: +
    +
  • Using a Trust On First Use (TOFU) model between an auditor and auditee, the pair establish a private key in the hardware-backed keystore of the Auditor.
    • +
  • The auditor can either be another instance of the Auditor app or the Remote Attestation Service.
    • +
  • The auditor records the current state and configuration of the auditee.
    • +
  • Should tampering with the operating system of the auditee after the pairing is complete, the auditor will be aware of the change in the device state and configurations.
    • +
  • The user will be alerted to the change.
    • +
+ + No personally identifiable information is submitted to the attestation service. We do still recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring. + + If your threat model requires complete anonymity you could consider using Orbot or a VPN to hide your IP address from the attestation service. + + To make sure that your hardware and operating system is genuine, perform local attestation immediately after the device has been installed and prior to any internet connection. + +website: 'https://attestation.app' +privacy_policy: 'https://attestation.app/privacy-policy' +downloads: + - icon: fab fa-google-play + url: 'https://play.google.com/store/apps/details?id=app.attestation.auditor' + - icon: fab fa-github + url: 'https://github.com/GrapheneOS/Auditor' diff --git a/_data/operating-systems/android/1_grapheneos.yml b/_data/operating-systems/android/1_grapheneos.yml new file mode 100644 index 00000000..b96c6792 --- /dev/null +++ b/_data/operating-systems/android/1_grapheneos.yml @@ -0,0 +1,19 @@ +title: GrapheneOS +type: Recommendation +logo: /assets/img/android/grapheneos.svg +description: | + GrapheneOS is the best choice when it comes to privacy and security. + + GrapheneOS has a lot of security hardening and privacy improvements. It has a hardened memory allocator, network and sensor permissions, and various other security features. GrapheneOS also comes with full firmware updates and signed builds, so verified boot is fully supported. + + Notably, GrapheneOS supports Sandboxed Play Services. Google Play Services can be run fully sandboxed like a regular user app and contained in a work profile or user profile of your choice. This means that you can run apps dependant on Play Services, such as those that require push notifications using Google's Firebase Cloud Messaging service. GrapheneOS allows you to take advantage of most Google Play Services whilst having full user control over their permissions and access. + + Currently, only Pixel phones meet its hardware security requirement and are supported. + +

Notes

+ GrapheneOS's "extended support" devices do not have full security patches (firmware updates) due to the original equipment manufacturer (OEM) discontinuing support. These devices cannot be considered completely secure. +website: 'https://grapheneos.org/' +privacy_policy: 'https://grapheneos.org/faq#privacy-policy' +downloads: + - icon: fab fa-github + url: 'https://github.com/GrapheneOS' diff --git a/_data/operating-systems/android/2_calyxos.yml b/_data/operating-systems/android/2_calyxos.yml new file mode 100644 index 00000000..00fb8fcf --- /dev/null +++ b/_data/operating-systems/android/2_calyxos.yml @@ -0,0 +1,25 @@ +title: CalyxOS +type: Recommendation +logo: /assets/img/android/calyxos.svg +description: | + CalyxOS is a decent alternative to GrapheneOS. + + It has some privacy features on top of AOSP, such as the Datura firewall, Signal integration in the dialer app, and a built in panic button. CalyxOS also comes with firmware updates and signed builds, so verified boot is fully supported. + + To accomodate users who need Google Play Services, CalyxOS optionally includes MicroG. With MicroG, CalyxOS also bundles in the Mozilla and DejaVu location services. + + Currently, CalyxOS supports Google Pixel phones and the Xiaomi Mi A2. For legacy devices, CalyxOS offers "extended support" for much longer than GrapheneOS, making it a good choice once GrapheneOS has dropped support. + +

Notes

+ CalyxOS's "extended support" does not have full security patches due to the original equipment manufacturer (OEM) discontinuing support, therefore they cannot be considered completely secure. + + With the Xiaomi Mi A2, CalyxOS does not distribute the the latest firmware. Newer versions of the firmware prevented the device from performing verified boot. + + The Daruta firewall can leak in some circumstances (see #572 and #581). +website: 'https://calyxos.org' +privacy_policy: 'https://calyxinstitute.org/legal/privacy-policy' +downloads: + - icon: fab fa-github + url: 'https://github.com/CalyxOS' + - icon: fab fa-gitlab + url: 'https://gitlab.com/calyxos' diff --git a/_data/operating-systems/android/3_divestos.yml b/_data/operating-systems/android/3_divestos.yml new file mode 100644 index 00000000..93f3101c --- /dev/null +++ b/_data/operating-systems/android/3_divestos.yml @@ -0,0 +1,29 @@ +title: DivestOS +type: Recommendation +logo: /assets/img/android/divestos.svg +description: | + DivestOS is a soft-fork of LineageOS. + + DivestOS inherits many supported devices from LineageOS. It has signed builds, making it possible to have verified boot on some non-Pixel devices. + + DivestOS has automated kernel vulnerability (CVE) patching, fewer proprietary blobs, a custom hosts file, along with bundled F-Droid as the app store. It also includes UnifedNlp for network location and some hardening with Mulch Webview. DivestOS also includes kernel patches from GrapheneOS and enables security features in defconfig. + + DivestOS also inherits LineageOS's iptables network access feature. You can deny network access to an individual application by pressing and holding on the app's icon. (App info → Data and Network → Uncheck "Network Access"). + + DivestOS 16.0 and 17.1 has GrapheneOS's hardened memory allocator. There are plans to port this to DivestOS 18.1. + +

Notes

+ DivestOS firmware update status varies across the devices it supports. For Pixel phones, we still recommend using GrapheneOS or CalyxOS. For other supported devices, DivestOS is a good alternative. + + Like CalyxOS's firewall, the network access toggle can also leak in some situations. + + Not all of the supported devices have verified boot and some perform it better than others. + +website: 'https://divestos.org' +website_tor: 'http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion' +privacy_policy: 'https://divestos.org/index.php?page=privacy_policy' +downloads: + - icon: fab fa-github + url: 'https://github.com/divested-mobile' + - icon: fab fa-gitlab + url: 'https://gitlab.com/divested-mobile' diff --git a/_data/software/browsers-desktop/1_firefox.yml b/_data/software/browsers-desktop/1_firefox.yml index 05a21c6a..717e5428 100644 --- a/_data/software/browsers-desktop/1_firefox.yml +++ b/_data/software/browsers-desktop/1_firefox.yml @@ -28,16 +28,16 @@ description: |

Arkenfox (advanced)

The Arkenfox project provides a set of carefully considered options for Firefox. These options are quite strict but a few are subjective and can sometimes cause a website to not work properly. You can easily change these settings to suit your needs. We strongly recommend reading through the basics section. Arkenfox also enables container support. -website: 'https://firefox.com/' -privacy_policy: 'https://www.mozilla.org/privacy/firefox/' +website: 'https://firefox.com' +privacy_policy: 'https://www.mozilla.org/privacy/firefox' downloads: - icon: fab fa-windows - url: 'https://www.mozilla.org/firefox/windows/' + url: 'https://www.mozilla.org/firefox/windows' - icon: fab fa-apple - url: 'https://www.mozilla.org/firefox/mac/' + url: 'https://www.mozilla.org/firefox/mac' - icon: fab fa-linux - url: 'https://www.mozilla.org/firefox/linux/' + url: 'https://www.mozilla.org/firefox/linux' - icon: fab fa-freebsd url: 'https://www.freshports.org/www/firefox' - icon: fab fa-git - url: 'https://hg.mozilla.org/mozilla-central/' + url: 'https://hg.mozilla.org/mozilla-central' diff --git a/_data/software/browsers-mobile/1_bromite.yml b/_data/software/browsers-mobile/1_bromite.yml index 1366ad6e..c1c27504 100644 --- a/_data/software/browsers-mobile/1_bromite.yml +++ b/_data/software/browsers-mobile/1_bromite.yml @@ -18,7 +18,7 @@ description: |
  • Select: Open external links in incognito.
    • -website: 'https://www.bromite.org/' +website: 'https://www.bromite.org' privacy_policy: 'https://www.bromite.org/privacy' downloads: - icon: fab fa-android diff --git a/_data/software/browsers-mobile/3_firefox.yml b/_data/software/browsers-mobile/3_firefox.yml index 6cb9052d..9bc51bd8 100644 --- a/_data/software/browsers-mobile/3_firefox.yml +++ b/_data/software/browsers-mobile/3_firefox.yml @@ -12,8 +12,8 @@ description: |
    Sanitizing on close
    Firefox iOS does not have have an option to clear cache on quit so you must do it manually. ( ≡ → ⚙️ Settings → Data Management). -website: 'https://firefox.com/' -privacy_policy: 'https://www.mozilla.org/privacy/firefox/' +website: 'https://firefox.com' +privacy_policy: 'https://www.mozilla.org/privacy/firefox' downloads: - icon: fab fa-app-store-ios url: 'https://apps.apple.com/app/id989804926' diff --git a/_data/software/browsers-mobile/4_firefox_focus.yml b/_data/software/browsers-mobile/4_firefox_focus.yml index c7fd1abc..b316e66c 100644 --- a/_data/software/browsers-mobile/4_firefox_focus.yml +++ b/_data/software/browsers-mobile/4_firefox_focus.yml @@ -12,8 +12,8 @@ description: |

    Notes

    Focus only lets you open one tab at a time. -website: 'https://firefox.com/' -privacy_policy: 'https://www.mozilla.org/privacy/firefox/' +website: 'https://firefox.com' +privacy_policy: 'https://www.mozilla.org/privacy/firefox' downloads: - icon: fab fa-app-store-ios url: 'https://apps.apple.com/app/id1055677337' diff --git a/_includes/legacy/sections/android-addons.html b/_includes/legacy/sections/android-addons.html deleted file mode 100644 index 2375f4d1..00000000 --- a/_includes/legacy/sections/android-addons.html +++ /dev/null @@ -1,33 +0,0 @@ -

    Android Privacy Add-ons

    - -
    - -
    -
    - NetGuard -
    -
    -

    Control your traffic with NetGuard

    -

    NetGuard provides simple and advanced methods to block certain apps from accessing the internet, without requiring root privileges. Applications and addresses can be individually allowed or denied access to your Wi-Fi and/or mobile connections, allowing you to control exactly which apps are able to phone home or not.

    -
    -
    - -
    -
    - Orbot -
    -
    -

    Tor for Android with Orbot

    -

    Orbot is a free proxy app that empowers other apps to use the internet more securely. Orbot uses Tor to encrypt your Internet traffic and then hides it by bouncing through a series of computers around the world.

    -
    -
    - -
    - -

    See also

    - - diff --git a/_includes/legacy/sections/android-operating-systems.html b/_includes/legacy/sections/android-operating-systems.html deleted file mode 100644 index 5752f5fa..00000000 --- a/_includes/legacy/sections/android-operating-systems.html +++ /dev/null @@ -1,32 +0,0 @@ -

    Mobile Operating Systems

    - -{% include legacy/cardv2.html - title="GrapheneOS" - image="/assets/img/legacy_svg/3rd-party/grapheneos.svg" - image-dark="/assets/img/legacy_svg/3rd-party/grapheneos-dark.svg" - description='GrapheneOS is a free and open-source security and privacy-focused mobile operating system built on top of the Android Open Source Project. It expands upon android security by providing a hardened memory allocator, network and sensors permission, sandboxed Play Services support, and various other security features. Using GrapheneOS is recommended if you want the utmost security for your device. Currently, only Pixel phones are supported.' - badges="info:AOSP" - website="https://grapheneos.org" - github="https://github.com/GrapheneOS" -%} - -{% include legacy/cardv2.html - title="CalyxOS" - image="/assets/img/legacy_svg/3rd-party/calyxos.svg" - description='CalyxOS is a custom ROM based on the Android Open Source Project, with support for Google Pixel devices and the Xiaomi Mi A2. It aims to be secure and private by default, and includes a number of good choices for default applications. Some of its features include optional MicroG support and a built-in firewall. It should be noted that CalyxOS lacks a lot of the security hardening that GrapheneOS has, such as a hardened memory allocator, hardened webview, more secure spawning system, and so on.' - badges="info:AOSP" - website="https://calyxos.org" - gitlab="https://gitlab.com/calyxos" -%} - -{% include legacy/cardv2.html - title="DivestOS" - image="/assets/img/legacy_svg/3rd-party/divestos.svg" - description='DivestOS is a soft-fork of LineageOS with signed builds, automated kernel vulnerability (CVE) patching, fewer proprietary blobs, along with bundled F-Droid and UnifedNlp. Not all of its supported devices support verified boot, and DivestOS does not handle firmware updates well currently. For Pixel devices, we still recommend using GrapheneOS or CalyxOS. For other supported devices, DivestOS is a good option.' - badges="info:AOSP" - website="https://divestos.org" - tor="http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion" - privacy-policy="https://divestos.org/index.php?page=privacy_policy" - github="https://github.com/divested-mobile" - gitlab="https://gitlab.com/divested-mobile" -%} diff --git a/_includes/legacy/sections/ios-addons.html b/_includes/legacy/sections/ios-addons.html index bda3a544..413616c9 100644 --- a/_includes/legacy/sections/ios-addons.html +++ b/_includes/legacy/sections/ios-addons.html @@ -23,11 +23,3 @@ - -

    See also

    - - diff --git a/_layouts/default.html b/_layouts/default.html index e8cd65aa..518e88c5 100644 --- a/_layouts/default.html +++ b/_layouts/default.html @@ -11,5 +11,6 @@ + {% if page.mathjax %}{% endif %} diff --git a/assets/img/android/auditor.svg b/assets/img/android/auditor.svg new file mode 100644 index 00000000..1223d9e2 --- /dev/null +++ b/assets/img/android/auditor.svg @@ -0,0 +1,2 @@ + + diff --git a/assets/img/legacy_svg/3rd-party/calyxos.svg b/assets/img/android/calyxos.svg similarity index 100% rename from assets/img/legacy_svg/3rd-party/calyxos.svg rename to assets/img/android/calyxos.svg diff --git a/assets/img/legacy_svg/3rd-party/divestos.svg b/assets/img/android/divestos.svg similarity index 100% rename from assets/img/legacy_svg/3rd-party/divestos.svg rename to assets/img/android/divestos.svg diff --git a/assets/img/legacy_svg/3rd-party/grapheneos-dark.svg b/assets/img/android/grapheneos-dark.svg similarity index 100% rename from assets/img/legacy_svg/3rd-party/grapheneos-dark.svg rename to assets/img/android/grapheneos-dark.svg diff --git a/assets/img/legacy_svg/3rd-party/grapheneos.svg b/assets/img/android/grapheneos.svg similarity index 100% rename from assets/img/legacy_svg/3rd-party/grapheneos.svg rename to assets/img/android/grapheneos.svg diff --git a/assets/img/legacy_svg/3rd-party/orbot.svg b/assets/img/android/orbot.svg similarity index 100% rename from assets/img/legacy_svg/3rd-party/orbot.svg rename to assets/img/android/orbot.svg diff --git a/assets/img/android/shelter.svg b/assets/img/android/shelter.svg new file mode 100644 index 00000000..15ba70ea --- /dev/null +++ b/assets/img/android/shelter.svg @@ -0,0 +1,2 @@ + + diff --git a/assets/img/legacy_png/3rd-party/netguard.png b/assets/img/legacy_png/3rd-party/netguard.png deleted file mode 100644 index 5bfaaa18fa254596a74ae8c181f590be55eb018b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 17661 zcmX6@1y~!+7LDNU?(XjH?$YA!?k>S8?!{e;Tk#TTahDeNQlPjMFOUB3`)0Gb=bn4+ z-N_``nVkzMhgG{LjN5I;5P*Hq#*frg0YoUeLFWNBR`wNzS%%e zEqN(G!!*g!n}O)2pzjF)uu=azfPNL?J^%orYk-cPmzKFNg`0<~jlGjKg_pmZHHEdG zy$t~1w_2ZT??cL;7WHb0+ZPD~+VkKjToA6_zw=GaP#CK`{lqqhbu@Cv6-ID|q0sSq z+duMx9@>(5Xu-tWkx%~j8=m3evqsU3_|x9gQ*P+)%iRe1>t&;F=wm$8cdw_9J?s9` z@X7CGSN_SIYa+(+zhVe4Vc0Z18MI>=WdF(TsAdn9YPOm91e<4`r|*Rq(lE63^f|D9jBcq_#1*wL-e2tM zqv_fC=7su~=^S*AP-(z`@O}_mveVYR3Ke$=-o%7?hb=|AK*IbpxPCFN-drrF7&SDINeRdV; zi#&eYSG`WI%D;QPxOKIf3bkTgS2+saxBcPQj$?diGKg%O<{>vMbz{}b0LJmsm@fQn zi87w=@uyAVeL0jW-J|t+pgirZ#FpK*1znB3jvlW|~mfmzI5O#h>p!RNwGpXAz>b)(hvv9(Lyhjgi$;GQgc z3JIdCam&QiG}HJ(M;`;>gQGq*B3oW@_#!7xj8Pmd@$Dkh4{l9YTt*fh^%+Ok3C)u& z==vnh%K^Vd>^pd!5@8+ZVx5=fuRj&S6sUw4Zi*&yOt{*bs&`!hsunx^A&mKlvqrC+GB|)~nHL=St==7OI zLXMr-MBFSvKKhK<6j4hfly7v1s)47l9EB8S&+G-`M>{vZJA(DdVb4q@-nsPkduv4j z(}p*o18#kR{t+7H#Ahb#>)PD8{NaayI?F`svJyJvnFphSIC#vlhT(&4_Vr;4r{@aM zcirwI2X4Mi#Jh8_pe7cNJB1YZ;t;^^oA)(+Hzy%EOEt+8c>T4G_S?z>2C7&>&#z#T zizYpdPApx;xE#I-uo?k<8HRL)vU3BB*3(qd9ZcdO(2VCNTH)M8nLt+W5dwrtTw^(@ zDY@v$1%X7g?FvSPPM0|i?ZW$qb7ji@QO=(zA4gy4NeCTMk288E>_vnf(6nB&+Wv7< z635S6(@LhH*fs1$b(OdcG*TgSoZY~W8_YpuqN{W_qDb;ifI?o7`I56KGBBdfQe(o< z3J4F`3*RuNoqmG9AE?P}4)S zJhcI~lt&&_YhkP4?07?4BVOV(N+Zab(J4P^;L6p_JA%w=h;UStA)>*~d7xyT#YNBo z+4dRGrcFd(z=pCwf+lnf(F`w-|D)xtC1uy=RI$jf-yUxxMtA;HH)Jx%r5zYxY*YQ>0VHEel!1y`$@OBDK3fRI)mk$;q#~1)yB7cx5&~ zL<&p7UIt9T89SBT51pd=lhWojZs{}SXT+v0Q?iq+Be1dEAELQIqfuP7disPP@zth{NQQJ7BxzYtQcTX;NwW5lSel& zA}nd}ZmDw?!~@qp6>ZW62YyG-(0uxJ`geetUe6u;R`HRs2$kgXG%vH0zkzQ!AXBD{ zT$4g3!)P!itfN)q9WkcqAc(^bvAq);nZG(pNb?~7bDr-{bInDJwUnUZ+#MeWj4XNk zLOI4qrPsCm!)z^l0vNVQ&1pSb{>_kta9hVkPUjDcqvK>vU;iSo<^sDS@YI6c$g>hq z9B3j0(wmgKMtvpB&A4i%LCWizA5iDMoV~hBGv#Z=#ezzw$J@S`(WDK}3pMuYRmWkI zf7f-heM&T#XO8!pP^s@y^&0IHEG;fiNj1r)%kU0FkvrCaXtRC%ACYY)j!$HRr z-AlUuF{3J1DygguCOa%09ymTYfUMY?v!)POZp$|4m{hwuoq=kW3_$8kCV5WD*z_!b zL(-Dekgpt6QO!$GS}i&FZfFO4!8S!em%-GW@Rx108Z}jY zG{KBw-mG3q)0FTXsr|w2pZbVm|7u*?Uz(Fm;qmzx`N?en&9D>|dWfl|^c~Jv@KfcW zDHqWwC6hQ7mk6zF!ZC#s0grJWS8!vU6Fh$u)i(ZbA&Ig3tOA1tGg;L3 z1YBC$?brgzr4YU^zwe-ES?pi(98aZ@$nqG*_m;ophQXJ2NI4RD{Hym zsWyv`HB0FsKSCl1c zEQz>yv~A5xbO3KjKBJ(`$C8x@S)i~pm@^js+zg^-?mFN7l0~KT#}TdszW8DG1;L0$ zI`5&L5(SqxvLzG7_js?=@m0ys^ntB%D{ulPpm-|}r0gvW3oMB_aIzE&;Qqw?MN=Ve zu#xbwZ=~rKa>t-u_ybvwS;(p}b9t`kTJ)^^I?py@O&GB(%fTxsF%7anV* zn}kXks~#VdIHdbIdk|rONYF|+N~xBpQd1l`Wi;?rQih^C^r*HZ%4`WTe~kT6W|P2{ z?MDnkBT^(N7(AD<*^QNLJXgI%Aj>X~LeMYK>MF7-KN)(|ySOgGe@KwZB7MdEdvPxP z=5yYK8#Y=p!%liQbqk_3*CripZ$l8y`)5rfa@{T5r*jt8mODI5XGpb*hpNl7Q_q?= zht3JG&yA_db zWCdXwC}i&;bYrri*nI20!T&%RW6{T$MA^Mzz@QxM;)n83BOx}%yq4>-=Y&M4s$hL~ z*)QMv9n7x$PlPI*lblBz)sMHWBdeFUYh<-JgA0?&HWbE4L=%pGe~FyRYPQWC#?}uU zMCcm8yB)yI3`nXh=BDn8Xl=@VA!pP`Ekp3%47KlJ#6`{oJwSk?YEOV_+pZ-xpmF z@$mr_kPr(M2;KbHho;lfHDCJ4yb=YETJ$nWZ}8J{@s@AaDH)i5`C_rj5$pGyPvQ1c zm58UfksaI!NJ9zLzd1ZXV?{GPJbsNJ#B6^}lcu7SJDV#&lC1w`oA;o?B}M254p!nK zEu{RUi07I#?Nj@-lF4e+)t4Q%zKD0DL<+PnN;sYoUVGZOS+FyD(-BTkj^W~TMb~J# z+4a*Vk0!3cq+ItS4W6W5ZXF&aqh45~ZbUC2&X?K#)0l=-^nCLwDZ_dT_`d5vEj`CE zb8Pz9A+E`EsJ==9Zn>I2o>l-17Mf#BQXrLN$&nj=&HMS{(Cv2C)VLp&n&uTJ&32v? zY1KDSc>FXAuW<+CC=KVaiK>r@XrsvMP{K2Qtg&SwQXY$Ao8DG657e@l%H@V%jfpDu zpZPewXP9U;KHT%NZDwJ4wSQ_u_(qq+JYN!M@=$%aP!uA z-Jgfx{kx0;o`8JI!z|y=S6S6k zaCS<{5QmiEX)|zoTf9LS{2S;*Ql}Tv(xTo4Q0g%bSHxUK;|TKAa4$|;*t$Wt`PR_bf?eWzAQm3*f_db@UB*`Aa#BPc5x49^2u$I~o|h<_;Mx7yx+)P3cdFUE8LZ76fV}Ac)bt zPg#+$7h`znPl6`cYI#D^g-G_=Ug2!Gu}O)Z1X}6bP$Y#m^{^00z9QUXWu_QR1#nn7@rNzkqwU;PjNgeMjnxcTEC*DY zJD$Wdg~}s!&7^uGs^Vy<#>C&9k$r-eS&wHr)X6B>{8Cy>RQgt_Rfhnt`Z`N9i+3zV zw+Jio`yQk1NK8a6k*E5188=&;(kZfLjw-3ch5gQlUoZ^hQpkJN7{l|LU_p!r%sWv{ zrxA_z%YDmSjJW6MPojVGsN&~uH)pO;zl^D%q(qYW@Pzf*%oa5Nwy&LoP@4+1 zE_KC#QhD9^HTqx<&pykjLJ@j(@Af zE*cAg<9%@Cq>y2Op*#^&oP#70#tEPW#GEUX$dcty)FZ$*^xq7N!2i%4W{m7=}MZ%DXv2Xn5A?^J1sK2sxwB>TNW7@4O2RtZ$!! z%q1yvlbj?dVIDs5?gf*J`s{sHyFMex{YjNsb+*bYGkdQS)1ydxXx?g<%BB z6I)Do&{%Qbb=5Gru8*Z1)*^3@i1Pp|aXQkZ2O7?x%WHxheo@H(3i6^oajyQwR7ggg z)c#$7OkQ4kuaq376>iw-WmFEIZ{$;QQ!Yo!J2S#$Ek=E@{TioHjhO4QY%~HzF=0v} zFAw-&*;&apJtej>ik%(B*Xj<_8X_??r;VcKp$--Vf|r z*@#p#V8W1l5DBH=MOk*wNukY@d9ob#4MEI2g11UtSUMX#A_ zrv21S(PBs`f+;714g07X0j;)8mZI8v5Tygs1NzFxjFADjg+7NlvAn@^U_i7?iPkK_ zH;>{l3mC(=N-u19jE9#KO_CN~Q()!ow&u!TzB3QI`KZjBeL4B=ZM9e@3lzRFACy)nvMns%BAaih3LZ6}y*&Zw-eYdi#SwqdnC9};Ob(XEug;xHxin9?(B zl0t|}QbHBY5d3Abn=Fex@~J6IUrPt5{w<1dGfZGmSI{=*w=Pt?q3^BUD7aKuT(c2r zioOgSv_kiMK13K zKTo*?RiR745-dk1f=4Dpo{d5071A5Vv>imLR49gEnfsdEgPRMPZ+VjZ46o7F-yJA4 zNm+|syi8zg&0sL&;%9jbb;WeU5zB~a@MjqTS&{?p+1<|-< z0J5NjFzpedi`dwEhcB!fAfsjh;agatfwnvU?cpPWB(D}TKXIEmcsKtg*W6ai^o6O8}ddA_WWnQ74R?Wzm^sA&->OgqyKaLU+PW& zKf$+MN)cTWu+m&L~s#YS5#kM<4~e^{dmZE0N#^ zIHIS8J?KzA=+pjICrdUI8dIfG3%8rK;Kc}Z**9jPOYpzYB#$r=JJld3Ne+6{qw(-J zkcxKZ{^0qnN4=v$dZ$AX;-gEL67o%r=1Pm)%R**Sg|b$Mt>PVrk)7HvRWbs92dq?x zWw4n-q$5>gfVP9yrYU=@m*%bsE2XbZn-w_z6KXD(IaBr~W^yJ*g36l(d!R>a0ei8Gt`j%71WKtkxP zK3%1=Y^sOqwHAehtAT>^J3w;yni+?*i(aliZ>fvCl&gNSsmMnIzIsQg8!d`)ebz_| zDXd6uEgz#lm&{3T&n8X0wA8c#7&!3YXB6OH*q?u&2_Fz|7|*F2NH?ztFCO-U`TtP) zZ+#ZyR9sMtD?TY-VbbqB{4%0oFuLe$b<~%gmhEmq>oqtP5uZ9$AKIj?BRN=9?ynkR z$FUZENZ@xOM)C4~6e+xYp? zbNqXCaH4fgOl)AqP;;`pD)(`CuQ09e6J-VM1z4>oyWVU2N#(~=QN0f;ZGtO`K{4wo zZYoYl23$-aA;GR)A`N>VtFW<*PO8aDXti=9Bc)%yBVzv?hr~4`(#GhwI|-V5*PG>z zASUTunOzjdrwV79ug?lKSMa>R&9u7K*33}YxBZB-!%@zBA&r zq_q01hDKq$g_MiGWCQ@-0!4Amp&Cm`6D1X?mZ-(8mX*)YRx3pJg8+Ca8^v8wSL};O z!WS`3-7#Ru}#NZ z{P@YDzmTw~P?bLHsNMZ;cToPElh59IE{l*R(lXrl4awS~4AJNt!-x$BsJM23R7NkZ zYvuOr#CRhX$iSK@PoL96`wt4gJdO=91&06Nr)L(DSd6smUqyu_O^3+s1ArnTp{J`IcJ+5Awf3Wc6ga05x-{mqlh_DTQj9EPPmh`st zcmFw1#RH?(m8-A zpoGqYx66ToA5?1K&Iv8l5*J+MVJRDRTR1E?L3Gn&X~5m#2qIidr-6kBeDD6GDt=nZ za{fVPsqG7DN>(KqLki7K3<3M<1g5SnNC~bYi0Z;j1J2??(o6~sLB_V$Jr=}wF`-9^0+FpRMmZm;h&C+d0mT^RjD%YXGmx>sj z`~6H@ETbJ)#Th}Z_gV0V9%Jpk@Q(`mI22ECXAb)iamvQJGX*sZ{#7j^w5$WkG_{U} z?>!9hMDcxWRm5pozcR_46xQ2xG<4afV0k7`;w~#?weWODhbrBpfU|ZJnOW}O0i&v>$s7M8B1^{fwm% zq$H`V`oQ#?;BjyIyLcS`m$S%q3>{%@dUKW(d;5yxZTeiAQuZ-s zP4?D$MFdK#>Bi+1%5b&ax^DPGjo_!pR~a*s;uMl@@>~=UTcO{I^)1yI?`m3YvXXzw z)2(4i5+yRly_^kd?#M)AntC|a`w0#CL%g48Mf9QuQzaZKir6}k$3>zDAH-QEYF8hW z<)Y)d$#CW50ov1aQzk2>pvv+hq*AamzD5w z*%vsg^(^wkFAI$Ud#F#Y-=4@Z852zyZKd(;K5aF+oUHfkU3BQX5mi?0S6nV8#AxWFcFn|rn>1E{4Dx}9?Z}D*Sxd636qCQabK*R z1HmrIYnmWp17e%ciQW0gkII(sQOiIInQ^HI47qyzV(eZ|NCQu)ZMf)hO$uGW^H?tH zDT|pdj4gq-kMQ_TUU|>YqdwPP_AU90)V3(p)W8Qx)^c?w?xnobA4zDGkHFA|9k+_# zle@dNKf>o9L=@?A9!cI^C|_Y4Pw4!qJ-)GE3AtM=x3v)i9GTBCy4@z;Ew?=#?d62` zf8V{h=-4&mFve;YSM49HjWD`QoMxVMXcIid=rk}m?2QYVipLEii0C=ml3j41zNzX6 zw1opI+BPn2Zq>`gl7ik3y15NIF2yLD6>{HeKe{s0UsHTu2(uZOftx9|2Wb-5~Q9H?1aV@oZ z&8cX1U4a))A@+Bvy}wU=Xs5Of8D%Tj{5d5+eB6)3ZoV_?V~z&^8NRsP~TJa z^GMvzbf2)D&(p=h{x}+q=uhMXPrM9|vn&@r%$Jd-rVl6V=Y6EZ6lE|>s2xFU&?*M2 zk>$3rN}1SOP~Hrd`t=X_qUYVM^ZqfcFo(M<74n}U8`dZM)tU*#x@Om~yZ+P9d*imD z!Fdm$%*U}Dy3r1rKHrV2?3FUZ?V;;$LizrCwlF}5EP@2ALLpFHJ|+I(gHhW6DMa^-$U za97;!Qa6lEd^jYchGoj7Lj4kGDW}a}3cm`&XDUQKOny1cE=ZAb6G<0Hq7*4Wm-2kY zlL`QheUE7-lA-oObaJKbWOo~1qh4ab+%1K&g|C6ex;8nTiA%`?VA6`PjPMkuStD`K zaPaLg6--2C%)`F^O;zk5qC7*Q>35+OU~bwgX&-s(oe9v|%x5>9?b& zadBH%i(2vimsa^kNq4$GAV!^wI-E{BZwVzh+GCi_%HPSlAYph4Q*MS^(G4f;<&fO% zV(5+rM$4*0OrkU9a!}TGDU`4Si!*`%+2{bR5E&FxN0fm9VtjW|hb^#>j3vE&$`+mu z8sYgs+4SOoOb?5;C5uSe^dKekcbR(DQUxK*vGK5rp-C|n0aUX-U>Syjx4bE97RG|N z9Fz$K>9eFH+yK6Ta%eBE>_Ny@%~13n1eTPcw@bm&qlkws?3oRRl>=6E3!hZkH)ANg zpphZ3>lF`k&Z+iGTurof^a7jsD`kUEBae(;m?Ar04 zmR7KAGAx%i#s2#nJql`AKGXGtei+q~)|P!7l39p6CXWSjv<2?waW;NTAk3LtpypD#O&mZx|S(xCg#uv2k! zl*j~%-yxw^b8O$RlmKzzy!JbJ{}FU1o_Q#M#i@c?b`st|)S~zQ@`!%;Pv2nw2ZRZ1 zWAM8QXbm=a1T8}5fmMblRlt2vfX6zKhPj0D*)}f)VR5ScEqXOv2GU{craD*&#*6kX z5!W_T2b>PU>?qDZEj^5Spe|h78JY=L3lQMs4|I^whoG+^s)DZoZN&*HU@cIkU(`Q- zI>W!h-&xN&N)SmH*x%jVeYHz6p$WO>;*$W~Kq+)ApE20#b*<2w%R0X)h39NtR zs3*-rkibMWE^q0JPuV3pq*9Vzl?4HS^uH} zJR;$A2sNZ&8iCF*ECh`IqQv||h-TrS8UOWI+tXX|tH=z@;Y*M|0HUJ*f;E04Yk&>V z4#)rdC=zujd5XIsa-Vy2Kyoh{fMAmW0Edy#b~47rIlwPWym(6g<`;wU($&qHWCAR5pSYe?>3h+U@@IZwNkQIu+W~jf9stp>0a5y_z zQ?3`Z%Iw2cCOE?v{v5s&6~L?v{~YxQ`TQ{z_l^V}>Q)IMZ-Sd7W9$S7<-NIZS?02E z|1#fTIzo^1!;vnCz)-4PvPRDkIpHr#*bILWAgKr z5KB<>77$8D)C2>8Z40ruXN80GqXI5k_gR3VCIe_qtYGL+Q8n;z42x)X=Ux>6ffoR! ztq(i_8^BNnR04`(W^MyJ=-|O!lZ^Hk0QC90 zMgA^ew;lEUF3`{o@QedM_XJP=+@}A0W&^m_)+;@wr?B0zw1J2X?CN&`0mO>%L0DOK zOrS3#$Q(lxFmCLCFHEEtf_kNQBa%PHP9^gJi09knLGRFEp-bi9&(XBw5>R4k0w7oH zc09ln*i_*K-5S7R6@-C|q}>C^Y%m61Uvu&Rkot1)U&1UqI#5V^3i`HxqZwEL2@uLg z+9b*{Hy97_YvLz|Ho}ra-&UcFg|?BKWE78q7p~Y{_p&cl=;Tm;YQP2U5yaRmF*+N- zwgd7LEx4u8u5p%FwtyvxBqpi$kTW8@dRK6vcVcC|EmF`pw2Z7A>kO71-H zcvmX;`F$uPahfxO2+wKK&oH6`)sG%ZlLi$`IaF-*#T@`;secxUVnMU=*ykOz0 zp#XfNdLYbu0ro2}Pq9M-)f;&M0#4-b^d{izl4!fr@9x2DJyPTY*y5b6=EU45D0qkO zQqW^>t?>bFLs?ocpx(RuFb#|8pt^G!z_+V%S#rsqLD`DUnJ%0^C7w;1+Snk8$@-bC zeRP3S5^F7$#oKlifH(;TyBPv%$j>IHwK>9!{e6IbdZh`D6;dq1K_)j#XpmR>a>K%s({nL#!$JR4je z^t8YD1d;wx*dvzGP+WT*SIM{D?JIa!@=kkYd{V`5vF8if2sn)8|z zWm$qg8CH8iM>uO49dh)w*IypW%9Jc&OuewK(SG<^$PFncE5oxyC~}IT<@~`FccXT8 z7@pkJDw>nez8Az#7^sta)@kLM2TD(-S;P@eaoDen-EF2lko-MIV1pojyZw5^E zJ~0o$xox-szD>lAD#1XUo2K68U;Rha`oLT(Uh~#5JWLo!dy`TKJ-GkrtKL1pBo_?v z%i3r_0-D{5n`MebpiaKXaRdQ6%)>EI(J~RScfhL z(Cm;|k5U0mZ*d|YbvrgVdpZ7l*hV-5;F70j1o#_OMUz>B4{{{W$+|eU!?L#Xwi#)I zjJcZHZvfQ|r}Axoa=vv820*AVR0w*EV9yS9jc#rNs@(JYd!RLhZI5>McTOWc78M=|ExAToOUsMOvu{Z)D^--~eC?bz1rbQ_N}JS7mp53)~n zfsOQ{gTLSj;!mS~4ZLT54In@)E<>J7GgV0c5m|541*o)CTP3j5)$3wREZXx&fJvWD z2keTtvqAbelEjhxSK5iOfIlLLW+-XGiWS*C*&t;cCA%m_ay<4bFnai)0m%m(@nX7# z(M|xJ89^s2*&wt*2BOP>kqH@N;3&g%^s|bBcu1?pVco=n zTE7U~lm#+in&~;lQmYlEoZ5=1=Oa_dVKP%vR|YAUG7Rq6p|9K$(pzs0oPBQQ3qH^cgIHZ#r*zP0YQ&kOS()f zB||qg?a&6j6W;;6r#3)V=?^aj<;y0@6)${-9ffmaT!bSVQA^*aLI8ekIzFCu_n^8z zCsY3hZbJ8}Gff;SP?bUes>)HauSj~r&tP!Sp*w*2cQ3v#F}zF;OKfr|oNW_=eht!j zT@av^k&`Plo?}Aq(TOKU^}r_Ks&?y6BG)z2NCXMjhJUa4F5#k4w;7ke-kiddGm)zx z5xm1iUvN@CLp3WDfQM%Df+=f!NrQeTa%f4w{~;P{3MBrG{GSWP>20p);#qKN_d+rQ z*e*_wp2F}Y>t6>vHNd>x*AYSuvr~O?WP1YoC7Q&haXQV2%|00tLbJIsV3A0K@i%h> zP`m_w?ud8CkbtNCK!TvY~OFZ_c}wB)}uhu+Y1q4 z%a5e&P^|koFdKA!z1a`Lpog=sNWZ^mlW&m$R|Yu~uwG=~_-nT>= zKsfabL@}Pe>Kx+@gJ#P$I^=URA66IzU4{UhRVI_&5t1_SWFa=*h1yHlUjRoy+Y$3* z;q>=rFxb$P1Bx!UHt+T;IiInYSfKnAF^Pn}*25X43P5!g@6WP@enrC!s}9&GuD^K9 zFX>$uA-=dgxL0d@*<8~lcZ697oL~$d;fPR;qZ-$>0PEqc6`>n^St(VslM;k(=w%B# z@zLSPWm$s{p@MpNw08Jw2+^EolQrg4kPIhVez6c6UbZq{l~xNdHfsi0jp=fXxK^edi)CQAE+nb@cuH#FnKfX=n_rHUSir&K zb2iTPnkub+O=$BUc$x0v3n{SNIzJCQ7wqnT5}om#Ruz?a;WbA9^F(^&2E_qDhBRL6 zLxmIK*N^Uh0FR(Sl2YYPoa`%A%v$SOx4fLQ&}Q2Ukr^_HKyeLtT$8LdDO{*(5qL10 zx;d*UnHynNfL%v|8DmhSrV^?6*_;xp&B<34>=$l}VdmQ5#>cj!{=UmYP#0irD2C|t zIcW;`Ww;f=&16}506y}gy`hy3FmhGeyFZxwfiUP3PzZ>Ah(VUFDlL6TMEqEdv8~;l zFVHfLBK95d6nR?w9P7sQ_)gFofNL0aJFCsh9KSL$40N}{^DurL|ps4|evBB$O~&6H8+UvL-;&>$EV31oasUq~9BX6FT*QbRyV zNW{N0y;pQVIwz|LegmPhs2A@=@&E;%gC;y7PFU50iwxB;u`OY7f11VRYQp7BLXuP= zkM=u4+i@UJf4N_p8mv+3ixi~$eQ0Vv?>!ADG8B8)1oUgp{^0PeLQfk5mT9$HS#fGR z9e{CN^btd2=ocmIB8~a14l!`Iz87WMBy{|5JNQh*T%QT zfhw%x{RmDoG#fL*@HKtKcF^ENcz3^y2h#Q2x#$RkMBfXOnMD1b1e(I0)V9Nz{~@wO z=&G+t0tMtl5m1#28c`;Jns}aze`dR*(=M0+mXW;!iGJC7O+M_R77uz9C<7$UQo*=h zbcVTX4pXf@P!1(ML3DO)UlS+vf9ZhoeI&Udf2iF*DZ$jAc zx6;@gF{~+|aZGRvq1HgvCZ#a+{!006oM8!sx!8d|S>WAM4!!qI!F+)q1NvMffV`$9 z2r0-TQ5cqr%|H~Zs4%77mZ3uW9MH|o9NnffNlQ8C@H?iU@C%!I6_z%LE&QSiUr$k zg_}OKLQTk-<}5Irmq*Po=PQat+Yu*2lK;`E-V9e2at2Vm?r z^ErwB$hnR^tesJtlyrx5K{3gD<6$iEj913dShA-hVtK6m0ebY}YYu{bJ>y^vm`~2r zwn!9@&sAXo31^ErTlD3KtgwKBVCU`80YWoz-j6-?5Y~|FwCXeZR~0w7A{NN-2enzq zRS5Zr1E!a1AWGBHz8v5EvEDRS6_&@K5=tIdt1 z0r!l59R2)oD*i1LRm>icxb(QgIi>7#5j}s(B?l~J;V9_WOns1i?mkRMnH3ECAimZ^ zKVXc#`h(?L-N_exuL%0rzq_e-Y8NaZo~h)4=lcd^GeG)Ny_C-b<;v2I(eC0_;rX^c zj2%+f_H#i;bb=e4CY>}3cF>_%wpq3DlvQg5sgG5qe=X@uZ?ktyCMpTr{z*Lw_jRs#yxeiOL1Qp1fDk zMxC%Hzn`<*%#P*~NyXj;0KjMd+Y8X^M414YHq?GLvzmS0#k zaT82TqtGG9t~mzr_d%yn!v0dRoIP_CE^X)eh8RIPV)5mmpYT8s+Ul*q>wC@Ec|D}O ziyq^>E&)tt=%yh4&e0|WHPBYu;M$OKIrhm*(3C*|QDTCJF<>WxlKh7|U!|aUBoZ3K zrErLm4uFT0E?TDn(dd4R5gn&oSiGFUX%L%)s2EV}%wb0>5@3cf(^#VsHg6jDTe%5u z^ox}mt3;pcm-rjAYb?H?9i`v#8gdGneR!`APklddKs=~{3SSNTLW1r~r*J};VTdna zHn=Sr!FGZ@96!_oPL>mhXBsIj@9V8@_Gu$g>Z(L}0jl^}vF>hxGq80}drITq86s$U zbfuR=4$vz>+bbOUFX4X~-#k3^D-2~cwV!d+XGwpn2uVz2x_EFla{nB@X0D%-BBXl= ztVN8fJ0h5}TLd`&E6~&KfSz@t(9i4i8h6q^`Wdv)1Estc%W`OGZEEy*8 z=tAr8r@c>(`wV5Y{S``zv2vG&-Mhe9F5W||2dT*jAE}#~I)^cNLN>u6@2>LUj1)n0 zKq5C=b4;EzUHHRfJ@d3=S~asm35qSbyB;=RcGnP(x!Zu0+Gn1+4cFnrrhJJ?SM*I` z5Hk2zC-?@{|66zUBp8|Ie8hgdmBxpE%I+Fl#yW@Oq-7Yl*j<3)^S$dSQGQ!W;iXKg zmDqVCSEjdr`N#dj^AGeAYepS*UTfUvbfQ#^4P2(XKJt7xOOB(LyLLLFj(;P{8zp<; zzY7b=>WHfbU&4J@-6+*q%3%7ScC4h1W3#vrFIsyLacpc6<>5GkTY9IR^`jaWtF_(c zZGWG~GJ)#e;k~}mLgEOsgJ>U+So5V*ew^kSk*aP9BU3|Mkj(zI4_`!Z*6uofq&4YM zQB?DV=N3zhWMK8Th{wL83(MfDfrQ^p=7JbMb3l=~)3i*!l!%$Ivg?7;|!}WzC)bT%uCc7M(2l3sUkk#O=|9`T;vdY=v`dKzKCD} z{}-+UQT##k_%-LP4jYdvf)r%rvPk_+d7wZtpAl8Jn>AvE=#Y3g!W+CJ^HV;PeSV}Z z0;4+{@>xXOU$a!Zj!+;>GKoyYQc$lFv7?qr&un{q z@U_o+CPlPQsj4rKs6-XZ)RNYDKQ69K#Ajc<0%4~_odSpYvJ~1WKN3gO^vYwtH zpI%J;_7zAgN9(Q2$jkPKc|wbCxqrR<`j^F02QGI{nOv&9#G-{YDlvqSbeBPizH3Iz zcyhU_8cF+NmEy*oN-;xf_eYx*8eD$6nDP97JJ;{hIuwQRJ?Xoa$1O=IP6>o8xl1yH z8dI_~i_$Lsz}T(e+Ch0%UI!6`EFB#32V{D5>F}f=IMjc_!J*)!e}T|HKnfz_uX}2f z_Eyd}CwI6X=ic+3@0?5Abp`i7fn>%h@??Ge@UA^h-_zf?eRs%PQ!P4}yd;90;$^u( z*y-Mbvze3oZigFwSr6M@lBw#y$^5W4>d(Iz76>+ z&|n*rmsGH*Y-oU?qvNRmE``m0bPV`i+fdLqN(&j&k^u+lMfA3LZNDE~01i*tGBdc( zDI#Cydc7m3X&Ak-?60HY8UH`kFXwTO(-wuh0pV+kaQL#webOF=eC0rbT?KnSQ^&6b zodJTd(RsLhx(b_@51j@e{FuIgb?fO+Xsapp sandboxing, verified boot, and a robust permission control system. + +The main privacy concern with most Android devices is that they usually include Google Play Services. This component is proprietary, closed source, has a privileged role on your phone and may collect private user information. It is not a part of the Android Open Source Project (AOSP) nor is it included with the below derivatives." +--- + +

    + + AOSP Derivatives +

    + +{% for item_hash in site.data.operating-systems.android %} +{% assign item = item_hash[1] %} + +{% if item.type == "Recommendation" %} +{% include recommendation-card.html %} +{% endif %} + +{% endfor %} + +

    + + Android security and privacy features +

    + +
    User Profiles
    + +

    Multiple user profiles (Settings → System → Multiple users) are the simplest way to isolate in Android. With user profiles you can limit a user from making calls, SMS or installing apps on the device. Each profile is encrypted using its own encryption key and cannot access the data of any other profiles. Even the device owner cannot view the data of other profiles without knowing their password. Multiple user profiles is a more secure method of isolation.

    + +
    Work Profile
    +

    Work profiles are another way to isolate individual apps and may be more convenient than separate user profiles.

    + +

    A device controller such as Shelter is required, unless you're using CalyxOS which includes one.

    + +

    The work profile is dependent on a device controller to function. Features such as File Shuttle and contact search blocking or any kind of isolation features must be implemented by the controller. The user must also fully trust the device controller app, as it has full access to the data inside of the work profile.

    + +

    This method is generally less secure than a secondary user profile, however, it does allow you the convenience of running run apps in both the work and personal profiles simultaneously.

    + +
    Verified Boot
    +

    Verified boot is an important part of the Android security model. It provides protection against Evil maid attacks, malware persistence, and ensures security updates cannot be downgraded with rollback protection.

    + +

    Android 10 and above has moved away from full disk encryption (FDE) to more flexible file based encryption.

    + +

    Each user's data is encrypted using their own unique encryption key, and the operating system files are left unencrypted. Verified boot ensures the integrity of the operating system files preventing an adversary with physical access from tampering or installing malware on the device. In the unlikely case that malware is able to exploit other parts of the system and gain higher privileged access, verified boot will prevent and revert changes to the system partition upon reboot of the device.

    + +

    Unfortunately, original equipment manufacturers (OEMs) are only obliged to support verified boot on their stock Android distribution. Only a few OEMs such as Google support custom Android Verified Boot (AVB) key enrollment on their devices. Some AOSP derivatives such as LineageOS or /e/ OS do not support verified boot even on hardware with verified boot support for third party operating systems. We recommend that you check for support before purchasing a new device. AOSP derivatives which do not support verified boot are not recommended.

    + +
    VPN Killswitch
    +

    Android 7 and above supports a VPN killswitch and it is available without the need to install third party apps. This feature can prevent leaks if the VPN is disconnected. It can be found in (⚙️ Settings → Network & internet → VPN → ⚙️ → Block connections without VPN).

    + +
    Global Toggles
    +

    Modern Android devices have global toggles for disabling Bluetooth and location services. Android 12 introduced toggles for the camera and microphone. When not in use, we recommend disabling these features. Apps cannot use disabled features (even if granted individual permission) until renabled.

    + + + +{% for item_hash in site.data.operating-systems.android-applications %} +{% assign item = item_hash[1] %} + +{% if item.type == "Recommendation" %} +{% include recommendation-card.html %} +{% endif %} + +{% endfor %} + +

    + + General Recommendations +

    + +
    Android Rooting
    +

    Rooting Android phones can decrease security significantly as it weakens the complete Android security model. This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful verified boot. Apps that require root will also modify the system partition meaning that verified boot would have to remain disabled. Having root exposed directly in the user interface also increases the attack surface and may assist in privilege escalation vulnerabilities and SELinux policy bypasses.

    + +

    Adblockers (Adaway) which modify the hosts file and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest DNS or VPN based blocking solutions instead. Adaway in non-root mode will take up the VPN slot preventing you from using privacy enhancing services such as Orbot or a VPN. AFWall+ works based on the packet filtering approach and is bypassable in some situations.

    + +

    We do not believe that the security sacrifices made by rooting a phone are worth the questionable privacy benefits of those apps.

    + +
    Firmware Updates
    + +

    Firmware updates are critical for maintaining security and without them your device cannot be secure. Original equipment manufacturers (OEMs) - phone manufacturers have support agreements with their partners to provide the closed source components for a limited support period. These are detailed in the monthly Android Security Bulletins.

    + +

    As the components of the phone such as the processor and radio technologies rely on closed source components, the updates must be provided by the respective manufacturers. Therefore it is important that you purchase a device within an active support cycle. Qualcomm and Samsung support their devices for 4 years while cheaper products often have shorter support. With the introduction of the Pixel 6, Google now makes their own system on chip (SoC) and they will provide 5 years of support.

    + +

    Fairphone claims that they will support their device for 6 years. However, as they use Qualcomm SoC there has been some skepticism surrounding that claim.

    + +

    Devices that have reached their end-of-life (EoL) and are no longer supported by the SoC manufacturer, cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.

    + +
    Android versions
    +

    It's also important to make sure that you're not using an end-of-life version of Android. Newer versions of Android not only receive security updates for the operating system but also important privacy enhancing updates too. For example, prior to Android 10, any user apps with the READ_PHONE_STATE permission could access sensitive and unique serial numbers of your phone such as IMEI, MEID, your SIM card's IMSI, whereas now they must be system apps to do so. System apps are only shipped by the OEM or Android distribution.

    + +
    Android Permissions
    +

    Permissions on Android grant users control over what apps are allowed to access. Google regularly makes improvements on the permission system in each successive version. All user installed apps are strictly sandboxed, therefore there is no need to install any antivirus apps. The savings you make from not purchasing or subscribing to security apps is better spent on paying for a supported device in the future.

    + +

    Should you want to run an app that you're unsure about consider using a user or work profile.

    + +
    Android Device Shopping
    +

    Google Pixels are known to have good security and properly support verified boot. Some other phones such as the Fairphone and Oneplus devices also support custom Android verified boot (AVB) key enrollment. However, there have been issues with their older models. In the past they were using test keys or not doing proper verification, making verified boot on those devices useless.

    + +

    Avoid buying phones from mobile network operators. These often have a locked bootloader and do not support OEM unlocking. These phone variants will prevent you from installing any kind of alternative Android distribution. Phones that cannot be unlocked will often have an IMEI starting with "35", that includes phones from purchased from Verizon, Telus, Rogers, EE etc.

    + +

    Be very careful about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen there's a possibility of IMEI blacklisting. There is also a risk involved with you being associated with the activity of the previous owner.

    + +We have these general tips: +
      +
    • If you're after a bargain on a Pixel device, we suggest buying an "a" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
      • +
    • Consider price beating options and specials offered at brick and mortar stores.
      • +
    • Look at online community bargain sites in your country. These can alert you to good sales.
      • +
    • The price per day for a device can be calculated as \({\text {EoL Date}-\text{Current Date} \over \text{Cost}}\). Google provides a list of their supported devices.
      • +
    • Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.
      • +
    • Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper verified boot support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
      • +
    • In short, if a device or Android distribution is not listed here, there is probably a good reason, so check our discussions page.
      • +
    + +

    The installation of GrapheneOS on a Pixel phone is easy with their web installer. If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the NitroPhone as they come preloaded with GrapheneOS from the reputable Nitrokey company. The GrapheneOS project is not currently affiliated with any vendor and cannot ensure the quality or security of their products.

    + +

    A CalyxOS membership also entitles you to a device preloaded with CalyxOS.

    + +

    + + Security comparison of GrapheneOS and CalyxOS +

    + +
    Profiles
    +

    CalyxOS includes a device controller app so there is no need to install a third party app like Shelter. GrapheneOS plans to introduce nested profile support with better isolation in the future.

    + +

    GrapheneOS extends the user profile feature allowing a user to press an "End Session" button. This button clears the encryption key from memory. There are plans to add a cross profile notifications system in the future.

    + +
    INTERNET permission vs packet filtering
    +

    Packet filter based solutions such Daruta Firewall, LineageOS (DivestOS), AFWall+ and Netguard, are not ideal as they can leak and don't prevent an app from proxying a network request through another app using an intent. Other filtering solutions such as RethinkDNS also prevent you from using a VPN at the same time.

    + +

    Android has a built-in INTERNET permission. This is enforced by the operating system. On AOSP and most of its derivatives, it is treated as an install time permission. GrapheneOS changes it to runtime permission, meaning that it can be revoked to deny internet access to a specific app.

    + +

    The INTERNET permission is a strong way of controlling internet access. It also blocks direct access to the internet and access to other APIs that rely on the INTERNET permission. The only way for an app to circumvent it is for it to communicate with another app that has been granted INTERNET permission via mutual consent. Such communication can be prevented by putting apps into seperate profiles.

    + +

    Some apps might crash if their INTERNET permission is revoked. CalyxOS instead uses a firewall to achieve a similar outcome however, in some circumstances CalyxOS's approach may leak (#572, #581). + +

    Sandboxed Play Services vs Privileged MicroG
    +

    When Google Play services are used on GrapheneOS, they run as a user app and are contained within a user or work profile.

    + +

    Sandboxed Play Services are confined using the highly restrictive, default untrusted_app domain provided by SELinux. Permissions for apps to use Play Services can be revoked at any time by the user.

    + +

    MicroG is a reimplementation of Google Play Services. This means it needs to be updated every time Android has a major version update (or the Android API changes). It also needs to run in the highly privileged system_app SELinux domain like the normal Play Services and is less secure than the Sandboxed Play Service approach. We do not believe MicroG provides any privacy advantages over Sandboxed Play Services except for the option to shift trust of the location backend from Google to another provider such as Mozilla or DejaVu.

    + +
    Device Patch Level
    + +

    GrapheneOS includes the latest Android 12 and comes with full firmware security patches for non "extended support" devices. If it is supported you will have the latest security patch level.

    + +

    CalyxOS has not yet finished Android 12 support. This means they cannot include the updated proprietary firmware with security patches that were designed for Android 12.

    + +
    Privileged App Extensions
    + +

    Android 12 comes with special support for seamless app updates with third party app stores. The popular Free and Open Source Software (FOSS) repository F-Droid doesn't implement this feature and requires a privileged extension to be included with the Android distribution in order to have unattended app installation.

    + +

    GrapheneOS doesn't compromise on security, therefore they do not include the F-Droid extension therefore, users have to confirm all updates manually if they want to use F-Droid. GrapheneOS officially recommends Sandboxed Play Services instead. Many FOSS Android apps are also in Google Play but sometimes they are not (like Newpipe).

    + +

    CalyxOS includes the privileged extension, which may lower device security. Seemless app updates should be possible with Aurora Store when CalyxOS is upgraded to Android 12 and #153 is completed.

    + +
    Additional Hardening
    +

    GrapheneOS improves upon AOSP security with:

    + + +

    Please note that these are just a few examples and are not an extensive list of GrapheneOS's hardening.

    diff --git a/legacy_pages/os.html b/legacy_pages/os.html index cdb62b20..a40babd4 100644 --- a/legacy_pages/os.html +++ b/legacy_pages/os.html @@ -15,10 +15,6 @@ description: "Even your own computer could be compromising your privacy. Discove {% include legacy/sections/tor-operating-systems.html %} -{% include legacy/sections/android-operating-systems.html %} - -{% include legacy/sections/android-addons.html %} - {% include legacy/sections/ios-addons.html %} {% include legacy/sections/router-firmware.html %} diff --git a/package-lock.json b/package-lock.json index 9f42441d..05d9728a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10,7 +10,8 @@ "license": "ISC", "dependencies": { "@fortawesome/fontawesome-pro": "^6.0.0-beta3", - "bootstrap": "^5.1.3" + "bootstrap": "^5.1.3", + "mathjax": "^3.2.0" } }, "node_modules/@fortawesome/fontawesome-pro": { @@ -42,6 +43,11 @@ "peerDependencies": { "@popperjs/core": "^2.10.2" } + }, + "node_modules/mathjax": { + "version": "3.2.0", + "resolved": "https://registry.npmjs.org/mathjax/-/mathjax-3.2.0.tgz", + "integrity": "sha512-PL+rdYRK4Wxif+SQ94zP/L0sv6/oW/1WdQiIx0Jvn9FZaU5W9E6nlIv8liYAXBNPL2Fw/i+o/mZ1212eSzn0Cw==" } }, "dependencies": { @@ -61,6 +67,11 @@ "resolved": "https://registry.npmjs.org/bootstrap/-/bootstrap-5.1.3.tgz", "integrity": "sha512-fcQztozJ8jToQWXxVuEyXWW+dSo8AiXWKwiSSrKWsRB/Qt+Ewwza+JWoLKiTuQLaEPhdNAJ7+Dosc9DOIqNy7Q==", "requires": {} + }, + "mathjax": { + "version": "3.2.0", + "resolved": "https://registry.npmjs.org/mathjax/-/mathjax-3.2.0.tgz", + "integrity": "sha512-PL+rdYRK4Wxif+SQ94zP/L0sv6/oW/1WdQiIx0Jvn9FZaU5W9E6nlIv8liYAXBNPL2Fw/i+o/mZ1212eSzn0Cw==" } } } diff --git a/package.json b/package.json index dd2d8902..f5be6457 100644 --- a/package.json +++ b/package.json @@ -4,7 +4,7 @@ "description": "", "main": "index.js", "scripts": { - "assets:copy:js": "mkdir -p assets/js/vendor && cp node_modules/bootstrap/dist/js/bootstrap.bundle.min.* assets/js/vendor/", + "assets:copy:js": "mkdir -p assets/js/vendor && cp node_modules/bootstrap/dist/js/bootstrap.bundle.min.* node_modules/mathjax/es5/tex-svg.js assets/js/vendor/", "assets:copy:icons": "mkdir -p assets/fonts/vendor/fontawesome && cp -a \"node_modules/@fortawesome/fontawesome-pro/.\" assets/fonts/vendor/fontawesome/", "assets:install": "npm run assets:copy:js && npm run assets:copy:icons", "build": "npm run assets:install && bundle exec jekyll build", @@ -23,6 +23,7 @@ "homepage": "https://github.com/privacyguides/privacyguides#readme", "dependencies": { "@fortawesome/fontawesome-pro": "^6.0.0-beta3", - "bootstrap": "^5.1.3" + "bootstrap": "^5.1.3", + "mathjax": "^3.2.0" } }