lissy93 / awesome-privacy Goto Github PK

Hi there. Maybe add our little FOSS app personalDNSfilter (DNS changer / ad- tracking- content-blocker). Cheers, Tobi.

https://www.zenz-solutions.de/personaldnsfilter-wp/

https://github.com/IngoZenz/personaldnsfilter

Category

Productivity

Software to be added

Vikunja is an open-source to-do application (primarily web, there's also a very rudimentary flutter app and CalDAV integration). Similar to Todoist or Trello it lets you organize pretty much everything from a shopping list to a bigger project with multiple collaborators. A highlight are multiple views (List, Gantt, Table, Kanban) to visualize all tasks in different contexts. For collaboration, it has the usual sharing functionalities like team and user sharing but also Link Shares which allow you to share a list with someone else without them requiring an account.

Supporting Material

Website: https://vikunja.io

Association Disclosure

I am the creator of Vikunja.

Would you like to submit a PR?

Yes!

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Category

Ad Blockers

Software to be added

personalDNSfilter is a DNS filter proxy written in Java.
It hooks into the domain name (DNS) resolution and returns the loopback address for filtered hosts.

personalDNSfilter supports secure DNS via DOH (DNS over HTTPS) and DOT (DNS over TLS)!
Available for Java enabled devices including Android (with and without VPN)!
See OpenVPN for personalDNSfilter in case you want to run personalDNSfilter on Android in combination with a real remote VPN!
The main memory usage is very low, you can filter with millions of hosts, but memory usage will only be few megabyte!

• It can be used for filtering ads and other unwished hosts based on a host list – Thus it is a good AdBlock alternative
• On Android devices (Android 4.2 an newer) it can be used as effective ad, malware and tracking server filter without root access!
• It works with any upstream DNS server – filtering is completely local – no phoning home or such things!
• See dnsfilter.conf file for information on how to configure the hosts filtering
• personalDNSfilter is preconfigured with the ad host filterlists from pgl.yoyo.org, adaway.org, energized.pro and Steven Black
• Feel free to add additional host filter lists of your choice
• You can run it locally on your device or centrally as DNS server in your network
• Tested on Raspberry Pi

(sorry, first request was submitted via fasthub app on Android which as I know now does not show forms and stuff for the issue)

Supporting Material

• personalDNSfilter is hosted on Github, Google Play and F-Droid
• more info at the personalDNSfilter project wesbite

Association Disclosure

I'm a volunteer team member of ZENZ Solutions / personalDNSfilter

Would you like to submit a PR?

No.

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Category

Audio

Software to be added

You can download your favorite songs, albums or tracks from various sources. (Spotify, Gaana, YouTube Music, Jio-Saavn and SoundCloud)

Supporting Material

GitHub Repo

Association Disclosure

I am not associated with project.

Would you like to submit a PR?

Maybe?

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Explain why it should be added

CloudConvert is a productivity tool that securely converts files of nearly any type to similar file types.

Additional Context

I think this would be a good tool to include on the TLDR checklist under the Productivity Tools section. Their about page details how the company wanted to become the "swiss army knife" of file conversion. Their security page goes into more detail about their practices. I've personally used their services for quite some time.

Content (optional)

Following the format of the TLDR checklist...
"File Conversion: CloudConvert."

I am willing to submit a PR for this request.

Category

Utilities

Software to be added

https://numbr.dev - notepad + calculator.

Supporting Material

https://github.com/antonmedv/numbr
https://chrome.google.com/webstore/detail/numbr/cncafkneilkicolelogcmmgblojmhfng
https://numbr.dev/ipbm

Association Disclosure

I'm the author of the project

Would you like to submit a PR?

Yes!

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Category

Email Clients

Software to be added

Betterbird is better than Thunderbird in three ways: It contains new features exclusive to Betterbird, it contains bug fixes exclusive to Betterbird and it contains fixes that Thunderbird may ship at a later stage.

Supporting Material

https://www.betterbird.eu/
https://github.com/Betterbird/

Association Disclosure

No

Would you like to submit a PR?

No response

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Lissy93 wrote 2 years ago that Telegram was deemed untrustworthy since its source code is not public, here.

As of today, it's not the case anymore, see https://github.com/TelegramMessenger

Is there any reason to maintain Telegram (and perhaps the other warny, I haven't checked) in this caution section? If yes, an elaboration would be adequate IMHO (and in fact I'd like to know since I'm using it, if I should stop or not).

Thanks!

Alternative Search Engines That Respect Your Privacy

the list provides a bit of information and ranks various privacy-centric search engines according to the following...

Decentralized | Type | Requires JS / Cookies | Self Contained | Client Required | Privacy Policy | Privacy / Overall

might fit best here: Search Engines

Put "Add ____" as Title

• ProxiTok for TikTok
• teddit for Reddit (old layout)
• rimgo for Imgur
• Scribe for Medium

Explain why it should be added

They're all good frontends for websites with popular content. They should all be listed in "proxy sites."

Additional Context

/

Content (optional)

/

Out of the scope of this issue, proxied frontends for sites other than social media that you may consider:

• Wikiless for Wikipedia
• SimplyTranslate for various online translators
• Lingva for Google translate
• Beatbump for YouTube music
• Librarian for LBRY/Odysee
• SimpleerTube for PeerTube

Additionally, searx/SearXNG and Whoogle are search engine proxies. Themselves are not search engines. SearX/NG can be called "metasearch engines" since they combine results of other search engines.

Thanks for making this list!

Explain why it should be added

Pirsch is a privacy-friendly and open-source alternative to Google Analytics.

Additional Context

Privacy Respecting Software > Bonus Lissy93/personal-security-checklist#1 - Alternatives to Google > Analytics

I've started this as a personal project for my own website. Find out more here: https://pirsch.io/blog/introduction/

Content (optional)

The website: https://pirsch.io

Category

Virtual Private Networks

Software to be added

SPN, currently in early development, is apparently part of a larger package called Portmaster

i know little about it and this would have to be evaluated by people far more tech-savvy than i, but it sounds interesting in that it was built from the ground up with privacy in mind and claims to be a (far) better alternative than a VPN or ToR

What Makes SPN A Better Alternative to VPNs

VPN is an out-dated technology that was never intended to protect your privacy. It simply swaps your one identity with one different identity, creating only a minor obstacle for today’s mass surveillance. SPN on the other hand is built from the ground up and fully designed to protect your privacy. It gives you multiple identities by default. Therefore we believe people looking for privacy will prefer SPN.

Supporting Material

• safing/portmaster: 🏔 Love Freedom - ❌ Block Mass Surveillance
• SPN - Safing Docs
• Safing Privacy Network
• What Makes SPN A Better Alternative to VPNs
• Dispelling Myths of VPN Alternatives w/ Safing!

Association Disclosure

no affiliation

Would you like to submit a PR?

No response

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

OVPN was just recommended to me by Michael Horowitz who wrote A Defensive Computing Checklist

OVPN (they do WG too) looks like another interesting one (i haven't used it)...

Total infrastructure ownership

All the hardware used to operate OVPN is owned by us. All VPN servers operate without hard drives as the operating system only resides in the RAM memory.

No rented servers, no virtual machines. Just pure baremetal hardware that we've either shipped or installed ourselves.

"Total infrastructure ownership" of course does not refer to the data-centers

also of interest...

OVPN has been in court fighting a two-month long information injunction as user information was requested from us. OVPN emerged victorious due to our no-logging policy.

We have an insurance that covers legal fees. OVPN has never given any information about our customers to a third party.

...

Monthly transparency reports have been published since 2014, detailing server statistics & information requests.

The company running OVPN is incorporated in Sweden and is named "OVPN Integritet AB". Integritet means Privacy in Swedish. That's how engrained our privacy focus is. The physical owners are David Wibergh & Ruben Rehn.

Title

DuckDuckGo references that should be removed...

• Notable Mentions
• Search Engines
• Browser Extensions > Privacy Essentials
• Bonus #1 - Alternatives to Google > Search

Removal Reason

DuckDuckGo has gotta go! - the company was never trustworthy and recent controversy has made this all the more evident

this first link provides a wealth of information about DDG...

Why People Should Never Ever Use DuckDuckGo | Techrights

DuckDuckGo is not safe to browse as Microsoft tracks user data | Technology News – India TV

Still trust DuckDuckGo? | www.alexanderhanff.com

DuckDuckGo denies using fingerprinting to track its users

Association Disclosure

negative

Would you like to submit a PR?

No.

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with this project or a competitor
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Feedback

I'm wondering what prompted the addition of Off-The-Record under Encrypted Messaging:

1. The other solutions listed are end user products, while OTR is just an old encryption protocol. You're not really pointing users to what they can start using here.
2. OTR is hopelessly old (I doubt v4 will ever be released and, if so, it will be on par with OMEMO), was never made for instant messaging of today, especially on mobile devices
3. OMEMO, based on the Double Ratchet (previously Axolotl Ratchet) algorithm from the Signal Protocol, has been adopted by most XMPP clients anyway. It's far more useful for instant messaging (on mobile devices), and it makes for an actually useful tip compared to OTR, as it's easy to point potential users to clients supporting it:

what do you think about Azire (parent is Netbouncer AB)?

there've been no independent audits yet so far as i know, but it's a smaller Swedish company operating since 2012 that claims some very enticing things...

• they physically buy, secure, install and maintain all their servers - this is the only commercial VPN i know of that does this
• wireguard
• accepts crypto, no personal info required
• and, of course, no logging, port restrictions, bandwidth caps, etc.

from their FAQ's...

Do you own the servers and how are they installed and secured?

We physically own all of our hardware, in all of our locations, including bare metal dedicated servers and switches, bringing it and installed on our own, co-located in closed racks on different data centers around the world meeting our strict security criteria, using dedicated network links and carefully chosen providers for maximum network quality and throughput. We also make sure to select locations with protective or non‑invasive laws to ensure the privacy of our customers.

They are equipped with a quad-core Intel Xeon CPU featuring special cryptographic optimizations AES-NI and 12GB of RAM for no‑compromise performance and are running in RAM without any physical hard drive disk which protect our users in case of seizure. Their software setup and installation is identical in each location, only using open-source software.

also see Server Environment and Security pages

i've been using them for many months and have been very satisfied overall with their service, much more so than with Nord or Air

Your Question

trusting 3rd parties with sensitive data scares the hell out of me

personally i store passwords and other sensitive data locally (KeePassXC) and should i ever find a reason to sync with other devices, i'd be running a solution on my own local server (and even that is potential disaster)

i'm not suggesting at this point that the "cloud" password manager suggestions be removed, but i am asking why in the world they should be trusted - is there something i'm failing to consider?

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• A similar question has not already been asked for this software/ service
• You agree to the code of conduct

Category

Utilities

Software to be added

Driver Store Explorer [RAPR] makes it easier to deal with Windows driver store. Supported operations include list/add/install/delete third-party driver packages.

Supporting Material

https://github.com/lostindark/DriverStoreExplorer

Association Disclosure

No, I'm just random user of this soft.

Would you like to submit a PR?

Maybe?

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Title

RainLoop

Removal Reason

• The RainLoop project is stale and hasn't been updated since May 6, 2021.
• There is a known vulnerability that allows access to all emails. This has not been patched in the official repository.
• Some mail services, like Disroot.org, have responded by migrating to an actively developed fork called SnappyMail.

On a side note: there's a typo in the template: "You have indicated weather whether or not you are associated with this project or a competitor"

Association Disclosure

None

Would you like to submit a PR?

Yes!

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with this project or a competitor
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Category

Utilities

Software to be added

Snappy Driver Installer Origin is a portable Windows tool to install and update device drivers. It can be used offline to install drivers where Internet isn't available. No more searching for drivers after a clean install, just let Snappy Driver Installer Origin do it's thing and your job will be done in no time. The perfect technician's tool.

Supporting Material

https://www.snappy-driver-installer.org/
https://www.glenn.delahoy.com/snappy-driver-installer-origin/

Association Disclosure

Not associated in any way, just grateful user of it.

Would you like to submit a PR?

Maybe?

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Category

Password Managers

Software to be added

Alternative implementation of the Bitwarden server API written in Rust and compatible with upstream Bitwarden clients*, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal.

Supporting Material

Github: https://github.com/dani-garcia/vaultwarden

Association Disclosure

a user

Would you like to submit a PR?

Yes!

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

State which point should be edited or removed. Put "Remove/ Edit ____" as Title

Remove Librewolf and Brave browser from the list.

Justification

Neither are truly privacy respecting. Please see: https://www.unixsheikh.com/articles/choose-your-browser-carefully.html

Put "Add ____" as Title

Explain why it should be added

[Mailfence is an encrypted email service that offers OpenPGP based end-to-end encryption and digital signatures. Much like Protonmail & Tutanota, it offers end to end encryption but it also offers a fully interoperable collaboration suite that features calendars, document editing, and storage space, address book. Protonmail & Tutanota and excellent services for individuals I figured it would be good to add a service that can accommodate both individuals and business users. ( I am affiliated with Mailfence)

Additional Context

[It collects minimal data, only first name, and last name and those can be entirely fictional and an external email address that is used to recover your email in case of a forgotten pass, etc. Protonmail and Tutanota are the dominant forces in the secure email space, it would be good to provide users with more choice. The preferred category I would like to see Mailfence in is Email, under Secure email providers]

Content (optional)

[Here are some links, about Mailfence.
Our transparency report https://blog.mailfence.com/transparency-report-and-warrant-canary/
Who is Mailfence https://blog.mailfence.com/about-mailfence/]

NOTES:

• Before submitting, check that there isn't a similar open issue already
• Please create a new issue for each separate/ stand-alone point you'd like added to the list
• If you are confident in your abilities, you can also write the point yourself, and submit it as a PR
• Thank you for your suggestion, it's because of contributors like yourself that this project can exist

Explain why it should be added

One of potential data leaks is map app, for example Google Maps definitely collects plenty of private data.

Maybe it would be worth mentioning OSM-based maps as partial alternative? Note that "OSM-based" does not mean "free from trackers and not sharing private data", for example any app using Mapbox hosting is contractually obligated to include trackers.

https://organicmaps.app/ and OSMand appear to be promising

Additional Context

Disclaimer: I am heavily involved in OSM, which includes my job.

Content (optional)

I can write something if that would be provisionally accepted and research a bit more (for example I am not entirely sure about Osmand)

Justification

Per this article, HTTPS Everywhere's browser extension will deprecate at the end of 2022. Their reason is cited as the most common browsers such as Safari, Chrome, and Firefox have this feature built-in. I recommend editing the section in the README.md list and the TLDR checklist to edit out recommendations to install the HTTPS Everywhere extension(s).

Possibly one of the better reasons to remove a link from this list!

Category

Cloud Hosting

Software to be added

https://servers.guru

Servers.guru provide cloud hosting (VPS and cloud servers with dedicated CPU resources). It is a reseller with an emphasis on privacy. No private informations beside a working email address are required from the customer if crypto-currencies are used as a payment method. It is also on the lower end of the usually costly alternatives.

Why it should be added?

It should be added as there is little alternatives in the list and one of them is even a dead link.

Supporting Material

website is here: https://servers.guru

Association Disclosure

I'm the funder of servers.guru

Would you like to submit a PR?

Yes!

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

well, if we can't throw the blasted things in the garbage :), then...

proposed additions...

• F-Droid client - for descrip...

F-Droid is an installable catalogue of FOSS (Free and Open Source Software) applications for the Android platform. The client makes it easy to browse, install, and keep track of updates on your device.

could add additional info from my site also...

Before you get started installing apps from F-Droid you will need to enable the installation of apps from unknown sources if you haven't already done so. I'm sure some might see this as a major no-no, to which i would reply that, out of 27 repositories tested in a 2017 independent study, including the Google Play Store, F-Droid was the only one in which no instances of malware were found. While the number of instances of malware in the Play Store was low, understand that the privacy aspect of those apps was not considered and this is perhaps the greatest concern with Play Store apps.

• KeePassDX or KeePassDroid
• OS Monitor

Explain why it should be added

Web-based Traffic and Security Network Traffic Monitoring, AdBlocking

Additional Context

https://github.com/ntop/ntopng - Network traffic/connections monitoring, block ads/malicious domains using filter lists
https://github.com/safing/portmaster - Monitor network connections, block ads/malicious domains using filter lists

Category

Search Engines

Software to be added

Mojeek is a search engine based in the UK, unlike options currently on the list (which all have decent no-tracking privacy policies) Mojeek does not rely upon another index when it comes to providing people with general web search results.

Supporting Material

A good summary of Mojeek milestones is on Wikipedia - https://en.wikipedia.org/wiki/Mojeek
Current privacy policy - https://www.mojeek.com/about/privacy/
Original privacy policy (2006) according to those who have looked, the first of its kind - https://web.archive.org/web/20060318104627/http://www.mojeek.com/privacy.html
A look search engines and indexes - https://seirdy.one/posts/2021/03/10/search-engines-with-own-indexes/
An article which cropped up in a previous issue which further explores some of the unique aspects of Mojeek - https://12bytes.org/articles/tech/alternative-search-engines-that-respect-your-privacy/

Association Disclosure

I currently work at Mojeek

Would you like to submit a PR?

No

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Title

ClamAV

Amendments

https://github.com/lissy93/awesome-privacy#anti-malware

On the linked page, it lists CalmAV instead of ClamAV. Only thought to mention it since "Calm" is a real word, it makes it look like this might not have been a typo, when it is.

Association Disclosure

I have not.

Would you like to submit a PR?

No.

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the project the amendment refers to
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Hello :)

Explain why it should be added

AFWall+ should be added because it's a good firewall for Android, FOSS Software

Additional Context

On Google Play and F-Droid

Have a good day ;)

Category

Productivity > Digital Notes

Software to be added

Notesnook is a (soon to be open source) end to end encrypted note taking alternative to Evernote & OneNote. I think it will be a good fit for the list of privacy focused software you are making.

Supporting Material

Website: https://notesnook.com
GitHub: https://github.com/streetwriters/notesnook/

Association Disclosure

I am the co-founder

Would you like to submit a PR?

Yes!

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Your Question

I had never really looked into Qwant or Startpage before and was curious to see if their claims of privacy actually held up (spoiler alert: it doesn't look like it).

For Qwant, I went to the homepage, searched for "test", and then saved uBlock Origin's blocked requests, which appear in the table below. Note that as you stay on the page and interact with random elements, further requests will be sent and blocked. I don't know what some of these requests are for, and I can assume some of them are extraneous without being necessarily malicious, but rum stands for Real User Monitoring, and is a tracker capable of collecting a whole host of information on the user. What exactly is Qwant collecting with RUM? What does it do with this data? There's no way to be sure, because Qwant isn't open source and the payloads sent to the apm/intake/v2/rum/events endpoint are garbled binary data.

As for Startpage, it doesn't send near as many shady-looking requests, but I also wouldn't call it private. I won't bog you down with another uBlock Origin log, as this GitHub issue does a good job of summing it up.

Should these still be included? They're certainly better than $BIG_TECH_SEARCH, but I'm also not sure if they're the best places to direct people.

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• A similar question has not already been asked for this software/ service
• You agree to the code of conduct

perhaps worth mentioning that Thunderbird has encryption built-in as of a few versions ago (at least on Linux anyway) - so Enigmail is no longer needed i don't think

Your Question

After reading the musts on this Wiki, you recommended some password managers. I decided to use Bitwarden but now I am asking myself, why am I changing to Bitwarden if Google is already storing my passwords on chrome? Are there some benefits? This is the first time I have been worried about privacy and security so I don't know if this question is very dumb or if I am missing the point.

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• A similar question has not already been asked for this software/ service
• You agree to the code of conduct

Category

Digital Notes

Software to be added

Logseq is a privacy-first, open-source knowledge base that works on top of local plain-text Markdown and Org-mode files.

Supporting Material

• Website – https://logseq.com/
• GitHub – https://github.com/logseq/logseq
• Discord – https://discord.com/invite/KpN4eHY
• Forum – https://discuss.logseq.com/
• Documentation – https://docs.logseq.com/#/page/Contents
• Product Roadmap - https://trello.com/b/8txSM12G/logseq-roadmap

Association Disclosure

I am not associated with the project, however, I am a happy user of the product

Would you like to submit a PR?

Maybe?

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Explain why it should be added

AnonAddy is a free, open-source, anonymous email alias forwarding service. It supports GPG/OpenPGP, custom domains, and includes browser extensions for easy alias creation. Owner does not store any personal information.

Additional Context

Should be listed as an option / alternative to 33mail.

Explain why it should be added

[A clear and concise description of the point and why it should be added to the list.]

Thanks for including FilePizza and Instant.io as recommendations for file transfer in the list. (I'm the creator of WebTorrent, which both of those services use!) Instant.io is actually run by me and the WebTorrent team :)

While I recommend both of those services, one shortcoming is that they don't use end-to-end encryption. That's why we built Wormhole (https://wormhole.app/) to fill that gap. I recommend Wormhole over the other services these days.

Additional Context

[Provide some context, with a bit of detail. Specify which of the 10 categories this point should be listed under]

Wormhole should go into the "File Drop" category.

Content (optional)

[Suggest some content, including links, written in clear English for the point you'd like added]

Wormhole lets you share files with end-to-end encryption and a link that automatically expires. So you can keep what you share private and make sure your stuff doesn't stay online forever. Wormhole uses end-to-end encryption to protect your files so they can never be shared or viewed by anyone but you and the intended recipients. Files are permanently deleted from the server after 24 hours. Wormhole encrypts all files with 128-bit AES-GCM encryption before they leave the browser. You can read more about the security design to learn more.

NOTES:

• Before submitting, check that there isn't a similar open issue already
• Please create a new issue for each separate/ stand-alone point you'd like added to the list
• If you are confident in your abilities, you can also write the point yourself, and submit it as a PR
• Thank you for your suggestion, it's because of contributors like yourself that this project can exist

Some people choose https://plaintextaccounting.org tools like https://hledger.org, https://beancount.github.io and https://ledger-cli.org for their privacy benefits (fully offline accounting data, completely under your control).

There are many offline accounting tools, like GNUCash and KMyMoney, but PTA is a popular alternative approach and might be worth mentioning. It could fit in the Budgeting Tools section next to GNUCash.

Possible content, if you don't want to link the three individual apps:

Plain Text Accounting apps (Desktop)
Powerful cross-platform accounting tools for Windows, Mac and Linux, with some web and mobile support, which are popular for their compact, version-controllable data format and privacy-friendly offline nature.

Alternate link, direct to the apps

Explain why it should be added

Arcano is an end-to-end encrypted file transfer service. All data is encrypted in the browser of the sender and only decrypted in the browser of the receiver. Arcano never has access to the keys of the users and can thus not access any of the files. Metadata such as filename are also encrypted.
Furthermore, we offer a free tier, where one can register to Arcano using only an email address. No credit card or other personal data is stored.

Additional Context

Arcano should go into the "File Drop" category.

Content (optional)

Arcano has been developed for lawyers and other professional secret carriers but can be used by anybody who cares about his privacy. This is why we made it our highest priority to have as little knowledge as possible about the lawyers and their clients. Arcano can never access the files that are being transferred or the metadata about this file (e.g. filename).

The files are encrypted using 256 bit AES with GCM.

NOTES:

• Before submitting, check that there isn't a similar open issue already
• Please create a new issue for each separate/ stand-alone point you'd like added to the list
• If you are confident in your abilities, you can also write the point yourself, and submit it as a PR
• Thank you for your suggestion, it's because of contributors like yourself that this project can exist

Category

File Encryption

Software to be added

age is a simple, modern and secure file encryption tool, format, and Go library. It features small explicit keys, no config options, and UNIX-style composability.

age is multi-platform with releases available on Darwin, BSD, Linux, and Windows as pre-compiled Go binaries.

age is also very easy to use from the command line, with encryption being done using passwords, passphrases, SSH keys, keyfiles, and even GitHub user account metadata.

Supporting Material

GitHub Repo: https://github.com/FiloSottile/age

Format Spec: https://github.com/C2SP/C2SP/blob/main/age.md

Manpage: https://github.com/FiloSottile/age/blob/main/doc/age.1.html

Authors: Filippo Valsorda and Ben Cox

Association Disclosure

No response

Would you like to submit a PR?

Maybe?

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Category

Non-Tracking Search Engines

Software to be added

There are very few independent, privacy respecting search engines that don't manipulate results and Mojeek is one of them

most of the so-called alternative search engines (DDG, Startpage, etc.) are not true search engines - they are essentially proxies that rely on Bing or Google for results

Mojeek is a very promising search engine that has their own index with somewhere over 6 billion pages indexed as of this writing and its founders seem to be very ethical - i've gotten to know them a bit as a result of providing feedback on their community site (they are very open to suggestions)

Supporting Material

• Mojeek
• About Mojeek - building the world's alternative search engine
• Mojeek Privacy Policy
• Mojeek Terms of Service
• The Mojeek Discourse - Alternative search engine, alternative community.

Association Disclosure

i've provided feedback but am not an employee

Would you like to submit a PR?

No.

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Category

Bonus

Software to be added

PhotoPrism® is an AI-Powered Photos App for the Decentralized Web.
It makes use of the latest technologies to tag and find pictures automatically without getting in your way. You can run it at home, on a private server, or in the cloud. (Source: photoprism.app).

Supporting Material

github
website
100% self-funded and indipendent

Association Disclosure

Not associated in any way

Would you like to submit a PR?

Yes!

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

REMOVE GREENIFY

Justification

Greenify has some Google trackers. https://reports.exodus-privacy.eu.org/en/reports/com.oasisfeng.greenify/latest/#trackers

Additional Context (optional)

The app is not FOSS either.

NOTES:

• Before submitting, check that there isn't a similar open issue already
• Please create a new issue for each separate/ stand-alone point you'd like edited/ removed from the list
• If you are confident in your abilities, you can also make the changes yourself, and submit it as a PR
• Thank you for your suggestion, it's because of contributors like yourself that this project can exist

there's allot that could be added to the "Word of Warning" section and in that vein i'll pimp my own article on the subject which you can link to if you see fit...

Malware - It's (way) worse than you think

i think i'm done spamming issues ... for today :)

there's so much fantastic stuff here - thanks for putting all this together - unfortunately the landscape is very dynamic and that makes writing about this stuff frustrating, for me at least

Category

Essentials/Private Browsers

Software to be added

All sources of the Catalyst project are proudly available here. I am constantly patching bugs, and most importantly, updating dependencies to keep a safe and secure browser. The best part, absolutely zero data collection. I haven't yet mentioned, but Catalyst is built with Electron. Making it impossible to block sites from collecting data, although some methods may not work in the environment anyways. But, if you use the browser (no data collection) and use sites that respect your privacy, you'll be practically invisible! I would add a fake user agent, but that would break several sites. The browser is also stable, fast, and does one thing and does it well (be a browser...). In upcoming releases there will be a one time warning on non-private sites! Anyways, you are not obliged to add this to the list. Simply a suggestion!

Supporting Material

Sources
Website

Association Disclosure

I own the repository, browser, and its sources. And my code makes up about 75 percent.

Would you like to submit a PR?

Maybe?

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with the suggested addition
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Title

Vanilla Cookie Manager

Removal Reason

Deprecated: https://github.com/laktak/vanilla-chrome

Association Disclosure

No association

Would you like to submit a PR?

No.

Please tick the boxes

• You have filled out this form accurately, and to the best of your knowledge
• You have indicated weather or not you are associated with this project or a competitor
• A similar submission has not already been opened for this software/ service
• You agree to the code of conduct

Explain why it should be added

Hi, I created picosnitch and thought it may be worth mentioning here.

picosnitch uses BPF to monitor network traffic per application, and per parent to cover those that just call others. It also does it's best to hash every executable, and will complain if some mischievous program is giving it trouble.

It was designed to help protect your security and privacy by "snitching" on anything that connects to the internet, letting you know when, how much data was transferred, and to where.

Additional Context

It would probably fit best in the Intrusion Detection category.

given our previous exchange regarding Firefox, i might suggest cleaning up/removing/rewording the following extensions (for FF specifically... i don't know, nor care, about chrome)

this is assuming a privacy/security user.js is being used (arkenfox)...

• Privacy Badger - raises entropy
• HTTPS Everywhere - not needed
• Firefox Multi-Account Containers/Temporary Containers - there are use cases for these, but for the average person, probably not ??? fingerprinting and isolation is covered by RFP and ETP/dFPI
• Canvas Fingerprint Blocker - covered by RFP
• First Party Isolation - obsolete - replaced by ETP/dFPI - no ext. needed
• LocalCDN/Decentraleyes - still useful speed-wise, but FF now strips some of the identifying info from these requests i'm told, plus ETP/dFPI isolates this stuff
• Vanilla Cookie Manager - probable useless for most people, plus it hasn't been updated in 7 years (there are better storage managers, but all are largely obsolete) - handled with ETP/dFPI
• Privacy Essentials - this could possibly raise entropy - personally not a fan of fluff like this, plus the code would have to be checked, plus much/all of this is handled by FF, arkenfox, RFP, dFPI - less is more
• Self-Destructing Cookies - same opinion as Vanilla Cookie Manager
• Site Bleacher - not needed - ETP/dFPI, RFP
• User Agent Switcher - raises entropy, though there are some instances where one might want to spoof the UA (note that very few of these "spoofers" address the JS UA)
• PrivacySpy - looks like it may be injecting into pages, not sure - also it's easy to detect crap privacy policies... the page has a scroll bar :)

    "web_accessible_resources": [
        "icons/privacyspy-96-dark.png"
    ]

• HTTPZ - as mush as like the work by @claustromaniac, this is no longer needed
• Track Me Not - that's a no-no - covered by RFP, ETP/dFPI
• AmIUnique Timeline - hmmm... a fluff piece i think, plus many/most fingerprint detection sites don't work properly at all according to the arkenfox crew (pants)
• Netcraft Extension - i'm skeptical - first of all, i think anyone that cares about privacy is going to be nuking JS globally (uBO anyone?) and allowing per-site - potentially odd and conflicting privacy policies here and here

this caught my attention...

The Extension collects the following information:

Web sites (not URLs) visited...
Where a web site loads malicious JavaScript...
The Extension does not collect any personal information except that described above. In particular, we do not collect personal information which can identify the browsing habits of individual users.

and then...

You have a right to access the personal information held about you. To obtain a copy of the personal information we hold about you, please mail us at [email protected].

how would they know how to correlate PII with a user if they collect none? interesting

Solution list

• GitLab - https://about.gitlab.com/install/
• Gitea - https://gitea.io/
• Gogs - https://gogs.io/