Privacy-Respecting Software
The problem with lists like this is they really are just a &quot;here&#x27;s 100 open source products&quot;, without any criteria or individual evaluation. It is often just parrots repeating what other parrots say.<p>Something which is clearly alpha-state isn&#x27;t usable to regular users shouldn&#x27;t have a &quot;recommendation&quot;. Then you get sub optimal recommendations, listing some projects which are unmaintained etc.<p>With the cleanup at <a href="https:&#x2F;&#x2F;privacyguides.org" rel="nofollow">https:&#x2F;&#x2F;privacyguides.org</a>, (since we split from PTIO) we&#x27;ve removed a lot of things, and gone down the part of actually providing guidance rather than &quot;use this software to make you magically more private&quot;.<p>I think it&#x27;s important to think privately, modify behavior rather than rely on technology to do it all for you.<p>Looking at this particular list there are some bad choices:<p>- LessPass: We explicitly removed deterministic password managers <a href="https:&#x2F;&#x2F;github.com&#x2F;privacyguides&#x2F;privacyguides.org&#x2F;pull&#x2F;323" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;privacyguides&#x2F;privacyguides.org&#x2F;pull&#x2F;323</a>, <a href="https:&#x2F;&#x2F;tonyarcieri.com&#x2F;4-fatal-flaws-in-deterministic-password-managers" rel="nofollow">https:&#x2F;&#x2F;tonyarcieri.com&#x2F;4-fatal-flaws-in-deterministic-passw...</a><p>- AndOTP: Uses PBKDF2 and a heap of rounds that is unbelievably slow when you have a number of OTPs. Aegis uses Argon, which doesn&#x27;t have this problem, and we think it&#x27;s code is developed by someone who is security conscientious.<p>- Qwant: <a href="https:&#x2F;&#x2F;github.com&#x2F;privacyguides&#x2F;privacyguides.org&#x2F;pull&#x2F;342#issue-1057922379" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;privacyguides&#x2F;privacyguides.org&#x2F;pull&#x2F;342#...</a>, we removed due to &quot;due to bad privacy policies data is collected and shared with third parties&quot;<p>- Silence: Unmaintained, uses SS7 network, should never be recommended.<p>- Off-The-Record: Doesn&#x27;t cover group chats or other side channels, such as status updates, VOIP. In general XMPP isn&#x27;t particularly &quot;privacy friendly&quot; <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20211215132539&#x2F;https:&#x2F;&#x2F;infosec-handbook.eu&#x2F;articles&#x2F;xmpp-aitm&#x2F;" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20211215132539&#x2F;https:&#x2F;&#x2F;infosec-h...</a><p>- PGP: NO. It has no forward secrecy, it&#x27;s a terrible way to encrypt real time communication.<p>- Matrix + Riot client: Seriously, it&#x27;s been &quot;Element&quot; for ages now, makes me think the author really isn&#x27;t up to date with current events.<p>- Ricochet: Unmaintained, (2016) domain dead, Only supported .onion HSv2<p>- Tox + qTox: Developed wrong. They developed the software then decided to write the spec afterwards. There&#x27;s also <a href="https:&#x2F;&#x2F;github.com&#x2F;TokTok&#x2F;c-toxcore&#x2F;issues&#x2F;426" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;TokTok&#x2F;c-toxcore&#x2F;issues&#x2F;426</a><p>- Mailfence: Last email I sent to them they don&#x27;t use any kind of disk encryption<p>- CriptText, these things really don&#x27;t help, they are walled, in that everyone has to be on a centralized service to get the benefit. E2EE that comes with web-apps can often be dangerous as it can change, have vulnerabilities introduced after an audit etc.<p>- TorBirdy: Unmaintained<p>- Mumble: Not really private<p>- Linphone: Not really private<p>- Rocket Chat: Experimental E2EE<p>- Browser Extensions: NO JUST NO. <a href="https:&#x2F;&#x2F;blog.privacyguides.org&#x2F;2021&#x2F;12&#x2F;01&#x2F;firefox-privacy-2021-update&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.privacyguides.org&#x2F;2021&#x2F;12&#x2F;01&#x2F;firefox-privacy-20...</a>
  <a href="https:&#x2F;&#x2F;github.com&#x2F;arkenfox&#x2F;user.js&#x2F;wiki&#x2F;4.1-Extensions" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;arkenfox&#x2F;user.js&#x2F;wiki&#x2F;4.1-Extensions</a><p>- Video Platforms: These are not private<p>- RSS Clients: There are better options<p>- Mobile Operating Systems: Options without Verified Boot. NO. <a href="https:&#x2F;&#x2F;source.android.com&#x2F;security&#x2F;verifiedboot" rel="nofollow">https:&#x2F;&#x2F;source.android.com&#x2F;security&#x2F;verifiedboot</a><p>- Linux recommendations: Those are also awful and don&#x27;t have any threat model in mind.<p>I&#x27;m going to stop now, it&#x27;s basically every bad thing that was ever on PTIO, that we removed. Basically there are terrible recommendations with a few good ones sprinkled in.<p>This list is *not* maintained!