Privacy-Respecting Software
The problem with lists like this is they really are just a "here's 100 open source products", without any criteria or individual evaluation. It is often just parrots repeating what other parrots say.<p>Something which is clearly alpha-state isn't usable to regular users shouldn't have a "recommendation". Then you get sub optimal recommendations, listing some projects which are unmaintained etc.<p>With the cleanup at <a href="https://privacyguides.org" rel="nofollow">https://privacyguides.org</a>, (since we split from PTIO) we've removed a lot of things, and gone down the part of actually providing guidance rather than "use this software to make you magically more private".<p>I think it's important to think privately, modify behavior rather than rely on technology to do it all for you.<p>Looking at this particular list there are some bad choices:<p>- LessPass: We explicitly removed deterministic password managers <a href="https://github.com/privacyguides/privacyguides.org/pull/323" rel="nofollow">https://github.com/privacyguides/privacyguides.org/pull/323</a>, <a href="https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers" rel="nofollow">https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...</a><p>- AndOTP: Uses PBKDF2 and a heap of rounds that is unbelievably slow when you have a number of OTPs. Aegis uses Argon, which doesn't have this problem, and we think it's code is developed by someone who is security conscientious.<p>- Qwant: <a href="https://github.com/privacyguides/privacyguides.org/pull/342#issue-1057922379" rel="nofollow">https://github.com/privacyguides/privacyguides.org/pull/342#...</a>, we removed due to "due to bad privacy policies data is collected and shared with third parties"<p>- Silence: Unmaintained, uses SS7 network, should never be recommended.<p>- Off-The-Record: Doesn't cover group chats or other side channels, such as status updates, VOIP. In general XMPP isn't particularly "privacy friendly" <a href="https://web.archive.org/web/20211215132539/https://infosec-handbook.eu/articles/xmpp-aitm/" rel="nofollow">https://web.archive.org/web/20211215132539/https://infosec-h...</a><p>- PGP: NO. It has no forward secrecy, it's a terrible way to encrypt real time communication.<p>- Matrix + Riot client: Seriously, it's been "Element" for ages now, makes me think the author really isn't up to date with current events.<p>- Ricochet: Unmaintained, (2016) domain dead, Only supported .onion HSv2<p>- Tox + qTox: Developed wrong. They developed the software then decided to write the spec afterwards. There's also <a href="https://github.com/TokTok/c-toxcore/issues/426" rel="nofollow">https://github.com/TokTok/c-toxcore/issues/426</a><p>- Mailfence: Last email I sent to them they don't use any kind of disk encryption<p>- CriptText, these things really don't help, they are walled, in that everyone has to be on a centralized service to get the benefit. E2EE that comes with web-apps can often be dangerous as it can change, have vulnerabilities introduced after an audit etc.<p>- TorBirdy: Unmaintained<p>- Mumble: Not really private<p>- Linphone: Not really private<p>- Rocket Chat: Experimental E2EE<p>- Browser Extensions: NO JUST NO. <a href="https://blog.privacyguides.org/2021/12/01/firefox-privacy-2021-update/" rel="nofollow">https://blog.privacyguides.org/2021/12/01/firefox-privacy-20...</a>
  <a href="https://github.com/arkenfox/user.js/wiki/4.1-Extensions" rel="nofollow">https://github.com/arkenfox/user.js/wiki/4.1-Extensions</a><p>- Video Platforms: These are not private<p>- RSS Clients: There are better options<p>- Mobile Operating Systems: Options without Verified Boot. NO. <a href="https://source.android.com/security/verifiedboot" rel="nofollow">https://source.android.com/security/verifiedboot</a><p>- Linux recommendations: Those are also awful and don't have any threat model in mind.<p>I'm going to stop now, it's basically every bad thing that was ever on PTIO, that we removed. Basically there are terrible recommendations with a few good ones sprinkled in.<p>This list is *not* maintained!