It&#x27;s true that not <i>all</i> of my criteria are included in the scorecard. For one thing, it&#x27;s based on the statements of the developers, so if they say &quot;it&#x27;s encrypted&quot;, the EFF takes them at their word, and doesn&#x27;t investigate the quality of the crypto. It also doesn&#x27;t consider usability issues (secure defaults).