Privacy-Respecting Software

The problem with lists like this is they really are just a "here's 100 open source products", without any criteria or individual evaluation. It is often just parrots repeating what other parrots say.

Something which is clearly alpha-state isn't usable to regular users shouldn't have a "recommendation". Then you get sub optimal recommendations, listing some projects which are unmaintained etc.

With the cleanup at https://privacyguides.org, (since we split from PTIO) we've removed a lot of things, and gone down the part of actually providing guidance rather than "use this software to make you magically more private".

I think it's important to think privately, modify behavior rather than rely on technology to do it all for you.

Looking at this particular list there are some bad choices:

- LessPass: We explicitly removed deterministic password managers https://github.com/privacyguides/privacyguides.org/pull/323, https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...

- AndOTP: Uses PBKDF2 and a heap of rounds that is unbelievably slow when you have a number of OTPs. Aegis uses Argon, which doesn't have this problem, and we think it's code is developed by someone who is security conscientious.

- Qwant: https://github.com/privacyguides/privacyguides.org/pull/342#..., we removed due to "due to bad privacy policies data is collected and shared with third parties"

- Silence: Unmaintained, uses SS7 network, should never be recommended.

- Off-The-Record: Doesn't cover group chats or other side channels, such as status updates, VOIP. In general XMPP isn't particularly "privacy friendly" https://web.archive.org/web/20211215132539/https://infosec-h...

- PGP: NO. It has no forward secrecy, it's a terrible way to encrypt real time communication.

- Matrix + Riot client: Seriously, it's been "Element" for ages now, makes me think the author really isn't up to date with current events.

- Ricochet: Unmaintained, (2016) domain dead, Only supported .onion HSv2

- Tox + qTox: Developed wrong. They developed the software then decided to write the spec afterwards. There's also https://github.com/TokTok/c-toxcore/issues/426

- Mailfence: Last email I sent to them they don't use any kind of disk encryption

- CriptText, these things really don't help, they are walled, in that everyone has to be on a centralized service to get the benefit. E2EE that comes with web-apps can often be dangerous as it can change, have vulnerabilities introduced after an audit etc.

- TorBirdy: Unmaintained

- Mumble: Not really private

- Linphone: Not really private

- Rocket Chat: Experimental E2EE

- Browser Extensions: NO JUST NO. https://blog.privacyguides.org/2021/12/01/firefox-privacy-20... https://github.com/arkenfox/user.js/wiki/4.1-Extensions

- Video Platforms: These are not private

- RSS Clients: There are better options

- Mobile Operating Systems: Options without Verified Boot. NO. https://source.android.com/security/verifiedboot

- Linux recommendations: Those are also awful and don't have any threat model in mind.

I'm going to stop now, it's basically every bad thing that was ever on PTIO, that we removed. Basically there are terrible recommendations with a few good ones sprinkled in.

This list is *not* maintained!

> Nice up-to-date collection. I'm tired of finding old lists like this but filled with legacy, unmaintained programs.

It doesn't seem very up-to-date even if the last update was only three hours ago. It still describes Element as 'Matrix + Riot client' even though this changed in 2020. [0]

> I like these little interjections to explain things for beginners.

These are nice, however a proper criteria would be even nicer. Currently it is just a list of vaguely private and open source software.

0 - https://element.io/blog/the-world-is-changing/

Whats the current consensus on Brave? Last time I tried it, it seemed to be an alright alternative to Chrome, but remember it wasn't entirely well liked on HN for whatever reason.

It supports Google monopoly on the web by following standards decided by Google.

Hmm, I guess that matters if you are using public servers. If you are running your own server, then it is a non-issue. I still think self hosted mumble is a great solution to the problem. Looking through the privacyguides recommendations[0], I don't see a good alternative.

[0] https://www.privacyguides.org/real-time-communication/