The problem with lists like this is they really are just a "here's 100 open source products", without any criteria or individual evaluation. It is often just pa

The problem with lists like this is they really are just a "here's 100 open source products", without any criteria or individual evaluation. It is often just parrots repeating what other parrots say. Something which is clearly alpha-state isn't usable to regular users shouldn't have a "recommendation". Then you get sub optimal recommendations, listing some projects which are unmaintained etc. With the cleanup at https://privacyguides.org https://privacyguides.org, (since we split from PTIO) we've removed a lot of things, and gone down the part of actually providing guidance rather than "use this software to make you magically more private". I think it's important to think privately, modify behavior rather than rely on technology to do it all for you. Looking at this particular list there are some bad choices: - LessPass: We explicitly removed deterministic password managers https://github.com/privacyguides/privacyguides.org/pull/323 https://github.com/privacyguides/privacyguides.org/pull/323, https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... - AndOTP: Uses PBKDF2 and a heap of rounds that is unbelievably slow when you have a number of OTPs. Aegis uses Argon, which doesn't have this problem, and we think it's code is developed by someone who is security conscientious. - Qwant: https://github.com/privacyguides/privacyguides.org/pull/342#issue-1057922379 https://github.com/privacyguides/privacyguides.org/pull/342#..., we removed due to "due to bad privacy policies data is collected and shared with third parties" - Silence: Unmaintained, uses SS7 network, should never be recommended. - Off-The-Record: Doesn't cover group chats or other side channels, such as status updates, VOIP. In general XMPP isn't particularly "privacy friendly" https://web.archive.org/web/20211215132539/https://infosec-handbook.eu/articles/xmpp-aitm/ https://web.archive.org/web/20211215132539/https://infosec-h... - PGP: NO. It has no forward secrecy, it's a terrible way to encrypt real time communication. - Matrix + Riot client: Seriously, it's been "Element" for ages now, makes me think the author really isn't up to date with current events. - Ricochet: Unmaintained, (2016) domain dead, Only supported .onion HSv2 - Tox + qTox: Developed wrong. They developed the software then decided to write the spec afterwards. There's also https://github.com/TokTok/c-toxcore/issues/426 https://github.com/TokTok/c-toxcore/issues/426 - Mailfence: Last email I sent to them they don't use any kind of disk encryption - CriptText, these things really don't help, they are walled, in that everyone has to be on a centralized service to get the benefit. E2EE that comes with web-apps can often be dangerous as it can change, have vulnerabilities introduced after an audit etc. - TorBirdy: Unmaintained - Mumble: Not really private - Linphone: Not really private - Rocket Chat: Experimental E2EE - Browser Extensions: NO JUST NO. https://blog.privacyguides.org/2021/12/01/firefox-privacy-2021-update/ https://blog.privacyguides.org/2021/12/01/firefox-privacy-20... https://github.com/arkenfox/user.js/wiki/4.1-Extensions https://github.com/arkenfox/user.js/wiki/4.1-Extensions - Video Platforms: These are not private - RSS Clients: There are better options - Mobile Operating Systems: Options without Verified Boot. NO. https://source.android.com/security/verifiedboot https://source.android.com/security/verifiedboot - Linux recommendations: Those are also awful and don't have any threat model in mind. I'm going to stop now, it's basically every bad thing that was ever on PTIO, that we removed. Basically there are terrible recommendations with a few good ones sprinkled in. This list is *not* maintained!