2025-04-22
Before I begin, I will say that for most people this is more a case of damage control than absolute true privacy. Aside from that, I will also not cover threat modeling in this post as there are two blogposts [1] [2] which explain what it is in detail. Please do read them if you do not know what "threat modeling" means. As a TL;DR, threat modeling is defining what you want privacy against.
By damage control, I mean using "evil" services as little as possible and opting for better alternatives instead; and maybe still using some of these services.
Of course, I have also compiled some of the very best choices for privacy. These sacrifice convenience heavily, however.
I will begin to list with a very base level privacy, with convenience being first priority, and privacy second. As it goes on, these priorities will switch places.
Keep in mind that every piece of information might not be accurate, may be outdated, and/or non-comprehensive. So don't take everything at face value here. In addition to this, please read the Notes sections as they contain additional information.
Let's begin with a base, and a low threat level.
Mobile Operating System: iOS, GrapheneOS
Desktop OS: Fedora Workstation, OpenSUSE Tumbleweed, Universal Blue, MacOS
Browser: Desktop: Trivalent, Hardened Chrome, Firefox + arkenfox or Librewolf
Mobile: Safari on iOS (optional for MacOS), Vanadium (Android), AOSmium Helium Browser for Android, Brave Browser (see notes)
E-mail Service: ProtonMail, Posteo, Tuta Mail
Social Media Services: Pixelfed (instagram), Mastodon (twitter), Revolt (discord), Lemmy (reddit), just don't use Facebook
Messenger: Signal
Cloud Service/Drive: Proton Drive
Search Engine: DuckDuckGo, Startpage, Brave Search
Hardware: Mobile: iPhone, Google Pixel
Desktop: Macbook, Lenovo Thinkpad, Dell Latitude (business series)
Notes:
It's unavailable on Android versions older than 13, so if that's the case, you can instead use Helium Browser for Android which is based on the new Helium browser and borrows patches from Vanadium. Note that this can be a less secure option compared to Vanadium when paired with extensions, and it is relatively slower to update. Consider setting up automatic updates using Obtainium. You can also use AOSmium, Cromite or Brave (available on Play Store).
AOSmium is a fork of Mulch. In terms of security it could be the best choice after Vanadium, but it lacks content filtering. You can mitigate this issue by using DNS-level content filtering. Mullvad DNS (adblock tier or above) can be a good option for this purpose.
For desktop browsers, there are specific choices for specific operating systems. On Windows devices, Firefox or Hardened Chrome can be used. Firefox is normally not recommended for use because it lacks some security features, however, it performs well on Windows specifically. For Linux, on the other hand, Trivalent can be used on RPM-based systems (Fedora-based and OpenSUSE). The best alternative to Trivalent would be Hardened Chrome. Those who don't want to use Chrome or manually harden it can instead use Brave.
Users on normal Fedora installations who want to use Trivalent should follow these commands (you can use sudo instead of run0):
run0 sh -c 'dnf config-manager addrepo --from-repofile=https://repo.secureblue.dev/secureblue.repo'
run0 sh -c 'dnf install trivalent'
run0 sh -c 'dnf copr enable secureblue/trivalent'
run0 sh -c 'dnf install trivalent-subresource-filter'
The trivalent-subresource-filter package from the COPR repository provides additional content blocking.
If you have to use Google Chrome, you can follow this hardening guide.
For android users, I recommend using F-Droid Basic (available on F-Droid) paired with the IzzyOnDroid repository, and Accrescent as an alternative to Play Store. You still may need to use Play Store itself, though. I do not recommend Aurora Store for security reasons.
In addition to this, it is also preferable for the user to replace their keyboard app. Consider installing HeliBoard, FlorisBoard.
I personally cannot recommend LineageOS because it comes with userdebug builds which expose root over ADB, and cannot recommend other custom ROMs as well, as sandboxed Google apps are a better choice for security, and this is only implemented on GrapheneOS so far. MicroG has security issues compared to sandboxed Google services. If you do not have a Pixel, it may be a better idea to stay on the stock OS, depending on the vendor, your threat model, and more importantly your personal preference. There needs to be a balance between privacy and security.
The best alternative option to an iPhone/Pixel would be Samsung. This is because Samsung provides lengthy update periods and abides by the Android security model. Make sure that you get rid of the unnecessary software using Universal Android Debloater or Canta.
Fedora and OpenSUSE are both Linux distributions that work well out of the box.
Hardened Firefox works pretty well on desktop. On Android however, it severely lacks any sandboxing, so I recommend Chromium based browsers. Also, Firefox on Android is really, really slow. As for Librewolf, updates are more delayed compared to upstream, so I only recommend it to users that don't want to configure everything.
ProtonMail is more than enough for an e-mail service. If you're willing to pay, I recommend Posteo instead.
Google Messages' RCS service is end-to-end encrypted, so it's not the most private solution but it is decent, paired with iMessage.
I don't know much about cloud storage, but Proton is decent.
Also, some of you might need Windows, and that's okay. However, make sure to activate your Windows with an Enterprise license, as you will need it to disable all telemetry. You will also want to debloat it. Ideally you shouldn't use third-party software for this, but it may be too inconvenient to manually configure everything for some.
Hardware: Most brands provide short security update cycles for their devices, and some others install unneeded software that have additional access over the OS which makes then inherently suspicious. For this reason it'll be ideal to use hardware considered secure enough. Make sure that the desktop hardware you're buying has a recent CPU model so that it receives microcode updates.
To disable all telemetry on Windows, press Win+R, type "gpedit.msc", go to "Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Telemetry > Activate the policy, and then choose 'Diagnostic data off'."
Update: Removed Droid-ify in favour of F-Droid Basic; as Droid-ify hasn't implemented index-v2 yet
F-Droid security model, and index-v2
Mobile Operating System: GrapheneOS
Desktop OS: Secureblue, Void Linux, Gentoo (Gentoo Hardened) (You need to harden; manually configure the last two yourself), MacOS
Browser: Trivalent, Vanadium (Android/GrapheneOS), or hardened Google Chrome as mentioned above, Firefox paired with arkenfox user.js if you don't want to use Chromium
E-mail Service: ProtonMail, Disroot, Riseup, Posteo, Tuta Mail
Social Media Services: Same as above
Messenger: Signal, XMPP services, Matrix
Cloud Service/Drive: Same as above
Hardware: Mobile: Google Pixel
Desktop: Macbook, Lenovo Thinkpad, Dell Latitude
Notes:
Apple is a giant corporation that still cannot be trusted and has got caught spying [1] [2], so they are not present relative to the previous tier. Apple is also known for introducing opt-out privacy breaching features in updates. However, MacOS will remain present anyway as it is ahead of the curve in security features such as verified boot.
Secureblue is my main recommendation for desktop. It's as convenient as it's secure, while remaining private.
At this point, you should consider using a VPN provider like Mullvad.
Optionally consider removing, disabling, or putting tape over the camera module(s) of your device(s).
For those willing to spend the effort, Gentoo Hardened can be a much better distribution to start from if you want to secure your desktop OS to the fullest. Follow a hardening guide [2]. Also check out SELinux Tutorials on the Gentoo wiki.
Check out AppArmor if your distribution doesn't support SELinux.
Users interested in XMPP can select an instance of their choice from providers.xmpp.net.
Check out HardenedBSD if you want to use *BSD.
Make sure you enable full disk encryption for your desktop system(s).
Update: I removed Qutebrowser, as it is not up to date with upstream Chromium.
Mobile Operating System: GrapheneOS, and your Pixel's cameras and its microphone are removed.
"Desktop" OS: GrapheneOS Desktop Mode, or none. Read note.
Browser: Tor Browser (less security), or Vanadium (less anonymity)
E-mail Service: Riseup, or none at all
Social Media Services: None.
Messenger: Briar, Meshtastic (Android app, SimpleX
Cloud Service/Drive: None.
Hardware: Google Pixel
Notes:
Desktop mode on GrapheneOS is just hooking up your GrapheneOS phone to a monitor. The reason as to why I cannot recommend a real desktop OS, is because they are considered insecure, as they had never been designed with security first in mind to begin with.
It's completely fine to use Signal, especially thanks to its excellent encryption protocol, but you may need a VOIP number or a burner phone number.
Briar and Meshtastic can work without an internet connection. Very cool! I think Meshtastic has better real-world usage.
SimpleX could be the most anonymous messenger as of right now, which has no identifiers.
While connecting to the internet, use Tor or I2P.
Consult a professional, not a hobbyist website.
You can mix and match from what I've provided. I usually advocate for the first tier, as it is easier to spread for me, and easier to get started for people.
Take small steps to switch, and don't rush it. Most people are entirely Google dependent these days, and it's a slow process to get through.