7ASecurity Completes Security Audit of Círculo
Posted on March 17, 2025
| n8fr8
Over the last six months, we’ve been working with 7ASecurity through support from the Open Technology Fund’s Security Safety Audits, to complete an audit of our Círculo project. The public report on that is now available. You can also read the blog post on the audit from 7ASecurity.
If you don’t know about Circulo, this is a physical check-in safety app we have developed, alongside Article 19’s Mexico City team, for a number of years, focused on providing secure location sharing and urgent notifications within small trusted groups, for people under threat of physical violence.
[Read More]
IOCipher 1.0 community reboot
Posted on February 1, 2025
| Zoff
IOCipher update to version 1.0 We are thrilled to announce that a community contributor has picked up maintaining a fork of IOCipher and updated to IOCipher 1.0, designed to enhance your development experience and empower you to create more secure applications with ease. Here’s what’s new and why it matters to you:
1. Enhanced Features We introduced a few new features. Most notably IOCipher is also available on Desktop Java for Linux and Windows now.
[Read More]
A Look Back at 2024: F-Droid's Progress and What’s Coming in 2025
Posted on January 21, 2025
| Hailey Still
With 2024 now behind us, we wanted to take a moment to reflect on the growth and achievements we accomplished as a community last year, and celebrate the incredible support we received from the FOSS community throughout the journey.
This year has been a milestone for us, with significant strides in decentralizing app distribution, expanding the F-Droid ecosystem, and solidifying our infrastructure. All of these advancements were made possible thanks to donations, grants, our volunteers and regular contributors.
[Read More]
Using TLS ECH from Python
Posted on January 10, 2025
| irl
At first, the idea of encrypting more of the metadata found inside the initial packet (the “ClientHello”) of a TLS connection may seem simple and obvious, but there are of course reasons that this wasn’t done right from the start. In this post I will describe the flow of a connection using Encrypted Client Hello (ECH) to protect the metadata fields, and present a working code example using a fork of CPython built with DEfO project’s OpenSSL fork to connect to ECH-enabled HTTPS servers.
[Read More]
Seeking Ruby/Jekyll contractors to start ASAP
Posted on December 6, 2024
| H. Still
Guardian Project is seeking Ruby/Jekyll contractors for mobile/free software and privacy work!
We’re looking for self-motivated, free software hackers to work with Guardian Project on privacy and internet freedom for mobile devices. Our work is 100% free software and we have a steady stream of projects that tie into F-Droid, Debian, Android, Fastlane, Mobifree and other exciting projects. We work to support people and communities around the world. This is a flexible, remote position but we also like to work in person when possible.
[Read More]
Seeking part-time Grant Administrator
Posted on August 5, 2024
| H. Still
Location: Fully remote (African/European time zone) or Vienna, Austria.
Type: Part-time contractor.
About us Guardian Project is a small organization working to make a big impact in data privacy and secure communications. From the average person looking to use the internet and their mobile device more securely, to journalists needing to safely communicate with sources, to activists looking for secure communication channels, Guardian Project creates solutions that focus on privacy so you have true freedom.
[Read More]
First Time Using CalyxOS Review
Posted on April 3, 2024
| H. Still
“But how are you planning on using the phone?” he asked me. I paused, a bit confused. “As a replacement for my iPhone. I want to do everything with this phone that I can do with my iPhone, and use it as I normally would.” He took a beat to respond, “Wow, alright. Well let’s give it a shot.”
I would describe myself as tech-curious, but the reality is I am not your typical CalyxOS user.
[Read More]
IETF119 Conference Report: Monday March 18, 2024
Posted on March 18, 2024
| David Oliver
It’s Opening Day of the 119th IETF meeting in Brisbane Australia. This post commences a daily rundown of privacy and Internet Freedom activities at this IETF meeting. For the rundown on IETF119 Hackathon, see my Hackathon report
Dispatch IETF meetings don’t often kick off with the open dispatch but this time it happened. Dispatch sessions are meant to help specification authors find a home for their work if a home isn’t obvious.
[Read More]
IETF119 Conference Report: Hackathon March 17, 2024
Posted on March 17, 2024
| David Oliver
Hackathon Weekend at the 119th IETF meeting in Brisbane Australia. This post commences a daily rundown of privacy and Internet Freedom activities at this IETF meeting.
IETF’s Hackathon, held at each face-to-face IETF meeting, is designed to encourage interoperability testing of standards under development. See this meeting’s wiki page for a description ofthis year’s twenty-four projects.
The The HTTP Signature Authentication Scheme has been winding its way through the HTTPbis Working Group since being adopted as a Working Group draft in July 2022.
[Read More]
The future of our fdroid-compatible app repository
Posted on February 24, 2024
| eighthave
Guardian Project has been running its own fdroid-compatible app repository since 2012. Up until now, we worked to ensure that our repository had the same standards of free software as the official F-Droid repository. Therefore, the Guardian Project repository was included in the official F-Droid client app by default. A lot has changed since then, for the better. F-Droid has long since stopped shipping pre-built binaries from any provider. Back in the day, F-Droid shipped some binaries, like Mozilla’s Firefox APKs, and allowed some non-free libraries in apps.
[Read More]
Quick set up guide for Encrypted Client Hello (ECH)
Posted on November 10, 2023
| jochensp
The Encrypted Client Hello (ECH) mechanism draft-spec is a way to plug a few privacy-holes that remain in the Transport Layer Security (TLS) protocol that’s used as the security layer for the web. OpenSSL is a widely used library that provides an implementation of the TLS protocol. The DEfO project has developed an implementation of ECH for OpenSSL, and proof-of-concept implementations of various clients and servers that use OpenSSL, and other TLS libraries, as a demonstration and for interoperability testing.
[Read More]
DEfO - Developing ECH for OpenSSL (round two)
Posted on November 9, 2023
| Stephen Farrell
Encrypted ClientHello (ECH) plugs a privacy-hole in TLS, hiding previously visible details from network observers. The most important being the name of the web-site the client wishes to visit (the Server Name Indication or SNI). This can be a major privacy leak, like when accessing a dissident news source hosted on a Content Delivery Network (CDN). A visible domain name also provides a straightforward method for censors to block websites and internet services.
[Read More]
FIFA2023 Report
Posted on November 3, 2023
| Cacu, Happy and Paul
Forum on Internet Freedom in Africa (FIFAfrica) organized by the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) took place in September 26-29, 2023 in Dar es Salaam, Tanzania at the Hyatt Regency Hotel.
The first two days - the 26th and 27th of September - were invite only. The rest of the days - 28th and 29th of September - were meant for all the other participating attendees.
[Read More]
Achieve Onion Layers of Security with the Triad of Apple-tizing Apps!
Posted on July 25, 2023
| Intern Alfred
Our summer intern Alfred just graduated high-school and is preparing to attend a major university to focus on a technical degree. He has a personal interest in privacy and security, and is working with us on a variety of projects this summer as part of a broad, crash-course in all things Guardian Project!
Last week, I worked with three different apps for the iPhone that, when they work together, allow for a secure and private mobile internet experience.
[Read More]
Improving website resilience with LibResilient and IPFS
Posted on June 15, 2023
| uniq
We’re always looking for techniques to make services more resilient to all sorts of issues. That’s why we took special interest in LibResilient and mapped out it’s capabilities. It’s a JavaScript library for decentralized content delivery in web-browsers and markets itself as easy to deploy to any website. We’ve looked at LibResilient primarily in the context of static websites. While it should work with dynamic websites too, that was out of focus for us.
[Read More]
EU should not require sharing unpatched vulnerabilities
Posted on June 11, 2023
| EDRi.org
We, the undersigned organisations, write to express our concern with vulnerability disclosure requirements under the proposed Cyber Resilience Act (CRA). The CRA’s objective to encourage software publishers to patch vulnerabilities and report cyber incidents is salutary. However, the CRA’s mandatory disclosure of unmitigated vulnerabilities will undermine the security of digital products and the individuals who use them.
The CRA would require organisations to disclose software vulnerabilities to government agencies within 24 hours of exploitation (Cyber Resilience Act, Articles 11.
[Read More]
Improving Usability of Tor on Smartphones in Latin America
Posted on June 2, 2023
| Fabiola, Carrie, and Nathan
Between 2022 and 2023 Guardian Project, with support from Okthanks and the Tor Project, organized and participated in a total of 12 workshops in Ecuador, Mexico and Brazil with the participation of 161 people. The workshops focused both on the broad topic of “Tor for Smartphones”, while also taking deeper dives into specific topics like virtual private networks VPNs) and anonymous web browsing. Through a variety of methods, we gathered feedback from the participants in each of those sessions.
[Read More]
IETF116 Conference Report: Friday March 31, 2023
Posted on April 4, 2023
| David Oliver
Day Five of the 116th IETF meeting in Yokohama Japan. For the rundown on Day Four, see my daily report.
With a lot of focus on privacy with respect to Internet protocols, novel new cryptography schemes are an important requirement for new protocol designs. For example, Privacy Preserving Measurement is relying on new cryptography to support distributed aggregation of a wide range of measurements in the advertising domain as well as application telemetry.
[Read More]
IETF116 Conference Report: Thursday March 30, 2023
Posted on March 30, 2023
| David Oliver
Day Four of the 116th IETF meeting in Yokohama Japan. For the rundown on Day Three, see my daily report.
The IETF is getting serious about interoperability among messaging services (this might have had something to do with it). The charter for the Messaging Layer Security Working Group (MLS) specifically excluded interoperability, though the group organized a draft that addressed the basic concepts that would allow MLS-compatible systems to federate. In early 2023, a new Working Group - More Instant Messaging Interoperability (MIMI) - was chartered to expand on the MLS federation work.
[Read More]
IETF116 Conference Report: Wednesday March 29, 2023
Posted on March 30, 2023
| David Oliver
Day Three of the 116th IETF meeting in Yokohama Japan. For the rundown on Day Two, see my daily report.
The long-running work on MASQUE - proxying all network-layer datatypes over QUIC (HTTP/3) - is nearing completion, with the specification for Proxying IP in HTTP in IESG review. With these components in place, the original MASQUE concept - a non-probable relay for client traffic providing privacy guarantees - has been revived, now defined within the new framework and leveraging HTTP Unprompted Authentication.
[Read More]