cyber-mawonaj/lage-chat-control
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rebuild du site sur Astro : i18n multilingue, faits verifies, Docker, CI, tests

Browse Source 
- Astro statique, EN par defaut + /fr/ + /nl/, detection langue navigateur
- i18n par fichiers JSON, ajouter une langue = ajouter des traductions
- Contenu original porte a l'identique (diff d'inventaire par langue)
- Chronologie legislative corrigee sur sources primaires (PE, Conseil, votes)
- Timeline 23 precedents + observatoire 35 items + annuaire 66 outils FOSS,
  chaque affirmation verifiee et sourcee
- Zero requete tierce (teste), lisible JS coupe, axe WCAG AA x2 themes
- Version offline monofichier par langue a chaque build
- Docker multi-stage vers nginx + CSP stricte auto-generee
- CI GitHub Actions (SHA-pinnees) + verification hebdo des liens
- CONTRIBUTING : divulgation d'affiliation obligatoire, allowlist de
  domaines testee en CI
This commit is contained in:
Aurealibe
2026-07-10 03:52:49 +01:00
parent 88b2f9bfd4
commit 8ebc1da9e4
181 changed files with 28167 additions and 2042 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/content/sections/en/01-menace.mdx
+159
View File
@@ -0,0 +1,159 @@
---
id: 'menace'
part: 0
order: 1
title: 'Understand the threat'
---
<p class="part-num">PART 00 · THE WHY</p>
## Understand the threat
Before you change tools, understand what you are protecting against. Otherwise you install random apps and feel safe when you are not.
### Chat Control 1.0 and 2.0, plainly
"Chat Control" is the nickname for two EU texts that allow (or would require) scanning your private messages for child sexual abuse material (CSAM). The stated goal is legitimate; the method, blanket scanning of the communications of unsuspected people, amounts to mass surveillance.
<div class="tablewrap">
<table>
<thead>
<tr>
<th></th>
<th>Chat Control 1.0</th>
<th>Chat Control 2.0 (CSAR)</th>
</tr>
</thead>
<tbody>
<tr>
<td>Text</td>
<td>Regulation (EU) 2021/1232, ePrivacy derogation</td>
<td>Proposal COM/2022/209 (Ylva Johansson, May 2022)</td>
</tr>
<tr>
<td>Scanning</td>
<td>
Voluntary, platforms <em>may</em> scan
</td>
<td>Mandatory via "detection orders" and "risk-mitigation measures"</td>
</tr>
<tr>
<td>Who</td>
<td>
Mostly unencrypted US services: Gmail, Messenger/Instagram, Skype, Snapchat, iCloud Mail,
Xbox
</td>
<td>
<strong>All</strong> platforms, including end-to-end encrypted messengers
</td>
</tr>
</tbody>
</table>
</div>
### Client-side scanning: the legal wiretap
The heart of Chat Control 2.0 is a technique called **client-side scanning**. The idea: instead of breaking encryption in transit, software is installed **directly on your phone** to inspect every message, photo or link **before** it is encrypted and sent. Signal put it in one line: it is "like malware on your device".
<div class="box honest">
<span class="lab">Technical honesty, read twice</span>
<p>
Against client-side scanning, <strong>neither a VPN nor end-to-end encryption is enough</strong>{' '}
if the app or the operating system cooperates. The scan happens on the device, before
encryption: the VPN has nothing to protect, and encryption kicks in too late. What actually
protects you is choosing{' '}
<strong>free/open-source software that refuses to implement scanning</strong>, favourable{' '}
<strong>jurisdictions</strong>, <strong>self-hosting</strong>, and{' '}
<strong>taking back control of your device</strong> (an untampered OS). Everything else in this
guide follows from this truth.
</p>
</div>
<div class="box warn">
<span class="lab">Worst of all: the tool doesn't even work</span>
<p>
Everyone's privacy is sacrificed for a technology that fails. The European Parliament's own
study concludes no system detects this content without a high error rate (because across
billions of messages, even a tiny false-positive rate yields millions of false accusations).
Irish police figures show it: of automated reports, only about 20% were actual material, and
over 11% were outright false positives. Landmark research ("Bugs in Our Pockets," 2021) further
shows that once client-side scanning is installed, it is inevitably repurposed (terrorism,
copyright, opinions).
</p>
</div>
### The pretext: "protecting children"
No one is against protecting minors, which is exactly what makes it such an effective lever. Fighting child abuse serves as an **emotional Trojan horse**: who would dare object? Under that banner, a principle is made acceptable that, on its own, would be flatly rejected, the automated inspection of the private communications of **hundreds of millions of unsuspected people**. Children are the stated motive; the real target is everyone's encryption and privacy.
The tell: the companies pushing hardest for this scanning are the ones whose business model **is** surveillance. On 19 March 2026, a joint appeal urged EU lawmakers to entrench "voluntary" detection, signed by:
<div class="namewall" aria-label="Google, LinkedIn, Snapchat, Microsoft, TikTok, Meta">
<span>Google</span>
<span>LinkedIn</span>
<span>Snapchat</span>
<span>Microsoft</span>
<span>TikTok</span>
<span>Meta</span>
</div>
<blockquote class="pull">
"Failure to do so would be irresponsible." The tech giants' argument for keeping message scanning
alive.
</blockquote>
Those same players even announced they would **keep scanning** messages after the legal basis lapsed on 4 April 2026. Citizens are thus asked to entrust the inspection of their intimate conversations to the very companies known for harvesting and monetising their data. This is the real face of Chat Control: an **attack on privacy** wrapped in a motive no one can refuse.
### This is not "just" surveillance
They try to reassure you: "it's only Gmail, Instagram, Snapchat, Messenger." That's false, and it's the most alarming part. Three shifts hide behind that downplaying.
1. **It's not targeting, it's dragnet.** This doesn't watch suspects: it installs systematic collection of entire populations' communications. Surveillance at state scale, continuously.
2. **It's no longer reading, it's the power to block.** Software that inspects a message before it's sent can also **refuse to send it**. Client-side scanning builds the infrastructure of prior censorship: blocking speech before it even reaches its recipient.
3. **Once the infrastructure exists, it gets repurposed.** A system built "for the children" becomes a general-purpose control tool. The motive changes; the machine stays.
<div class="box warn">
<span class="lab">The logical next step: the digital euro</span>
<p>
The same logic is about to reach your money. The ECB's digital euro rests on a{' '}
<strong>traceable</strong> currency, bars companies from holding any, and comes with a{' '}
<strong>holding cap</strong>: the ECB has floated about €3,000 per person as a working
assumption, and the position voted in the European Parliament's committee (June 2026) leaves the
cap for the Commission to set on the ECB's recommendation, reviewed every two years. The ECB
swears the currency won't be "programmable," but the cap and the traceability are very much on
the menu. When it lands, will you say "relax, it's only a cap"? That's the very same rhetorical
trap as "it's only Gmail." The real question is never what is controlled today, but the control
infrastructure being installed for tomorrow.
</p>
</div>
### Which profile are you?
No tool is magic and nobody needs to do everything. Find your profile: each section tells you how far to go.
<div class="profiles">
<div class="profile p1">
<div class="lvl lvl-1">Beginner</div>
<h4>🟢 The ordinary citizen</h4>
<p>
You just want your conversations and private life to stop being scanned and monetised. Goal:
everyday privacy, without becoming an expert.
</p>
</div>
<div class="profile p2">
<div class="lvl lvl-2">Intermediate</div>
<h4>🟡 The pseudonymous account</h4>
<p>
Information account, activist page, creator: you fear being deanonymised, doxxed, or losing
your account. Goal: separate your real identity from your public one.
</p>
</div>
<div class="profile p3">
<div class="lvl lvl-3">Advanced</div>
<h4>🔴 The whistleblower</h4>
<p>
Journalist, activist, source, facing a powerful adversary (state, employer). Goal: strong
anonymity, anti-correlation, passing documents without being caught.
</p>
</div>
</div>
src/content/sections/en/02-memo.mdx
+64
View File
@@ -0,0 +1,64 @@
---
id: 'memo'
part: 0
order: 2
title: 'Delete / Adopt'
---
<p class="part-num">PART 01 · MEMO · THE DIGITAL SWAP</p>
## Delete / Adopt
The big picture at a glance. Each tool is detailed in the numbered sections below.
<div class="swap">
<div class="swap-col del">
<div class="swap-h">Delete</div>
<ul>
<li>
WhatsApp <b>(Meta)</b>
</li>
<li>
Messenger <b>(Meta)</b>
</li>
<li>
Instagram <b>(Meta)</b>
</li>
<li>Snapchat</li>
<li>
Skype <b>(Microsoft)</b>
</li>
<li>Discord</li>
<li>
Gmail <b>(Google)</b>
</li>
<li>
Outlook <b>(Microsoft)</b>
</li>
<li>Google Drive / Photos</li>
<li>
OneDrive <b>(Microsoft)</b>
</li>
<li>TikTok</li>
<li>Telegram (normal chats)</li>
</ul>
</div>
<div class="swap-col keep">
<div class="swap-h">Adopt</div>
<ul>
<li>Signal</li>
<li>SimpleX Chat</li>
<li>Session</li>
<li>Bitchat</li>
<li>
Element <b>(Matrix)</b>
</li>
<li>Nostr</li>
<li>Mastodon</li>
<li>Proton Mail</li>
<li>Tuta Mail</li>
<li>Mullvad (VPN &amp; browser)</li>
<li>GrapheneOS</li>
</ul>
</div>
</div>
src/content/sections/en/03-messagerie.mdx
+241
View File
@@ -0,0 +1,241 @@
---
id: 'messagerie'
part: 1
order: 3
title: 'Encrypted messaging'
---
<p class="part-num">
PART 02 · FOUNDATIONS · <span class="lvl lvl-1">🟢</span>
</p>
## Encrypted messaging
The first move, the one that protects you fastest: leave WhatsApp, Messenger and Telegram for a genuinely encrypted (ideally open-source) messenger.
<div class="tablewrap">
<table>
<thead>
<tr>
<th>You leave</th>
<th>You adopt</th>
<th>Why</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<span class="old">WhatsApp</span>
</td>
<td>
<span class="new">Signal</span>
</td>
<td>Same simplicity, without Meta or metadata harvesting</td>
</tr>
<tr>
<td>
<span class="old">Messenger</span>
</td>
<td>
<span class="new">Signal / SimpleX</span>
</td>
<td>Messenger isn't E2EE by default and was scanned under Chat Control 1.0</td>
</tr>
<tr>
<td>
<span class="old">Telegram</span>
</td>
<td>
<span class="new">Signal / SimpleX</span>
</td>
<td>Telegram isn't end-to-end encrypted by default</td>
</tr>
</tbody>
</table>
</div>
<ToolCard tool="t-signal">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Replaces WhatsApp</span>
<span class="tool-tag">🇺🇸 · open-source</span>
</Fragment>
<Fragment slot="what">
An encrypted messenger for your texts, calls, video and groups. The direct replacement for
WhatsApp, just as simple.
</Fragment>
<Fragment slot="why">
End-to-end encryption by default, non-profit, an audited protocol that is the world standard.
Almost no metadata kept, and the team has pledged to leave the EU rather than install scanning.
</Fragment>
<Fragment slot="who">
Everyone, starting today. It's the first and most useful step. One catch: a phone number, which
you can hide behind a username.
</Fragment>
<ol slot="install">
<li>
Install from <b>signal.org</b> (App Store, Google Play, or the direct APK on Android).
</li>
<li>Confirm your number by SMS, then set a PIN.</li>
<li>
Settings &gt; Privacy: create a <b>username</b> to hide your number, and turn on{' '}
<b>registration lock</b>.
</li>
<li>Invite your contacts. On desktop, link the desktop app to your phone.</li>
</ol>
</ToolCard>
<ToolCard tool="t-simplex">
<Fragment slot="tags">
<span class="tool-tag">🟡 Intermediate</span>
<span class="tool-tag">No identifier</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
An encrypted messenger with no account, no number and no identifier. You connect by sharing a
link or QR code.
</Fragment>
<Fragment slot="why">
By design, even the servers can't know who talks to whom. It's currently the strongest option
against metadata correlation.
</Fragment>
<Fragment slot="who">
Pseudonymous accounts, sensitive contacts, high-risk. A bit younger than Signal, with a few
rough edges.
</Fragment>
<ol slot="install">
<li>
Install from <b>simplex.chat</b> (F-Droid, Google Play, App Store or APK).
</li>
<li>
Pick a <b>local</b> display name (never your real name: it stays on your device).
</li>
<li>
To add a contact, share a <b>one-time invitation link</b> or a QR code.
</li>
<li>Turn on the passcode lock, and (advanced) configure your own SMP servers.</li>
</ol>
</ToolCard>
<ToolCard tool="t-session">
<Fragment slot="tags">
<span class="tool-tag">🟡 Intermediate</span>
<span class="tool-tag">No phone</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Signal-grade encryption, but with no phone number and onion routing.
</Fragment>
<Fragment slot="why">
Your identity is a random "Session ID." Traffic goes through a decentralised network (Lokinet)
that sharply reduces metadata.
</Fragment>
<Fragment slot="who">
When a phone number is a liability. Smaller ecosystem, best kept for conversations that matter.
</Fragment>
<ol slot="install">
<li>
Install from <b>getsession.org</b> (all platforms).
</li>
<li>
"Create account" generates your Session ID and a <b>recovery phrase</b>.
</li>
<li>Write the recovery phrase on paper: it's the only key to your account.</li>
<li>Share your Session ID (or QR) with your contacts.</li>
</ol>
</ToolCard>
<ToolCard tool="t-briar">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Offline / P2P</span>
<span class="tool-tag">Android · open-source</span>
</Fragment>
<Fragment slot="what">
A peer-to-peer messenger that works <b>with no internet</b>: over Bluetooth, Wi-Fi Direct or
Tor.
</Fragment>
<Fragment slot="why">
No server, so nothing to shut down or seize. Survives internet shutdowns and network censorship.
</Fragment>
<Fragment slot="who">
Protests, disasters, remote areas, blackouts. Android only, and both people need the app.
</Fragment>
<ol slot="install">
<li>
Install from <b>briarproject.org</b> or F-Droid (no iOS).
</li>
<li>
Create a <b>local</b> account (nickname + password), stored only on the phone.
</li>
<li>Add a nearby contact by scanning their QR code, or remotely via a link.</li>
<li>When the network is down, turn on Bluetooth: messages hop device to device.</li>
</ol>
</ToolCard>
<ToolCard tool="t-bitchat">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Bluetooth mesh</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Jack Dorsey's mesh messenger: nearby phones relay messages hop by hop, with no internet, server
or account.
</Fragment>
<Fragment slot="why">
End-to-end encryption (AES-256-GCM) and a "panic mode" that wipes everything with three taps on
the logo.
</Fragment>
<Fragment slot="who">Protests and blackouts, alongside Briar. Use with caution.</Fragment>
<div class="box warn" slot="extra">
<span class="lab">Caution: unaudited</span>
<p>
Its own repo warns it "has not received external security review." Great for resilience, but
don't stake lives on it yet.
</p>
</div>
<ol slot="install">
<li>Install from the App Store (iOS) or the APK/GitHub (Android).</li>
<li>Open the app and pick a nickname. No account to create.</li>
<li>Nearby devices auto-discover over Bluetooth.</li>
<li>In danger, triple-tap the logo to wipe everything (panic mode).</li>
</ol>
</ToolCard>
<ToolCard tool="t-molly">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Hardened Signal</span>
<span class="tool-tag">Android · open-source</span>
</Fragment>
<Fragment slot="what">
A hardened build of Signal for Android, compatible with the same network.
</Fragment>
<Fragment slot="why">
Database encrypted at rest, automatic locking, and a "FOSS" variant fully free of Google
services.
</Fragment>
<Fragment slot="who">
Advanced users, especially on GrapheneOS, with a high threat model. Android only.
</Fragment>
<ol slot="install">
<li>
Add the Molly repo in F-Droid, or grab the APK from <b>molly.im</b>.
</li>
<li>
Choose <b>Molly-FOSS</b> if you want zero Google dependencies.
</li>
<li>Register with your number (same network as Signal).</li>
<li>Set a database password and automatic locking.</li>
</ol>
</ToolCard>
<div class="box">
<span class="lab">Against Chat Control</span>
<p>
Prefer <strong>open-source</strong> apps <strong>outside the big US platforms</strong>, whose
teams have publicly pledged to leave the EU rather than install client-side scanning (Signal
has). Reminder: if the OS itself enforces scanning, the app can't help, hence section 12.
</p>
</div>
src/content/sections/en/04-email.mdx
+103
View File
@@ -0,0 +1,103 @@
---
id: 'email'
part: 2
order: 4
title: 'Encrypted email & PGP'
---
<p class="part-num">
PART 03 · <span class="lvl lvl-1">🟢</span>
</p>
## Encrypted email &amp; PGP
Gmail reads your email and lives in the US, under "Five Eyes" jurisdiction. Leaving Gmail/Outlook is a huge win for minimal effort.
<ToolCard tool="t-protonmail">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Replaces Gmail</span>
<span class="tool-tag">🇨🇭 · open-source · OpenPGP</span>
</Fragment>
<Fragment slot="what">
An encrypted inbox that replaces Gmail or Outlook, and the pivot account for the whole Proton
ecosystem.
</Fragment>
<Fragment slot="why">
Based in Switzerland, outside "Five Eyes" jurisdiction. OpenPGP-compatible: automatic encryption
between Proton accounts and to other PGP services.
</Fragment>
<Fragment slot="who">
Everyone. It's the best starting point to leave Google (see section 05 for the rest of the
suite).
</Fragment>
<ol slot="install">
<li>
Create an account at <b>proton.me</b> (the free tier is enough to start).
</li>
<li>
Import your old messages and contacts with <b>Easy Switch</b> (built in).
</li>
<li>Set up forwarding from Gmail and tell your contacts your new address.</li>
<li>
Install the mobile app, turn on <b>two-factor auth</b>, and use Proton Bridge if you want
Thunderbird.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-tuta">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Replaces Gmail</span>
<span class="tool-tag">🇩🇪 · open-source · post-quantum</span>
</Fragment>
<Fragment slot="what">
A German email service, fully open-source and free of any Google service.
</Fragment>
<Fragment slot="why">
It also encrypts <b>the subject line and some metadata</b>, with post-quantum-resistant
encryption. EU jurisdiction.
</Fragment>
<Fragment slot="who">
Those who want maximum encrypted metadata and fully free software. It doesn't use PGP: to write
encrypted to outsiders, you password-protect the message.
</Fragment>
<ol slot="install">
<li>
Create an account at <b>tuta.com</b> and install the app (available on F-Droid).
</li>
<li>
To write encrypted to a non-user: click the lock and set a password, shared with your
correspondent through another channel.
</li>
<li>Turn on two-factor authentication.</li>
</ol>
</ToolCard>
<ToolCard tool="t-mailbox">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Ethical classic mail</span>
<span class="tool-tag">🇩🇪 · UE · PGP</span>
</Fragment>
<Fragment slot="what">
Two ethical, low-cost European email providers, with server-side PGP support.
</Fragment>
<Fragment slot="why">
Privacy- and eco-conscious, built on open standards (IMAP, PGP). They work with any mail client.
</Fragment>
<Fragment slot="who">
Those who want a "classic" mailbox (read in Thunderbird) but ethical, rather than a closed
encrypted app.
</Fragment>
<ol slot="install">
<li>Create an account (paid, roughly €1 to €3 per month).</li>
<li>Enable server-side PGP encryption (the "Guard" feature at mailbox.org).</li>
<li>Set the account up in Thunderbird or the mobile app of your choice.</li>
</ol>
</ToolCard>
#### PGP in one minute
**PGP** (Pretty Good Privacy) is key-based encryption: you have a _public_ key you hand out, and a _private_ key you keep secret. Anyone with your public key can send you a message that **only you** can decrypt. It's the basis of provider-independent encrypted email. Proton Mail handles it automatically; for manual use, **OpenPGP** works via Thunderbird (built in since v78).
src/content/sections/en/05-navigateur.mdx
+148
View File
@@ -0,0 +1,148 @@
---
id: 'navigateur'
part: 3
order: 5
title: 'Browser & search'
---
<p class="part-num">
PART 04 · <span class="lvl lvl-1">🟢</span>
</p>
## Browser &amp; search
Chrome is an advertising tracker. Google Search profiles every query. Replace both.
<ToolCard tool="t-mullvadbrowser">
<Fragment slot="tags">
<span class="tool-tag">🟡🔴 Interm. / Advanced</span>
<span class="tool-tag">Anti-fingerprint</span>
<span class="tool-tag">🇸🇪 · open-source</span>
</Fragment>
<Fragment slot="what">
The Tor Browser's browser, but without the Tor network: use it with your VPN for a hard-to-track
desktop.
</Fragment>
<Fragment slot="why">
Built with the Tor Project, it's designed so all its users present the{' '}
<b>same digital fingerprint</b>. The result: instead of being unique and thus trackable, you
blend into the crowd. It's the best privacy choice on desktop.
</Fragment>
<Fragment slot="who">
Those who want to go beyond simple ad-blocking, especially pseudonymous accounts and exposed
profiles.
</Fragment>
<ol slot="install">
<li>
Download it from <b>mullvad.net/browser</b> (Windows, macOS, Linux).
</li>
<li>
Use it as-is, without customising: every added extension or setting makes you identifiable
again.
</li>
<li>Pair it with your VPN to also mask your IP address.</li>
</ol>
</ToolCard>
<ToolCard tool="t-firefox">
<Fragment slot="name">Firefox (hardened)</Fragment>
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Replaces Chrome</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">The reference free browser for privacy-respecting daily use.</Fragment>
<Fragment slot="why">
Unlike Chrome (a Google advertising tracker), Firefox is built by a foundation with no interest
in profiling you. With a few tweaks (the <em>arkenfox</em> guide) and the uBlock Origin
extension, it becomes very solid.
</Fragment>
<Fragment slot="who">Everyone, as a main daily browser.</Fragment>
<ol slot="install">
<li>
Install Firefox from <b>mozilla.org/firefox</b>.
</li>
<li>
Add the <b>uBlock Origin</b> extension (ad and tracker blocking).
</li>
<li>
In privacy settings, choose "Strict," disable telemetry, and clear cookies on close. To go
further, apply the arkenfox guide.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-brave">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Blocks everything by default</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
A Chromium-based browser that blocks ads and trackers by default, with a bonus private window
connected to Tor.
</Fragment>
<Fragment slot="why">
It's the simplest option for someone coming from Chrome: same feel, but without the tracking. It
blocks YouTube ads natively, offers encrypted video (Brave Talk, based on Jitsi) and one-click
Tor access, handy to reach a blocked site.
</Fragment>
<Fragment slot="who">
Beginners who want a painless switch from Chrome. (Ignore the crypto/rewarded-ads features if
they don't interest you.)
</Fragment>
<ol slot="install">
<li>
Install Brave from <b>brave.com</b>.
</li>
<li>Set "Shields" to "aggressive," and turn off Brave Rewards if you don't want ads.</li>
<li>For Tor: menu &gt; "New private window with Tor," then wait for "Tor connected".</li>
</ol>
</ToolCard>
<ToolCard tool="t-ublock">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Extension</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
The browser extension that blocks ads, trackers and spy scripts. The highest-return move, in ten
seconds.
</Fragment>
<Fragment slot="why">
Online advertising is the main vector of surveillance and profiling. Blocking it cuts most
tracking, speeds up pages and reduces malware risk.
</Fragment>
<Fragment slot="who">Everyone, on Firefox as well as Chromium browsers.</Fragment>
<ol slot="install">
<li>
Open your browser's extension store and search "uBlock Origin" (the original, by Raymond
Hill).
</li>
<li>Install it. It works right away, no setup needed.</li>
</ol>
</ToolCard>
<ToolCard tool="t-search">
<Fragment slot="tags">
<span class="tool-tag">🟢🟡 Search engines</span>
<span class="tool-tag">Replaces Google Search</span>
</Fragment>
<Fragment slot="what">Search engines that don't profile every query, unlike Google.</Fragment>
<Fragment slot="why">
DuckDuckGo and Brave Search keep no history tied to your identity. Startpage serves Google
results without the tracking. SearXNG goes further: a <b>self-hostable</b> metasearch engine,
sovereignty down to your search bar.
</Fragment>
<Fragment slot="who">Everyone. SearXNG targets those who want to host their own engine.</Fragment>
<ol slot="install">
<li>
In your browser settings, change the default engine to DuckDuckGo, Brave Search or Startpage.
</li>
<li>
For SearXNG: use a public instance (directory at searx.space) or host your own (see section
10).
</li>
</ol>
</ToolCard>
src/content/sections/en/06-dns.mdx
+119
View File
@@ -0,0 +1,119 @@
---
id: 'dns'
part: 3
order: 6
title: 'Encrypted DNS & Cloudflare'
---
<p class="part-num">
PART 05 · NETWORK · DNS · <span class="lvl lvl-2">🟡</span>
</p>
## Encrypted DNS &amp; Cloudflare
DNS is the directory that turns a site name (example.com) into a machine address. The catch: by default your internet provider runs that directory, so it sees **every site you visit**, even when the page is HTTPS. Encrypting your DNS takes that list back from your ISP. It's a quiet setting but one of the most effective.
<ToolCard tool="t-quad9">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Malware-blocking</span>
<span class="tool-tag">🇨🇭 non-profit</span>
</Fragment>
<Fragment slot="what">
An encrypted, Swiss, non-profit DNS resolver that also blocks known malicious domains.
</Fragment>
<Fragment slot="why">
Swiss jurisdiction, no retention of your IP address, protection against phishing and malware. An
excellent "set and forget" choice.
</Fragment>
<Fragment slot="who">
Everyone, especially those who want simplicity and a good jurisdiction.
</Fragment>
<ol slot="install">
<li>
On Android: Settings &gt; Network &gt; <b>Private DNS</b> &gt; enter <b>dns.quad9.net</b>.
</li>
<li>
On iPhone/Mac: install the DoH profile from quad9.net. On PC: set DNS-over-HTTPS in the
browser or the system.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-mullvaddns">
<Fragment slot="tags">
<span class="tool-tag">🟡 Intermediate</span>
<span class="tool-tag">Network filtering</span>
</Fragment>
<Fragment slot="what">
Two encrypted resolvers that also block ads and trackers for the whole device.
</Fragment>
<Fragment slot="why">
<b>Mullvad DNS</b> (Sweden, no-log) is free and offers blocklists. <b>NextDNS</b> is highly
customisable, with a dashboard and per-device profiles, but it's US-based and logs by default
(turn it off in settings).
</Fragment>
<Fragment slot="who">
Those who want system-wide ad-blocking without installing a per-browser extension.
</Fragment>
<ol slot="install">
<li>
Mullvad DNS: use the address shown at mullvad.net/help/dns as your private DNS (same method as
Quad9).
</li>
<li>
NextDNS: create a profile at nextdns.io, <b>disable logging</b>, then apply the config to your
devices.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-cloudflare">
<Fragment slot="name">Cloudflare 1.1.1.1 (with nuance)</Fragment>
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Fast but centralised</span>
<span class="tool-tag">🇺🇸</span>
</Fragment>
<Fragment slot="what">
Cloudflare's 1.1.1.1 encrypted DNS and WARP app: fast, free, and a real upgrade over your ISP's
resolver.
</Fragment>
<Fragment slot="why">
It's useful, with an audited no-logging pledge. But be clear-eyed: Cloudflare already sits in
front of a huge share of the web (as a technical middleman, it can see plaintext traffic to
those sites). Routing your DNS there too means <b>concentrating even more of your footprint</b>{' '}
with one US company under US law.
</Fragment>
<Fragment slot="who">
Fine for everyday use and malware-blocking (1.1.1.1 for Families). Avoid or diversify for
sensitive use: prefer Quad9 or Mullvad DNS instead.
</Fragment>
</ToolCard>
<ToolCard tool="t-pihole">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Whole-network blocking</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
An ad and tracker blocker that protects <b>your whole network at once</b>, installed on a small
computer like a Raspberry Pi.
</Fragment>
<Fragment slot="why">
Where uBlock Origin protects one browser, Pi-hole filters <b>every device</b> in the home,
including those where you can't install an extension: phones, smart TVs, connected objects. Ads
and trackers are blocked at the DNS level, before they even load. <b>AdGuard Home</b> is an
alternative with a more modern interface.
</Fragment>
<Fragment slot="who">
Households that want to clean up all their devices at once, and who have (or want) a Raspberry
Pi or small server.
</Fragment>
<ol slot="install">
<li>On a Raspberry Pi (or a container), run Pi-hole's official installer.</li>
<li>In your router's settings, set the Pi-hole's address as the DNS server.</li>
<li>From now on, every device on your network is filtered automatically.</li>
</ol>
</ToolCard>
src/content/sections/en/07-vpn.mdx
+139
View File
@@ -0,0 +1,139 @@
---
id: 'vpn'
part: 4
order: 7
title: 'VPN: the truth'
---
<p class="part-num">
PART 06 · <span class="lvl lvl-1">🟢</span>
</p>
## VPN: the truth
A VPN is useful, but sold with a lot of lies. Here's what it actually protects.
<div class="box warn">
<span class="lab">What a VPN does NOT do</span>
<p>
A VPN <strong>does not protect you from Chat Control's client-side scanning</strong>: that reads
your messages on your device, before encryption and therefore before the VPN. It's also not an
invisibility cloak: your OS and apps see more than your VPN provider does.
</p>
</div>
<div class="box ok">
<span class="lab">What a VPN does well</span>
<p>
It hides your activity from your <strong>ISP</strong> and masks your <strong>IP address</strong>{' '}
(and thus location) from the sites you visit. Useful against network surveillance, geolocation
and censorship. One piece of the puzzle, not the solution.
</p>
</div>
<ToolCard tool="t-mullvad">
<Fragment slot="tags">
<span class="tool-tag">🟢🟡🔴 All levels</span>
<span class="tool-tag">No account · cash/Monero</span>
<span class="tool-tag">🇸🇪 · open-source</span>
</Fragment>
<Fragment slot="what">
A VPN that masks your IP address and encrypts your traffic up to its servers, without ever
asking for a single piece of personal information.
</Fragment>
<Fragment slot="why">
It's the privacy gold standard. No email, no name: at signup you're given a plain account
number. Audited no-log policy, a single honest price (€5 per month, no tiers, no false
promises), and payment in cash or Monero. That's exactly what matters the day a state tries to
cut off VPN access: an account that can't be tied to your identity, and a payment banks can't
block.
</Fragment>
<Fragment slot="who">
Everyone, from the citizen bypassing an ID check to the high-risk profile. It's the VPN to
recommend first.
</Fragment>
<ol slot="install">
<li>
Go to <b>mullvad.net</b>. If the site is blocked in your country, open it through the Tor
Browser or its <b>.onion</b> address. Click "Generate account number": no email or name is
asked. Save this number in your password manager and never share it, it's your only access
key.
</li>
<li>
Choose the duration and payment method. The price is flat. Three routes: bank card (simplest
if not blocked), cash sent by post, or cryptocurrency.
</li>
<li>
<b>Anonymous crypto payment:</b> click "Create a one-time payment address." Mullvad shows an
address (Bitcoin or Monero) and an exact amount. Send that amount from your wallet. For
maximum anonymity, prefer <b>Monero</b> (private by default); Bitcoin is simpler but
traceable. See section 09 to buy crypto. Allow about 30 minutes for confirmation.
</li>
<li>
Download the app from <b>mullvad.net/download</b> (via Tor if the site is filtered) and
install it. On mobile, use the App Store, Google Play, or the official APK if the app was
pulled from your store.
</li>
<li>
Launch the app, enter your account number, then connect to a server{' '}
<b>outside your country</b>, ideally outside the EU (Switzerland, US…). Enable the "kill
switch" (which cuts the internet if the VPN drops) and Mullvad's DNS.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-protonvpn">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Honest free tier</span>
<span class="tool-tag">🇨🇭 · open-source</span>
</Fragment>
<Fragment slot="what">
The VPN from the Proton ecosystem, with a genuine free tier (rare and honest).
</Fragment>
<Fragment slot="why">
Swiss-based, audited, open-source. Its free tier has no ads, no data resale and no data cap
(only the number of countries is limited). It's the ideal on-ramp for a beginner, especially if
you already use Proton Mail.
</Fragment>
<Fragment slot="who">
Beginners, and anyone already in the Proton ecosystem who wants a single account for everything.
</Fragment>
<ol slot="install">
<li>
Go to <b>protonvpn.com</b> and sign in with your Proton account (or create one).
</li>
<li>Install the app (Windows, macOS, Linux, Android, iOS).</li>
<li>
Use "Quick Connect" or pick a country, then enable the kill switch and NetShield (ad and
tracker blocking).
</li>
</ol>
</ToolCard>
<ToolCard tool="t-ivpn">
<Fragment slot="tags">
<span class="tool-tag">🟡🔴 Interm. / Advanced</span>
<span class="tool-tag">No email · no-log</span>
<span class="tool-tag">🇬🇮 · open-source</span>
</Fragment>
<Fragment slot="what">
A small, especially rigorous and transparent VPN provider, on the same model as Mullvad.
</Fragment>
<Fragment slot="why">
Audited no-log policy, no mandatory email, payment in crypto or cash. It even offers
anti-tracking options (network-level tracker blocking) and signup with no identifier at all.
</Fragment>
<Fragment slot="who">
A solid alternative to Mullvad, for pseudonymous and high-risk profiles who want to diversify.
</Fragment>
<ol slot="install">
<li>
At <b>ivpn.net</b>, generate an account (an ID is created for you, no email).
</li>
<li>Pay in crypto or cash, as with Mullvad.</li>
<li>
Install the app, connect outside the EU, enable the kill switch and the WireGuard protocol.
</li>
</ol>
</ToolCard>
src/content/sections/en/08-censure.mdx
+39
View File
@@ -0,0 +1,39 @@
---
id: 'censure'
part: 4
order: 8
title: 'Censorship & identity checks'
---
<p class="part-num">
PART 07 · CENSURE · DIGITAL IDENTITY · <span class="lvl lvl-2">🟡</span>
</p>
## Censorship &amp; identity checks
The same pretext ("protect minors") is used to force identity checks to access the internet. It's the planned end of online anonymity, and therefore a form of censorship. Here's the state of play, then how to escape it lawfully.
#### Where we stand (2025-2026)
- **France.** The SREN law (May 2024) tasks regulator Arcom with age verification; since April 2025, covered sites must implement it. A decree imposing age checks was upheld by the Conseil d'État on 15 July 2025, and a bill banning under-15s from social media passed the Assemblée on 26 January 2026, which means verifying the age, and thus the identity, of everyone.
- **UK.** Since 25 July 2025, the Online Safety Act requires "highly effective" age verification (ID, credit card, facial estimation). The immediate result: VPN signups jumped over 1,400% within hours. The House of Lords even debated, in early 2026, an age limit on VPN use itself.
- **EU.** The Commission unveiled an age-verification app (April 2025), piloted in five countries, designed to plug into the European digital identity wallet (EUDI Wallet, eIDAS 2) that every state must offer by end of 2026. EFF and EDRi warn: the "zero-knowledge" proof is only optional, and this builds an online-ID infrastructure far beyond child protection.
#### Escaping it lawfully
The counter comes down to one idea: take an IP address in a country that doesn't impose these checks, and obtain the tools anonymously, even if they get blocked one day.
- **An offshore VPN.** Connect to a server outside the filtering country (ideally outside the EU and the "14 Eyes"), with an audited no-log policy. This restores access to networks demanding an ID.
- **Anonymous payment.** Pay for the VPN in crypto or cash (Mullvad, IVPN, Proton accept it). Crucial: if VPNs ever get "banned," payment processors could refuse cards; cash and crypto would be the only options left.
- **Tor to fetch a blocked VPN.** If the provider's site becomes unreachable from your country, use the Tor Browser (or a .onion address) to download the client. Once installed, the VPN is far faster for daily use.
- **Switch your store country.** An Apple/Google account set to another country brings back apps pulled from your local store.
<div class="box warn">
<span class="lab">The law is shifting, check</span>
<p>
Bypassing a geo-restriction is legal in most European countries, but the ground shifts fast:
Utah (US) has criminalised VPN circumvention, and the UK Lords are eyeing VPN limits. Check your
country's law before relying on any method. This guide is about protecting privacy, not hiding a
crime.
</p>
</div>
src/content/sections/en/09-proton.mdx
+75
View File
@@ -0,0 +1,75 @@
---
id: 'proton'
part: 5
order: 9
title: 'Leave Google'
---
<p class="part-num">
PART 08 · TAKE BACK CONTROL · <span class="lvl lvl-2">🟡</span>
</p>
## Leave Google
Google is a single account that knows your email, calendar, files, movements and searches. Replace the whole suite.
<div class="tablewrap">
<table>
<thead>
<tr>
<th>Google</th>
<th>Proton</th>
<th>Others</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<span class="old">Gmail</span>
</td>
<td>
<span class="new">Proton Mail</span>
</td>
<td>Tuta, mailbox.org</td>
</tr>
<tr>
<td>
<span class="old">Google Drive</span>
</td>
<td>
<span class="new">Proton Drive</span>
</td>
<td>Nextcloud, Cryptomator</td>
</tr>
<tr>
<td>
<span class="old">Google Calendar</span>
</td>
<td>
<span class="new">Proton Calendar</span>
</td>
<td>Tuta Calendar</td>
</tr>
<tr>
<td>
<span class="old">Google Password</span>
</td>
<td>
<span class="new">Proton Pass</span>
</td>
<td>Bitwarden, KeePassXC</td>
</tr>
<tr>
<td>
<span class="old">Google One VPN</span>
</td>
<td>
<span class="new">Proton VPN</span>
</td>
<td>Mullvad, IVPN</td>
</tr>
</tbody>
</table>
</div>
The appeal of **Proton** (Swiss, non-profit foundation, open-source): one account replaces all of Google, with end-to-end encryption and a jurisdiction outside "Five Eyes". You can migrate gradually, service by service. If you'd rather not recentralise on one provider, every row has an independent alternative.
src/content/sections/en/10-stockage.mdx
+77
View File
@@ -0,0 +1,77 @@
---
id: 'stockage'
part: 6
order: 10
title: 'Encrypted storage'
---
<p class="part-num">
PART 09 · <span class="lvl lvl-2">🟡</span>
</p>
## Encrypted storage
<ToolCard tool="t-protondrive">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Replaces Google Drive / iCloud</span>
<span class="tool-tag">🇨🇭 · E2EE</span>
</Fragment>
<Fragment slot="what">
An end-to-end encrypted cloud for your files and photos, part of Proton.
</Fragment>
<Fragment slot="why">
Unlike Google Drive or iCloud, Proton can't read your files: they're encrypted before leaving
your device. Swiss jurisdiction, same account as Proton Mail.
</Fragment>
<Fragment slot="who">
Everyone, as a simple, direct replacement for Google's or Apple's cloud.
</Fragment>
<ol slot="install">
<li>Enable Proton Drive in your Proton account and install the app.</li>
<li>Turn on automatic photo backup, then disable Google's/Apple's.</li>
</ol>
</ToolCard>
<ToolCard tool="t-cryptomator">
<Fragment slot="tags">
<span class="tool-tag">🟡 Intermediate</span>
<span class="tool-tag">Encrypt before upload</span>
<span class="tool-tag">🇩🇪 · open-source</span>
</Fragment>
<Fragment slot="what">
A vault that encrypts your files <b>before</b> uploading them to any cloud, even Google Drive or
Dropbox.
</Fragment>
<Fragment slot="why">
The perfect trick if you must keep an existing cloud: you keep the convenient service, but the
provider only sees encrypted gibberish. You alone hold the key.
</Fragment>
<Fragment slot="who">
Those who can't leave a mainstream cloud yet, but want to protect their files right now.
</Fragment>
<ol slot="install">
<li>Install Cryptomator (desktop and mobile) from cryptomator.org.</li>
<li>Create a "vault" in your cloud's synced folder, choose a strong password.</li>
<li>Put your files in the vault: they're encrypted then synced automatically.</li>
</ol>
</ToolCard>
<ToolCard tool="t-nc-storage">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Your own cloud</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Your own cloud (files, calendar, contacts, notes) hosted on your server.
</Fragment>
<Fragment slot="why">
The ultimate degree of control: your data never leaves your hardware. Detailed in section 10
(Self-hosting).
</Fragment>
<Fragment slot="who">Self-hosters. See the full card in section 10.</Fragment>
<a slot="links" class="tool-link" href="#selfhost">
→ Section 10
</a>
</ToolCard>
src/content/sections/en/11-motsdepasse.mdx
+85
View File
@@ -0,0 +1,85 @@
---
id: 'motsdepasse'
part: 7
order: 11
title: 'Password manager'
---
<p class="part-num">
PART 10 · <span class="lvl lvl-2">🟡</span>
</p>
## Password manager
One strong, unique password per service: the foundation of everything that follows. Drop the notebook, drop the reused password.
<ToolCard tool="t-bitwarden">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Best to start with</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
A password vault that remembers, generates and fills your passwords for you, across all your
devices.
</Fragment>
<Fragment slot="why">
Free, audited, cross-platform, and end-to-end encrypted. You only need to remember one strong
password. It's even <b>self-hostable</b> (via Vaultwarden) so you depend on no one.
</Fragment>
<Fragment slot="who">
Everyone. It's the foundation of all security: one strong, unique password per service.
</Fragment>
<ol slot="install">
<li>
Create an account at bitwarden.com and choose a <b>long</b> master password (a phrase). Never
forget it: it can't be recovered.
</li>
<li>Install the browser extension and the mobile app.</li>
<li>
As you log in, let Bitwarden save and then replace your old passwords with generated ones.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-keepassxc">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">100% local</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
A <b>local</b> vault: an encrypted file only you hold, with no cloud and no account.
</Fragment>
<Fragment slot="why">
Nothing leaves your device, unless you choose to sync the file yourself (for example via
Cryptomator). It's the purist's choice, with no middleman at all.
</Fragment>
<Fragment slot="who">
Advanced profiles who want full control and zero online dependency.
</Fragment>
<ol slot="install">
<li>
Install KeePassXC (desktop) and a compatible mobile app (KeePassDX on Android, Strongbox on
iOS).
</li>
<li>Create a database file protected by a master password.</li>
<li>To have it on all devices, sync that file through an encrypted cloud.</li>
</ol>
</ToolCard>
<ToolCard tool="t-protonpass">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">With email aliases</span>
<span class="tool-tag">🇨🇭 · open-source</span>
</Fragment>
<Fragment slot="what">
The password manager of the Proton ecosystem, with built-in disposable email aliases.
</Fragment>
<Fragment slot="why">
Ideal if you're already on Proton: one account for mail, cloud and passwords. Its email aliases
save you from giving your real address everywhere.
</Fragment>
<Fragment slot="who">Those who want everything in one place with Proton.</Fragment>
</ToolCard>
src/content/sections/en/12-deuxfa.mdx
+76
View File
@@ -0,0 +1,76 @@
---
id: 'deuxfa'
part: 7
order: 12
title: 'Two-factor auth & hardware keys'
---
<p class="part-num">
PART 11 · SECURITY · 2FA · <span class="lvl lvl-2">🟡</span>
</p>
## Two-factor auth &amp; hardware keys
A password, even a strong one, can leak. Two-factor authentication (2FA) adds a second proof at login: even if your password is stolen, the account stays locked. It's essential on your sensitive accounts (email, password manager, social).
<div class="box warn">
<span class="lab">Avoid SMS 2FA</span>
<p>
A code sent by SMS is the weak link: it's vulnerable to "SIM-swap" (an attacker gets your number
transferred) and to interception over the phone network (SS7). Studies estimate most SIM-swap
attempts succeed. Use SMS only as a last resort, never as your main protection.
</p>
</div>
<ToolCard tool="t-yubikey">
<Fragment slot="tags">
<span class="tool-tag">🟡🔴 Interm. / Advanced</span>
<span class="tool-tag">FIDO2 hardware key</span>
</Fragment>
<Fragment slot="what">
A small physical key (USB, often with NFC) that proves your identity with a single touch.
</Fragment>
<Fragment slot="why">
It's the strongest 2FA: it resists phishing, because the key checks the site's real address
before responding. <b>Nitrokey</b> is the fully open-hardware, open-firmware alternative. A fake
site can't trick you.
</Fragment>
<Fragment slot="who">
Those who want maximum security on key accounts. Buy <b>two</b> (one main, one backup).
</Fragment>
<ol slot="install">
<li>Get two keys from yubico.com or nitrokey.com.</li>
<li>
In each account's security settings (email, password manager…), add a "security key" or
"passkey." Enrol both keys.
</li>
<li>Keep the backup key in a safe, separate place.</li>
</ol>
</ToolCard>
<ToolCard tool="t-aegis">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">TOTP codes</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Apps that generate the six-digit codes changing every 30 seconds, replacing Google
Authenticator.
</Fragment>
<Fragment slot="why">
<b>Aegis</b> (Android) keeps your codes in a local encrypted vault, no cloud. <b>Ente Auth</b>{' '}
adds end-to-end encrypted sync across devices, and has been audited. Far safer than SMS, and
free.
</Fragment>
<Fragment slot="who">
Everyone: it's the default 2FA level to adopt, ahead of hardware keys.
</Fragment>
<ol slot="install">
<li>Install Aegis (F-Droid) or Ente Auth (all platforms).</li>
<li>On each account, enable "authenticator app" 2FA and scan the QR code shown.</li>
<li>
Write down the <b>backup codes</b> on paper and make an encrypted backup of your vault.
</li>
</ol>
</ToolCard>
src/content/sections/en/13-social.mdx
+122
View File
@@ -0,0 +1,122 @@
---
id: 'social'
part: 8
order: 13
title: 'Decentralised social'
---
<p class="part-num">
PART 12 · <span class="lvl lvl-2">🟡</span>
</p>
## Decentralised social
Instagram, X and Facebook belong to companies that profile you and can censor or delete you overnight. The "fediverse" offers networks owned by their users.
<ToolCard tool="t-mastodon">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Replaces X / Twitter</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
The X/Twitter alternative: a social network made of thousands of independent servers that talk
to each other (the "fediverse").
</Fragment>
<Fragment slot="why">
No single owner, no algorithm deciding for you, no arbitrary ban by one company. The feed is
chronological, with no ads or manipulation.
</Fragment>
<Fragment slot="who">
Everyone. Ideal for information accounts that want a presence no company can cut off.
</Fragment>
<ol slot="install">
<li>
On joinmastodon.org, choose a server (or "instance") that suits you, then create an account.
</li>
<li>
Install an app (the official one, or Ivory, Tusky…) and follow accounts: you see the whole
fediverse, whatever their server.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-nostr">
<Fragment slot="tags">
<span class="tool-tag">🟡🔴</span>
<span class="tool-tag">Un-censorable</span>
<span class="tool-tag">🌍 · open protocol</span>
</Fragment>
<Fragment slot="what">
Not an app but a protocol: a social network where your identity is a simple key pair, like
Bitcoin.
</Fragment>
<Fragment slot="why">
No email, no password, no account anyone can delete. Your posts travel across decentralised
relays and you truly own your audience: no one can ban you for good. You can even receive
Bitcoin tips ("zaps") and switch apps anytime without losing your followers.
</Fragment>
<Fragment slot="who">
Information accounts and creators who fear platform censorship and want a presence truly their
own.
</Fragment>
<ol slot="install">
<li>Install a client: Damus (iPhone), Amethyst or Primal (Android), or a web version.</li>
<li>
The app generates your key pair. <b>Back up your private key (nsec)</b> like a Bitcoin seed
phrase: on paper, never shared.
</li>
<li>Create your profile, follow people, enable zaps to receive sats.</li>
</ol>
</ToolCard>
<ToolCard tool="t-element">
<Fragment slot="tags">
<span class="tool-tag">🟡🔴</span>
<span class="tool-tag">Replaces Discord / Slack</span>
<span class="tool-tag">🌍 · federated · E2EE</span>
</Fragment>
<Fragment slot="what">
Community chat, in the spirit of Discord or Slack, but federated and end-to-end encryptable.
Element is the app, Matrix the network.
</Fragment>
<Fragment slot="why">
You can host your own server (Synapse) and control your data. Perfect for a collective, a
newsroom or an association that wants its own independent space.
</Fragment>
<Fragment slot="who">Communities and groups. See the metadata caveat below.</Fragment>
<ol slot="install">
<li>
Install Element (element.io) and create an account on a public server, or on your own (section
10).
</li>
<li>Join or create rooms, and enable end-to-end encryption for private conversations.</li>
</ol>
</ToolCard>
<ToolCard tool="t-fediverse">
<Fragment slot="tags">
<span class="tool-tag">🟡</span>
<span class="tool-tag">Insta · YouTube · Reddit</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
The federated cousins of Instagram (Pixelfed), YouTube (PeerTube) and Reddit (Lemmy).
</Fragment>
<Fragment slot="why">
Same logic as Mastodon: no single owner, no ad algorithm, no tracking. You post photos, videos
or discussions without feeding a profiling machine.
</Fragment>
<Fragment slot="who">
Those who want to leave Instagram, YouTube or Reddit without giving up the format.
</Fragment>
</ToolCard>
<div class="box">
<span class="lab">Metadata caveat</span>
<p>
Matrix encrypts <em>content</em> well, but in federation, participating servers see room
membership and message timing. For highly sensitive use, prefer SimpleX/Session or self-host
your server.
</p>
</div>
src/content/sections/en/14-argent.mdx
+73
View File
@@ -0,0 +1,73 @@
---
id: 'argent'
part: 9
order: 14
title: 'Financial sovereignty'
---
<p class="part-num">
PART 13 · <span class="lvl lvl-2">🟡</span>
</p>
## Financial sovereignty
Money is surveilled and censorable too. Activists' accounts have been frozen, donations blocked, and every card payment is tracked. Financial privacy is part of sovereignty.
<ToolCard tool="t-bitcoin">
<Fragment slot="name">Bitcoin (self-custody)</Fragment>
<Fragment slot="tags">
<span class="tool-tag">🟡🔴</span>
<span class="tool-tag">Censorship-resistant</span>
</Fragment>
<Fragment slot="what">A digital money you hold yourself, without going through a bank.</Fragment>
<Fragment slot="why">
In <b>self-custody</b> (your keys in a wallet only you control), no one can freeze or block your
funds. Its privacy isn't perfect (the ledger is public), but it escapes banking censorship,
useful the day a payment is refused.
</Fragment>
<Fragment slot="who">
Guarding against account freezes or de-banking, and paying anonymously for a service like a VPN.
</Fragment>
<ol slot="install">
<li>Get some bitcoin (an exchange, or peer-to-peer).</li>
<li>
Move them right away to a wallet <b>you</b> control: a hardware wallet (Trezor, ColdCard) or
an open-source app. Don't leave them on the exchange.
</li>
<li>Back up your recovery phrase on paper, never as a photo or online.</li>
</ol>
</ToolCard>
<ToolCard tool="t-monero">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Private by default</span>
</Fragment>
<Fragment slot="what">
The privacy cryptocurrency: amounts, sender and recipient are hidden by default.
</Fragment>
<Fragment slot="why">
It's the exact opposite of Bitcoin here: transactions are private by design. It's the best way
to pay for a service without leaving a trail back to you.
</Fragment>
<Fragment slot="who">
Those who want maximum financial privacy. Note: Monero is already delisted from several European
exchanges, so you often need a decentralised swap.
</Fragment>
<ol slot="install">
<li>Install a wallet (the official one at getmonero.org, or Cake Wallet on mobile).</li>
<li>
Get XMR through a decentralised exchange service (for example a "swap" from another crypto).
</li>
<li>Back up your recovery phrase on paper.</li>
</ol>
</ToolCard>
<div class="box warn">
<span class="lab">Legality &amp; caution</span>
<p>
Financial privacy is <strong>legal</strong>. Don't confuse it with tax evasion: declare what
must be declared. Cryptocurrencies are <strong>volatile</strong> and scams are common; never
risk what you can't lose, and learn before you act.
</p>
</div>
src/content/sections/en/15-ia.mdx
+87
View File
@@ -0,0 +1,87 @@
---
id: 'ia'
part: 9
order: 15
title: 'Conversational AI'
---
<p class="part-num">
PART 14 · BLIND SPOT · THE AI MADNESS · <span class="lvl lvl-2">🟡</span>
</p>
## Conversational AI
While we fight to encrypt our messages, hundreds of millions of people pour their most intimate thoughts into ChatGPT, Gemini or Copilot, on US servers. This is the blind spot of the whole story. Sheer madness.
What you type into a cloud AI is a **written, timestamped, stored confession**. Worse than a message: you spill your anxieties, your health, your finances, your work secrets, often more honestly than to a friend. And unlike an encrypted messenger, it's all readable in plaintext on the server.
<div class="box warn">
<span class="lab">What the facts say (2025-2026)</span>
<p>
Consumer tiers <strong>train on your data by default</strong>. In January 2026, a US judge
ordered OpenAI to produce <strong>20 million ChatGPT conversations</strong> as evidence: the
affected users were neither notified nor consulted. Deleting a chat{' '}
<strong>does not guarantee</strong> it's gone. And in one leak, 47,000 exposed conversations
held emails, phone numbers and re-identifiable intimate details.
</p>
</div>
#### The counter: local AI
<ToolCard tool="t-localai">
<Fragment slot="tags">
<span class="tool-tag">🟡🔴</span>
<span class="tool-tag">Replaces ChatGPT</span>
<span class="tool-tag">🌍 · 100% local</span>
</Fragment>
<Fragment slot="what">Software to run an AI model directly on your own computer.</Fragment>
<Fragment slot="why">
Your questions never leave the device: no server, no account, no telemetry, and it works
offline. Quality depends on your hardware, but nothing leaks. <b>Ollama</b> and <b>LM Studio</b>{' '}
are the easiest; <b>Jan</b> and <b>GPT4All</b> aim for maximum privacy.
</Fragment>
<Fragment slot="who">
Anyone who uses AI for even slightly personal topics and doesn't want to hand them to a US
server.
</Fragment>
<ol slot="install">
<li>
For a gentle start, install <b>LM Studio</b> or <b>Jan</b> (a graphical interface, like a
normal app).
</li>
<li>
Download a model offered in the app (for example Llama or Mistral), matched to your machine's
power.
</li>
<li>
Chat away: everything happens locally. Ollama is the command-line version for the more
technical.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-cloudai">
<Fragment slot="tags">
<span class="tool-tag">🟢🟡</span>
<span class="tool-tag">Privacy-minded cloud</span>
</Fragment>
<Fragment slot="what">
Cloud AI access, but built for privacy, when a local AI isn't possible.
</Fragment>
<Fragment slot="why">
<b>Duck.ai</b> (DuckDuckGo) gives anonymised access to several models. <b>Lumo</b> (Proton)
encrypts exchanges and doesn't train on them. Far better than consumer ChatGPT, but it's still a
remote server.
</Fragment>
<Fragment slot="who">
Those who want cloud convenience without feeding the giants. Keep non-sensitive topics there.
</Fragment>
</ToolCard>
<div class="box honest">
<span class="lab">The simple rule</span>
<p>
Never paste into a cloud AI what you wouldn't tell a stranger who's recording: identity, health,
passwords, work secrets, confessions. For anything sensitive, use a local AI.
</p>
</div>
src/content/sections/en/16-boiteaoutils.mdx
+192
View File
@@ -0,0 +1,192 @@
---
id: 'boiteaoutils'
part: 9
order: 16
title: 'The everyday toolbox'
---
<p class="part-num">
PART 15 · REPLACE THE REST · <span class="lvl lvl-2">🟡</span>
</p>
## The everyday toolbox
Google and Apple are not just email: maps, notes, calendar, photos, video calls, everything is tied to your identity. Here's how to replace each brick, one at a time, without losing convenience.
<ToolCard tool="t-maps">
<Fragment slot="tags">
<span class="tool-tag">🟢 Beginner</span>
<span class="tool-tag">Replaces Google Maps</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Map and navigation apps, built on OpenStreetMap, that work offline.
</Fragment>
<Fragment slot="why">
Google Maps logs every trip and builds a chillingly precise location history.{' '}
<b>Organic Maps</b> tracks nothing and shows no ads; <b>OsmAnd</b> targets power users (hiking,
contour lines, detailed navigation).
</Fragment>
<Fragment slot="who">
Everyone. Live traffic and transit are less complete than Google's, but everyday navigation is
excellent.
</Fragment>
<ol slot="install">
<li>Install from F-Droid, the App Store or Google Play.</li>
<li>Download the maps of the regions you need in advance for offline use.</li>
</ol>
</ToolCard>
<ToolCard tool="t-notes">
<Fragment slot="tags">
<span class="tool-tag">🟢🟡</span>
<span class="tool-tag">Replaces Docs / Notion</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
End-to-end encrypted notes and documents, to replace Google Docs, Notion or Evernote.
</Fragment>
<Fragment slot="why">
<b>Standard Notes</b> (by Proton) encrypts your notes by default. <b>Joplin</b> handles Markdown
notebooks with optional encryption and the sync of your choice. <b>CryptPad</b> (French) offers
a real-time, fully encrypted Google Docs equivalent.
</Fragment>
<Fragment slot="who">Everyone for notes; CryptPad for multi-person collaboration.</Fragment>
<ol slot="install">
<li>
Standard Notes / Joplin: create an account, install the app, and enable encryption (on by
default in Standard Notes, to switch on in Joplin).
</li>
<li>CryptPad: use cryptpad.fr or another instance, no account needed to start.</li>
</ol>
</ToolCard>
<ToolCard tool="t-visio">
<Fragment slot="tags">
<span class="tool-tag">🟢🟡</span>
<span class="tool-tag">Replaces Zoom / Meet</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Video-conferencing tools with no account or heavy install, to replace Zoom, Google Meet or
Teams.
</Fragment>
<Fragment slot="why">
<b>Jitsi Meet</b> runs in the browser, no account, and can be self-hosted (it's also the basis
of Brave Talk). <b>Element Call</b> is end-to-end encrypted and federated via Matrix. For a
simple, fully encrypted call, <b>Signal</b> calls also do the job.
</Fragment>
<Fragment slot="who">
Everyone. On a public Jitsi server, multi-party calls are transport-encrypted; end-to-end
encryption is optional.
</Fragment>
<ol slot="install">
<li>Jitsi: go to meet.jit.si, create a room name, share the link. Nothing to install.</li>
<li>Element Call: from the Element (Matrix) app, start a call in a room.</li>
</ol>
</ToolCard>
<ToolCard tool="t-photos">
<Fragment slot="tags">
<span class="tool-tag">🟡🔴</span>
<span class="tool-tag">Replaces Google Photos</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Two ways to keep your photos without handing them to Google or Apple.
</Fragment>
<Fragment slot="why">
<b>Ente</b> is a managed, end-to-end encrypted service, with on-device recognition and search:
simple and safe. <b>Immich</b> is a Google Photos clone you <b>host yourself</b> (face and
object search included), for those comfortable running a server.
</Fragment>
<Fragment slot="who">
Ente for everyone; Immich for self-hosters. Note: Immich is not end-to-end encrypted, its
security depends on your server.
</Fragment>
<ol slot="install">
<li>Ente: install the app, create an account, turn on automatic backup of your camera roll.</li>
<li>
Immich: deploy it on your server (see section 10) via Docker, then connect the mobile app.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-alias">
<Fragment slot="tags">
<span class="tool-tag">🟢🟡</span>
<span class="tool-tag">Email aliases</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Disposable email aliases: a unique address per site, forwarding to your real inbox without ever
revealing it.
</Fragment>
<Fragment slot="why">
You stop giving out your real address everywhere. If a site is breached or spams you, you cut
that one alias, and you instantly know who leaked your data. <b>SimpleLogin</b> is integrated
with Proton; <b>addy.io</b> offers unlimited aliases on the free tier.
</Fragment>
<Fragment slot="who">
Everyone, and especially pseudonymous accounts that want to compartmentalise their signups.
</Fragment>
<ol slot="install">
<li>Create an account, install the browser extension.</li>
<li>At each signup, generate a new alias instead of typing your real address.</li>
</ol>
</ToolCard>
<ToolCard tool="t-backups">
<Fragment slot="name">Encrypted backups</Fragment>
<Fragment slot="tags">
<span class="tool-tag">🟡🔴</span>
<span class="tool-tag">Cryptomator · restic</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
A way to back up your phone and computer, encrypting the data <b>before</b> it leaves for any
cloud.
</Fragment>
<Fragment slot="why">
iCloud/Google backups are often accessible to the provider, and thus to courts.{' '}
<b>Cryptomator</b> encrypts your files before sending them to any cloud; <b>restic</b> makes
automatic encrypted backups; <b>Proton Drive</b> is end-to-end encrypted. On iPhone, enable
"Advanced Data Protection" to encrypt your iCloud backups.
</Fragment>
<Fragment slot="who">
Everyone should encrypt their backups. Golden rule: two encrypted copies, on two media, in two
places.
</Fragment>
<ol slot="install">
<li>iPhone: Settings &gt; your name &gt; iCloud &gt; Advanced Data Protection: turn it on.</li>
<li>
PC: install Cryptomator, create a vault, put your files in it before syncing to the cloud.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-databrokers">
<Fragment slot="name">Erase your data (GDPR)</Fragment>
<Fragment slot="tags">
<span class="tool-tag">🟡</span>
<span class="tool-tag">Data brokers</span>
</Fragment>
<Fragment slot="what">
Getting your personal information removed from the "data brokers" that collect and resell it.
</Fragment>
<Fragment slot="why">
In Europe, the GDPR (Article 17) gives you a <b>right to erasure</b>: you can demand, for free,
that a company delete your data, in principle within a month. Services like <b>Incogni</b>{' '}
automate these requests at scale, for a fee.
</Fragment>
<Fragment slot="who">
Those who want to reduce their exposure. Note: data reappears over time, and this doesn't touch
public records or social media. Doing it yourself is free but tedious.
</Fragment>
<ol slot="install">
<li>For a manual request: write to the broker citing GDPR Article 17 and ask for deletion.</li>
<li>
To automate: subscribe to a removal service and let it send the requests on your behalf.
</li>
</ol>
</ToolCard>
src/content/sections/en/17-selfhost.mdx
+154
View File
@@ -0,0 +1,154 @@
---
id: 'selfhost'
part: 10
order: 17
title: 'Self-hosting'
---
<p class="part-num">
PART 16 · ADVANCED SELF-DEFENCE · <span class="lvl lvl-3">🔴</span>
</p>
## Self-hosting
The ultimate level of sovereignty: host your services yourself. Your data lives on your hardware, under the jurisdiction you choose.
<ToolCard tool="t-yunohost">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Turnkey server</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Systems that turn an old PC or a Raspberry Pi into a personal server, with an app catalogue you
install in a few clicks.
</Fragment>
<Fragment slot="why">
Self-hosting sounds scary, but these tools do the heavy lifting. <b>YunoHost</b> even runs your
own email and single sign-on. <b>Umbrel</b> offers a 300+ app store, popular with privacy and
Bitcoin folks. <b>Start9</b> encrypts backups and gives every service a Tor address by default.
</Fragment>
<Fragment slot="who">
Advanced profiles ready to spend an afternoon building their own cloud. It's the most radical
structural counter to Chat Control.
</Fragment>
<ol slot="install">
<li>
Get an old computer, a Raspberry Pi, or rent a small server (VPS) in a protective country.
</li>
<li>Install YunoHost, Umbrel or Start9 following their official guide.</li>
<li>From the catalogue, install Nextcloud, a Matrix server, a photo gallery, etc.</li>
<li>
Reach it privately with Tailscale (card below) rather than exposing the server to the public.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-nextcloud">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Replaces all of Google</span>
<span class="tool-tag">🇩🇪 · open-source</span>
</Fragment>
<Fragment slot="what">
Your own cloud: files, calendar, contacts, photos, notes and collaborative documents, on your
server.
</Fragment>
<Fragment slot="why">
It's the full replacement for Google Drive, Calendar and Contacts, but at home. You choose the
jurisdiction and no one else controls your files. Note: it's "your server" privacy, not
end-to-end encryption by default; you must keep it updated.
</Fragment>
<Fragment slot="who">
Self-hosters. The easiest path is to install it via YunoHost or Umbrel.
</Fragment>
</ToolCard>
<ToolCard tool="t-synapse">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Your chat server</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Your own Matrix chat server, powering Element and encrypted calls.
</Fragment>
<Fragment slot="why">
By hosting the server, you also control the <b>metadata</b> (who talks to whom, when), Matrix's
weak point in federation. It's community chat that you alone own.
</Fragment>
<Fragment slot="who">
Communities, collectives, newsrooms that want their own independent federated space.
</Fragment>
</ToolCard>
<ToolCard tool="t-tailscale">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Private access to your server</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
A private encrypted network linking your devices to your server, without ever exposing it on the
public internet.
</Fragment>
<Fragment slot="why">
Instead of opening ports (and getting attacked), <b>Tailscale</b> builds a WireGuard tunnel
between your authorised devices only: your server has no public attack surface. <b>Headscale</b>{' '}
is the self-hosted version, so you depend on no third party. <b>WireGuard</b> alone gives full
control, at the cost of manual setup.
</Fragment>
<Fragment slot="who">
Every self-hoster. It's the safe way to reach your Nextcloud or photos from outside.
</Fragment>
<ol slot="install">
<li>
Install Tailscale on your server and on your phone/PC, connect them to the same account.
</li>
<li>
Your devices instantly see each other on a private network; reach your server at its Tailscale
address.
</li>
<li>For zero dependency, replace the coordination server with self-hosted Headscale.</li>
</ol>
</ToolCard>
<ToolCard tool="t-website">
<Fragment slot="name">Your own website</Fragment>
<Fragment slot="tags">
<span class="tool-tag">🟡🔴</span>
<span class="tool-tag">Ban-proof your voice</span>
</Fragment>
<Fragment slot="what">
A site of your own, on your own domain name, where your content depends on no platform.
</Fragment>
<Fragment slot="why">
The day a network deletes or suspends your account, all your work vanishes. A personal site is
your anchor: your posts stay there, archived and up to date, whatever happens. It's exactly what
cautious information accounts do. A static site (built with Hugo, Astro or Jekyll) is enough and
publishes almost for free; for a dynamic blog, a self-hosted WordPress or Ghost does the job.
</Fragment>
<Fragment slot="who">
Information accounts, creators, activists, anyone who publishes and fears platform censorship.
</Fragment>
<ol slot="install">
<li>Buy a domain name (ideally from a privacy-respecting registrar).</li>
<li>
Choose a static-site generator (Astro, Hugo) and host the output, or install WordPress/Ghost
on your server.
</li>
<li>
Always point to it from your social accounts: your audience finds you even if one account
falls.
</li>
</ol>
</ToolCard>
<div class="box">
<span class="lab">The jurisdiction point</span>
<p>
Self-hosting also means choosing <em>where</em> your data lives. A server at home or in a
protective country escapes the scanning duties imposed on big platforms. It's the most radical
structural counter to Chat Control.
</p>
</div>
src/content/sections/en/18-tor.mdx
+53
View File
@@ -0,0 +1,53 @@
---
id: 'tor'
part: 11
order: 18
title: 'Tor'
---
<p class="part-num">
PART 17 · <span class="lvl lvl-3">🔴</span>
</p>
## Tor
The network that separates who you are from what you do online.
<ToolCard tool="t-tor">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Network anonymity</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
A network that separates who you are from what you do online, accessible via the Tor Browser.
</Fragment>
<Fragment slot="why">
Your traffic bounces through several encrypted relays worldwide: none knows both your identity
and your destination. It's the tool of journalists and sources, and the way to reach a blocked
site (for example to download a censored VPN).
</Fragment>
<Fragment slot="who">
High-risk profiles, and anyone who must decouple their activity from their real IP. Use it
occasionally, not as an everyday browser.
</Fragment>
<ol slot="install">
<li>
Download the Tor Browser from <b>torproject.org</b> (Windows, macOS, Linux, Android).
</li>
<li>Launch it and click "Connect." If Tor is blocked in your country, enable a "bridge."</li>
<li>
Browse without maximising the window, without installing extensions, and{' '}
<b>without logging into your real accounts</b>.
</li>
</ol>
</ToolCard>
<div class="box warn">
<span class="lab">Limits, not magic</span>
<p>
Tor protects transport, not your habits: log into your real account and you deanonymise
yourself. It's slower, and the exit node sees unencrypted traffic (use HTTPS). For serious
anonymity, pair it with Tails (section 12).
</p>
</div>
src/content/sections/en/19-os.mdx
+138
View File
@@ -0,0 +1,138 @@
---
id: 'os'
part: 12
order: 19
title: 'Free operating systems'
---
<p class="part-num">
PART 18 · <span class="lvl lvl-3">🔴</span>
</p>
## Free operating systems
The keystone. If client-side scanning can be imposed by the operating system itself, the only real counter is to control that OS. That's true on the phone (GrapheneOS) and on the computer (Linux). Don't underestimate this: as long as you stay on Windows, macOS or a Google Android, you don't truly control your machine.
<ToolCard tool="t-grapheneos">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">De-Googled mobile</span>
<span class="tool-tag">Android · Pixel · open-source</span>
</Fragment>
<Fragment slot="what">
A fully de-Googled Android, installed on a Pixel phone: mobile sovereignty.
</Fragment>
<Fragment slot="why">
It's the structural defence par excellence against an OS or app store that would scan you.
Google services in an optional sandbox, <b>per-app network permissions</b>, isolated profiles,
auto-reboot that purges keys from memory, a duress PIN that wipes the phone. So respected for
security that it's used by spyware targets.
</Fragment>
<Fragment slot="who">
Exposed profiles, but also any citizen willing to buy a Pixel to take back control of their
phone.
</Fragment>
<ol slot="install">
<li>
Get a compatible <b>Google Pixel</b> phone (it's the only supported hardware, for security
reasons).
</li>
<li>
On a computer, go to <b>grapheneos.org/install</b> and follow the web installer (a few clicks,
no terminal needed).
</li>
<li>
For your apps, install the free F-Droid store; add sandboxed Google Play only if needed.
</li>
<li>Set a long passphrase (not a 4-digit PIN) and learn the "Lockdown" mode.</li>
</ol>
</ToolCard>
<ToolCard tool="t-linux">
<Fragment slot="name">Linux (on desktop)</Fragment>
<Fragment slot="tags">
<span class="tool-tag">🟡🔴</span>
<span class="tool-tag">Replaces Windows / macOS</span>
<span class="tool-tag">🌍 · free</span>
</Fragment>
<Fragment slot="what">
A free operating system for your computer, replacing Windows or macOS. It comes in many
flavours, called "distributions."
</Fragment>
<Fragment slot="why">
It's many people's blind spot: they encrypt their messages but keep a Windows that streams
telemetry to Microsoft nonstop (whose "Recall" feature tried to screenshot the screen
continuously), or a macOS that reports the apps you launch. Linux doesn't spy on you, it's free,
it revives old computers, and it finally makes you master of your machine. It's easier than its
reputation: modern distributions look like Windows or macOS.
</Fragment>
<Fragment slot="who">
Anyone can make the switch. To start, <b>Linux Mint</b> (closest to Windows) or <b>Fedora</b>;{' '}
<b>Debian</b> for stability. No need to wipe anything: you can test first, then install
alongside your current system.
</Fragment>
<ol slot="install">
<li>
Not sure which distribution? Answer the <b>distrochooser.de/fr</b> quiz, which points you to
the right one for your needs.
</li>
<li>
Try it <b>without installing anything</b>, right in your browser, at <b>distrosea.com</b>.
</li>
<li>
Once convinced, download the distribution's image and create a bootable USB (with Ventoy or
Balena Etcher).
</li>
<li>
Boot from the USB to try the system "live," then run the install. Enable the disk encryption
it offers.
</li>
</ol>
</ToolCard>
<ToolCard tool="t-tails">
<Fragment slot="tags">
<span class="tool-tag">🔴 Advanced</span>
<span class="tool-tag">Amnesic USB</span>
<span class="tool-tag">🌍 · all via Tor</span>
</Fragment>
<Fragment slot="what">
A system that boots from a USB stick, routes all traffic through Tor and leaves <b>no trace</b>{' '}
when shut down.
</Fragment>
<Fragment slot="why">
On shutdown, everything is forgotten: it's "amnesic." Ideal for sensitive, one-off work on a
computer that isn't yours, leaving nothing behind.
</Fragment>
<Fragment slot="who">
Whistleblowers, journalists, sources. The reference tool for high-risk work.
</Fragment>
<ol slot="install">
<li>
Download Tails from <b>tails.net</b> and follow the wizard to create the USB stick.
</li>
<li>Reboot the computer from that USB. Use it, then shut down: everything vanishes.</li>
</ol>
</ToolCard>
<ToolCard tool="t-qubes">
<Fragment slot="tags">
<span class="tool-tag">🔴 Expert</span>
<span class="tool-tag">Compartmentalisation</span>
<span class="tool-tag">🌍 · open-source</span>
</Fragment>
<Fragment slot="what">
Two niche systems: Qubes compartmentalises your PC into sealed virtual machines; postmarketOS
runs Linux on old phones.
</Fragment>
<Fragment slot="why">
Qubes isolates each activity (work, banking, risky browsing) in its own compartment: a
compromise doesn't reach the rest. postmarketOS extends the life of phones abandoned by their
maker.
</Fragment>
<Fragment slot="who">Expert users with a very high threat model.</Fragment>
</ToolCard>
#### Harden your device
Even without switching OS, you gain a lot: install apps via **F-Droid** (free store) or **Aurora Store**, replace Google services with **microG**, create separate profiles, cut needless network permissions, disable automatic cloud backup and the advertising ID.
src/content/sections/en/20-telephonie.mdx
+46
View File
@@ -0,0 +1,46 @@
---
id: 'telephonie'
part: 12
order: 20
title: 'Telephony & physical device'
---
<p class="part-num">
PART 19 · HARDWARE · <span class="lvl lvl-3">🔴</span>
</p>
## Telephony &amp; physical device
The best app is useless if the device itself betrays you. Here are the hardware threats and the moves that neutralise them.
#### The phone number is a tracker
Your number ties together your SIM card, your device (its IMEI identifier), your location and your identity (most countries require ID to buy a SIM). It's the thread that lets everything be cross-referenced.
- Use **number-free** messengers (SimpleX, Session) for sensitive contacts, and always prefer Signal over SMS.
- For a separate identity, a "data-only" SIM or prepaid eSIM limits the link at the point of sale (check your country's rules).
#### IMSI-catchers &amp; the phone network
"IMSI-catchers" (or "stingrays") are fake cell towers that force phones to connect so they can log their identifier and sometimes intercept communications, often by downgrading to weakly encrypted 2G. In parallel, an old network flaw (SS7) still allows SMS interception and remote phone location: one more reason to drop SMS.
- **Disable 2G** in settings (possible on Android and GrapheneOS) to cut the main interception vector.
- At a protest or in a sensitive area, switch to **airplane mode** or slip the phone into a **Faraday bag** (which blocks all signal). The EFF even publishes a free tool, Rayhunter, to detect IMSI-catchers.
#### Biometrics or passcode?
<div class="box warn">
<span class="lab">A finger can be forced, a passcode can't</span>
<p>
Your face or finger can be applied to the sensor while you're restrained (at a border, during an
arrest); a password in your head cannot. Before a risky situation, force a return to the
passcode: on iPhone, hold the side button and a volume button (the "SOS" screen); on
Android/GrapheneOS, use <b>Lockdown</b> in the power menu, which disables biometrics until the
PIN is entered. Choose a long passphrase, not a four-digit PIN. GrapheneOS even offers a{' '}
<b>duress PIN</b> that wipes the phone.
</p>
</div>
#### De-Microsoft, de-Apple
Don't forget the computer: Windows streams telemetry nonstop (and its "Recall" feature tried to screenshot the screen continuously), macOS reports the apps you launch. The real exit is Linux (see section 12). Short of that, disable telemetry, the advertising ID and "Recall," and add an outbound firewall (like Little Snitch on Mac).
src/content/sections/en/21-opsec.mdx
+37
View File
@@ -0,0 +1,37 @@
---
id: 'opsec'
part: 13
order: 21
title: 'Anonymity & OPSEC'
---
<p class="part-num">
PART 20 · <span class="lvl lvl-3">🔴</span>
</p>
## Anonymity &amp; OPSEC
For the pseudonymous account and the whistleblower. Here you no longer protect just a message: you protect an **identity**.
#### Pseudonymity vs anonymity
The golden rule: **never cross your real identity with your public one**. Not the same email, number, device, network, posting hours or writing style. A single leak links the two.
- **Identity-less accounts** : SimpleX and Session need no number; pair them with disposable email aliases. Beware resold, traceable "virtual numbers".
- **Clean metadata** : a posted photo often carries the date, device model and sometimes GPS coordinates (EXIF data). Strip it with _Metadata Cleaner_, _mat2_ or _ExifTool_ before posting; watch file names and document metadata too.
- **Network anti-correlation** : use Tor/Tails to decouple your activity from your home IP. Never mix your personal and pseudonymous networks. A SIM in your name betrays your location no matter what else you do.
- **Compartmentalisation** : a device, or at least a profile, dedicated to the public identity, a separate password manager, and never a cross-login between the two worlds.
#### Passing documents as a source
**SecureDrop** is the anonymous submission system many newsrooms use to receive documents from sources. Many outlets also publish a PGP key and a Signal contact. Never submit from your work hardware or usual network.
<div class="box honest">
<span class="lab">Honesty, don't overestimate yourself</span>
<p>
Strong anonymity against a state adversary is <strong>hard and fallible</strong>. This guide
gives bearings, not guarantees. If lives depend on it, train with the authoritative references:{' '}
<em>EFF Surveillance Self-Defense</em>, <em>Freedom of the Press Foundation</em>,{' '}
<em>Privacy Guides</em>. Strictly defensive and journalistic context.
</p>
</div>
src/content/sections/en/22-ecosysteme.mdx
+72
View File
@@ -0,0 +1,72 @@
---
id: 'ecosysteme'
part: 14
order: 22
title: 'The full free ecosystem'
---
<p class="part-num">PART 21 · GOING FURTHER</p>
## The full free ecosystem
Fully de-Googling means replacing each brick with a free equivalent. The common logic (**free software + control of your device + self-hosting**) is the real counter to client-side scanning.
<div class="eco">
<div class="eco-cat">
<h4>Office</h4>
<ul>
<li>LibreOffice</li>
<li>OnlyOffice</li>
</ul>
</div>
<div class="eco-cat">
<h4>Media</h4>
<ul>
<li>VLC</li>
<li>Jellyfin</li>
<li>FreeTube / NewPipe</li>
<li>Audacity · OBS</li>
<li>GIMP · Inkscape</li>
<li>Calibre · Shotcut</li>
</ul>
</div>
<div class="eco-cat">
<h4>Cloud &amp; network</h4>
<ul>
<li>Nextcloud</li>
<li>Pi-hole</li>
<li>KDE Connect</li>
</ul>
</div>
<div class="eco-cat">
<h4>Free mobile</h4>
<ul>
<li>F-Droid · Aurora</li>
<li>microG</li>
<li>postmarketOS</li>
</ul>
</div>
<div class="eco-cat">
<h4>Security</h4>
<ul>
<li>Bitwarden</li>
<li>KeePassXC</li>
<li>Wireshark</li>
</ul>
</div>
<div class="eco-cat">
<h4>Email &amp; desktop</h4>
<ul>
<li>Thunderbird</li>
<li>FairEmail</li>
</ul>
</div>
<div class="eco-cat">
<h4>Dev &amp; advanced</h4>
<ul>
<li>Termux · git</li>
<li>QEMU / KVM · Wine</li>
<li>Flatpak · GNU/Linux</li>
</ul>
</div>
</div>
src/content/sections/en/23-action.mdx
+24
View File
@@ -0,0 +1,24 @@
---
id: 'action'
part: 15
order: 23
title: 'Migration & digital civil disobedience'
---
<p class="part-num">PART 22 · TAKE ACTION</p>
## Migration &amp; digital civil disobedience
#### A step-by-step plan
1. **Week 1 🟢** : Install Signal and bring your close ones over. Move to Proton Mail or Tuta. Set up a password manager and uBlock Origin.
2. **Week 2 🟡** : Move files to an encrypted cloud, replace Chrome/Google Search, get a VPN, open a Mastodon account.
3. **Then 🔴** : Depending on your profile: GrapheneOS, Tor/Tails, self-hosting, OPSEC discipline.
<div class="box warn">
<span class="lab">Common mistakes</span>
<p>
Believing one tool is enough; reusing your real number for an anonymous account; installing ten
apps without changing habits; forgetting the weak link is often the device itself.
</p>
</div>