Last fall, we soft-launched Tor VPN Beta as a way to extend Tor's privacy protections beyond the browser to an entire Android device. Since then, we've been able to learn from how people are actually using it in real-world scenarios. This post walks through what makes our per-app circuit isolation different from commercial VPNs, the surprising UX lesson when trying to bypass blocks, and the mobile foundation we're building for what's next.
guardianproject/orbot-android
The Github home of Orbot: Tor on Android (Also available on gitlab!)
No more “Root” features in Orbot… use Orfox & VPN instead!
People, Apps and Code You Can Trust
Improve device security with Advanced Protection for Android - Android Help
When you turn on Advanced Protection, you get the strongest security and privacy features to protect you and your device against online attacks, harmful apps, and data risks. This feature offers seve
GrapheneOS: the private and secure mobile OS
GrapheneOS is a security and privacy focused mobile OS with Android app compatibility.
A new project tackling transparency in the VPN ecosystem
We are kicking off the development of a new methodology to assess the policies and practices of VPN providers through a human rights lens.
Trying Tailscale.
Like most folks working in infrastructure engineering in 2014, I really enjoyed Google’s BeyondCorp whitepaper. My foremost personal interest was grounded in the fact that Uber’s contemporaneous security implementation didn’t include a VPN, so it was interesting to see a well-thought description of fostering security without over-reliance on a hardened network for employee devices. I had a second, longer-term, personal interest as well, which was never again having to argue with a coworker about why they needed to log into the VPN before accessing a secure resource.
I Decompiled the White House's New App
The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes, and loads JavaScript from some guy's GitHub Pages.
A new layer of security for certified Android devices
Starting in 2026 and in select countries first, Android apps must be registered to a verified developer in order to be installed.
Google’s iron grip on Android: Controlling open source by any means necessary
From the archives: Android is open—except for all the good parts.
WAFRN | F-Droid - Free and Open Source Android App Repository
The social network that respects you
First Time Building My Own Proxy To Hide My VPN (ft. youtube comments)
Haggle: Clean-slate networking for mobile devices
Jing Su, James Scott, Pan Hui, Eben Upton, Meng How Lim, Christophe Diot, Jon Crowcroft, Ashvin Goel, Eyal de Lara
A BlueSky thread by GrapheneOS on Skyview
We strongly oppose the Unified Attestation initiative and call for app developers supporting privacy, security and freedom on mobile to avoid it. Companies selling phones should not be deciding which operating systems people are allowed to use for apps. uattest.net
Decentralizing My Smartphone With Single Purpose Devices
Lately, I’ve become nostalgic for the days before smartphones, when the internet was a place we went to deliberately, and not a place that lived on all of ou...
Holochain | Distributed app framework with P2P networking
Holochain delivers beyond the promises of blockchain by providing a lightweight, secure and versatile framework for everyday distributed apps.
Add support for WebRTC · google/android-emulator-container-scripts@b0b9a34
This adds a multi-container example that makes the emulator accessible over the web over https. It consists of three containers: - Envoy proxy - Nginx - Emulator And a react application that dem...