That doesn’t work with a VPN (unless you have root)

I just use NextDNS via the DNS-over-TLS (Private DNS) setting in Android

Doesn’t I2P encrypt the traffic already?

I tried the second approach for some time, but using NoScript became really annoying, since I never knew which scripts are necessary, and which are used for tracking or some other bullshit. It was always trial and error, and just felt tedious and unnecessary. I wish NoScript would have a built in whitelist of scripts that are known to be necessary for websites to function, this would avoid breakages and make it much more comfortable to use.

And basically 99% of the modern web doesn’t work without JS. I don’t know why there are still so many people running around and saying “disAblE jAvAscrIpT!!!”, yeah like how the fuck am I supposed to use the web??? At that point, I could also just delete my web browser, it would literally have the exact same effect.

You don’t control any VPN services hosted on someone else’s (e.g. a cloud provider’s) infrastructure. They have full access and can technically do anything. And they see your incoming and outgoing connections. This is stupid, and doesn’t give you any privacy benefit. There are good and trustworthy VPN providers like Mullvad, IVPN and Proton. Just acknowledge that.

RCS is a pile of garbage for many reasons. On Android, it’s locked behind Google’s proprietary, privacy-invasive Messages app, and there is no API for third-party RCS clients (like with SMS). The encryption is also implemented in that proprietary client, offering no transparency and meaning that it’s probably backdoored. No one should ever trust encryption software if its source code isn’t public. People should use actual private messengers like Signal, with open source applications available for all platforms, as well as all of the features you mentioned. The only thing it obviously lacks is SMS fallback, but it’s really unnecessary, because Wi-Fi or cell data are literally available everywhere nowadays.

Just use Signal. It’s private and secure, available on every platform (including desktop), you can send photos, voice messages and all kinds of other files.

I think we should spread this message and the guide in other communities or on other platforms. I don’t think posting this in the Firefox community will achieve much.

I’ve been using OpenCalc, but CalcYou seems great too

This is just talking about developers having to include a link to their privacy policy in the respective field in the App Store/Play Store

A privacy policy is only legally required when you actually collect user data. Most devs don’t write a privacy policy for no reason, so seeing one can often be suspicious. Btw if you are worried about a FOSS app tracking you without disclosing it in their privacy policy, if this is the case, F-Droid would display it under the Anti-features section.

Yes, I use and recommend Clock You: https://f-droid.org/packages/com.bnyro.clock/

+1 for the Minecraft Clock mentioned in another comment tho

It’s actually a problem with Google, because the only reason GrapheneOS doesn’t pass the Play Integrity API check is that Google enforces a whitelist of allowed operating systems. Even though GrapheneOS is 10x as secure as the stock OS, Google doesn’t allow it. Since this is a highly monopolistic practice, the GrapheneOS team is talking to regulators to finally stop this: https://grapheneos.social/@GrapheneOS/112916691727814901

Because it’s Google’s proprietary garbage app. Use FOSS alternatives from F-Droid instead.

I don’t really think a separate device like a phone is necessary to store 2FA tokens, the only option I would consider is a hardware key like YubiKey for storing TOTPs.

Personally I wouldn’t keep my TOTP together with my passwords, but it’s up to you

macOS doesn’t support some basic ways of rendering text and colors. I see iTerm as strictly necessary if you are serious about using the Terminal on a Mac.

It seems like you’re using the standard macOS Terminal. It has all kinds of issues with many terminal applications. I recommend switching to iTerm2. You can install it with a simple brew install --cask iterm2

Using 2FA on all accounts that offer it is just as important. And make sure to use a good, open-source TOTP client like Aegis on Android or Tofu on iOS.

Definitely make sure to backup your seeds in an encrypted format (e.g. Veracrypt container or GPG-encrypted files). If you lose your seeds, you lose access to your accounts.
I like to use the automatic backup feature in Aegis, which syncs my encrypted vault to my Nextcloud server. You can also enable compatibility with Android’s backup API and use that if your ROM includes a backup solution like Seedvault.