What's your opinion about QubesOS ? Is it really more secure?

Lounge EndeavourOS pub
21

Sorry for picking the wrong smiley! My bad! I wanted to pick the sad one as a sign of confirmation.

22

No problem.

1 Like
23

It is exactly what you read - isolation - without contact to the outside world - access to the outside only on grant.

No - it is not.

No you will not.

VirtualBox is a type2 hypervisor - that means it requires an operating system to function.

QubesOS is built using the Xen hypervisor which is a type-1 which runs on bare metal.

What QubesOS does is rather unique. You need to use it to understand it. The developers has completely isolated the virtual machines from accessing other vms address space and diskspace. Of course if your hypervisor running on domain0 is compromized there is only one thing to do - reinstall.

Roughly it is a bare-metal hypervisor and everything you do is to create virtual machines - which runs totally independent of each-other - isolated.

You define and assign zones in which they operate - allowing them access to network - you can even restrict the virtual machines by firewalling e.g. your banking vm to only access your banking site.

You can create temporary vms which are spun up once and removed when closed - only the definition persist.

So QubesOS is - to paraphrase - a reasonable secure system - because no system can be as secure as the user.

The OS is resource heavy compared to other systems but the advantages are many if your wear your tin-foil-hat.

6 Likes
24

It costs more than money, it takes time, effort and a willingness to incur inconvenience.

If qubes is more secure, how come everyone doesn’t run it? Because it is a pain to have everything separated in containers. They aren’t only isolated from an attacker, they are isolated from each other.

When it comes to security, you have to decide which risks are the most important to you and how do you protect yourself from those things. Creating a “completely secure system” is a myth unless it is air-gapped.

5 Likes
25

And only if it’s operated by yourself…BUT
Can you trust yourself?!

2 Likes
26

Its not that I can’t tolerate inconvenience. From the moment I applied the arkenfox user.js & added Noscript I am well aware what inconvenience feels like. Other than that I am using the hardened kernel. I just want a way to isolate my personal data so that even if an attacker manages to penetrate Nftables he/she fails to access any of my personal stuff.

Edit : I forgot to mention that I am running all Internet facing app like Firefox, Thunderbird, Pidgin inside a Firejail sandbox. As you know Firejail too creates isolation to a certain level. For example while using Firefox I cant access any folder other than Downloads.

27

Technically even “air-gapped” systems can be compromised by using an external device to induce abnormal behaviours upon traditional hardwired electronics and in doing so can infer data from the system remotely.

Russian scientists have already shown that you can use speakers to transmit data in an encrypted format from an air-gapped device even when the speakers themselves produce no sound and are switched off, simply having a AUX cable connected is enough.

Similar concepts also apply to USB cables, Serial Cables, etc.
In extreme cases you can even use modified firmware inside of the microcontrollers themselves at production time to cause the traces on a PCB to operate as antennas and constantly leak data on command.

Computers cannot be secure to ALL threats, you can only attempt to secure yourself against the most common threats to a limited extent.

If you don’t want your data to be stolen, don’t store it digitally.

1 Like
28

What about wrapping case, cables, monitors in Tin-Foil ? :face_with_hand_over_mouth:

HA! Get this russian h4xXx0rs!!! :male_detective:

29

Well most people don’t have access to tin-foil these days…
Usually it’s aluminium foil, and even then it is often not 100% pure aluminium, primarily to save cost and modify certain properties.

Anyway…
On a serious note, you could use surface materials to reduce interaction with or modify the behaviour of your cables, but ultimately the end result will be the same, techniques will be developed to circumvent whatever defenses you have implemented and you’ll be back to square one all over again.

Computers are by their design, insecure, and no matter what you do, you cannot overcome that flaw.
If you want absolute security & privacy then operating a computer is out of the question.

I wouldn’t worry too much though, because unless you’re a well known political activist, journalist, reporter, investigator, or, seen as a traitor to a particular nation, you’ll not be of interest to anybody in the intelligence sector, and so your biggest threat will be script kiddies & so-called professional hackers who intend to damage your reputation or your financial situation for their own gain.

Defending against common criminals and actors is easily enough done, use good multi-factor security, don’t share information unless you genuinely need to, think about what you share and who you share it with, keep out of trouble, and, use common sense when securing or hiding information that you don’t want others to see (Financial Information for example, Personal Documents, etc).

30

Theoretically speaking, can Whonix’ gateway get compromised/ (hacked) ? I know I have to read up on Whonix but the thought just passed my mind.

31

Theoretically of course, it’s still maintained by humans, but if you do everything right and follow their news stream / forums (it’s a bit like Arch in that sense) - you’ll be fine :upside_down_face:

Most vulnerable part of Whonix is VirtualBox, but you can Virtualize it somewhere else or through Qubes-Whonix (it’s just a bit harder for newcomers)

1 Like
32

You can just encrypt your data, no?

1 Like
33

Is Veracrypt a good choice ?

34

Encryption isn’t a magic security pill. Your data can’t be encrypted all the time. There is no doubt that encryption is super important but people shouldn’t think “My data is encrypted so I have nothing else to worry about.”

Encryption isn’t an alternative to the type of isolation provided by Qubes in most cases.

A good choice for what? There are lots of different places and ways encryption can be used.

1 Like
35
36

Yup I agree, but for local data it should be enough to make it “not worthwhile”?

37

I am using Veracrypt in two ways :

  1. I have encrypted the external USB drive that I use for backups. I am not using an encrypted container. The whole device is encrypted.

  2. I have created an encrypted container & copied all my important data & finally uploaded the container to Mega.

But none of my data which resides on my SSD & HDD are encrypted.

38

I guess it depends what kind of encryption we are talking about.

If we are talking about full disk encryption, all that protects you against if physical loss. It has no real benefit against the types of attacks that qubes would protect you against.

Again, I think it is important and almost everyone should do it but it is protection against a completely different attack vector.

39

Those are reasonable applications of veracrypt.

You should consider encrypting all your local drives. But with luks, not veracrypt.

40

Before I do that let me explain. This is a desktop so chances of it getting stolen is negligible. I am the only person in my house who knows how to use a computer.
Do you still think I should encrypt ? I will have to reinstall EO. If its important I will do it.