| ▲ | fsflover 6 hours ago |
| It seems Qubes OS and Qubes-Whonix are not affected. |
|
| ▲ | handedness 2 hours ago | parent | next [-] |
| > It seems Qubes OS and Qubes-Whonix are not affected. This is dangerously incomplete and bad advice. Qubes OS does not work the way you seem to think it does. Creating a new identity in the Tor Browser inside a disposable VM does not automatically stop that VM and start a new disposable VM. That initial disposable VM launches the new identity from the existing process and therefore remains vulnerable, the same as any bare metal computer running Tor Browser would. Virtualization is not magic. A Qubes OS user needs to spin up a new disposable Whonix VM to sidestep this attack. Creating a new identity alone is ineffective in this threat model. If you care about these projects as much as you say you do, please stop giving harmful advice. You do it in various places on the Internet and in every thread which gives you half a chance to do so, and these projects would be better off if you either took any of the extensive well-reasoned correction many people offer you, or opted to stop making such claims. The former would be ideal, the latter still vastly preferable to the existing state of affairs. |
|
| ▲ | hrimfaxi 6 hours ago | parent | prev | next [-] |
| How so? If you kept a disposable VM open and just created new identities in tor browser, how does Qubes mitigate the threat here? |
| |
| ▲ | handedness 2 hours ago | parent | next [-] | | I believe you are correct, and that this poses a significant risk for people who don't properly understand the underlying concepts. A Qubes OS user needs to start a new disposable Whonix workstation VM to sidestep this attack, NOT create a new identity in the same disposable VM's browser, which is exactly what this attack targets. | |
| ▲ | fsflover 6 hours ago | parent | prev [-] | | On Qubes, you do not create a new identity in the same VM. This would go against the Qubes approach to security/privacy. Using separate VMs for independent tasks is the whole point of using Qubes. | | |
| ▲ | handedness 2 hours ago | parent [-] | | > On Qubes, you do not create a new identity in the same VM. This would go against the Qubes approach to security/privacy. Using separate VMs for independent tasks is the whole point of using Qubes. This is technically incorrect information and could get people in trouble if followed literally. On Qubes OS, if a user creates a new identity inside a Whonix workstation disposable VM via the browser's new identity functionality, the new identity spawns within the same disposable VM. I just tested this on Qubes OS 4.3. That, I assume would expose one to OP's vulnerability, as its still running in the same VM. I would be glad to learn that I'm incorrect in my unverified assumption. Even Qubes OS users still need to be mindful to launch new disposable VM when keeping identities separate to sidestep this attack. |
|
|
|
| ▲ | 2ndorderthought 5 hours ago | parent | prev | next [-] |
| In the last ten years has qubes moved on to support more hardware? Every 4 years I would try to use it only to find it didn't support any of my hardware. |
| |
| ▲ | handedness 4 hours ago | parent | next [-] | | Qubes OS hardware support, while still far from perfect, is vastly better than it was ten years ago. Joanna Rutkowska's understandable preference for older kernels had its advantages, but the current team is much more likely to ship somewhat newer kernels and I've been surprised by what hardware 4.3 has worked well on. Beyond that, I'm currently running a kernel from late Feb/early Mar (6.19.5). Driver support can still be an issue, and a Wi-Fi card that doesn't play nice with Linux in general is doing to be no different on Qubes OS. | |
| ▲ | Aachen 5 hours ago | parent | prev | next [-] | | We buy off the shelf laptops, not sure anyone ever checked that it can run Qubes specifically before trying to install it (I'm sure of at least one person: myself). Doesn't just about any x64 machine with hardware where drivers are available in standard kernels also work with Qubes? What have you bought that's not supported? | | |
| ▲ | fsflover 5 hours ago | parent [-] | | Actually, it should work indeed, unless it lacks some Linux drivers or VT-d. |
| |
| ▲ | hrimfaxi 5 hours ago | parent | prev | next [-] | | No problems on framework laptop that I've run into at least. | |
| ▲ | orbital-decay 5 hours ago | parent | prev | next [-] | | Most hardware (especially GPUs) is hard to virtualize in a secure manner, which is the entire point of Qubes. People who use it typically buy compatible hardware. | | |
| ▲ | fsflover 5 hours ago | parent [-] | | I would expect that most Qubes users (including myself) do not virtualize GPUs and use the CPU to render graphics outside of dom0. |
| |
| ▲ | fsflover 5 hours ago | parent | prev [-] | | Tested hardware can be found here https://qubes-os.org/hcl. New hardware is being constantly added. If you plan to switch to Qubes, consider buying something from that list or, better, certified, or community-recommended hardware linked there. |
|
|
| ▲ | ranger_danger 6 hours ago | parent | prev [-] |
| Source? |
| |
