Even better, QubesOS with a Whonix template. QubesOS never allows true full screen mode to prevent spoofing attacks, the titlebar and taskbar are always visibl

Even better, QubesOS with a Whonix template. QubesOS never allows true full screen mode to prevent spoofing attacks, the titlebar and taskbar are always visible. It also forces all windows to display a colored border, the color represents the application's security domain. A window in an untrusted VM cannot pretend to be a trusted VM window. A spoofed browser screen won't show the correct titlebar and (user-defined) color. But what makes this attack frightening is that even such kind of extreme measures only provide limited protections. Spoofing is still possible, you can bet on the default theme with a red border - this is the default for untrusted, disposable VM. I'd say I would totally fall for this. The only thing that makes it somewhat safe is the impossibility to detect QubesOS reliably. Some heuristics exist: you can detect CPU cores, a low number indicates a potential VM. You can also detect the GPU model, a LLVM software renderer or disabled WebGL is a strong indication of VM or Tor Browser. But none is reliable.