4 ms·

What kind of threat model requires someone to use Qubes? I know Snowden uses it and there's even a testimonial of him on the Qubes site recommending it. Is this

What kind of threat model requires someone to use Qubes? I know Snowden uses it and there's even a testimonial of him on the Qubes site recommending it. Is this for people on 'lists' or are high value targets because they visited the wrong site or said something the authorities didn't like and their machines are now being targeted?

beardog 3y ago
Honestly you don't need to be super paranoid to benefit from Qubes. Windows and Linux default sandboxing is still pretty mediocre at best, people can't be perfect with security all the time and sometimes even legit programs get compromised, so the sandboxing security model helps contain the damage. That said you can still setup sandboxing without Qubes.
fsflover 3y ago
I would say, almost anyone running anything untrusted from time to time can benefit from the strong hardware virtualization. Qubes is my daily driver by the way. My attempt of explaining it to a layman: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15 https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15
- Syonyk 3y ago
  And "anything untrusted" includes "any use of the internet." Browser escapes are cheap enough and common enough that we've seen malware delivered through advertising networks before.
thoughtbag 3y ago
I know what Theo says about (x86) virtualization[1], but I think it's still useful to virtually separate your random browsing the web from things like health and banking, or where you keep your ssh keys (if you don't use a Yubikey or similar to keep it off your laptop) -- or other secrets. You can be a victim of a random drive-by, you don't have to be a person on a "list". [1] https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582
- Syonyk 3y ago
  Yeah. He's probably right. When we first saw Meltdown/Spectre/etc, and he preemtively disabled hyperthreading out of an abundance of paranoia, turned out he was right... It's all broken, all the way down. However, compromising a browser or kernel is still a lot easier than compromising a hypervisor. At least in terms of number of known exploits. Qubes tends to make very limited use of the riskier parts of Xen anyway, though. A lot of the security notices for Xen don't apply to Qubes because of how they've configured things or what features they use.
  - thoughtbag 3y ago
    He's been right more times that I can count. Abrasive guy for sure, but he has decided not to suffer idiots. And he does what he does for himself; we are lucky beneficiaries. Agree wrt your arguments; it's also why I write this in a browser in a VM that is not used for anything else than this sort of thing, and periodically I will roll back to a recent snap shot with a clean browser. (I do not use Qubes, but I do like their work.)
  - snvzz 3y ago
    There's also Makatea[0], an effort to build a Qubes-like around seL4. 0. https://trustworthy.systems/projects/TS/makatea https://trustworthy.systems/projects/TS/makatea
weinzierl 3y ago
I used it for sifting through job applications (see my other comment). I think it was worth it because even though we were a small boring company we received a fair share of drag-net style malware via the application channels. Some of the attempts were pretty good also. I used to joke that the bad guys tailor their cover letters better than most real applicants. Which of course is a bit of a hyperbole, but there is a kernel of truth. It's not too hard to write a believable application letter that fits the archetypal IT position. Similar to not all fishing mails being full of spelling errors malicious application letters aren't either. I don't know if we ever received a targeted attack, but I wouldn't know. I think bigger companies certainly will and I can only consider every HR department a high risk area.
vitehozonage 3y ago
I'd say everyone that has the ability to use it. Society is in a dark age where basically nothing else is fit for use; one bad click on most machines could compromise you for years, it is an insane situation. Even if you have other needs that can't be fulfilled with Qubes, you should have a Qubes machine for other tasks that are security-sensitive
Syonyk 3y ago
> What kind of threat model requires someone to use Qubes? "Not trusting modern software to be correct nor secure" is sufficient. I do almost all my web browsing in disposable VMs with no access to interesting things like my password manager, email, SSH keys, etc. I also run JITless (disable Javascript JIT engine), because those are a common attack point on browsers. If you compromise my browser from a random site, you get nothing of interest. Even if you pop the kernel. You still have to get through Xen to get to anything I consider of value.
- aborsy 3y ago
  Browsers have built-in sandboxes, plus sometimes wrapped around stuff like snap.
  - Syonyk 3y ago
    And yet... Browser exploits are a thing, and reliably compromise systems. Apple just released a security update yesterday for "something in WebKit," and we see regular browser security updates. The art of escaping browser sandboxes seems to exceed the art of building browser sandboxes. The Javascript JIT engine gains you a lot of attack surface, unfortunately (one of the reasons I run JITless with Javascript). As for snaps, they're just containers - kernel separated. Unfortunately, I consider the value of that against actively malicious code to be "about zero" - local root/kernel exploits are fairly cheap. Containers (so snaps) are great for convenience - if you want to run code you trust without worrying about dependencies, this is fine. They're not fine if you want to isolate things you don't trust - such as a browser from "everything else." Qubes gives you a much harder boundary around your VMs than containers and sandboxes do.
    - aborsy 3y ago
      Snap uses AppArmor, while flatpak uses bubblewrap. You need to have a zero day in these sandboxes, in addition to in the browser. Not so easy! But definitely VMs provide a much better boundary.
- snvzz 3y ago

beardog 3y ago

Honestly you don't need to be super paranoid to benefit from Qubes. Windows and Linux default sandboxing is still pretty mediocre at best, people can't be perfect with security all the time and sometimes even legit programs get compromised, so the sandboxing security model helps contain the damage. That said you can still setup sandboxing without Qubes.

fsflover 3y ago

I would say, almost anyone running anything untrusted from time to time can benefit from the strong hardware virtualization. Qubes is my daily driver by the way. My attempt of explaining it to a layman: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15 https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15

Syonyk 3y ago
And "anything untrusted" includes "any use of the internet." Browser escapes are cheap enough and common enough that we've seen malware delivered through advertising networks before.

thoughtbag 3y ago

I know what Theo says about (x86) virtualization[1], but I think it's still useful to virtually separate your random browsing the web from things like health and banking, or where you keep your ssh keys (if you don't use a Yubikey or similar to keep it off your laptop) -- or other secrets. You can be a victim of a random drive-by, you don't have to be a person on a "list". [1] https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582

Syonyk 3y ago
Yeah. He's probably right. When we first saw Meltdown/Spectre/etc, and he preemtively disabled hyperthreading out of an abundance of paranoia, turned out he was right... It's all broken, all the way down. However, compromising a browser or kernel is still a lot easier than compromising a hypervisor. At least in terms of number of known exploits. Qubes tends to make very limited use of the riskier parts of Xen anyway, though. A lot of the security notices for Xen don't apply to Qubes because of how they've configured things or what features they use.
- thoughtbag 3y ago
  He's been right more times that I can count. Abrasive guy for sure, but he has decided not to suffer idiots. And he does what he does for himself; we are lucky beneficiaries. Agree wrt your arguments; it's also why I write this in a browser in a VM that is not used for anything else than this sort of thing, and periodically I will roll back to a recent snap shot with a clean browser. (I do not use Qubes, but I do like their work.)
- snvzz 3y ago
  There's also Makatea[0], an effort to build a Qubes-like around seL4. 0. https://trustworthy.systems/projects/TS/makatea https://trustworthy.systems/projects/TS/makatea

weinzierl 3y ago

I used it for sifting through job applications (see my other comment). I think it was worth it because even though we were a small boring company we received a fair share of drag-net style malware via the application channels. Some of the attempts were pretty good also. I used to joke that the bad guys tailor their cover letters better than most real applicants. Which of course is a bit of a hyperbole, but there is a kernel of truth. It's not too hard to write a believable application letter that fits the archetypal IT position. Similar to not all fishing mails being full of spelling errors malicious application letters aren't either. I don't know if we ever received a targeted attack, but I wouldn't know. I think bigger companies certainly will and I can only consider every HR department a high risk area.

vitehozonage 3y ago

I'd say everyone that has the ability to use it. Society is in a dark age where basically nothing else is fit for use; one bad click on most machines could compromise you for years, it is an insane situation. Even if you have other needs that can't be fulfilled with Qubes, you should have a Qubes machine for other tasks that are security-sensitive

Syonyk 3y ago

> What kind of threat model requires someone to use Qubes? "Not trusting modern software to be correct nor secure" is sufficient. I do almost all my web browsing in disposable VMs with no access to interesting things like my password manager, email, SSH keys, etc. I also run JITless (disable Javascript JIT engine), because those are a common attack point on browsers. If you compromise my browser from a random site, you get nothing of interest. Even if you pop the kernel. You still have to get through Xen to get to anything I consider of value.

aborsy 3y ago
Browsers have built-in sandboxes, plus sometimes wrapped around stuff like snap.
- Syonyk 3y ago
  And yet... Browser exploits are a thing, and reliably compromise systems. Apple just released a security update yesterday for "something in WebKit," and we see regular browser security updates. The art of escaping browser sandboxes seems to exceed the art of building browser sandboxes. The Javascript JIT engine gains you a lot of attack surface, unfortunately (one of the reasons I run JITless with Javascript). As for snaps, they're just containers - kernel separated. Unfortunately, I consider the value of that against actively malicious code to be "about zero" - local root/kernel exploits are fairly cheap. Containers (so snaps) are great for convenience - if you want to run code you trust without worrying about dependencies, this is fine. They're not fine if you want to isolate things you don't trust - such as a browser from "everything else." Qubes gives you a much harder boundary around your VMs than containers and sandboxes do.
  - aborsy 3y ago
    Snap uses AppArmor, while flatpak uses bubblewrap. You need to have a zero day in these sandboxes, in addition to in the browser. Not so easy! But definitely VMs provide a much better boundary.
snvzz 3y ago