6 ms·

SecureDrop Workstation is based on Qubes OS. It removes the need for a separate ‘air gapped’ machine Qubes is awesome, but it's no substitute for an air gap.

SecureDrop Workstation is based on Qubes OS. It removes the need for a separate ‘air gapped’ machine Qubes is awesome, but it's no substitute for an air gap. This is the same publication that broke the Snowden story. Their adversary collects hardware backdoors like baseball cards. This is not smart. I would think twice before making a whistleblower disclosure to an organization that thinks this way.

jackstraw14 3y ago
> Their adversary collects hardware backdoors like baseball cards. link?
- karma_pharmer 3y ago
  https://www.technologyreview.com/2013/10/08/176195/nsas-own-hardware-backdoors-may-still-be-a-problem-from-hell/ https://www.technologyreview.com/2013/10/08/176195/nsas-own-... MIT Technology Review -- NSA’s Own Hardware Backdoors May Still Be a “Problem from Hell” "This month, news reports based on leaked documents said that the NSA itself has used that tactic, working with U.S. companies to insert secret backdoors into chips and other hardware to aid its surveillance efforts. That revelation particularly concerned security experts because Hayden’s assessment is widely held to be true."
  - tucnak 3y ago
    And they would genuinely believe Xen is secure from NSA. Qubes is fun because it locks you into Intel processors; manufacturer notorious for sending cease-and-desist letters to researchers who had attempted to disable IME.
    - fsflover 3y ago
      Nevertheless I'm using Qubes OS just fine on Librem 15 with disabled and neutralized IME.
helpfulContrib 3y ago
[dead]
aborsy 3y ago
In Qubes, the networking can be disabled in the hypervisor. This will turn the VM into an air gapped machine. There is also split GPG, to transfer encrypted data to a VM containing Gpg keys. But the ease of use could also mean that the user turns on and off the networking, bringing an air gapped VM sometimes online. There is a need for a permanent one way VM.
- karma_pharmer 3y ago
  In Qubes, the networking can be disabled in the hypervisor. This will turn the VM into an air gapped machine. That is not an air gap.
  - fsflover 3y ago
    https://news.ycombinator.com/item?id=39952128 https://news.ycombinator.com/item?id=39952128
- gavinsyancey 3y ago
  > the networking can be disabled in the hypervisor The hypervisor is software. Software has bugs. I'm sure the NSA has some hypervisor escape zero-days...
  - fsflover 3y ago
    Qubes relies on hardware-assisted virtualization, which is virtually impossible to break.
    - tucnak 3y ago
      >virtually impossible >NSA I have a bridge to sell.
      - fsflover 3y ago
        I'm not aware of any escape since Blue Pill in 2006, found by the Qubes founder herself.
deckiedan 3y ago
If I was their security team, I would be fine with them publishing articles about our security set up - as long as it wasn't 100% accurate. Possibly mention a specific virtualization system, and then run a honeypot version of the above to try and catch directed attacks at it while actually relying on a totally different system...
- felsokning 3y ago
  > I would be fine with them publishing articles about our security set up - as long as it wasn't 100% accurate. It reads, at least to me, as a PoC on them wanting to "standardise" end point creation to talk to them securely; given the introduction points to "you may have come across the ‘Contact the Guardian securely’ banner".
fsflover 3y ago
> Qubes is awesome, but it's no substitute for an air gap. In many cases it's even more secure, especially if you're constantly exchanging untrusted files via USB sticks: https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-using-a-separate-physical-machine https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-u...
greggsy 3y ago
This is a bit of a straw man argument. They’ve framed a specific architecture paradigm in a way you disagree with, so you shouldn’t deal with them ever? The way I read it is that it eliminated the need for an air gap for their needs, not the need of humanity as a whole.
devaiops9001 3y ago
Spectre vulnerabilities are a huge problem. Problems in x86_64 never cease to emerge. Qubes Air is probably the most outstanding viable approach to not exactly mitigate CPU and chipset problems but avoid them or leave them moot. https://www.qubes-os.org/news/2018/01/22/qubes-air/ https://www.qubes-os.org/news/2018/01/22/qubes-air/
wftglf 3y ago
Hey, author of the post here. I've had quite a bit of feedback on the post from some people with a lot more Qubes experience than me - there are definitely some issues with it - e.g. you can install software from non-default repos in Qubes without setting a netvm for the template. We'll publish an edited version soon in case anyone else stumbles across it. "Qubes is awesome, but it's no substitute for an air gap." - agreed - for some stories an actually air-gapped machine is essential - if nothing else just because it's very easy when messing round in Qubes manager to add a netvm to the wrong Qube. However, of the stories we receive coming through SecureDrop system, many don't have the risk profile of something like Snowden - e.g. a local politics story that GCHQ aren't likely to be too fussed about. For these cases, it's helpful to have an environment which is secure, but has a browser available for e.g accessing our CMS or doing research.
- karma_pharmer 3y ago
  This sounds like you abandoning any hope of ever producing the level of journalism you did in 2013. That is disappointing.
- Dalewyn 3y ago
  Wow. Has journalism has fallen so low that sensitive information is handled with wanton abandon just for the sake of convenience? Assuming what is said here is true, nobody should be providing sensitive information to The Guardian if for no other reason than to guarantee their own safety.
  - wftglf 3y ago
    I wouldn't say it's wanton abandon - here is a deeper explanation of the threat model of SecureDrop workstation https://github.com/freedomofpress/securedrop-workstation?tab=readme-ov-file#detailed-rationale https://github.com/freedomofpress/securedrop-workstation?tab...
- dr_kiszonka 3y ago
  Would you have two different systems, one for low risk and another for high risk messages? How would triage and enforcement work? What it sounds like is that you are proposing a system that is less secure compared to what is already in place and this is what people are protesting against.
deleted 3y ago
[deleted]
rurban 3y ago
I would be more worried about them having directly hired a CIA shill. Smoke & mirrors

jackstraw14 3y ago

> Their adversary collects hardware backdoors like baseball cards. link?

karma_pharmer 3y ago
https://www.technologyreview.com/2013/10/08/176195/nsas-own-hardware-backdoors-may-still-be-a-problem-from-hell/ https://www.technologyreview.com/2013/10/08/176195/nsas-own-... MIT Technology Review -- NSA’s Own Hardware Backdoors May Still Be a “Problem from Hell” "This month, news reports based on leaked documents said that the NSA itself has used that tactic, working with U.S. companies to insert secret backdoors into chips and other hardware to aid its surveillance efforts. That revelation particularly concerned security experts because Hayden’s assessment is widely held to be true."
- tucnak 3y ago
  And they would genuinely believe Xen is secure from NSA. Qubes is fun because it locks you into Intel processors; manufacturer notorious for sending cease-and-desist letters to researchers who had attempted to disable IME.
  - fsflover 3y ago
    Nevertheless I'm using Qubes OS just fine on Librem 15 with disabled and neutralized IME.

helpfulContrib 3y ago

[dead]

aborsy 3y ago

In Qubes, the networking can be disabled in the hypervisor. This will turn the VM into an air gapped machine. There is also split GPG, to transfer encrypted data to a VM containing Gpg keys. But the ease of use could also mean that the user turns on and off the networking, bringing an air gapped VM sometimes online. There is a need for a permanent one way VM.

karma_pharmer 3y ago
In Qubes, the networking can be disabled in the hypervisor. This will turn the VM into an air gapped machine. That is not an air gap.
- fsflover 3y ago
  https://news.ycombinator.com/item?id=39952128 https://news.ycombinator.com/item?id=39952128
gavinsyancey 3y ago
> the networking can be disabled in the hypervisor The hypervisor is software. Software has bugs. I'm sure the NSA has some hypervisor escape zero-days...
- fsflover 3y ago
  Qubes relies on hardware-assisted virtualization, which is virtually impossible to break.
  - tucnak 3y ago
    >virtually impossible >NSA I have a bridge to sell.
    - fsflover 3y ago
      I'm not aware of any escape since Blue Pill in 2006, found by the Qubes founder herself.

deckiedan 3y ago

If I was their security team, I would be fine with them publishing articles about our security set up - as long as it wasn't 100% accurate. Possibly mention a specific virtualization system, and then run a honeypot version of the above to try and catch directed attacks at it while actually relying on a totally different system...

felsokning 3y ago
> I would be fine with them publishing articles about our security set up - as long as it wasn't 100% accurate. It reads, at least to me, as a PoC on them wanting to "standardise" end point creation to talk to them securely; given the introduction points to "you may have come across the ‘Contact the Guardian securely’ banner".

fsflover 3y ago

> Qubes is awesome, but it's no substitute for an air gap. In many cases it's even more secure, especially if you're constantly exchanging untrusted files via USB sticks: https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-using-a-separate-physical-machine https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-u...

greggsy 3y ago

This is a bit of a straw man argument. They’ve framed a specific architecture paradigm in a way you disagree with, so you shouldn’t deal with them ever? The way I read it is that it eliminated the need for an air gap for their needs, not the need of humanity as a whole.

devaiops9001 3y ago

Spectre vulnerabilities are a huge problem. Problems in x86_64 never cease to emerge. Qubes Air is probably the most outstanding viable approach to not exactly mitigate CPU and chipset problems but avoid them or leave them moot. https://www.qubes-os.org/news/2018/01/22/qubes-air/ https://www.qubes-os.org/news/2018/01/22/qubes-air/

wftglf 3y ago

Hey, author of the post here. I've had quite a bit of feedback on the post from some people with a lot more Qubes experience than me - there are definitely some issues with it - e.g. you can install software from non-default repos in Qubes without setting a netvm for the template. We'll publish an edited version soon in case anyone else stumbles across it. "Qubes is awesome, but it's no substitute for an air gap." - agreed - for some stories an actually air-gapped machine is essential - if nothing else just because it's very easy when messing round in Qubes manager to add a netvm to the wrong Qube. However, of the stories we receive coming through SecureDrop system, many don't have the risk profile of something like Snowden - e.g. a local politics story that GCHQ aren't likely to be too fussed about. For these cases, it's helpful to have an environment which is secure, but has a browser available for e.g accessing our CMS or doing research.

karma_pharmer 3y ago
This sounds like you abandoning any hope of ever producing the level of journalism you did in 2013. That is disappointing.
Dalewyn 3y ago
Wow. Has journalism has fallen so low that sensitive information is handled with wanton abandon just for the sake of convenience? Assuming what is said here is true, nobody should be providing sensitive information to The Guardian if for no other reason than to guarantee their own safety.
- wftglf 3y ago
  I wouldn't say it's wanton abandon - here is a deeper explanation of the threat model of SecureDrop workstation https://github.com/freedomofpress/securedrop-workstation?tab=readme-ov-file#detailed-rationale https://github.com/freedomofpress/securedrop-workstation?tab...
dr_kiszonka 3y ago
Would you have two different systems, one for low risk and another for high risk messages? How would triage and enforcement work? What it sounds like is that you are proposing a system that is less secure compared to what is already in place and this is what people are protesting against.

deleted 3y ago

[deleted]

rurban 3y ago

I would be more worried about them having directly hired a CIA shill. Smoke & mirrors