All Secrets in Vault vs. Distributing Secrets

[unman]

But this ignores the point I actually made. The important question is not whether the attacker gets access to six months versus six years of statements. Rather, it’s whether the attacker gets to transact on my account as if he were me. I care almost infinitely more about the latter than the former, so I’m fine, in practice, with storing unlimited historical data in a qube with transaction authority for the account that generated that data in exchange for the convenience of not having to deal with double the number of qubes.

But that’s just me. If you care enough to deal with double the number of qubes in order to make sure that an attacker who gains transaction authority over an account does not also gain access to old statements that are no longer available from the online account itself, then by all means. I just can’t imagine myself ever saying, “The hacker may have drained my account, but at least he doesn’t know how much was in it over six months ago!”

This depends entirely on what threat you are guarding against.
For example, if you had an account (of any sort) which you used solely to
funnel funds, there would be no threat from a hacker gaining control
over that account since it rarely has a positive balance.
But gaining access to 6 years of past transactions would be enough to
build a substantial case against you.
As always, Qubes provides the means, but it is up to the user to
determine what threat is significant for them, and how to use Qubes to
reduce that threat.

“that’s just me” is a great caveat - I wish more users would follow your
example when posting in this forum.

I never presume to speak for the Qubes team.
When I comment in the Forum or in the mailing lists I speak for myself.