Can non-networked qube be as trusted as an airgapped physical computer?

General Discussion
1

AFAIK hardware-based virtualization extensions that Qubes/Xen use are extremely hard to exploit, but on the other hand there are gotchas, like:

  • regularly discovered Xen vulnerabilities that allow cross-VM leaks
  • your ethernet cable or wifi sits on the same machine that your “airgapped” thing is on
  • human error is possible and more likely than on a real airgapped machine, like copying clipboard from a wrong qube

So at the end of the day, would you trust offline qube enough to put your crypto seed in for example?

2

I would not treat it as equivalent to a separate airgapped machine. A non-networked qube removes a lot of everyday network exposure, but it still shares the same physical hardware, Xen/dom0, firmware, and user workflows with the rest of the system.

For notes or moderately sensitive files, that may be a reasonable tradeoff. For a crypto seed, I would prefer a hardware wallet or another offline storage method where the seed never has to be typed into a general-purpose computer. If you do use an offline qube, I’d at least make the threat model explicit and be very strict about clipboard/file transfer paths.

3 Likes
3

The suggested reading:

Software compartmentalization vs. physical separation
(Or why Qubes OS is more than just a random collection of VMs)

by Joanna Rutkowska
Invisible Things Lab
August 2014

6 Likes
4

I subscribed to Qubes news and XSA and I don’t see updates about such vulnerabilities. What is your source?

5

So, what do you think about SecureDrop that uses offline qubes for extremely sensitive files?

Sorry, I had intel/AMD CPU vulns in mind which often make room for cross-qube data exposure, for example QSB-113 or QSB-112.

1 Like