Discussion on Purism

[Insurgo]

As I pointed before @TommyTran732 and to anyone thinking compromising measured boot is trivial, I layed down the tooling for anyone wanting to further protection / prove measured boot not enough to understand and break it once and for all under WiP: introspection - replicate TPM PCRs measurements directly from measured content (TCPA/TPM Event log) by tlaurion · Pull Request #1568 · linuxboot/heads · GitHub

Just use it for the bad to faster the development of something good/better.

Until then, it was proven non trivial. You refusing to read it, test it, prove you understand how a TPM extend/seal/unseal/quote ops work, extract/replay/tamper bootblock anchored measured boot is yet to be proven flawed beyond just theoretical attack by anyone/to everyone. Please just do it and like I said: you’ll get the world’s attention. Until then, you are in denial. And this echo chamber is not the place (not my place) to discuss this further.

---

EDIT: added repro notes directly at WiP: introspection - replicate TPM PCRs measurements directly from measured content (TCPA/TPM Event log) by tlaurion · Pull Request #1568 · linuxboot/heads · GitHub to entice Evil-Made PoC by anyone willing to take that challenge to move theoretical vuln into a practical, reproducible PoC. Up for the challenge with more than words but code? PLEASE DO IT.

[Insurgo]

And again, for the sake of this thread, I already replied extensively with my own learnings and criticisms at "Maybe I messed up my qubes installation?" related support questions involving "some" Heads subtleties, aka "How to disable autostarting of service qubes at boot without Grub interface" - #8 by Insurgo

(tags: firmware, testing, security, Purism, QubeOS certification process, oem disk installation, salt, kick-start what should be the next steps, where collaboration is needed etc etc etc)

[adrelanos]

Heads_OEM_device_ownership_reownership_A_tamper_evident_approach_to_remote_integrity_attestation_Current_status_and_future_plan_A_call_for_collaboration_final.pdf

Do you have the corresponding video?

[apparatus]

FOSDEM 2020 - Heads OEM device ownership/reownership : A tamper evident...

[FranklyFlawless]

Direct video link:

[FranklyFlawless]

I moved this topic to the #all-around-qubes category due to these posts:

@fsflover

It seems this is already an off-topic here, but I still believe that a discussion of a privacy- and security-focused company may be interesting for Qubes users in general. Perhaps moderators could extract this discussion of Purism the company to a separate thread in a newly created category.

@deeplow

Leaving this discussion open as some sections are relevant for Qubes. But it’s at the edge of what’s off-topic and what’s not.

@fsflover

I disagree. Hardware running Qubes is essential for Qubes users. Trusting hardware comanies is essential for trusting your hardware. Otherwise why bother with security-oriented system?

As I mentioned earlier, this topic is an example of the new category which should definitely be useful for Qubes users. All around Qubes I would call it.

@fiftyfourthparallel

This is thread is a showcase of why a trusted level of 2 should be needed to participate in tangential discussions (though some might argue that this is directly relevant to Qubes). Relevant thread here.

Once a product/company had been badmouthed there’s a pattern of new accounts being made with the sole purpose of taking a side. Two brand new accounts are posting here, for example, and neither seem to have an interest in Qubes. What’s worse, they’re making lengthy posts that take considerable effort to get through. This is obviously leading to increased workloads for the mod(s) and clogging up the moderation queue.

As I’ve mentioned before, I’m not going to bother arguing with those in entrenched positions spouting long-winded sophistry, since I have better things to do with my time.

@fiftyfourthparallel

Thank you for this detailed and informative post.

1. “Not having some ancient piece of hardware” – Do you manually verify every piece of hardware in a laptop that you’re interested in? If so, what resources do you use?
2. Memory encryption – Pardon my naivete, but why is it important beyond the context of cold boot attacks; and if it’s that important, why would Apple choose to forgo it? Especially since it should be easy to implement given their other security features.
3. I’ve been using Dell for the last few years but I’ve personally experienced a rash of hardware defects and now I’m considering alternatives. What are your thoughts on HP?

I’m somewhat glad the mods haven’t shut it down this thread yet, but it’s snowballing into something that belongs in the restricted category (and this post doesn’t help).

If @moderators and/or trust level 3/Regular users would rather prefer the topic goes back into the General Discussion category, simply move it again.

[barto]

access to category

Isn’t “All around Qubes” somehow access-restricted?
[After checking] → yes it is:

@deeplow

This category is exclusively available to those who have participated significantly on the forum already.

[Sven]

Moved back to `General Discussion`.

It doesn’t seem appropriate to move this mega-thread after all this years. As @fsflover outlined: this is hardware specifically marketed towards Qubes OS users and their experiences and impressions with the vendor are on-topic.

[FranklyFlawless]

Sure, although Purism primarily targets PureOS, not Qubes OS.

[capsizebacklog]

@FranklyFlawless

During my anti-interdiction service(s), Purism used gel nail polish instead of acryllic, so they were easy to remove fully intact from the screws using just my fingernails alone, and they are just as easy to adhere back with some applied pressure. Acryllic would experience chipping if performed with the same procedure, so you can use that knowledge to improve your anti-interdiction service(s) with Purism next time.

How can I know if the glitter nail polish is acryllic or gel?
I’ve had a very bad experience trying to ask questions about glitter nail polish at local stores that sell glitter nail polish. They always answer “don’t know”.

[FranklyFlawless]

At a glance, thickness of the applied polish is a giveaway. Gel is thicker while acrylic is thinner.

[barto]

Gel is thicker while acrylic is thinner.

As a straight guy, I wouldn’t know

[Insurgo]

Trammel recommended this brand. Shipped all privacy beast with it. Worked awesome.

Glitter