QubesOS is mainly focused on security, but many might have reasons to leave no traces of previous connections as well. For example a journalist who goes to a public cafe and wants no traces on his laptop that he was ever connected to that cafe WIFI.
Disposable sys-net fix this partly (great for security), but it is not 100% forensic proof. Even your sys-net gets destroyed, there might be still some traces recoverable on your SSD when seized. To fix this, you could easily run NM-system-connections folder in RAM (so the SSID will never be written to your disk) and set ephemeral True for sys-net, so volatile data leaks are not easily recoverable.
For those who did this all, they need to keep in mind that Dom0 might accidentally remember your WIFI metadata. It is because XFCE4-panel uses the Network Manager Applet. Especially when crashing (without you knowing it, for example during shutdown), it saves a copy of your SSID.
Where to find stored SSIDs leaks in your Dom0?
If you go to Panel Preferences (right clock on panel), select Items Tab and highlight Status Tray Plugin. Click on Edit and click on Systray Icons. There is a chance previous SSIDs are stored there. This can be a risk for someone who needs to have plausible deniability in worst case scenarios.
This data is stored in /home/user/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml
Running /home/user/.config/xfce4/xfconf/xfce-perchannel-xml in RAM will solve this issue but with usability issues. If anyone has some better solution, it would be helpful for those who need to leave no traces of previous connections.
A chance? Are you saying that you actually do see an SSID there?
Those tray icons are tiny X11 windows running in their respective VMs, so unless there are circumstances in which NetworkManager from sys-net is putting an SSID into an X11 property of the window (like WM_NAME or WM_CLASS - anything that is forwarded across the GUI protocol), I don’t get how an SSID would end up in this list.
Yes, but as i mentioned, only metadata, no real VM escapes to Dom0, it is the Applet that shows a user the SSID and that information gets stored sometimes, what exposes which SSID a Qubes user was connected with. So no password of the SSID, just the name. I could see Starbuck Wifi etc. Or Hotel XX_Wifi_5G in XFCE4-panel.xml
If for example a journalist uses Coffee Shop XXX WIFI with Tor browser only, post something online assuming Tor Browser saves no browsing history, the journalist assumes there is no forensic proof left on his device that he ever connected from that Coffee Shop, while Dom0 might save Coffee Shop XXX in case his laptop gets seized. I tested it on different laptops and those leaks happen, and all had some previous SSIDs in the list, but not a full list of all previous SSIDs. So something, probably a crash triggers XFCE4-Panel to write from time time.
If other people reading this also see SSIDs in the list, please post.
Xfce persisting the tray icon titles doesn’t seem to be unusual, although I don’t like it and it might be good to turn that off somehow by default. But I’m wondering under which circumstances NetworkManager in sys-net is putting an SSID into the title at all, causing Xfce to become aware of it.
@tommy is right. I can see that in dom0 within /home/user/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.
It shows the SSIDs and the signal strength. I’m using persistant sys-net, though.
Just as an additional data point: This can’t be an old relic, since I perform a fresh installation with every major version and only reimport data backups afterwards.
@qubist I tried this before, but cause it is after this fix not possible to write to xfce4-panel.xml, the system creates a second xfce4-panel.xml file and it does the same behavior on the new created file, writing SSIDs, but in the automated created new file, XFCE4-Panel-2 for example.
This is my current solution, it works well especially for those who don’t often set or change custom xfce4-panel settings.
1 Create once a custom folder to store all your xfce4-panel settings. Make sure all saved SSDs are removed first.
#!/bin/bash
#. Unlock configuration cache files
killall xfconfd 2>/dev/null
#. Mount tmpfs into RAM using
sudo mount -t tmpfs -o mode=0700,uid=$(id -u),gid=$(id -g),size=10M tmpfs /home/user/.config/xfce4/xfconf/xfce-perchannel-xml
#. Copy the clean, static template files into the volatile RAM space
cp -r /home/user/custom/panel/* /home/user/.config/xfce4/xfconf/xfce-perchannel-xml/
#. Restart the panel application to force it to read the new RAM files
xfce4-panel -r &
Now those who run a disp sys-net, the script is executed before connected to WIFI. Once you connect, the xfce4 panel is already running in RAM and all leakages will not survive a reboot. If someone has a better fix, please post.