Dom0 might store your previous SSIDs in your xfce4-panel.xml file in your user folder in Dom0, even when your sys-net is forensic proof.
Qubes OS is mainly focused on security, but many might have reasons to leave no traces of previous connections as well. For example a journalist who goes to a public cafe and wants no traces on his laptop that he was ever connected to that cafe WIFI.
Disposable sys-net fix this partly (great for security), but it is not 100% forensic proof. Even your sys-net gets destroyed, there might be still some traces recoverable on your SSD when seized. To fix this, you could easily run NM-system-connections folder in RAM (so the SSID will never be written to your disk) and set ephemeral True for sys-net, so volatile data leaks are not easily recoverable.
For those who did this all, they need to keep in mind that Dom0 might accidentally remember your WIFI metadata. It is because XFCE4-panel uses the Network Manager Applet. Especially when crashing (without you knowing it, for example during shutdown), it saves a copy of your SSID.
Where to find stored SSIDs leaks in your Dom0?
If you go to Panel Preferences (right click on your panel), select Items Tab and highlight Status Tray Plugin. Click on Edit and click on Systray Icons. There is a chance that your previous SSIDs are stored there. This can be a risk for someone who needs to have plausible deniability in worst case scenarios.
This data is stored in /home/user/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml
Running /home/user/.config/xfce4/xfconf/xfce-perchannel-xml in RAM will solve this issue but with usability issues. If anyone has some better solution, it would be helpful for those who need to leave no traces of previous connections.
A chance? Are you saying that you actually do see an SSID there?
Those tray icons are tiny X11 windows running in their respective VMs, so unless there are circumstances in which NetworkManager from sys-net is putting an SSID into an X11 property of the window (like WM_NAME or WM_CLASS - anything that is forwarded across the GUI protocol), I don’t get how an SSID would end up in this list.
Yes, but as i mentioned, only metadata, no real VM escapes to Dom0, it is the Applet that shows a user the SSID and that information gets stored sometimes, what exposes which SSID a Qubes user was connected with. So no password of the SSID, just the name. I could see Starbuck Wifi etc. Or Hotel XX_Wifi_5G in XFCE4-panel.xml
If for example a journalist uses Coffee Shop XXX WIFI with Tor browser only, post something online assuming Tor Browser saves no browsing history, the journalist assumes there is no forensic proof left on his device that he ever connected from that Coffee Shop, while Dom0 might save Coffee Shop XXX in case his laptop gets seized. I tested it on different laptops and those leaks happen, and all had some previous SSIDs in the list, but not a full list of all previous SSIDs. So something, probably a crash triggers XFCE4-Panel to write from time time.
If other people reading this also see SSIDs in the list, please post.
Xfce persisting the tray icon titles doesn’t seem to be unusual, although I don’t like it and it might be good to turn that off somehow by default. But I’m wondering under which circumstances NetworkManager in sys-net is putting an SSID into the title at all, causing Xfce to become aware of it.
@tommy is right. I can see that in dom0 within /home/user/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.
It shows the SSIDs and the signal strength. I’m using persistant sys-net, though.
Just as an additional data point: This can’t be an old relic, since I perform a fresh installation with every major version and only reimport data backups afterwards.
#!/bin/bash
#. Unlock configuration cache files
killall xfconfd 2>/dev/null
#. Mount tmpfs into RAM using
sudo mount -t tmpfs -o mode=0700,uid=$(id -u),gid=$(id -g),size=10M tmpfs /home/user/.config/xfce4/xfconf/xfce-perchannel-xml
#. Copy the clean, static template files into the volatile RAM space
cp -r /home/user/custom/panel/* /home/user/.config/xfce4/xfconf/xfce-perchannel-xml/
#. Restart the panel application to force it to read the new RAM files
xfce4-panel -r &
Now those who run a disp sys-net, the script is executed before connected to WIFI. Once you connect, the xfce4 panel is already running in RAM and all leakages will not survive a reboot. If someone has a better fix, please post.
Oh YES. I contacted (privately) a forum user who inadvertently posted their xfce4-panel.xml , sometime during the last 12 months. Was showing all the used SSIDs.
It’s removed/sanitized now.
@Frogger The problem is that after clearing, those SSIDs are getting added again over time. Locking the Panel is not doing the job. And chattr prevent the xfce4-panel.xml file from being edited, but xfce4-panel creates a new file and those leaks keep taking place on the new file. I tried many solutions, and running in RAM is the only temporary solution that really works. I am glad the team knows about it thank to RustyBird, so i hope it gets fixed soon, since it is very serious for those who need plausible deniability.
Yes, thanks to @rustybird … but don’t hold your breath, because it was deemed a “feature”, not a bug, by higher $GODS. The github report is now “waiting for upstream”, i.e. until Xfce fixes itself.
To add to the urgency of the issue, let me add that the SSIDs are not the only leaks in xfce4-panel.xml . It also stores the names of all the widgets that appeared on the panel, stuff like “vlc”, VPN app widgets (if you use the VPN app in a qube), Keepass, Signal/Telegram if you use the app, etc.
So I applied your (@tommy’s) RAM workaround from up in the thread, for the time being.
HI tommy, yes that is true though one could add a logoff and logon script that purges the data via the two commands. The solution to move it to ram would just mean, it is for the time persistent in ram. I didn’t find anything related to disable these panel history things, though hope xfce implements a “dont remember history” option. Also great find from rusty. A bit odd that it keeps history not only of ssids their signal strength (would allow exact location of a person in the area of the wifi network) as also run applications.
@barto@Frogger Thanks for the feedback. And indeed it might take a long time, after the team changed the issue to feature instead of bug. It would be better to directly restrict with qubes-guid instead of waiting (assuming) that there will be an xfce4 option in the future to disable it.
@dhimh I tried the locked attributes in the past, it does not prevent the behavior.
