How To: Verify Qubes Digital Signatures and Key Verification (Verifying Signatures)

Community Guides
1

Description: In this tutorial we will be easily verifying signatures to ensure that your download of the Qubes ISO is more authentic. This is important because evil, desperate people suffering from IBS and with malicious intent may try to compromise your download. Using this tutorial assumes that you are not using a compromised computer. If your computer is compromised then no amount of verifications or fancy doo-dads will help.

Below is a link to a YouTube video I made for Qubes Digital Signatures and Key Verification (Verifying Signatures).

The audio quality is low because I had a lot of background noise when I made the audio and I did my best to remove all the background noise at the cost of audio quality.

I need help reviewing my video tutorial I made. I made it so anybody can follow along. I need one or more people to check out the video to make sure it makes sense and is easy to follow along before I make it live and is also correct. The video is currently unlisted. I still need to fill out the description part but I’m just focusing on the content at the moment.

Any and all criticism is appreciated. Thank you.

4 Likes
2

How do I delete this post?

3

Hey @Trizzle,

Welcome to the forum! Unfortunately, post deletion is currently disabled due to the original decision made in the Deletion policy thread, though some have since voiced their objections to it. If you want to provide your input on the subject and explain why the ability to delete your post is important to you, you are free to do so on that thread. Sorry about that; I am not happy about the decision, either.

Since I’m here, I might as well comment on your video. I have been busy, so apologies for not doing so earlier.

I found the video to be immediately accessible. I don’t know why you consider the “audio quality” to be “low”; it sounds clear and easily intelligible to me. If you had not mentioned that you filtered out the background noise, I would have assumed that you simply recorded in a quiet room. Your voice is also confident and fitting for an instruction video, something that greatly improves the presentation, especially when the video consists of nothing but image stills and your voice.

It was easy to follow what you were saying and you made sure to not introduce anything technical that is not necessary to accomplish the task the video is about. Naturally, anyone watching it will have to come with some basic knowledge of the relevant concepts to really understand why this is important, but unless you intended to also introduce viewers to the very concept of PGP signatures and verification, this is a reasonable assumption. Even for those who are totally unfamiliar however, blindly following your instructions is sufficient for them to verify the signatures with good confidence, even if they do not fully appreciate what they are doing.

I actually had a paragraph here about omissions that probably do not need inclusion because they are more about high-assurance authentication rather than mere authentication, such as by checking the key’s authenticity with multiple independent sources (as recommended by the Qubes documentation), but you actually covered that in the video! Great job! And even better is that you did not belabor the point or present it confusingly, which is important to get through to those for whom such advice may seem strange if not paranoid.

One addition that might be worth considering is actually not in the video, but in its description, where you include a text tutorial as well, or at least the relevant commands and key IDs, so that viewers can copy and paste the commands rather than type them in by hand. I understand that this is available on the documentation page, but replicating it below your video (with the non-generic commands) may be more convenient to viewers. This too is not necessary, and your video would not be less without it, but it may add to the video without having to edit it.

But really, I have no complaints. I was just surprised that with this level of quality, your channel is not more popular. It seems that you have just started going beyond gaming videos and this video is unlisted though, so I suppose I shouldn’t be.

Thanks for your contribution to the Qubes community. I think it is a great video to share for anyone using Windows and hesitant to read the documentation.

Kindest regards,
John

2 Likes
4

I see that my description suggestion was already implemented on your recently published video (YouTube link) before I even posted, so I guess I really do have no complaints!

Thanks again for taking the time and energy to reproduce the relevant documentation in a more accessible video format. It is definitely the video I will be sharing to anyone who I think will need it, probably alongside the documentation page.

John

5

I appreciate it good sir! Only reason I was looking to delete my OP is because I couldn’t find the edit button anywhere so I edit the original post and swap out the original youtube link with the new youtube link. lol

How would I go about editing this post so it has the new link and information. I’m also looking to edit the title. If there’s no way to edit the title, can I just create a new thread without worrying about consequences?

2 Likes
6

I am not sure why you cannot edit. You should be able to edit it the same way you appear to have edited your reply above, by clicking on the pencil icon at the bottom right of the post.

If I were to guess, you may currently be unable to edit your topic post because your trust level is too low, which should automatically change as you further participate in the forum. The particular trust level settings for this forum are unclear to me, so you may be able to edit your replies but not your topic posts, or only edit within the first five-minute grace period before further editing becomes public and counts as an “edit”. @deeplow should be able to clarify this if they’re available.

By the way, I forgot to mention that I particularly appreciate you coming to this community first to ask for review before publishing (even though no one responded before you did). As you can see from searching this forum, YouTube videos about Qubes OS are sometimes discussed and criticized here, particularly by @oijawyuh. They tend to have quite some inaccuracies and can actually mislead new Qubes OS users into dangerously insecure behaviors. Fortunately, yours did not and does not (as far as I can tell), and unlike those others, you stuck close to the documentation and gave us an opportunity to correct any errors before it went live.

Best,
John

1 Like
7

This has actually been a labor of love with more than a month of work put into it. I have reviewed this video so many times that I feel like I have it memorized and could recite it off the top of my head. lol Since the original video, I edited the video 5 times removing errors, inaccuracies, and other items before I put the final version up. I don’t dare try to make a tutorial about the actual use of Qubes because I lack the knowledge and experience using it (plus I get frustrated with it). I’m planning on starting a new tutorial for Mobian but I wanted to ensure this video was finished first. I hate having an uncompleted project when I start another project.

Below is a screenshot of what I see by the way.

what am I missing
what am I missing837Ă—487 36.6 KB

2 Likes
8

That is how it looks for me too, though I am not the post author. You probably just do not have sufficient privileges yet.

If you don’t mind me asking, what five “errors, inaccuracies, and other items” did you remove? Maybe this should concern me, since I honestly did not notice any when I watched the unlisted video. :sweat_smile:

Best of luck with your next project!

John

9

Uh, placards in the wrong place, spellin’ errors, arrows in the wrong place, something else I don’t remember, and optimizing the terminal commands.

All of these were small nominal things but significant enough that I noticed them.

2 Likes
10

I also have a reddit post about this:

https://www.reddit.com/r/Qubes/comments/m6jpqa/how_to_verify_qubes_digital_signatures_and_key/?

2 Likes
11

Ah, so not any major errors in the instructions, just some details of accurate presentation. I was worried I was getting a bit rusty for a moment! :smile:

If you want to spread your video some more, you may want to consider sending it into the [qubes-users] mailing list. It is usually for fielding support questions similar to #user-support here, but I have seen people send in their creations and projects as well, such as here and here, as well as other items that may interest the general community (ex: 1, 2). So I assume that would be an acceptable use of the mailing list, but don’t quote me on that!

John

12

I haven’t used the mailing lists as it was confusing but I’ll give it another shot. I’ll check out the other links as well.

1 Like
13

Since you’re new to the forum still can’t edit it. Just let me know the new link and I’ll update it for you. I can also make the post into a wiki post. But that will allow anyone edit it as well. (probably not what you want)

Whenever you have an issue like this, you can flag your post and add via the flag a message to the moderators. We will promptly help you.

edit: I’ve updated to what I think is the latest version. Uploaded 20h to your channel.

Also, contributions that increase the accessibility of qubes for non-technical users are very much appreciated.

3 Likes
14

Here’s some feedback as well. I don’t understand enough of the process of verifying signatures on windows to give feedback on that, but there is a recent contribution by @GWeck detailing this process:

Feedback

What I liked:

  • Arrows pointing to the documentation
    This is something no other tutorial seems to do but it helps a lot people see that you’re just following the docs. Most people just watch the tutorials and thing those tutorials are the only source of information there it.

  • voice
    The voice sounds great and is pretty clear. A lot of tutorials have poor audio, but this is not the case.

What I think could be improved:

  • windows aesthetics
    the windows theme you’re using seems to a bit different than what people are used to (the colors seem off) - not sure if it’s the version you’re using or the theme. But this may make people confused as to which window you are opening. For example, whenever I share screenshots of Qubes, I to to reset all my visual settings to the default onces (white theme instead of dark theme) to make easier for others to follow along.

latest_version
latest_version1280Ă—720 59.9 KB

2 Likes
15

@deeplow Thank you for updating the link.

I use windows 7 and a different theme because I have light-induced migraines so I’m constantly having to edit the theme colors to adapt to my vision issues. I can remake the entire placards and make them uniform and swap them in the editor. I also try to make my videos engaging and entertaining, since some of the humor. :slight_smile:

I appreciate the uplifting encouragement that you guys have provided.

I saw the link you provided by GWeck and I don’t entirely understand his thought process about the decrypt command but I’ll shoot a message on the thread he’s in.

Lastly, if you could update the topic of this thread to " How To: Verify Qubes Digital Signatures and Key Verification (Verifying Signatures)" and the description to the first paragraph of my video that would be awesome:

In this tutorial we will be easily verifying signatures to ensure that your download of the Qubes ISO is more authentic. This is important because evil, desperate people suffering from IBS and with malicious intent may try to compromise your download. Using this tutorial assumes that you are not using a compromised computer. If your computer is compromised then no amount of verifications or fancy doo-dads will help.

2 Likes
16

Thank you @deeplow !

1 Like
17

Yes, I think it did the trick! It makes it more easy to follow, especially for someone who has never seen a command line.

Ah. I see. Then I guess it is probably too much work to change it. Maybe adding a note in the beginning (in future videos) just acknowledging that the colors in your windows are a bit different, but that people can follow along just fine. Idk, just a suggestion. Otherwise it may feel to the viewer that it is a different version of windows or something.

On another note, it would be interesting to have feedback on the accessibility of Qubes (maybe in another post), if you’re interested. I bet there are ways to make it more accessibly for people with visual challenges. (again, just if you’re interested)

That’s what a community is for :slight_smile:

2 Likes
18

Disclaimer added in the video description.

2 Likes
19

@JTeller3 I posted on the mailing list:
https://groups.google.com/g/qubes-users/c/JwZOg9a4xsc

I made the post in the same format as my video, which I find humorous. lol

1 Like
20

Hi,

My observations:

  • your voice is great.
    (I wouldn’t be surprised if you use it for your living :wink:

  • the video/audio quality is super.

  • As somebody already noted, the used commands should be copy-pasted, and you already included comment for easy copy-pasting - that is really cool!

  • Everybody would be able to follow your guide - even if not even knowing what he is doind :smiley:

But my concern is exactly this.
You give the listener very detailed instructions about how to copy-paste - while talking about gpg signature checking of a Qubes download. These two topics are assuming very different level of knowledge.
I mean if somebody can’t copy-paste a string to a command line without this level of guidance, that person will not namage to install any operating systen in their own for sure…

If somebody able to install an operating system alone, that person surely not needs instructions about how to copy-paste…

3 Likes