Is browser cross-contamination between VM qubes possible?

Fun Fact:
He has a pattern
Once he finds out he or his exploits have been discovered, he leaves a calling card of total obliteration

He destroyed my ADT system the similar way he destroyed my MacBook after he realized his efforts were being discovered and compromised back


Image Description:
Photo of a software based glitch obliterated ADT panel screen (again not hardware, the screen is fine — the software displays lines now as the entire root file system was left corrupted)

they shouldn’t be

I have found the vocabulary list

They should not by default be set to Whonix?

I am just guessing from the 2 pop up errors

This laptop hasn’t yet been online yet so I truly do not yet know, and I am setting up other templates and qubes first and saving these for last so I have no idea they look like Whonix though :woman_shrugging:t2:

Well, didn’t read each message but I saw you got the link to the glossary, that’s a good start. Using the good vocab is not that important but the underlying concepts are essentials.

You say you don’t have time to learn the Qubes basics but from what I see, it’s your best option, it’s far better than trying to customize the defaults like users and passwords.

It’s a bit off-topic but your post about template and appvm is a good example: it’s far more efficient for a begginer to learn the concepts of Qubes OS and apply them than to try to harden random things. You put a browser, a mail client and an office tool in the same qube but maybe using a qube for each one, even with the default firefox, is far more secure.

2 Likes

Yes, because each will have its own dedicated email alias and/or email account

I am not even sure I will have my mom use the mail client, as she might do best with the web portal to such the only issue is some of the web based email providers may not suffice in stopping Beacon attacks that tag which may fingerprint the qube appVM itself if it remains persistent — then again that is why 2 out of the 3 are going to be disposable

I don’t think my mom will be happy about the clipboard, which is also why I figured to have dedicated alias emails associated with her activity per each qube included

The idea is banking will be banking stuff, but it will not be her 2FA (I do have a different qube appVM for just 2FA)

See:

Image Description:
– START IMAGE DESCRIPTION –

Top separate qube appVM is a different color, green, while the 3 bellow are a charcoal dark gray.

0 QUBES 3D square image =
1 side says the OS minimum requirements,
“16G RAM, 250G hard disk”

The top side describes its appVM config as,
“Persistent Storage [with a thick red question mark as I don’t know the RAM or disk allocation yet I will give it]”

The final 3rd facing front side has install and functional descriptors as,
“[bullet point] 2FA / MFA” then goes on to list the software installed,
“[package box icon] [redacted] app 2FA
[package box icon] [redacted] OTP
[package box icon] Authy”

Bellow are the charcoal gray qubed box shapes:

3 qubes representing the appVMs from the Templated base iso image of an OS.

1st QUBED 3D square image =

1 side says the OS minimum requirements,
“4G RAM, 15G hard disk”

The top side describes its appVM config as,
“Disposable 8G RAM, 5G hard disk”

The final 3rd facing front side has install and functional descriptors as,
“[bullet point] Banking” then goes on to list the software installed,
“[package box icon] Libre Wolf
[package box icon] Thunderbird
[package box icon] Libre Office”

2nd QUBED 3D square image =

1 side says the OS minimum requirements,
“4G RAM, 15G hard disk”

The top side describes its appVM config as,
“Disposable 8G RAM, 5G hard disk”

The final 3rd facing front side has install and functional descriptors as,
“[bullet point] Finance” then goes on to list the software installed,
“[package box icon] Libre Wolf
[package box icon] Thunderbird
[package box icon] Libre Office”

3rd (last) QUBED 3D square image =

1 side says the OS minimum requirements,
“4G RAM, 15G hard disk”

The top side describes its appVM config as,
“[in bold red letters] Persistent [end of bold red letters] 8G RAM, 5G hard disk”

The final 3rd facing front side has install and functional descriptors as,
“[bullet point] IRS / Taxes” then goes on to list the software installed,
“[package box icon] Libre Wolf
[package box icon] Thunderbird
[package box icon] Libre Office”

• NOTE:
The mention of the OS for the Template was redacted in all 3 qube appVM image depictions

– END OF IMAGE DESCRIPTION –

This looks really good actually.

Just make sure that if you are installing Libre Wolf, you are installing it in the template itself. You could use the AppImage inside the AppVm without modifying the template also if you prefer that. What’s hard about that is that for Librewolf they want you to import the signing key and the repo and to do that you will need to download it in a non-template and copy it to the template VM and then move it to the right directory. You could just use the AppImage in the mean time. I would make a post to ask for advice on how to do that properly. I’ve posted a lot but I’m not that good with Qubes or linux and am not explaining this well.

Sometimes you can do everything right and still get hacked and Qubes takes a long time to set up. I would urge you to backup your qubes and keep them in offline storage. You can restore Qubes really easily and if you system gets corrupted, it’s not that hard to reinstall Qubes and restore the backups of the Qubes.

2 Likes

A Disposable will not save anything so just know that if you download emails into Thunderbird with a VM like that, they will not be saved.

2 Likes

Had no idea … I haven’t installed these yet as I have just been planning them out

Is there a guide on here that has those steps?

Eventually it will likely come to that :sweat_smile:

Yup! Got that covered, I have a drive dedicated for image backups and all that

Good point, may have not thought this all through… might have the web emails here instead then hmmm. The issue is not all the web emails protect against Beacon attacks such as tagging hidden little tracking pixels into image sent through email. Okay well I have to think this over again, thanks for the reminder

If you load webemail using whonix, those beacon would get different addresses. You just need to make sure your email provider will not block tor exit nodes.

You can use Thunderbird in a non-disposable AppVM as well.

1 Like

Thanks for informing me of this as I am brand new to Whonix as well as Qubes lol

That is doable for me, but that will drive my mom into a fury of frustrated madness so I can’t have that as the solution for my mom’s set-up sadly

Am still brainstorming over it …

[irrelevant comment retracted]

1 Like

Also good to know, thank you!

1 Like

it’s in the debian-12 repo now?

[irrelevant comment retracted]

2 Likes

Unfortunately, a minimal debian 12 qube cannot find it in the repository.

As far as I know, both debian 12 and debian 12 minimal point to the same repositories.

1 Like

Are we using the same Debian 12 repo?

I don’t know about Barto, but I’m using whatever debian-12-minimal points to. Again, I’m presuming it’s the same as debian-12, and that the difference between debian-12 and debian-12-minimal is what is actually installed, not in what is available to be installed.

Maybe I’m wrong about that, but if so I’d like to know.

Oh and to be clear, I am talking about clones of these templates, of course; I don’t install anything to the original templates.

I do install things to the original templates. Is that a bad security practice?

Would it not be acceptable to clone the original and then add to that one?