Mitigations for resource usage covert side channels in qubes

[fsflover]

@Suspicious_Actions

Things anybody can do now:
Pause critical qubes like password vaults when not in use.

And, vice versa, pause all other qubes when doing something with vaults:

@deeplow

Pause All VMs for Secure Operation

(Haven’t seen this implemented yet – as far as I know)
We know that harware-based attacks like spectre or meltdown can read memory portions in other VMs.

But imagine for example that while opening you password manager on your vault qube it pauses all other VMs, then you enter the passphrase (it’s now in memory), copies the password to the qubes-clipboard, removes your master passphrase from memory and then resumes everything else. (stole this idea from here and

This needs some more thinking since there may be timing-sensitve operations running on other qubes, but I believe this could easily be implemented via a Qubes RPC to dom0.