It requires an adversary that can passively monitor two endpoints:
- ISP
- Destination
Typically that access is reserved for governments and nation state actors, but no Qubes OS configuration can prevent a MTIM on both sides.
I guessed so, thanks. That would need a lot of efforts and resources on an adversary side, and no sane threat model would include such an adversary, while being on this forum regularly over tor and accessing regular banking portal over clearnet.
I just wanted to point out that answers on a questions like this topic’s subjects can’t be universal, but general, or they can be particular when the threat model is known.
1 Like
I suggest you think about the pros and cons of each network topology from what has been discussed here,
For example the chained option, you don’t need VPN for banking. If anything that would make your life harder for no reason. You are signing in with your real name credentials.
For the separated option you have 3 FW! Unless you want to have appvm qubes connected to those network chain communicating, and you want to isolate them, it doesn’t make sense to run 2 more qubes for no reason, seems like wasted RAM and cpu cycles.
Start with a simpler topology, use it and make adjustments to fit your needs.
1 Like
Multiple ways, some crypto-to-fiat companies do B2B models, you can email them to ask them to process employee payments, I think there is a small fee but in B2B should be a lot cheaper then B2C services they offer, transak is one of these companies but there are a few others, just searx or yacy “fiat to crypto b2b” and you should get some results.
Ask your lawyer but your company should be able to legally store any crypto as internal cashflow or assets in general, then your employees and even you should be able to request payment in any currency, again ask your lawyer but you might even be able to use monero or zcash as salary, AFAIK the laws around the world are pretty lax and all they expect is a tax sheet filled at the end of the day
1 Like