Should print jobs be proxied? I.E. Do printers uniquely identify you to torbrowser?

General Discussion
1

So whonix talks about making a “anon-printer” VM based on whonix workstation, and setting up the printer in that. However, given :

  1. The model/description string of the printer, and
  2. The ip address of the printer, for example: “10.1.2.3”
    the wouldn’t that uniquely identify you to all disposable, anonymous VMs that you have the option to print from?
    (Note: not as bad if your network happens to be 192.168.0.0/24)

I don’t know if web sites one visits can access the printer settings in a torbrowser, but it seems like a risk.

Should there be a special sys-cups (or sys-printer) VM that they print to, in order to not uniquely identify to the browser?

Note, I’m just talking about having the expected anonymity of torbrowser dissapear. I’m not worried about the tracking information on the printed pages, or the unencrypted network traffic yet.

2

Apart from the question if websites could access your printer settings (which is a very interesting one that should definitely be answered by someone knowledgeable), I would always recommend two things:

  • Deny access from VMs that can access the Internet to your local network and vice versa (using Qubes firewall settings or, if possible, even dedicated network VMs)
  • Put your printer settings in a dedicated disposableVM (see, e.g., "Now You're Thinking with Qubes" - #5 by phl)

Both help with stronger isolation of your digital life in general. If you would want to print something from the Internet you would then:

  1. Print page to PDF in (tor)browser
  2. Navigate to PDF in file system
  3. Right click → View in DispVM (which would open a disposable PDF reader with access to your local printer)
  4. Use the regular print menu from there.

Just make sure you leave the dispVM open long enough for the printjob to be fully transmitted. Especially with larger files, I sometimes close the window before all data has been transmitted to the printer and then the job aborts.

3

Note to anyone reading this discussion: the discussion he mentioned generated a more detailed version in a “guide” discussion, and I just posted a even more detailed alternate version lower in the same discussion.

(It does successfully solve the issue I was asking about)

His more detailed version is at: Printing from DisposableVMs - #2 by phl

My even more detailed alternate version is at: Printing from DisposableVMs - #8 by ddevz

Feel free to chip in over there.

4

A somewhat simpler solution is to use a split-printer, where you print
as usual from a qube, and the print job is passed by qrexec.
The printing qube has no knowledge of the printer at all, or of the
“print” qube, since this is handled at the admin level, so there is no
risk of unique identification.
GitHub - unman/qubes-print has some details.

1 Like