Vault has Firefox, why?

[unicornmalarkey]

My understanding is the vault is an air gapped Qube/container, so why is Firefox showing in the APPS vault menu?
Next question is how secure is a password manager in vault, perhaps compared to a cloud password manager?
Might be an answer for BTC seed phrase or passphrase storage, using KeePassXC 2.7.9?

[mohabaks]

Your seeing firefox since the base template from *-xfce4 has firefox installed you can have a base template only for vault with only apps you need e.g keepassxc,pass etc.

[otter2]

@unicornmalarkey

Next question is how secure is a password manager in vault, perhaps compared to a cloud password manager?

IMO more secure because you don’t need to trust a third party that much and it has no direct access to the internet, but less reliable unless you practice a good backup policy.

@unicornmalarkey

Might be an answer for BTC seed phrase or passphrase storage, using KeePassXC 2.7.9?

It depends on your threat model and the purpose of the wallet. Sometimes literal paper wallet is the best choice.

Keep in mind that QubesOS domains are technically vulnerable to side-channel attacks - read this topic:

Mitigations for resource usage covert side channels in qubes

When using shared resources, one is able to modulate data into the usage pattern. This is bad. The other day i thought a bit on how to extract information from a vault qube. The first thing that came to my mind: “If i utilize the CPU in qube A, i may be able to detect that in qube B by measuring the time when qube B is rescheduled. I should be able to transmit information over this channel.” Sure: The adversary need to have RCE in both qubes, but think big. Think supply chain attack for exam…

[fsflover]

@otter2

Keep in mind that QubesOS domains are technically vulnerable to side-channel attacks - read this topic:

Which you can mitigate by stopping all untrusted qubes while doing some sensitive action.