What's your system layout like?

[fiftyfourthparallel]

@adw

It’s exactly the opposite.

Physical air gaps require you to transfer files via USB (or less convenient methods) rather than secure qvm-copy/move. BadUSB is a big problem. Therefore, qvm-copy/move has the security advantage over physical USB sneakernet. The attack surface of qvm-copy/move is incredibly minuscule compared to plugging the same USB drive into multiple conventional physical machines. This is a point in favor of Qubes over physical air gaps.

I might have been unclear–what I wrote agrees with what you’re saying.

Because BadUSB is a massive issue, I see the argument against physical airgaps, because such airgaps tend to rely on USB for data transfer, and BadUSB is hard to detect (impossible for those without specialized equipment, training, and tons of time AFAIK). This is why I brought up my point that “USB isn’t the only means of data transfer”–MicroSD cards are very hard to compromise, for example, and SATA (like eSATA) are less targeted AFAIK.

[fsflover]

Can websites track me across different qubes?

Hi all. I think I’ve been more or less doing what others have described. I’ve broken my online “world” into 3 categories: Sites where I always log in: A dedicated AppVM for each with Debian’s default Firefox-ESR with no plugins installed. They already know who I am and they already know what pages on their site I visit. General browsing: Whonix with Tor Browser on Safest and accessibility refresh disabled. If a site doesn’t work, then (in general) it’s their problem and I move on. …

[Clodius]

i’ve gotten tired of torbrowser not loading youtube videos and started using disposable firefox-esr with add-ons ; i might get a few videos, but then yt starts complaining and i have to reload the circuit, just time consuming

[fsflover]

@Brainhack

My Qube number 1 will be for open and official data. Will keep my old Gmail account along with banking and government contact there, probably even without a VPN.

Number 2 will be for cryptos and all sorts of services that are a bit more sensitive. As a lot of this comes with KYC and such it will still be “official” but with a VPN or sometimes using sys-whonix instead I guess.

Number 3 is then based on data that should have NO connection to the others. In other words this one is where I build another online presence from scratch. (Not talking about any illegal or black hat antics here, merely NOT giving any real data)

This is where I’ll do anything from reading & posting on forums that belong to this level of sensitivity, keep some of my privacy coins and in general feel pretty secure that there will be no direct links to Qube 1 & 2 that could lead to ALL of the (scarce) data from this Qube being spliced or connected with the others.

Number 4 remains to be decided upon, but if I build that it will be done via number 3. I do not have any real need for doing this, but if the need arise I will be prepared. Mainly talking about IF there is some very serious situation like a civil war here, I’m living in South East Asia after all. Could even happen that there is some push to “get” foreigners, and I might have to get info, contact helpers or whatever worst case.

Number 5 is for personal writing and files, so that is simple - NO networking for this one!

(Post can’t be empty!)

[Brainhack]

Use Brave instead, blocks almost everything that you won’t have spying on you!

[deeplow]

I would just ask for the conversation to stay on-topic. For non-Qubes’ conversations more suited venues are https://forum.privacytools.io/.