Thank you for all the comments!:)

Windows

final Here are some Windows comments:

Thank you so much, this was a great read! I'll probably still not use Windows, but knowing this is still extremely useful. There are plenty of people who will have to keep using Windows, and being able to help them improve their security is great.

ChromeOS Flex

ujjayi Two layman cents in here since you mention two distros I've tried recently, and you also mention Chrome OS Flex. Some differences in potential security aspects with the latter are listed here: https://support.google.com/chromeosflex/answer/11542901?hl=en

Great, that page is going straight into my bookmarks! No surprises, though. Even if I was willing to accept the problems that come with ChromeOS because of its security, that tradeoff would fall apart with Flex.

NixOS

N1b [Nix] has a really interesting USP that your entire setup is summarized in a single config file which makes changing or cloning devices a very easy experience, maybe that's interesting for you.

For some reason, I never really considered NixOS even though I knew about it. It's still not as good as immutable openSUSE or Fedora for me, but for others it might be better, so good to have that in mind.

openSUSE vs Fedora

ujjayi Some things felt buggy and slow with Kalpa

Yeah, that's my experience as well. As I said, I used Fedora Workstation for a few months and switched to Kalpa yesterday. I'd like to go back to Fedora (Silverblue or Kinoite), but I'm determined to use the most secure option in the range of what's possible for me. Mainly because I want to be able to recommend people in a similar situation an OS, and feel only comfortable doing so if I have experience using it.

I'll have to look into how big the difference in security between them is from openSUSE being rolling release. If it doesn't make that much of a difference, maybe I'll return to Fedora.

Whether GNOME vs. KDE makes a difference in security is also something I haven't seen conclusively answered, although I think they are close enough where it doesn't matter much. So much research to do… but it is what it is. I think I'm close to finished when it comes to desktop. And that choice of words is deliberate.

GOS Pixel Tablet

N1b ever since I started using GOS on my phones it gets harder and harder to get satisfied with anything else.

Yeah, same. It's hard to accept that the combination of usability, freedom of choice and security that GrapheneOS offers knows no equal. Choosing a desktop OS feels like desperately looking for the least bad option. In comparison, using GOS almost doesn't seem to have downsides.

As someone who knew very little about Privacy, Security, Linux etc. until quite recently, I really wonder how the desktop got to the state it is in now. Why is there no GOS-like desktop OS? Is it impossible for some reason?

Anyway. I'll probably just give up on desktop once I can get a Pixel Tablet. Or only use Tails sticks or something.

[deleted] at the moment use Fedora when, say, editing images.

Yeah, if I could get a Pixel Tablet something like this might be the only thing I'd use desktop for – if that. I don't know what's possible on there, but GIMP and Inkscape might actually be some of the most problematic uses to replace.

Tails vs. Qubes OS vs. GrapheneOS

Having put a little thought into it now, a Pixel Tablet might be all I need in addition to my phone. This would be a dream in its simplicity. There is only one thing I'm not so sure of, as I haven't seen anyone going into the comparison in too much detail: How does the privacy and especially security of using GrapheneOS compare to either using Qubes OS or using (potentially multiple) Tails Sticks with persistent storage?

Compartmentalization

In terms of security through compartmentalization, I expect Tails to be hard to beat in theory. In practice, I expect Qubes OS to be safer because realistically, you'd compartmentalize your workflow better. Please, just picture some paranoid, sweating dude running 20 Tails on 20 laptops simultaneously in a crammed room.

While Qubes has, well, Qubes, Graphene has user profiles, which might be used somewhat similarly. They can easily be deleted, and creating them is quick as well. You can even install the apps you need during creation if you have them on the owner profile. That means you can, among other things, turn off the ability to install apps for the whole profile. I've never thought about embracing this feature to this extent, but I don't really see why it shouldn't be possible.

You might even have a separate user profile only for specific password managers, heavily isolating them from the profiles you use the passwords in. I don't expect copy & paste to work through switching user profiles, but when using randomized multi-word-passphrases, simply remembering them for 10s can work.

When I began writing, I was sure Qubes should come out on top. Now I'm not sure at all anymore. I have never used Qubes, but GrapheneOS seems to hold lots of potential for this as well. I do remember a user on this forum complaining that a language change in one profile influenced an app in another profile, so if this was indeed the case and wasn't an outlier, there might be some problems with leakage. But even if the isolation between Qubes was stricter and harder to overcome than the isolation between user profiles, it's not decided.

Every profile has GOS running as OS, which I expect to be generally more secure and have better internal sandboxing than every OS you can run in a Qube. If you use GOS in way that, for example, means a threat has to compromise the app, then break out of sandboxing, compromise the heavily restricted user profile, break out of the profile into the owner profile and then break into the other (encrypted!) user profiles... that should be reasonably secure. You might also have crossed into 5-dollar-wrench-attack territory. So which is better? No clue. Can Graphene be used in a way where the difference probably isn't that meaningful? I think so.

Anonymous browsing

Another important area is anonymous browsing. Tails runs everything through TOR by default, and Qubes has Whonix-Qubes. In GOS you could create a heavily restricted user profile with either preinstalled Orbot as permanent VPN with Killswitch and browse through your browser of choice (probably vanadium) or preinstall Tor Browser.

I have no idea which would be best at anonymizing you. The only thing I can say is that Orbot + Vanadium should beat the security of Tor Browser on GOS, but I don't know about the anonymity.

Anti-forensics

How much evidence you leave matters as well. Assuming a threat actor captures all devices shortly after Tails (with persistent storage) was pulled out; after Qubes has been shut down; after all sensitive user profiles have been deleted and GOS has been shut down.

Here I am completely unable to evaluate the options.

Conclusion

This completely got out of hand and I need to go to bed now. Maybe I should make this into another post tomorrow? Until then, I'd love someone with more knowledge/experience than me to destroy what I said here with facts and logic;)

However, I do think that GrapheneOS is likely at least a usable option to adequately replace what I and many others have associated only with Tails, Qubes (and Whonix). I'll definitely go down this rabbit hole as soon as I have the opportunity to. If GrapheneOS turns out to indeed be a viable alternative, I'll be even more blown away.

You people all have a good night (or day)!