Is Qubes OS really secure? What about Windows security in 2025?

Lilac6044

de0u Yeah, harder question to answer than the one before... Windows recommends using Windows Sandbox instead, this isolates the entire environment however, rather than just the browser. So likely as effective, but no direct browser integration with Edge can make it a little clunkier.

wuseman

de0u
Application Guard is being deprecated, so it still works and it still uses basically a more locked down Windows Sandbox.

The alternative is to use Windows Sandbox, either with Edge or a portable browser. I've used it with both Tor Browser and Mullvad Browser and it works great.

newbie24689

IMHO, ZEN is the magic sauce of Qubes. IIRC, there are users running Hardened Gentoo, and GrapheneOS on Qubes - either would dramatically increase security over standard distributions. This would require a lot of technical expertise on the part of the user.

It's been a year since I worked with Windows.

My QOS Thinkpad is growing old (as am I), and I'm now inclined toward replacing my QOS Thinkpad and GOS P6P with a GOS P10PXL (to be frequently used in desktop mode) or a GOS P10PFOLD.

With this setup, I would keep my data and processing NOT on the phone, but "hidden" in the cloud as much as practical (so that if the phone is snatched, or border-crossing-confiscated from me, there is no info to be recovered.)
(If GOS offers a GOS phone, I'll plan on getting that to support GOS.)

freebsd-user

ryrona
Hey man, you seem knowledgeble.
Can you make a comparison of: Secureblue vs QubesOS

gristle-cause

freebsd-user they are not immediately comparable

Secureblue is a very secure Linux distro, enjoying features like hardened_malloc and SElinux. It will be difficult to hack it, but if something were to do so, your system is compromised

Qubes is a hypervisor - it's a server that runs virtual machines. The available templates for each virtual machine (whonix, Debian, fedora) are less secure than secureblue, easier to hack. But the VM compartmentalization is very strong - should a qube become compromised, your system is safe, just delete the quarantined qube

ryrona

freebsd-user Hey man, you seem knowledgeble.

I am a woman.

Can you make a comparison of: Secureblue vs QubesOS

SecureBlue is really just a security hardened Linux distribution. It doesn't implement any specific security paradigm, but removes all telemetry and implements many security hardenings compared to your average Linux distribution, at the expense of app compatibility. If you want a Linux distribution that is as secure and private as possible, and are prepared to make changes to what apps you use to get this security and privacy, SecureBlue should be the best option out there.

QubesOS on the other hand implements a specific security paradigm, security domain isolation by compartmentalization, and implements this paradigm really well. QubesOS enables very strong isolation, and perfectly leak proof setups, even in the presence of successful remote attacks. But this requires that you as the user compartmentalize your life into security domains, and mapping those into their own qubes, eg one qube for online activism, one for real-life government contacts, one for your private offline activities, and so on and on. Activists and journalists may be prepared to do this, to benefit from the very high security offered by QubesOS, but this may be hard to do at first, and if you do not do that, QubesOS is no better than your average Linux distribution. QubesOS crucially does not contain general hardenings like what SecureBlue does, and in fact contains some of the same telemetry as Linux does by default, even if it can be removed like on any Linux.

DeletedUser594

freebsd-user Can you make a comparison of: Secureblue vs QubesOS

https://secureblue.dev/faq#qubes

Wyut

ryrona what telemetry does Linux have by default that you are referring to? And how do you turn it off?

wuseman

argante It's inexpensive, so I recommend it.

Where did you buy it from, if you don't mind me asking?

ryrona

Wyut what telemetry does Linux have by default that you are referring to? And how do you turn it off?

Depends on Linux distribution.

Most Linux distributions include regular Firefox, which has quite extensive telemetry. It is common the Linux distributions disable the most invasive ones, but not common at all for them to disable all of it. Firefox is practically as bad as Google Chrome today when it comes to invasive data collection for purposes of "improving the app" and "collect usage statistics". (QubesOS specifically has said they won't disable the telemetry in their templates, nor change default web browser, as it is the responsibility of Fedora or Debian.)

Some Linux distributions have app popularity reporting (on app installs from main repositories), crash reporting (usually not automatic, but might be), and similar things. (I haven't seen anything like that in QubesOS templates however, as they tend to be rather minimal.)

Although not strictly speaking telemetry, as it is not intentional data collection and as far as I know has no unique identifiers that can be tracked (other than IP address), many Linux distributions phone home when the system starts up and connects to Internet, to check Internet availability or check for software or firmware updates, or sync the clock. But benefit of these features may outweigh the risks, depending on threat model.

For use-cases where you want your computer to be hidden from other devices on the local network, it may also make sense to disable or uninstall Avahi / MDNS / UPNP, as those broadcast your presence and what apps you have available to link devices.

« Previous Page