On Thu, 5 Mar 2020 at 18:21, Chris Laprise <[email protected]> wrote:
> On 3/5/20 7:31 AM, Mark Fernandes wrote: > > I want to get a genuine copy of Qubos, from here in the UK (United > Kingdom). > > > > The only way described on the Quebos website at present, appears to be > > to download the ISO. > > > > I have the classic security problem described on the website > > <https://www.qubes-os.org/doc/install-security/>, where not having a > > trust-worthy machine, means that I have a never-ending chain of trust > > issues for each machine that I use in the obtaining of the software. > > Many of us work with a threat model that assumes at least some computers > available by retail are not compromised "out of the box", or else if > compromised then not at the BIOS/UEFI firmware level. For this model, > verifying the Qubes ISO with gpg is acceptable. > > Hello Chris, I've only heard of gpg as a binary running over an operating system. Is it available as something you can run directly off boot-able media? In any case, you still need to ensure that gpg hasn't been compromised. If it has to run off an OS, that OS needs to have not been compromised. If you need to download gpg, the OS which you use for downloading gpg has to be not compromised. The website doesn't appear to address these issues. The security Qubes OS offers may be great. But getting from a position where you don't have Qubes OS at all, to having Qubes OS installed, appears to be a serious security concern. You can also qualify the model somewhat and say that an attacker cannot > successfully infect all of your (hopefully diverse) computers, so that > makes checking a signature on several different computers a form of > reassurance. > > OTOH, you may have decided to discard the above threat model because of > some intent or capability known to you. In that case, I think the Qubes > community has only two answers: Find a trusted service that can flash a > known good/uncompromised firmware suite onto one of your machines, or > find a system vendor like Insurgo or NitroKey that sell re-flashed > systems and uses anti-interception measures (like tamper-evident > packaging and signatures) in addition to offering Qubes pre-installed. > -- > Chris Laprise, [email protected] > https://github.com/tasket > https://twitter.com/ttaskett > PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886 > > 👍 Thanks for these tips. They are valuable. Mark Fernandes -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/CANJMFk8DUVciwtjFs%3DRJQf9EPNHgU1cRWE7N7NfreF9epqCtvA%40mail.gmail.com.
