Coreboot vs. anti evil maid

I plan on buying a laptop that can run QubesOS but I am undecided which one would make more sense. If my threat model does not consist of a three letter agency and if I won't travel with the device, coreboot should be the better choice, right?

I have Qubes running on a Librem 15 v 3 with 32 GB of RAM and it works great. I'm not sure why you believe Qubes OS doesn't work against state and 3 letter agencies, it's threat model accounts for such attacks. As you stated, on a Librem you're only really vulnerable to someone physically hacking your computer.

Why not have both? What is your threat model? It might be that you don't need as much protection as you think you do.

>>17533 >>17536 >Why not have both? This really. They're not mutually exclusive.

>>17534 Sorry if that came out wrong. I do believe that to some degree Qubes is working against the alphabet boys. >>17537 >>17536 As stated here: https://www.qubes-os.org/doc/anti-evil-maid/ >The current package requires a TPM 1.2 interface and a working Intel TXT engine. If you cleaned your Intel Management Engine with e.g. me_cleaner while installing CoreBoot then you are out of luck. For now you have to choose between cleaning your BIOS and deploying Anti Evil Maid. So I assumed I would have to decide between the two. >What is you threat model? Well my threat model is pretty basic. I am not a journalist nor do I work for important people or engage in criminal activities so the chances of targeted surveillance are pretty low. My only adversaries are online tracking and mass surveillance. I don't live in a hostile environment and I wouldn't travel with the device so the potential threat of an evil maid attack should be close to zero. If aem and coreboot would be possible together I still would get both. Do I actually need Qubes? Not as much as other people do but I love tinkering with technology and it's not a bad thing to have a secure OS in this time and age.

>>17538 Based on your threat model Qubes is probably excessive. Smart software choices (like say using Tor Browser for anything you don't need personal accounts for) will be most effective in combating corporate surveillance.

>>17542 Considering it's literally the only "widespread" OS that does any effort with isolating things meaningfully? It can't be overkill when it's the only choice. >>17538 >As stated here: https://www.qubes-os.org/doc/anti-evil-maid/ >The current package requires a TPM 1.2 interface and a working Intel TXT engine. If you cleaned your Intel Management Engine with e.g. me_cleaner while installing CoreBoot then you are out of luck. For now you have to choose between cleaning your BIOS and deploying Anti Evil Maid. >So I assumed I would have to decide between the two. That just means you don't get Anti-Evil Maid. So you'll have to avoid situations where compromise via physical access to your hardware is likely.

>>17543 >Considering it's literally the only "widespread" OS that does any effort with isolating things meaningfully? wait until you hear about android

>>17544 >wait until you hear about android Yeah, it's pretty bad at it. Container-tier bullshit isn't isolation, it's a joke.

>>17543 >Considering it's literally the only "widespread" OS that does any effort with isolating things meaningfully? It can't be overkill when it's the only choice. tfw Genode still isn't considered production-ready ;_;

>>17546 I think seL4 is ready now. But much like Genode, it needs some userspace to actually build on top of it. Qubes could very well have backends for both Genode & seL4, but someone needs to actually implement them.

>>17547 I'm pretty sure Genode can work on top of SeL4. But yeah there needs to be more user-space... as far as I'm aware, most stuff in Sculpt OS is just run in paravirtualized environments.

Use anti evil maid if you actually care about security, coreboot if you are an tinfoil hat worried about muh backdoor.

>>17555 ... or roll your own anti-evil-maid with glue/latex and a glitter nail polish surface layer. or disconnect the ports from the motherboard altogether. (put nail polish on all screws and photograph the glitter pattern anyway. this is to prevent the "fat evil maid" e.g. one with enough time to screw open your pc like the TSA does. check for screws beneath rubber feet using the disassembly manual.)

>>17558 >>17555 Actually good advice. When crossing borders with a phone maybe it's a good idea to desolder the data line or destroy the pin strips for data of that micro USB port. And now no data cable works! At least you still get to charge your phone still but no one's gonna tamper that twrp with a sneaky dongle and no one's gonna image that phone of yours as they're filled with confusion. Even make your phone emit a loud noise when it detects charger so the moment somebody try to plug in a data cable over that phone they will return that immediately, sounds hilarious while you now know what they've done. They probably have those usb with clips so you should clean that desoldered/destroyed data line properly! also make sure in the schematics there's no exposed data line or if there is a DMA anywhere put tamper resistance or just make sure it's harder to just interface with it, yup glue gun is your friend. Our friend. Gluegun that PCB and chips. Do it now. Another would be to actually make a proprietary small USB port from another salvaged port like let's say those old dumbphone samsung charging ports, put the port on your phone and own a cable that only works with it since it has more lines than a USB and you only need two for charge it should be possible to make an obscure USB charger or data cable which you carry in your pocket. You can even intentionally break the cable and fix it when you get to the your destination. "Warranty" stickers, cover those holes. The same procedure above could be done with netbooks or laptops, you can even desolder the USB port and just use optical discs for the cyberpunk points (since usb is f%%ked). If no odd is available, try looking for ones with pc-card and destroy any other USB port although pc-card is vulnerable to DMA so you could maybe do the proprietary port trick. You should probably obscure it. There should also be a way to determine if your device is tampered, there were keylogging devices that go in between the ribbon connection of the laptop keyboard and motherboard, maybe a transparent laptop would be a good way to actually inspect tampers? Unironically, if you're worried about acronym agencies you should just use alternative ISA and ignore any of those AEM/coreboot dilemma. Yup a psp or nintendo actually running linux???? They ignored that part and they probably don't have preemptive tools for that obscure $h1T you have there. Maybe you should also obscure the USB port because why not. Actually the thing is portable handheld devices are much easier to physically secure than latpops which have too much ports ready for DMA.

>>17560 >>17558 >>17555 Thanks for the input guys. I really appreciate it.

>>17560 Why are you talking about phones? Actually that had a funny thought pass through my mind wondering what would happen if someone made a phone case with a fake USB port that is actually a USB killer.

>>17563 Well I mean "handheld" form factor is a lot easier to manage, and pretty small enough to inspect everything unlike laptops filled with plenty of magic ports and chips. "gpd win" can run qubes which I technically treat as a "handheld/phone", but if the OP question is the dilemma about having coreboot or aem I am suggesting the idea of just just picking a different approach which is having a device which has less potential against DMA attacks (a physically securified phone/handheld) or an obscure OS that no existing "tampering method" actually works (maybe data extraction but what can they do if there's no DMA or data lines anywhere???). I think I figured out with this conversation, the best way is to have a device which is sealed completely like a microsoft surface (pic related is funny) but have only one charging port, no data input or USB of any sort - maybe a userspace level access only through wifi/nfc or similar nature of connection to actually modify your bios or use "wireless usb hub" to even use internet (maybe infrared serial is nice for this?) but it should also use an obscure OS that's built in such a way along with hardware, just the power button and touch screen is the user input (and the wireless usb hub only runs at userspace) which should be pretty secure and lastly maybe the case should require extra drilling to actually open that up. "Screw" the idea of having screws and have all accessible testpoints or any direct access pins be either baked in a way there's no access to them, or tampering breaks the thing itself, maybe gluegun method is the best approach if the design flaw exist (like every device right now) that has some magic chip that's just waiting for DMA to be abused by 3-4 letters that end in A or some h4r or oppressive g8t (<- that's a neuronym). ^ ideas above belong to public domain - UTC 23:42 Wednesday, October 6, 2021

>>17533 So, did I get it right: Anti-evil maid works with proprietary boot firmware of laptops, but doesn't work with free coreboot?

>>17566 It depends on processor features Intel decided it would be clever to make dependent on part of ME's functionality. Because of course that's a smart idea (it's not).

>>17568 Coreboot preserves ME region of firmware, you're confusing it with Libreboot, and machines that support Libreboot don't run Qubes well to be considered in scope of this discussion, nor have relevant TPM hardware version to implement Anti-Evil Maid. I still don't see a problem.

>>17538 >If you cleaned your Intel Management Engine with e.g. me_cleaner while installing CoreBoot >If I know very little about coreboot so perhaps I'm wrong, but doesn't this imply it's possible to install coreboot while retaining me, and thus making it possible to get AEM + coreboot?

>>17571 >>17572 I think the cleaner might remove a lot more than coreboot does, which might be why it causes problems.

>>17572 Coreboot supports vboot and measured boot though. Maybe you could use that instead of AEM.

>>17572 >>17537 >>17574 >>17565 >>17566 I opened a thread in the forum: https://forum.qubes-os.org/t/anti-evil-maid-and-coreboot/6790 and it seems like that aem and coreboot can work together. I'll see if I can find a list with supported boards.

The Nitropad x230 has both coreboot and aem https://shop.nitrokey.com/shop/product/nitropad-x230-67