Qubes OS: The Operating System That Can Protect You Even If You Get Hacked

Micah Lee explains how Qubes OS uses virtualization to isolate activities into separate security domains, protecting users even if a single VM is compromised.

Talk from the Circle of HOPE (2018) hacker conference: hope.net/schedule.html#-qubes-os-the-operating-system-that-c… "If you’re serious about security, Qubes OS is the best OS available today," says NSA whistleblower Edward Snowden. "It’s what I use, and free." In most operating systems like Windows, macOS, and all Linux distributions, all it takes is one mistake - open the wrong PDF, plug in the wrong USB stick, "curl | bash" the wrong URL - and it’s game over. Even without root, the attacker can access all of your data, take screenshots, listen through your mic, watch you through your webcam, and get persistence to spy on you in the future. Qubes OS aims to be a reasonably secure operating system that doesn’t have this problem. In Qubes, your host machine runs a thin layer of software for managing a graphical desktop environment and all other software is compartmentalized in separate virtual machines, with strict controls on what hardware they can access and how they can communicate, all while being usable enough to run as your daily OS. In this talk, Micah will show off some of the cool things that this approach makes possible, like opening email attachments in "disposable VMs," managing anonymous identities, keeping secrets like password databases, PGP keys, and sensitive documents stored in vaults without Internet access, and much more.