I would do this without a separate network device. Create a clone of a clean (no saved passwords) sys-net.
First set sys-net and sys-firewall to NOT autostart. Starting an appVM which uses them will start them first anyway. Create a shutdown script which... stop all appVMs stop sys-firewall update sys-firewall to use the insecure, general sys-net complete shut down Use this shutdown script for all shut downs. Then when you turn your machine on "not at work", it will be using the insecure sys-net by default...you won't accidentally expose your work wifi credentials. Startup at work will require running a script from dom0 to... stop all appVMs if any are running stop sys-firewall stop sys-net update sys-firewall to use work-sys-net start work-sys-net start sys-firewall start usual work appVMs All done without an additional network device Clear out any saved work wifi credentials in sys-net This is how I would approach this issue. On Wed, 12 Sep 2018 11:26:57 -0700 (PDT) daniel <dan...@allcock.org> wrote: >Thank you for your advice and quick reply, Alex. > >My question isn't just abstract security paranoia. Most wifi passwords don't >really matter. >But my university in its wisdom uses a one-per-user username/password combo >for *everything*. >So someone who gets my work wifi password can also change student grades and >redirect >my paycheck. (There is 2FA for some things, but still.) And I can't do >anything about this policy. > >So I'd rather not have that particular password stored in a VM which qubes >expects to be subverted. >I don't think this is paranoia, just part of the data-flow thinking that qubes >users are expected to do. > >I like your suggestion for a separate usb wifi device. Then when I want to >connect at work I would >just change the networking VM for sys-firewall from sys-net to sys-net-work. >Would appreciate any >pointers to docs helpful for actually doing this. (Haven't delved into the >usb system yet.) > >And still open for suggestions from all, to my original broader question as >well as the current how-to-protect-a-single-wifi-password question. > >Best, >Daniel > -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20180912144406.2bba3184%40gmail.com. For more options, visit https://groups.google.com/d/optout.
