Re: [qubes-users] Qubes 4.0+ Windows 10

[Stefan Sperling]

Hello Franziska,

I just found the post from Black Beard and your answer. Since I have the same 
problem, I have some questions and would be verry happy, if you could send me 
your How-to.


Am Mittwoch, 21. November 2018 00:03:23 UTC+1 schrieb 799:
>  
> I made the decisions that I can live with this risk, still I wanted to try as 
> reasonable secure as possible which included:

We made the same decisions for our needs and did some tries to. We are now at a 
place, where we want to enable bitlocker and luks encryption for Win10 and 
Qubes. But moving Grub to a Qubes Partition didn't work yet. I found some 
description 
(https://www.andysblog.de/dualboot-mit-windows-8-bitlocker-und-debian-wheezy) 
and was able to follow the steps. But after that the windows bootmanager workes 
fine and qubes failed booting...

> 
> 
> 1) having my windows partition Bitlocker encrypted
> 2) run Coreboot
> 3) Beeing able to Multiboot and launch windows without entering the Bitlocker 
> Recovery key
> 

Sounds very good and seems to be perfect for our needs. But what is core boot? 


> I spent lots (!!) of time getting this accomplished, but it worked.
> I can send you my How-to if you are interested.


Your How-to would be a great help for us.

Thanks in advance an greetings, Stefan

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/2d695635-c65b-4f2a-9f58-64d897c0c5ff%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Qubes 4.0+ Windows 10

[799]

Hello Black Beard,

Am Mo., 19. Nov. 2018, 10:32 hat Black Beard 
geschrieben:

> [...]
> I'm currently thinking about creating a separate Windows 10 partition
> besides Qubes.
> Is this feasible? Or would one jeopardize his safety in any way?


I am running exactly this configuration as I must run Windows for some
applications (ERP / VMware Workstation ...)

I'm not a security expert, as such I'd like to see someone who is more
skilled adding information if this is not correct:


The problem in a dual boot setup is, that it might be possible to tweak the
unencrypted Boot partition.
The Qubes partition is LUKS encrypted and is therefore more secured.
It could be that an attacker  is able to place "something" in /boot which
will steal the passphrase when you enter it to unlock the LuKS partition.
And it could be possible that the other partitions will be destroyed from
windows, but as you have Backups (do you ;-) , this is acceptable.

I made the decisions that I can live with this risk, still I wanted to try
as reasonable secure as possible which included:

1) having my windows partition Bitlocker encrypted
2) run Coreboot
3) Beeing able to Multiboot and launch windows without entering the
Bitlocker Recovery key

I spent lots (!!) of time getting this accomplished, but it worked.
I can send you my How-to if you are interested.

- O

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAJ3yz2sphWDic9AG8-Vs%3DRX663Ar7oLPf8qNtJ8CUeRJyHU5vQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.