Best practice for using Tor Browser with Whonix Workstation

Qubes-Whonix
1

Hello. I am trying to carefully follow the instructions in the documentation and I am confused about how to run Tor browser. It says:

Tor Browser is useful to run in:

  • Whonix-Workstation ™ App Qube (anon-whonix)
  • Dispoables

Tor Browser should not be run in:

  • Whonix-Workstation ™ Template (whonix-ws-16)
  • Disposable Template (whonix-ws-16-dvm)

“create new qube” window only allows me to create an AppVM qube if I select a template. However, the instructions clearly say do not use a template and I only see Whonix Workstation available inside the “template” drop down.

Am I missing something?

Thank you in advance.

2

This is more Qubes related than Whonix related. Qubes OS don’t recommend to use templates or/and give internet connection. The reason is: Template is only to be used to create AppVM, Disp and Standalone. If you use your template with internet connection and the templates gets hacked, all your Qubes based on that template will be hacked too. So you need to create a new qube based on the Template of the system that you want to use. Always keep the system settings default after installing a OS Template.

3

You’re mixing up different levels. The host operating system (Qubes dom0
outside the VM) versus inside the VM.

The documentation applies to the inside of the VM. I.e. after a VM has
been started and running commands inside it.

When creating an App Qube, not too much thought needs to be spend on Tor
Browser.

It doesn’t say “Do not use a template”. It says “Do not run Tor Browser
inside Template”.

An App Qube is by definition based on a Template.

In other words…

Good: Create an App Qube based on whonix-gw-16 (see Qubes-Whonix
documentation on how to do that).

Bad: Run Tor Browser inside Template.

4

I am very grateful for your response. I have a learning disability and sometimes it is hard for me to understand written information and I can mix it up. I am very interested in learning Qubes-Whonix though and I am spending many hours everyday trying to learn it.

So is this the correct way to start an App Qube with Whonix?

Create new qube
type: AppVM
template: Whonix-ws-16
networking: default (sys-firewall)
OK

Then I open Tor Browser (anon-dist) from inside the Qube I just made?

Thank you for your patience. I hope I am not frustrating you.

5

That’s correct but incomplete. For full instructions, see:

6

Thank you, Patrick. I tried to read through this very carefully.

The link you shared appeared to be specifically for Workstation so thats what I am focusing on.

The only section that I see that might help is:

4.3 How-to: Use more than One Whonix-Workstation ™ - More Security

I follow this link and it says:

  • [Qubes-Whonix ™]This step can be skipped.

There is a link for non qubes whonix but thats not what I want, right?

I don’t see any other information regarding Whonix Workstation within these links.

7

Users of Qubes-Whonix, when told to skip Non-Qubes-Whonix information, can skip Non-Qubes-Whonix information.