How to install GPG key?

Summerside · September 3, 2024, 11:03am

I can’t find the GPG key for Whonix and the posts Ive seen are from 2015
I originally was trying to install Kloak but then was getting conflict issue which what looked to be conflicting keys so I removed it but accidentally removed the wrong one. This occured after installing and trying to enable per the guide.
To my understanding Kloak is not installed.
I just want to remove everything and have it back as is and all I need is to install the GPG key as cant even update it now.

.whonix.org/wiki/Packages_for_Debian_Hosts#b-qubes-whonix-sup-sup-template
Just add the www. above as it doesnt allow me to edit post with the link from the guide. Not sure why.

"“Reading package lists… Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: tor+https://deb.whonix.org bookworm InRelease: The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY CB8D50BB77BB3C48
E: Failed to fetch tor+https://deb.whonix.org/dists/bookworm/InRelease The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY CB8D50BB77BB3C48
E: Some index files failed to download. They have been ignored, or old ones used instead.
zsh: exit 100 sudo apt update”

extraextra · September 3, 2024, 11:25am

Did you discover the inside website browser search function yet? The key is clearly mentioned there.

But you’re wasting your time anyhow.

Kloak unavailable for Qubes. It’s stated on Keystroke Deanonymization - Whonix

github.com/QubesOS/qubes-issues

Feature Request: Anti-Keystroke Fingerprinting Tool

opened 04:36PM - 17 Mar 16 UTC

HulaHoopWhonix

T: enhancement help wanted C: gui-virtualization privacy C: Whonix P: default

Keystroke fingerprinting works by measuring how long keys are pressed and the ti…me between presses. Its very high accuracy poses a serious threat to anonymous users.[1] This tracking technology has been deployed by major advertisers (Google, Facebook), banks and massive online courses. Its also happening at a massive scale because just using an interactive JS application in presence of a network adversary that records all traffic allows them to construct biometric models for virtually everyone (think Google suggestions) even if the website does not record these biometric stats itself.[2] They have this data from everyone's clearnet browsing and by comparing this to data exiting the Tor network they will unmask users. As a countermeasure security researcher Paul Moore created a prototype Chrome plugin known as KeyboardPrivacy. It works by caching keystrokes and introducing a random delay before passing them on to a webpage.[3] Unfortunately there is no source code available for the add-on and the planned Firefox version has not surfaced so far. There are hints that the author wants to create a closed hardware solution that implements this which does not help our cause. A very much needed project would be to write a program that mimics the functionality of the this add-on but on the display server / OS level. Ideally the solution would be compatible with Wayland for the upcoming transition in the near future. [1] http://arstechnica.com/security/2015/07/how-the-way-you-type-can-shatter-anonymity-even-on-tor/ [2] http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=7358795 [3] https://archive.is/vCvWb

Summerside · September 3, 2024, 11:40am

HI

Thank you for the link.
I did see that it does mention its not officially merged/applied but as provided there is a guide with its installation for Qubes Whonix on the official docs.
Sorry but yes I did try the search function and don’t see it. Would appreciate it alot if you could share how to reinstall the key.

Patrick · September 3, 2024, 8:13pm

There is no guide.

Updated the wiki page Kloak now to state “Unavailable.” (Previously stated “not merged”, and it won’t be, it’s stalled upstream.)

Add Whonix Repository

There are two different options to enable the Whonix APT repository. [1]

Using extrepo

Manually

Choose one.

Point out which one you have chosen.

For extrepo. no signing key needed because extrepo handles that.

For manually, which I guess you have chosen, otherwise there would not be that issue, there are detailed instructions under quote:

2. Download Whonix Signing Key. [5]