Long Wiki Edits Thread

[0brand]

https://www.whonix.org/wiki/Windows_Qubes_Start - I guess Qubes has no place in page URL?

Not sure what happened with that. Not intentional.

Perhaps move to https://www.whonix.org/wiki/Windows_Testers_Only_Version during testing?

Sounds good.

https://www.whonix.org/wiki/Windows_Quick_Start_Testers_Only_Version would e a bit weird, long?

Odd and might be a little confusing.

https://www.whonix.org/wiki/Windows currently redirects to https://www.whonix.org/wiki/Windows_Quick_Start . Not sure about if we want a redirect or two pages a long and a short version?

Keep mostly as with these modifications to https://www.whonix.org/wiki/Windows

Currently

Please choose:

• A) Whonix with XFCE (recommended for beginners); or
• B) Whonix with CLI.

Change to:(?)

Please choose:

• A) Whonix with XFCE Expedited Setup (recommended for first time users to beginners (Quick and easy setup/configutation); or

• B) Whonix with XFCE (recommended for beginners to intermediate users); or

• C) Whonix with CLI. (recommended for intermediate to advanced users)

It’s important that new/first time users of Whonix (already complicated enough due to split-VM design and run in VM by default, Linux based…) have a quick path and feeling of success quickly.

Yes. So the Whonix Installer docs could be seen (in terms of usabilty ONLY) a Live CD. Users just want to try out the distribion without the hastel of gpg verification or anything Cli… “I just want to get Whonix installed so I can start using it.” Simple is what they are used to with Windows. For myself, and before Whonix, I never realy had a use for the termimal in Windows.

OpenPGP/gpg verification: If you have a better idea in mind or ever see a better solution implemented anywhere, please open a new forum thread about this.

OK, I’m sure there is a better solution somewhere.

I guess what we’re doing is increasing the awareness about software verification generally and for the next download rather than securing the actual initial download?

Not just for verification (for security) but also to prevent unneeded support requests due to corrupted images (non MITM attacks) . Maybe https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil (Windows built-in) could simply be used to ensure the Whonix Installer was not corrupted during download. Meaning verifying the checksum.

And at no point, the user has any path to verify gpg4win through the The OpenPGP Web of Trust. Not sure if worth we’ll being the first ones (?) to point that out and document?

Definatly not for first time Whonix/linux users.

• Machine → Close → Power Off .

This is not good since this is a hard power off. Should only be used if Whonix hangs. Otherwise the usual shutdown mechanisms from inside the VM should be preferred.

OK wasn’t aware of that. I’ll remove.

Figure: Whonix user interface

Perhaps reduce size a bit? Looks much bigger than original on the actual screen? No new screenshot needed. Mediawiki allows somehow image resize, we are using that elsewhere in wiki somewhere.

Tried to resize using Gimp but wasn’t successful. I forgot about Mediawiki resize which was brought up recently. I’ll see about shrinking tha png.

Overall, amazing job on!

Thanks! I’ll revive the original Quick start (you mentioned in email) with the changes. Just to be clear,

• maybe mention Whonix Installer verification with a link. But not imposing.
• Add download link to 0brand.asc and Whonix installer signature
• No gpg Cli.
• Very simple (get Whoinx in Windows installed so users can get going)

[Patrick]

Change to: (?)

Please choose:

• A) Whonix with XFCE Expedited Setup (recommended for first time users to beginners (Quick and easy setup/configutation); or
• B) Whonix with XFCE (recommended for beginners to intermediate users); or
• C) Whonix with CLI. (recommended for intermediate to advanced users)

We can keep it even simpler for Windows users. XFCE version only. Everything else on a by search/by ask basis.

Not just for verification (for security) but also to prevent unneeded support requests due to corrupted images (non MITM attacks) .

Btw Whonix VirtualBox images nowadays contain a manifest. Once imported, images should be fine. Non-malicious corrupted downloads are excluded due to integrated hash check by VirtualBox (manifest). (Maliciously modified downloads could have the hashsums in the manifest modified as well or somehow manifest hash check disabled.)

Maybe https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil (Windows built-in) could simply be used to ensure the Whonix Installer was not corrupted during download.

Haven’t herd of certutil but there is also signcode. (No preference yet. Little knowledge on Windows native digital signatures by me yet.)
(These tools can also be used on the Linux platform. If I was to figure out how to use these, I could automate creating such signatures during build of Whonix.)

(VirtualBox also has some kind of native signing but no one figured it out yet and we couldn’t use it since Whonix Windows Installer as a necessity wraps around it. References:

• Appliance is not signed
• https://forums.virtualbox.org/viewtopic.php?f=1&t=94327#p455421)

Just now remembered I did reserach Windows native software signatures a while ago and even tweet about it (also as note to self):

Whonix (Whonix)

story here:
https://github.com/ImageOptim/gifski/releases/tag/0.8.3

[0brand]

We can keep it even simpler for Windows users. XFCE version only. Everything else on a by search/by ask basis.

There would be a lot of support requests if Whonix in Cli link was removed from that page. Better to leave it there imo.

I have the Whonix Installer Quick Start page section complete but haven’t decided where to put it on the XFCE page. Its Very minimal and verification is for advanced user only. For those users I’m going to provide a link to the yet to be created (https://www.whonix.org/wiki/Windows_Testers_Only_Version#Verify_Whonix_Installer)

BTW I did try resizing that image in Mediawiki but I’m not sure its was possible since that png only had one size. Lots of the other png images has multiple sizes to choose from. Anyways I save all my screenshots and I usually create a bunch for later use such as the new Stop Whonix image I uploaded. It was actually simple to resize in thunar (was having resolution issues with Gimp. )

[0brand]

New Windows Quick Start section has been added. Tried to get a little separation from the Long configuration section. Can the second section be given a better name other than “Long Whonix configuration”? I haven’t added a header for that section.

https://whonix.org/w/index.php?title=VirtualBox/XFCE&oldid=46669&diff=cur

[Patrick]

I don’t think https://www.whonix.org/wiki/VirtualBox/XFCE should include Whonix Windows Quick Start as a whole.

Previously it said:

1. Download Whonix XFCE for Windows , Mac and Linux FREE

thereby highlighting platform support.

By adding Windows Quick Start: on top, likely hood of non-Windows user bouncing away gets higher.

Instead we could add a link saying

Windows users can use the easy [[Windows_Quick_Start|Whonix Windows Installer]] instead.

The short instructions you just wrote could replace:

Windows Quick Start

In essence for Windows users, ideally just need a single fat download button.

…and perhaps some screenshots and short instructions, looking easy, as encouragement. Whonix has been a tool to convert Windows users to first time Linux desktop users.

https://www.whonix.org/wiki/Windows_Quick_Start currently only looks the same like https://www.whonix.org/wiki/VirtualBox due to previous absence of Whonix Windows Installer.

---

Could you please rename the page

• https://www.whonix.org/wiki/Windows_Qubes_Start
• https://www.whonix.org/wiki/Windows_Qubes_Start

since it still incldues Qubes?

---

Btw there is also:

Linux

Debian

Ubuntu

MacOS

Windows Quick Start

These pages are for users who use search engines. Search engine optimization (SEO). The best way to optimize things, I think, is to create landing pages which truthfully describe the status. These landing pages make it concise and abundantly clear, that what the searcher is looking for is explicitly possible.

[0brand]

I don’t think https://www.whonix.org/wiki/VirtualBox/XFCE should include Whonix Windows Quick Start as a whole.

Misunderstanding. Thought you wanted all XFCE on one page.

Instead we could add a link saying

Windows users can use the easy [[Windows_Quick_Start|Whonix Windows Installer]] instead.

Simple and to the point? Note sure if this is the best spot for it.

https://www.whonix.org/w/index.php?title=Template:VirtualBox&stable=0

The short instructions you just wrote could replace:

https://www.whonix.org/wiki/Windows_Quick_Start

Whonix ™ Quick Start Guide for Windows Users - Windows XP, Vista, 7, 8 and Windows 10

In essence for Windows users, ideally just need a single fat download button.

Done.

https://whonix.org/wiki/w/index.php?title=Windows_Quick_Start&oldid=50508&diff=cur

Could you please rename the page

• https://www.whonix.org/wiki/Windows_Qubes_Start
• https://www.whonix.org/wiki/Windows_ Qubes _Start

since it still incldues Qubes ?

Done. Moved:

Windows Testers Only Version

These pages are for users who use search engines. Search engine optimization (SEO). The best way to optimize things, I think, is to create landing pages which truthfully describe the status. These landing pages make it concise and abundantly clear, that what the searcher is looking for is explicitly possible.

So all these pages are very specific content. No gray areas, what you see is what you get.

A lot of pages have {{Anchor|Landing}}. Is it important to have {{Anchor|Landing}} as opposed to " = Introduction = " Or is that just preference?

I wonder if the verify section for SecBrowser in Microsoft Windows should be sim;ified as well? It looks a bit to long . Maybe collapse the verify section. Would have to shuffle things around as well.

[Patrick]

A lot of pages have {{Anchor|Landing}}. Is it important to have {{Anchor|Landing}} as opposed to " = Introduction = " Or is that just preference?

A bit of a legacy link.
https://www.whonix.org/wiki/Download links to #Landing. #Landing could be different from introduction.
Not very important and could be redesigned.

I wonder if the verify section for SecBrowser in Microsoft Windows should be sim;ified as well? It looks a bit to long . Maybe collapse the verify section. Would have to shuffle things around as well.

Yes, since the threat model on Windows is broken anyhow.
I doubt there are any Windows users who verify all of their software using the web of trust or similarly clever to verify all their software downloads.

Having documentation on Windows verification though is great to show how broken things on the Windows platform are. To through what length people have to go due to some mess caused by various upstream.

[Patrick]

Let the Whonix ™ Windows Installer set up Whonix ™ XFCE in VirtualBox for you. FREE

The Whonix ™ Windows Installer was developed with a focus on providing users with an fast and easy method to install Whonix ™ in Microsoft Windows. This gives users the opportunity to experiment with Whonix ™ in a familiar environment without the necessity of complex virtual machine imports or host operating system changes. When the whonix-installer.exe is executed, the latest VirtualBox version and both Whonix ™ VMs are seamlessly installed on the Windows machine. From there, users can immediately start using Whonix ™ with no further configuration required.[1]

This introduction is well written but is it required from the perspective of a first time visitor? Expected in a similar fashion as viewing any other usual Windows software? I think no. Using the razor blade for simplification.

Moved here: https://www.whonix.org/wiki/Dev/Virtualization_Platform#Arguments_for_keeping_VirtualBox_Support

[Patrick]

Also even Tor Project went the route of radical simplification. See https://www.torproject.org which links to https://www.torproject.org/download. Speculation: They might have hired a usability designer who then talked them into changing that.

[Patrick]

Simplified https://www.whonix.org/wiki/Windows_Quick_Start

We can’t really teach users to do OpenPGP verification on the download page. Users visit new websites with their with existing experience, knowledge and expectations. That’s not easily redireced. Verification of software signatures is a skill.

Downloading signing keys, signatures over https, from the same source as the actual software does not improve actual security. Verification of software signatures isn’t a copy/paste skill. It requires critical thinking, intelligence. Because if an adversary would replace the contents of the website, they’d next time just write “OpenPGP verification no longer required because now built-in, automated” and many users would buy it without questioning.

Users mostly can’t learn software signature verification of Whonix from whonix.org. And even if they could, they woulnd’t have needed it for Whonix (otherwise adversaries already feeding them fake information). Users might learn the concept of software verification from us generally though at some point.

In the past when Whonix downloads were hosted on other websites other than whonix.org without SSL support (mirrors; sourceforge) having the gpg verification instructions on whonix.org download page made more sense.

Software signature verification is for a smaller part only something that one can offer. For the bigger part however, software signature verification only works when there is demand for it.

• Who is the vendor of the software?
• Does the vendor of the software sign their releases?
• How does the vendor of the software sign their releases?
• How to safely acquire the signing key of the software vendor?
• How to safely acquire the software used for software signature verification?
• Why did the signing key allegedly change this time? Has there been a plausible explanation?

That is because if the case which software signature verification tries to prevent happens - that is contents of lets way whonix.org replaced with malicious contents - then users already need to know that kind of mindset.

[Patrick]

https://www.whonix.org/wiki/Windows_Quick_Start could use a screenshot (or even gif if mediawiki supports that?) for double clicking the Whonix Windows Installer. Similar to https://www.whonix.org/wiki/File:Whonix_desktop_starter.png.

[0brand]

Also even Tor Project went the route of radical simplification. See https://www.torproject.org which links to https://www.torproject.org/download. Speculation: They might have hired a usability designer who then talked them into changing that.

I was previously planning on submitting an enhancement request to Tor Project because users are redirected to https://www.torproject.org/thank-you/ after the download link (Windows tor browser installer) is clicked. I couldn’t understand why users where not given the opportuaty to download the sig file before redirecting to that page. It didn’t make sense until now. That happens even when the Linux download link is clicked.

Observation: Tor Project has Donate links everywhere.

We need your help to keep Tor secure and safe for millions across the globe. Donate Now

https://www.whonix.org/wiki/Windows_Quick_Start could use a screenshot (or even gif if mediawiki supports that?) for double clicking the Whonix Windows Installer. Similar to https://www.whonix.org/wiki/File:Whonix_desktop_starter.png .

I previosly created a Whonix Windows Installer screenshot but I don’t like it,so didn’t add to that page. I’ll see about a gif.

[0brand]

Even with the big download button https://www.whonix.org/wiki/Template:VirtualBox might be a little confusing with all of the links?

[Patrick]

Yeah, I just can’t be concise sometimes. Remove links for Windows, MacOS and Linux?

Reminds me… Generally and long term I would also encourage to get rid of [Expand] buttons and to move that content to other pages instead. Those disabling javascript by default, i.e. users of Tor Browser with security slider setting to highest and those using SecBrowser will see those pages auto expanded by default. There is was (yet?) to have collapsed/expanded switch without javascript.

[0brand]

https://www.whonix.org/wiki/Windows_Quick_Start could use a screenshot (or even gif if mediawiki supports that?) for double clicking the Whonix Windows Installer. Similar to https://www.whonix.org/wiki/File:Whonix_desktop_starter.png

GIFs are supported using the same syntax [[Image:some.gif]] . Pushed to live wiki.

https://www.whonix.org/w/index.php?title=Windows_Quick_Start&stable=0

[Patrick]

That gif is 10/10. Very illustrative.

[0brand]

Removed the verify instruction for SecBrowser for Windows.

Reminds me… Generally and long term I would also encourage to get rid of [Expand] buttons and to move that content to other pages instead

In keeping with not creating “expand” sections, I don’t think creating a separate page for verification is worth while either. I very much doubt anyone will follow those instructions for a browser. They are way to long and complicated. The incentive for migrating to a more secure platform ( Debian) is the tb-updater does the verification for users.

I can create a new SecBrowser in Windows verification page if you’d like though.

https://whonix.org/w/index.php?title=SecBrowser_in_Windows&oldid=50052&diff=cur

[Patrick]

Your call. Not a big deal either way. I guess since the documentation already exists, energy was being used, it’s good to keep it at some page. Doesn’t need to be kept supported/maintained. It’s been a research project, still interesting for educational purposes.

These screenshots look excellent btw!

[Patrick]

Software signature verification cannot be really be educated / solved downstream at websites such as whonix.org. That’s something that downloaders, mostly browsers need to sort out.

A solution that browsers could implement would be metalink support including OpenPGP verification.

331979 - Support metalink file download format

I was previously planning on submitting an enhancement request to Tor Project because users are redirected to https://www.torproject.org/thank-you/ after the download link (Windows tor browser installer) is clicked.

I would be very surprised if they hadn’t considered that. Hardly a slip/mistake that can go unnoticed. Seems like a redesign which I hope relevant people discussed.

[0brand]

A solution that browsers could implement would be metalink support including OpenPGP verification.

bugzilla.mozilla.org

331979 - Support metalink file download format

NEW (nobody) in Toolkit - Downloads API. Last updated 2019-02-27.

It would be nice to see something like this implemented but unfortunately many people don’t like change.

I would be very surprised if they hadn’t considered that. Hardly a slip/mistake that can go unnoticed. Seems like a redesign which I hope relevant people discussed.

I still find it a little odd that the Linux TBB download also redirects to a different page as well.

---

Also,

New wiki page “Verify Tor Browser in Windows” → Done!

https://whonix.org/w/index.php?title=Verify_Tor_Browser_in_Windows&oldid=50627&diff=cur