Suggestions for Whonix Host

[HulaHoop]

These are suggestions copied verbatim from a user on Tails mailing list and they might be very relevant to the scope of a host distro also whonix VMs:

1. Please turn off camera and microphone by default.

2. MAC address 10:62:E5:… is very unique. Government, Administrator, Network Controller, ISP and others will know that you are using Tails from very unique MAC address especially in censorship-surveillance-nonfree society/city/state/territory/country and they will force Tails user.

3. Please have tool for clear clipboard automatically. Example auto clear after 10 seconds.

4. Please auto login to persistent volume after user type a password and press enter no need to click anymore.

[madaidan]

Please turn off camera and microphone by default.

Instructions to blacklist the modules are here https://www.whonix.org/wiki/Hardware_Threat_Minimization

MAC address 10:62:E5:… is very unique. Government, Administrator, Network Controller, ISP and others will know that you are using Tails from very unique MAC address especially in censorship-surveillance-nonfree society/city/state/territory/country and they will force Tails user.

You can’t tell a Tails user from their MAC address anyway.

MAC address randomization is important though. Just make sure not to randomize the OUI as it can make you stand out if you choose an OUI nobody has ever used before.

[anontor]

With Debian now supporting Secure boot would something like that make sense for Whonix Host?

[Patrick]

Secure Boot is being discussed here:

enable Linux kernel gpg verification in grub and/or enable Secure Boot by default

Since we are going for allow loading signed kernel modules by default / disallow kernel module loading by default, should we also work towards enable Linux kernel gpg verification in grub and/or enable Secure Boot by default? Looks doable in principle. KVM: supports both EFI boot and Secure Boot. On https://blog.heckel.io/2018/08/06/booting-image-files-and-isos-with-kvm-qemu-efi-and-bios/ see 2. Booting image files with KVM (EFI) The https://packages.debian.org/buster/ovmf ships an EFI BIOS…