Whonix should bundle less pre-installed programs (minimal images)

[Patrick]

@chadsec

@Patrick

Most users want things to “just work”. They’re also much more rarely posting in forums.

True, but a minimal image would also “just work”

Just work for technical users only.

@chadsec

Sure. I wasn’t really talking from personal opinion. Let’s talk statistics:
If Whonix suddenly gains 1 million new users, assuming even just 1% of those users ran into issues especially with pre-installed programs, and then even 10% of that 1% decided to post on the forums, that’s 1000 users, and if we assume the average number of “issues” each user has to bother to register on forum and post threads is 2 issues, that’s 2k threads, potentially just dedicated to issues, and assume 1 of those issues is related to software pre-installed on Whonix, that’s 1k threads.

The problem is, that this is based on assumptions, philosophical arguments. Please let me know if I am presumptions, but I think this not based on usability design or operating system maintenance / support experience.

Minimal images increase support requests even more. Examples…

Monero GUI used to be installed by default. Removal caused complaints, see: Monero Integration in Whonix - #72 by Patrick

Here are more complaints about this and feature requests to re-install it: Search results for 'monero in:title' - Whonix Forum

See also

• this post by unman: Remove non-essential packages from debian-12-minimal template · Issue #8980 · QubesOS/qubes-issues · GitHub

  • Given the support questions that MINIMAL templates
    throw up, despite the prominent health warning in the docs, providing
    such micro templates would just create yet more support issues.

• Minimal templates | Qubes OS
• this post by adw: Why Use Minimal Templates? - #15 by adw - General Discussion - Qubes OS Forum

@chadsec

The adversary now knows both Alice and Bob have downloaded something, and since they visited whonix.org, adversary can guess they both downloaded Whonix.

One already gets flagged for lesser “offenses” such as this:
NSA: Linux Journal is an "extremist forum" and its readers get flagged for extra surveillance | Linux Journal

@chadsec

Whonix and conducted her first updates, while Bob is less certain, it’s possible Bob could be just using a regular Tor browser and downloading something / loading a heavy page / video even.

No matter how small the images are. The traffic volume for initial download and updates would always be a give away.

If someone can “look inside” (fingerprint) Tor traffic and guess what’s going on, then that’s a Tor issue and needs to be fixed in Tor.

Related: cover traffic

New low cost traffic analysis attacks and mitigations

Interesting blogpost that provides some technical meat. It has some client side suggestions for thwarting website fingerprinting. I will quote here and if anything useful is covered we can spin them off into their separate phabricator tickets. Users: Do multiple things at once with your Tor client Thankfully we get this for free with Whonix’s design and thanks to stream isolation, safely at that. We can do better by allowing users to run their client as a bridge we protect client traffic…

Proposal: add Noisy to default software

AnarSec recently forked the project Noisy, for a use case of mitigating some correlation attacks on Tor, with an eye towards Tails and Whonix users. You can see the code and README document here: Would the Whonix project like to take ownership of Noisy, and include it as default software in the Workstation? If so, two paths could be pursued: A GUI is made so that users uncomfortable with a CLI can use Noisy. We could contribute this. This is the “opt-in” option. Noisy is a default process -…

Idea proposal of Cover Traffic / a "Fake-Workstation"

Hi everyone, As probably the weakest part of anonymity on Tor is traffic analysis, i.e. traffic size or timing correlation, I have been thinking about this topic recently. So, I wanted to share my current ideas and I believe we can brain storm with interested people and create tools and usage ideas. Some related document links about traffic analysis: Users Get Routed: Traffic Correlation on Tor Towards Efficient Traffic-analysis Resistant Anonymity Networks Inferring users’ online activitie…

How does a clearnet user learn about Tor, Tor Browser, Whonix (or Tails) without already getting flagged for looking up the forbidden fruit? It’s possible to construct a hypothetical case where one evades all of this but not a realistic one to base a distribution on.

It’s difficult to hide that one is trying to hide. See also: Hide Tor use from the Internet Service Provider

Also Non-Existing Network Fingerprint Research and Implementation.

@chadsec

Further fingerprint protection could theoretically be added to Whonix’s download page, where each user gets a slightly “different” image than the other, so an adversary doesn’t see the exact download size and confidently conclude a Whonix download.

Connecting to whonix.org doesn’t allow for other conclusions no matter the size of any downloads.

@chadsec

I don’t know, maybe Whonix adds some junk data download / appended to end of an image?

Not happening. And would complicate reproducible builds.

@chadsec

In these examples, as you can see, we didn’t eliminate fingerprintability, we just reduced it.

Reducing without having certainty of having accomplished anything makes me think this is not worth prioritizing it as a development goal.

@chadsec

This is not a valid argument, your project is a research project. You are supposed to experiment, not stay in the “everyone does it, so we will do it too”, especially when said “experiment” benefits the core idea behind your project: Security.

It’s arguing against this:
Security versus Usability

For VirtualBox, KVM, there’s 2 flavors. GUI and CLI. Each has a target audience. CLI is more minimalist. GUI comes with more usability by default. There’s nothing in the middle.

We cannot expand to maintain more and more flavors. We don’t have plans for a flavor minimalist GUI only.

@chadsec

Users who choose to download Whonix, are looking for a Linux distribution that is completely torified, has a desktop-environment, has Tor browser pre-bundled, and has “extra” protections like apparmor profiles for most common software they might optionally choose to download later on, and that’s it.

How would you know that?

Related:

Whonix Community Survey: Shaping the Future of Whonix