Why use Qubes over other Virtualizers?
- 1 Why use Qubes over other Virtualizers?
- 2 Qubes-Whonix Advantages over Non-Qubes-Whonix
- 3 Qubes Vulnerabilities
- 4 Footnotes
Why use Qubes over other Virtualizers?
The Qubes project is focused on developing the Qubes OS desktop operating system, which is based upon the principle of "Security by Isolation". It is not a general purpose operating system where the ability to install a virtualizer is just another feature. Rather, it runs a bare-metal virtualizer (Xen) and isolates hardware controllers and multiple user domains (qubes) in separate VMs that are explicitly assigned different levels of trust.
Advanced Separation / Least Privilege
- The Xen hypervisor and administrative domain (dom0) in Qubes OS actively discourages any activity other than running VMs.
- The network stack and WiFi drivers are running in a dedicated, unprivileged network VM (NetVM), which substantially reduces the attack surface.
- Future separation of the GUI (graphical) domain from dom0 is planned.
Hardware and Protocol Protection
- Enabling VT-d/IOMMU via BIOS provides DMA protection.
- The USB stack can be isolated in a dedicated USB VM, protecting dom0 from untrusted USB devices.
- Anti Evil Maid (AEM) protection is supported.
- Yubikey multi-factor user authentication is available to enhance the security of logins, mitigate the risk of password snooping, and improve USB keyboard security.
- No microphones are attached to VMs by default.
- An additional firewall VM is used to house the Linux kernel-based firewall, providing extra protection against a compromised NetVM.
- By default, Qubes OS is firewalled and no incoming ports are open.
- No networking is present in the administrative domain (dom0). Even dom0 upgrades are done in a dedicated UpdateVM (currently set by default to firewallvm), before those are verified and installed in dom0.
- All TemplateVM and dom0 updates can be easily fetched over Tor via the Whonix-Gateway ProxyVM (commonly called
- TCP timestamps are disabled by default. 
- ICMP timestamps are disabled by default. 
- Protection against unintentional leaks of critical user data is possible by setting an empty NetVM field for the corresponding qube.
- Tor Traffic can be white-listed using corridor as a filtering gateway, protecting against accidental clearnet leaks.
- Availability of an experimental unikernel firewall based on MirageOS for greater security, performance and a lower resource footprint.
- DisposableVMs are available to open untrusted applications, links, attachments and documents. 
- Unforgeable, colored window borders allow easy identification of qubes with different security levels.
- PDFs can be easily sanitized via a trusted PDF converter. 
- Greater security of email-centric work environments is possible by using split GPG to protect private keys and limiting network connections exclusively to the chosen email server.
- Joanna Rutkowska, security researcher, founder and developer emeritus of Qubes OS has completed a research paper comparing the security of software compartmentalization vs. physically separated computers (pdf). It concluded that in some cases, notably for specific, desktop-related workflows, Physical Isolation might be less secure than Qubes' compartmentalized approach.
- OS agnostic: qubes can be based upon Fedora, Debian, Ubuntu, Whonix, Windows, Kali Linux, CentOS and Arch Linux templates, among others.
- All isolated qubes are integrated into a single, usable system via a unified desktop.
- Software installation and updates are centralized.
- Creating new VMs and disposing of unwanted VMs is very easy and fast.
- The VM start menu is integrated into the host's (dom0) start menu via Qubes VM Manager.
- A secure and usable mechanism exists for copying and pasting clipboard contents and files between qubes.
- An easier backup / restore mechanism for VMs.
- The keyboard layout only needs to be configured once in dom0.
- No duplicate task bars are present.
- A default seamless mode is available for Windows (similar to VirtualBox’s Seamless Mode or VMware’s Unity Mode).  It is easy to distinguish which window belongs to each VM. 
- VMs boot up much faster, because fewer services need to be started.
- AppVMs therefore also use much less RAM.
- AppVMs use far less disk space because they can share the root image of the TemplateVM in read-only mode. Separate disk storage is only used for the user's directory and per-VM settings (read more: Template Implementation).
- Standalone VMs can be created for the installation of software in only specific domains.
Qubes-Whonix Advantages over Non-Qubes-Whonix
- It is easier to tunnel the whole system -- including host (dom0) updates -- through Tor (besides
- Multiple Whonix-Workstations AppVMs can easily use the same Whonix-Gateway ProxyVM without being able to make contact with one another. 
- Downloads of Whonix TemplateVM images use cryptographic signatures of the dom0 package manager (qubes-dom0-update / dnf). Without the user knowing it, this makes verification transparent.
- It is simple to run Tor Browser in a Whonix-Workstation DisposableVM.
- Various operations can be securely performed in Qubes-Whonix VMs which are not available in Non-Qubes-Whonix, like:
- Secure copy / paste operations between VMs.
- Secure copying and transfer of files between VMs.
- Sanitization of PDFs and images.
- Easier installation.
- As an option during Qubes installer.
- Or later downloaded from the Qubes repository.
- Issues specific to Non-Qubes-Whonix do not apply.
- No confusing Network Manager Systray Unmanaged Devices error messages, since there is no duplicate taskbar.
- No confusion is caused by the VM timezone being set to UTC (for anonymity reasons),  since there is no duplicate taskbar. 
- Watching videos with VLC works out of the box.  
- No duplicate sound settings are present.  
Qubes is not however a silver bullet - attacks are still possible against:
- The virtualization technology (VT-x, VT-d).
- The hypervisor (Xen).
- Additional software used by any virtualized system, like qemu and DirectX emulation.
Further, data leaks are possible via cooperative covert channels (malware working in concert across two or more VMs), and side channel attacks (malware in one VM trying to learn about processes executed in another VM).
- Disposable Whonix-Workstation VMs are now available, with multiple DisposableVMs planned for Qubes OS R4.0.
Convert to Trusted PDF
- This issue for non-Qubes-Whonix is documented on the Multiple Whonix-Workstations wiki page.
- Whonix VirtualBox issues: VLC / Video Player Crash
- Whonix KVM Video issue: https://www.whonix.org/old-forum/index.php/topic,1768.0.html
- Whonix VirtualBox: Duplicate sound settings exist within VMs.
- Whonix KVM: https://www.whonix.org/old-forum/index.php/topic,1767.0.html
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.