Qubes 4.0+ Windows 10

[Black Beard]

Hey guys,

I'm currently thinking about creating a separate Windows 10 partition besides Qubes.
Is this feasible? Or would one jeopardize his safety in any way?

About a message i would be very happy.

regards

[799]

Hello Black Beard,

Am Mo., 19. Nov. 2018, 10:32 hat Black Beard <franziska...@gmail.com> geschrieben:

[...]

I'm currently thinking about creating a separate Windows 10 partition besides Qubes.
Is this feasible? Or would one jeopardize his safety in any way?

I am running exactly this configuration as I must run Windows for some applications (ERP / VMware Workstation ...)

I'm not a security expert, as such I'd like to see someone who is more skilled adding information if this is not correct:

The problem in a dual boot setup is, that it might be possible to tweak the unencrypted Boot partition.

The Qubes partition is LUKS encrypted and is therefore more secured.

It could be that an attacker  is able to place "something" in /boot which will steal the passphrase when you enter it to unlock the LuKS partition.

And it could be possible that the other partitions will be destroyed from windows, but as you have Backups (do you ;-) , this is acceptable.

I made the decisions that I can live with this risk, still I wanted to try as reasonable secure as possible which included:

1) having my windows partition Bitlocker encrypted

2) run Coreboot

3) Beeing able to Multiboot and launch windows without entering the Bitlocker Recovery key

I spent lots (!!) of time getting this accomplished, but it worked.

I can send you my How-to if you are interested.

- O

[Stefan Sperling]

Hello Franziska,

I just found the post from Black Beard and your answer. Since I have the same problem, I have some questions and would be verry happy, if you could send me your How-to.

Am Mittwoch, 21. November 2018 00:03:23 UTC+1 schrieb 799:
> ....

> I made the decisions that I can live with this risk, still I wanted to try as reasonable secure as possible which included:

We made the same decisions for our needs and did some tries to. We are now at a place, where we want to enable bitlocker and luks encryption for Win10 and Qubes. But moving Grub to a Qubes Partition didn't work yet. I found some description (https://www.andysblog.de/dualboot-mit-windows-8-bitlocker-und-debian-wheezy) and was able to follow the steps. But after that the windows bootmanager workes fine and qubes failed booting...

>
>
> 1) having my windows partition Bitlocker encrypted
> 2) run Coreboot
> 3) Beeing able to Multiboot and launch windows without entering the Bitlocker Recovery key
>

Sounds very good and seems to be perfect for our needs. But what is core boot?

> I spent lots (!!) of time getting this accomplished, but it worked.
> I can send you my How-to if you are interested.

Your How-to would be a great help for us.

Thanks in advance an greetings, Stefan