Password not working a day after reinstall

[Anil]

I have Qubes OS on Dell XPS 9370. It seemed to have been compromised,
so I reinstalled it yesterday, after updating the BIOS (though not
updated IME). Everything went smoothly and I had setup it up and even
copied back the data. A new password was set. I changed the BIOS admin
and system passwords too.

I wrote down the passwords and since it was only yesterday, I remember
them alright.

One extra thing I did was to setup Mullvad VPN (following the Micah
Lee instructions) and made it the network provider for sys-whonix.

Today morning when I started the laptop, the disk password was not
working. I tried several times, carefully. It didn't work.

I tried to use a USB keyboard, but of course that won't work in Qubes.

Then I booted from a live pen drive. The keyboard was behaving oddly.
Wrong letter were appearing apparently arbitrarily, though not always.
Then I used the USB keyboard with the live linux and tried to mount
the LVM volume. This keyboard is perfectly new and works perfectly.
Still the password was not working, even after typing carefully,
letter by letter, several times.

I have repeated the installation process today and setup the laptop
again, including the VPN. I am writing the mail from it.

The last time I had setup a VPN (NordVPN), there was a hell of a
trouble on all devices. Some people consider using VPN very suspicious
here.

I know this is not directly a Qubes OS related question, but could it
be due to an IME exploit or something like that? There is no question
of forgetting the password. It was a memorable story telling password,
and in any case I had it written down, as I do sometimes forget
passwords.

The thing is, every night these days, I keep the laptop in the best
Faraday bag available and the bag I keep inside a locked cupboard,
with key in my pocket (and I live alone), so it seems unlikely to have
happened during the night. Perhaps after I brought it out from the bag
today morning?

This kind of thing has happened before. Once the boot password was not
working, even though that too was written down. I had to call Dell
customer care and they gave me a code which cleared the boot password.

The last time there was major problem, which I had mentioned on this
list, I had again called Dell and they have asked for remote access
from Windows, which I had given. But there is no Windows or any other
OS on the system now.

Regards,

अनिल एकलव्य
(Anil Eklavya)

[Anil]

Also, I have been trying to update the templates, but except for one,
updates are failing with long messages about "Error downloading
packages" and "tried all mirrors". Most probably a network problem,
but could there be any other reason that I could check, keeping in
mind the extra VPN layer.

By the way, as I write this mail, the keyboarding is again acting up:
sometimes eating up space, sometimes emitting two for one key press.
It was working well the whole day.

[dhorf-hfre...@hashmail.org]

On Tue, May 05, 2020 at 11:25:53PM +0530, Anil wrote:

> I tried to use a USB keyboard, but of course that won't work in Qubes.

that is not a "of course" qubes thing but your choice / configuration.
you can use a USB keyboard with qubes if you want to, including
for entering luks passphrase.

> I know this is not directly a Qubes OS related question, but could it
> be due to an IME exploit or something like that? There is no question

if you assume a hardware/firmware level compromise, there is no
real way to reuse any of the hardware in a safe way.
== you have to replace _all_ hardware involved.

> This kind of thing has happened before. Once the boot password was not
> working, even though that too was written down. I had to call Dell

you can set multiple passphrases and perhaps add a keyfile or two.
make a backup of your LUKS header and store it separate from the system.
if the system doesnt accept the passphrase again, check if the
luks header got changed.

[dhorf-hfre...@hashmail.org]

On Tue, May 05, 2020 at 11:36:27PM +0530, Anil wrote:

> By the way, as I write this mail, the keyboarding is again acting up:
> sometimes eating up space, sometimes emitting two for one key press.
> It was working well the whole day.

did you try asking the internet about this problem?
like, reading the first google hit for
"dell xps 9370 keyboard problems"?

https://www.dell.com/community/XPS/XPS-13-9370-Keyboard-skips-button-presses/td-p/5835431

seems like that hardware just might be subfunctional by design
in general, no "compromise" required.

so for the keyboard to work, unplug _all_ cables (data, dock, power)
_and_ pick a bios version that matches your current astrological
alignment. if you are lucky, then it might work.
changes in room temperature might require a different bios version.

(that thread is pretty glorious...)

[Anil]

> that is not a "of course" qubes thing but your choice / configuration.
> you can use a USB keyboard with qubes if you want to, including
> for entering luks passphrase.

Since I am not yet into the internals of Qubes OS or much
customization, I use basically the default setting, where USB
keyboard, as far as I know, does not work without doing some extra
work. Since this problem is recurring, I will have to do that perhaps.

> if you assume a hardware/firmware level compromise, there is no
> real way to reuse any of the hardware in a safe way.
> == you have to replace _all_ hardware involved.

That was the advice given last time and it is correct, but hardware
costs money and this one was particularly costly with upgrades. I know
I should get rid of it, but there are practical constraints.

> you can set multiple passphrases and perhaps add a keyfile or two.
> make a backup of your LUKS header and store it separate from the system.
> if the system doesnt accept the passphrase again, check if the
> luks header got changed.

This I must do. Thanks for pointing this out.

[Anil]

> did you try asking the internet about this problem?
> like, reading the first google hit for
> "dell xps 9370 keyboard problems"?

25 years ago the first thing I would have done would have been to look
for answers in books, computer magazines etc.
10 years ago, I would have googled it. Even 2 years ago I would have googled it.

For the last two years, there have been such an avalanche of problems
that I have to think of other possibilities beyond those discussed on
the thread.

See, the keyboard has been working perfectly for months. It was
working perfectly yesterday and again whole day after reinstall.
Problems pop up suddenly and then they often go away for no reason,
even without changing BIOS etc.

If it was about just one device, I would still google it. As a matter
of fact (don't put that in quotes in the reply) I still do daily for
various problems. That's how I installed Mullvad, the first time I
have installed it. For the last two years (or somewhat more), the same
kind of problems appear on all devices that I use: feature phone,
Android smartphone, iPhone, iPad, Macbook, Windows laptop, Linux
laptop, Qubes OS laptop. Different hardwares, different OS's.

> seems like that hardware just might be subfunctional by design
> in general, no "compromise" required.
>
> so for the keyboard to work, unplug _all_ cables (data, dock, power)
> _and_ pick a bios version that matches your current astrological
> alignment. if you are lucky, then it might work.
> changes in room temperature might require a different bios version.
>

It is (in)glorious. Perhaps the message is just "Remove" (hardware?),
as you suggested. It's a pretty bleak scenario, if you look at it in
general, not as a developer or niche user.

Room temperature is a whole different story by itself. There are many
stories linked to it.

[Anil]

Today I am not able to connect to VPN at all. I tried configurations for three countries, have set the DNS to Mullvad DNS. Connects to Internet, but does connect to VPN. Even for normal Internet, I had to change the DNS. This DNS thing also has become a regular problem. Every I have to change DNS several times and hope it will work.

--

[Anil]

It turned out that the password was set to something other than the m
that Mullvad used. I definitely didn't change it. I remember from
earlier when I had read discussion on this list about Mullvad that the
password is m, which not easy to forget. Even after I added two more
countries today, I had set the password as m.

So, I guess, there isn't much hope for security or privacy on this
particular laptop at least. Either I use it for some purpose and
accept the risks or I use something more like to be secure/private.

They keyboard problem has started again. Perhaps I should learn a bit
or astrology.

[dono...@unseen.is]

Have you considered the possibility of RFI (radio frequency interference) in your immediate environment? It is a persistent issue with amateur radio operators, especially for those that use a computer interface for digital modes. Some of the symptoms you describe with your keyboard sound similar to those described by amateur radio operators. USB ports, specifically the connecting cables, need RF chokes to prevent interference. Peripheral device switching power supplies (wall-warts, power bricks et al) sometimes do not have any RF choking (usually a molded bulge or a snap-on ferrite bead with one or two loops of the cord around it, either of which would be located close to where the power plugs into the device) at all. You can use the search term "rf in the shack" to give you insight to the issue and solutions.

Alternately, I know from personal experience that some laptops themselves (looking at you Dell) are very noisy from an RF perspective (specifically the screen) as well as some laptop switching power supplies. Many people do not realize how much RF pollution there is in a technology-based society nor are there always ways to mitigate it. An example of the latter would be RF noise from the electrical power grid itself, such as a transformer.

[Anil]

Now it is working, after changing back the password to
m.

Since today morning it is again not connecting to Mullvad VPN.

I setup another ProxyVM using NordVPN. It seems to go alright, but nothing gets resolved. I tried using the NordVPN VM in another AppVM, but it doesn’t connect to anything.

I do have frequent problems DNS. Can this be also due DNS? How can I check if the VPN is going through DNS correctly?

NetVM is connected to clearnet through the Mullvad DNS.

[Anil]

The log from journalctl in mulvad-vpn is attached. Any hint? Should I
look at some other logs? How do I do that?

These lines seems to be related to VPN, but I don't know what it means?

nm-openvpn-auth[802]: cannot open display:

[taran1s]

Anil:

Anil, do you try to connect through Tor or directly? If directly, it
should be quite straightforward. I also fought with it, but now direct
connection with mullvad works well.

[Anil]

> Anil, do you try to connect through Tor or directly? If directly, it
> should be quite straightforward. I also fought with it, but now direct
> connection with mullvad works well.

Right now, I am getting to Tor. Just trying to connect to the clearnet
via mullvad, but mullvad not connecting to any VPS server, it seems.

[Anil]

> Right now, I am getting to Tor. Just trying to connect to the clearnet
> via mullvad, but mullvad not connecting to any VPS server, it seems.

I am able to connect to clearnet through sys-net, but sys-net ->
mullvad is not connecting.

[Anil]

guest-vpn-mullvad.log is attached.

[Anil]

I just shutdown the mullvad vpn vm and restarted it and it got connected.