Librem 14 Qubes Users: Which device is for Wifi?

[dom0]

@bigT

So does having the wifi on (or at least enabled) at boot, therefore cause these passphrases to be exposed at all to the outside world, while I am typing them in?

I think that this is a theoretical possibility, but I have not seen any information about it. It is definitely not something for average people like you and me to worry about.

@bigT

And if so, is there a workaround that anyone could suggest, to improve the security?

Out of curiosity, I did some testing when I first received my Librem 14 and wrote about it in my QubesOS forum post here (this is the new link since the page was moved):

@dom0

The Wifi/Bluetooth device can be disabled by the killswitch during boot but must be enabled at two certain moments. After the Qubes grub menu disappears and the display goes black, there is a delay of a few seconds before the keyboard backlight turns off and then a shorter delay beore the Qubes luks decrypt screen appears. The Wifi/Bluetooth device must be enabled before the keyboard backlight turns off. Then the Wifi/Bluetooth device can be disabled again. After typing the correct Qubes luks decrypt password and hitting the “Enter” key, the Wifi/Bluetooth module must again be enabled for a few seconds until the Qubes luks decrypt process finishes and the user account login screen appears.

In case that was confusing:

• Boot computer with Wifi disabled.

• When the grub menu disappears and the screen goes black, flip the killswitch to enable the Wifi.

• Once the Qubes luks decrypt screen appears, you can flip the killswitch to disable the Wifi.

• Type your password, hit enter, and then flip the killswitch to enable Wifi.

• Once the user login screen appears, you can flip the killswitch to disable Wifi.

• Type your user password and hit enter.

This way, you can type your passwords while the Wifi is disabled, if that makes you feel more comfortable.