On Mon, 5 Aug 2019 at 22:58, <ljul8...@gmail.com> wrote:

> I was told that buying an used laptop represents an extra risk since the
> previous owner could have used the laptop with Qubes and got dom0 infected.
> After a little bit of research, I was told that installing coreboot would
> eliminate/delete any malware that, in a hypothetical case, took control of
> dom0 when the previous owner used the laptop for Qubes but I’m not too sure
> if this is true, do you guys thinks it’s true?

I would always replace the storage media in a used laptop to get a fresh
SSD, as this is where your data is stored and you don't want to mess
arround with a used SSD or HDDs. And with todays low prices for SSDs it's
even more fun to do so.

If dom0 was "infected" you would not be affected if you use another ssd,
you could of course also reinstall Qubes on the used device, but as
mentioned above .. no reason to do so.
If the previous user has an infected or manipulated BIOS you can indeed
reflash with coreboot, in fact I would always suggest to run coreboot if
your laptop is able to do so - I would even reccomend to buy only devices
which support coreboot (for example Lenovo X230 / T430 / W530 ...).

Keep in mind that an attacker could always place a tiny spy device inside a
used laptop which can then be used to sniff your keyboard entries etc. But
as this is an attack which is more likely used if you are a high priority
target, I think that this scenario is quiet unlikely.

Buy a used Lenovo X/T/W x30, install coreboot and become a happy Qubes user.
If you need more information how to install coreboot, take a look here,
where I tried to document a whole run through for a X230:

- O

You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 

Reply via email to