Other suggestions

[PowerPress]

Is there anything else that can done hardware wise then loading Heads on 230 and using Qubes 4.0+ OS? This technology is great just wandering if there is anything else out there that will compliment it or improve security posture?

Is the Lenovo Thinkpad 230 the best laptop for security features with Heads?

[osresearch]

There are some steps that are not part of the stock install that we should considering implementing or documenting better:

• Setting the SPI flash non-volatile block protection bits (BP)
• Grounding the write protect pin (WP#) to enforce hardware protection
• Disabling DMA capabilities of the card interface and docking connector
• Using the me_cleaner to reduce the Mangement Engine attack surface
• Protecting the S3 resume script (prevent Thunderstrike 2 / Dark Jedi)
• Flushing disk encryption keys during sleep (prevent cold boot attacks)
• Measurements when awaking from sleep
• SMM block encryption (remove disk encryption keys from normal memory)
• SMM integrity monitoring (like the NSA's XHIM)
• ThinkPad EC firmware (lots of interesting things to investigate)
• Battery firmware (prevent attacks like Miller's mac battery attack)
• And probably lots more

Most of these are addressing increasingly esoteric threats, so they may not apply to your use case.

[osresearch]

On the negative side, the x230 is lacking some number of features that would improve its security:

• Tamper switches (like the X1 or T470)
• Bootguard Measured Boot mode (like the Librem)
• Open source EC (like chromebooks)

[PowerPress]

Is there another recommended model that will work with Heads and Qubes 4 and still be able to take advantage of these?

On Mon, Aug 13, 2018 at 6:19 AM, Trammell Hudson notifications@github.com wrote:

On the negative side, the x230 is lacking some number of features that would improve its security:

• Tamper switches (like the X1 or T470)
• Bootguard Measured Boot mode (like the Librem)
• Open source EC (like chromebooks)

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/osresearch/heads/issues/438#issuecomment-412486044, or mute the thread https://github.com/notifications/unsubscribe-auth/AGB07yubf3M_Bu-j3cOCNh6tmITUdAPTks5uQWDVgaJpZM4V4Rne .