Here’s something that most of you probably know, but I didn’t. I think it has cost me dearly in terms of privacy. This is for those as ignorant as me, before they make the same mistake.
tl;dr - running one VPN-vm for multiple qubes links your identity across all of them. Separate qubes may afford more security, but unless you separate your VPN use as well, it won’t give you privacy. (I know, I know, it should be obvious.)
My VPN provider advertises a “shared” VPN connection. There’s not much other explanation - I thought that meant you shared a variety of IPs per session. No. On connection, you’re assigned an IP address. Others will share that IP, but you will not share others. Break the connection, and you get a new IP (see below).
When I first started using this provider - who is one of the best and supports Qubes - I was on a standard Linux OS. I used wireguard or their wireguard-based app. Connections were transparent, obvious and easy to change. If I wanted to get separation between one part of my online life and another (no Tor used here), I’d switch server locations. Better, I had a couple of dedicated VMs in VirtualBox, each with separate VPN connections via their app. Privacy by separation. All very clear to know - and not forget - what you were doing. I thought I could run something similar in Qubes, but more effectively and efficiently.
In Qubes, (going by the VPN company’s instructions) the connection to the server is by an OpenVPN arrangement in a dedicated net-VM, VPN-vm. Set your app-vm’s net-vm to VPN-vm, and you’re away. It kind of sits out-of-sight-out-of-mind. Close an app-vm, and the connection with the VPN stays open. Its the same connection when you fire up the next qube that’s also on that VPN-vm. So your IP address is the same between e.g. work-vm and personal-vm.
I thought my IP address was switching around their servers by what I thought “sharing” was. I thought there would be a ‘timeout’ function, or a re-connection, or even the instability I would sometimes see on the standard LinuxOS/wireguard/app. No. These connections, and thus your IP address, are surprisingly durable. I have now observed several days on the same IP address, including through a couple of suspend/resume and wifi on/off (several minutes). This makes a very persistent identity on the internet.
I’ve worked with this arrangement for about a year, not realizing. Even with the IP address sharing (just how shared are they?), even with restarts and successful reconnections, I’m almost always using Fedora-based qubes, Firefox (with a very similar set of privacy focused addons) and the same system time, screen size and language settings. F-i-n-g-e-r-p-r-i-n-t. For a year, I’ve left a big fat statistical trail blazed across every data aggregator company’s database that says “that’s the same guy”.
Does any of this really matter? You be the judge:
Last week I used Google-maps with GPS on my phone (through the VPN’s android client). A day later on my Qubes system, I opened my Google-vm, that uses VPN-vm, and logged into my Google account (that has location services switched off). A day or two after that, in personal-vm (i.e. a third, separate vm), Duckduckgo just wasn’t delivering so I ran the search in Google. Down the bottom of the page Google quietly displayed my location. It was my local district. Accurate. The VPN company has no servers near my side of the city. Its only happened once. I think that’s enough.
I think my mistake has wrecked 5 years of progress towards good online privacy. It really hurts. I’ve worked hard to get to this point. Miswiring two powerful privacy tools (VPN, Qubes) has actually backfired. There was no discussion of the issue on the VPN’s pages, and Qubes docs don’t really deal with the risk. I admit the risk is one of user error, but VPN connections are bewildering enough for lower-skilled users. A simple sentence or two could have saved me pain. Bet I am not the only one to have made this mistake.
Mitigations:
-
Use Tor/Whonix. In this place, I’m worried about Tor activity being legally prejudicial, also slow and scarce “bandwidth-for-freedom-fighters”, so I’ve avoided it. I am reviewing my position on the matter.
-
Use multiple VPN-vms. Be strict and strategic about which qube uses which VPN server. (Watch your provider’s connection cap).
-
Unless you really are relaxed about it, shutdown your VPN-vm at the same time you shut the app-vm. (I’d love to know how to automate that).
-
Force reconnection to the VPN server/s (and check). Suspend/resume, wifi powercycle and elapsed time will not work. Powercycling the machine will do it, but its a pain (~5+ minutes for me). Restarting the VPN-vm would (probably) also work. An `openvpn` command in the VPN-vm w/c/should also work (maybe even on a `cronjob`) - welcome suggestions.