Ask Slashdot: Why Are There No True Dual-System Laptops Or Tablet Computers? 378
dryriver writes: This is not a question about dual-booting OSs -- having 2 or more different OSs installed on the same machine. Rather, imagine that I'm a business person or product engineer or management consultant with a Windows 10 laptop that has confidential client emails, word documents, financial spreadsheets, product CAD files or similar on it. Business stuff that needs to stay confidential per my employment contract or NDAs or any other agreement I may have signed. When I have to access the internet from an untrusted internet access point that somebody else controls -- free WiFi in a restaurant, cafe or airport lounge in a foreign country for example -- I do not want my main Win 10 OS, Intel/AMD laptop hardware or other software exposed to this untrusted internet connection at all. Rather, I want to use a 2nd and completely separate System On Chip or SOC inside my Laptop running Linux or Android to do my internet accessing. In other words, I want to be able to switch to a small 2nd standalone Android/Linux computer inside my Windows 10 laptop, so that I can do my emailing and internet browsing just about anywhere without any worries at all, because in that mode, only the small SOC hardware and its RAM is exposed to the internet, not any of the rest of my laptop or tablet. A hardware switch on the laptop casing would let me turn the 2nd SOC computer on when I need to use it, and it would take over the screen, trackpad and keyboard when used. But the SOC computer would have no physical connection at all to my main OS, BIOS, CPU, RAM, SSD, USB ports and so on. Does something like this exist at all (if so, I've never seen it...)? And if not, isn't this a major oversight? Wouldn't it be worth sticking a 200 Dollar Android or Linux SOC computer into a laptop computer if that enables you access internet anywhere, without any worries that your main OS and hardware can be compromised by 3rd parties while you do this?
just run the 2nd OS in a VM and call it a day (Score:5, Insightful)
real exploits of that situation are rare
Re: (Score:3)
Re:just run the 2nd OS in a VM and call it a day (Score:4, Informative)
Re: (Score:2)
Re:just run the 2nd OS in a VM and call it a day (Score:4, Interesting)
What makes chromebooks less useful than tablets?
Modern Chromebooks run all android apps in addition to their normal stuff, they also are capable of running full Linux distros in parallel with ChromeOS.
I use a Pixelbook as my primary, and only, personal computer at this point. I've not run in to any situations where I wished I had a tablet instead, nor any where I wished I had a different type of computer. The Pixelbook has actually surprised me. When I bought it, I assumed that I'd spend all my time in Ubuntu on it, but that's just not the case, I almost never bother to switch to Ubuntu, and instead do everything I need on ChromeOS, either online, in android apps, or in a shell. The times I need to open Ubuntu are few and far between.
Re: (Score:3)
Modern Chromebooks run all android apps in addition to their normal stuff, they also are capable of running full Linux distros in parallel with ChromeOS.
How does that work without putting the Chromebook into a "developer mode" where it'll wipe itself at next boot if someone turns it on and looks at it funny [slashdot.org]? Did Google recently push out an update to Chrome OS that allows installing GNU and X11 in a container?
Re: (Score:3)
Explain how this is less useful than a tablet (presumably running iOS or Android as those are the dominant players in that space) Even without installing a full linux distro, you still have chromeos AND android. so right away it's more useful than a tablet, and it only goes up from there with things like a full keyboard, and the ability to install another OS if you so desire.
Re: just run the 2nd OS in a VM and call it a day (Score:3)
Why not install Ubuntu on a USB drive [ubuntu.com] and simply boot from it? Why require a second, lesser processor, less memory, and greatly limited storage be included inside the laptop?
If you want to run Windows on the hardware securely, take a look at Microsoft's "Windows to go" offering?
Re:just run the 2nd OS in a VM and call it a day (Score:5, Insightful)
Run BOTH systems as VMs of a more secure system such as a Citrix or VMware Client Hypervisor or Qubes OS.
Re: (Score:2)
The poster only cares about one OS being secure. There's no reason to run his main OS as a VM as well.
Re: (Score:3)
Re: (Score:2)
I'm amused you imagine either of those are more secure in any way, the same exploits *proven* to cross VMs work just as well on those. Guess the marketing droids count you as an effective market
Re: (Score:2)
--Came to post this and found your recommendation. ;-)
https://distrowatch.com/table.... [distrowatch.com]
Re: (Score:2)
For a laptop and tablet one of their key features, is long battery life. Having extra components of a mini-pc in your main system is just going to drain more power.
Using a VM or multiple VMs would be good enough for security in 2018, they may find an other flaw that may make this method considered childish in the future. But at the moment it is as good as we can expect. If you are that paranoid, I would either partition your drive to duel boot, or keep a bootable USB Stick on hand.
Re:just run the 2nd OS in a VM and call it a day (Score:4, Informative)
It'a not that it's not feasible. It's that there's not a big enough market/demand that any manufacturer has bothered to offer that bit of kit. So suggestions for how achieve a similar end result are entirely appropriate. And at the end of the day, "Here's my idea for a device I would like and poses no particularly difficult or interesting technical challenge, but is not offered for sale... GIMME!" is not "news or nerds" or for anyone else. It's banal and trite water-cooler chit-chat at the very best.
If msmash and dryriver think it's such a good idea and are so put out that it doesn't exist; one of them should go get a job in product design at Dell or whatnot, do their own damn market research, and present a business case that there's enough demand for this thing to make it worthwhile to bring to market.
Re: (Score:3)
It'a not that it's not feasible. It's that there's not a big enough market/demand that any manufacturer has bothered to offer that bit of kit.
Exactly. In fact, it's bloody obvious. If a thing doesn't present significant technical hurdles to develop, but that thing isn't being sold - it's almost certainly because there's no significant market for the thing.
Now the submitter obviously disagrees. Of course, he could always launch a kickstarter and work on developing one himself. If he's discovered an untapped market, he could make a lot of money.
Re: (Score:2, Informative)
You could also add a VPN and have the VM communicate with the Internet via the VPN.
Re: (Score:2)
Now go ask the IT department how hard it is just to get staff to connect to the VPN before browsing some Facebook on the work laptop and you will understand why no-one sells machines like the OP describes.
If the company actually cares about this they will just disable all wifi access except to their trusted network with a valid certificate. Ordinary users won't be able to understand what the hell this feature actually does.
Only tech savvy nerds will use such a complex set up, and they won't trust anyone els
Re:just run the 2nd OS in a VM and call it a day (Score:5, Informative)
If truly worried, I'd just have a dedicated machine where the sensitive OS runs in a VM. You can even set up some secure remote access so you don't have to lug two machines around everywhere. In fact, I'd consider multiple separate VMs, one for each client, so a compromise doesn't mean everything is lost, just whatever is opened at the time.
Attacks where something jumping across or out of VMs is extremely rare. It can happen, but this is not a big attack vector, relatively.
Plus, if you store your VM on an eSATA or USB 3.1 drive, when done with it, just unplug the drive and toss it somewhere secure. $200 buys you a FIPS compliant external SSD with hardware encryption from Apricorn. This takes care of the DAR (data at test) element, regardless of the OS. From there, a PC with VirtualBox, Hyper-V, VMWare, or Parallels can run the VM.
Re:just run the 2nd OS in a VM and call it a day (Score:5, Interesting)
My own implementation presumes Windows as the (very) weak link in the chain, and it's run as a VM inside of Linux. I've given up on ever trusting Microsoft again, in light of the recent, ongoing, and ever-doubling-down, privacy horrors, endless stream of newly-discovered exploitable vulnerabilities, and forced corporateware installations associated with Win 10. So ok. So no Win 10. I went the other way. Win 7 Starter Edition SP1, stripped down to the ground floor, no Windows Updates, no antivirus, no anything, just the bare OS, to run the proprietary software (if the software demands an x64 OS, well then, we'll move up the Win7 hierarchy one notch) that demands Windows, to run smoothly enough, hassle-free. This Win7 VM is considered to be laying on the floor with its legs spread, and it only runs the programs it must run, and nothing whatsoever else. No games. No VOIP. Certainly no web browsers. It's drawbacks are obvious, but with adult supervision, nothing that cannot be dealt with, and it's lightning fast in its stripped-down state.
If he wants a second Linux VM running alongside the Win7 VM inside the first one, well then, ok, so he shall have it. Whatever suits the situation most appropriately.
Toss in a TAILS USB stick with encrypted persistent storage for situations that seem a bit sketchy for the above "standard" setup, and we're good to go.
Again, your answer is the correct one.
Comment removed (Score:4, Insightful)
Because physical security is a myth (Score:3, Informative)
End thread.
Re:Because physical security is a myth (Score:4, Interesting)
That very much depends on how you define security.
If you define security as aboslute safety and isolation, then you are correct. However, that is not the definition of security in the real world. In the real world, security is the achieved by incremental decreases in risk of harm to a system. What he proposes would have the potential to increase security by this measure. However, this only works if the following is true:
That said, this would actually open up a potential new avenue of attack, and decrease security, unless the isolation is nigh total. If I recall correctly, even being in proximity, there have been proof-of-concept demonstrations that two air-gapped computers can still transmit data to each other under the right conditions.
Re: (Score:2)
You're adding tons of complexity for a niche use case and only really gaining reuse of the keyboard, screen, and battery. Just carry a second device because nobody is going to design a system around your use case.
Re: (Score:2)
They share NO hardware whatsoever? So you laptop has 2 screens, 2 batteries, 2 keyboards etc? That's one weird and rather bulky laptop, i'd rather just carry 2 laptops around, maybe a small chromebook for internet access on untrusted networks.
Re: (Score:2)
Because.... (Score:3, Insightful)
Re: (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
We can that completely separate CPU, video hardware, OS, and network stack... Your phone.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Well, there is at least one person (clearly). But there needs to be a market, and I think this thread contains plenty of reasons why that market is very small.
Re: (Score:3)
Open your existing laptop, how much empty space is inside? How complex are the existing logic boards?
You're asking for a system that has a second SoC, RAM and a hard drive. Then has additional circuits so the system can share the battery & charging, a circuit to share the display, either share or duplicate the antennas, and likely you want to be able to use ports on the system too. All this in addition to the circuits and software for switching between the two systems.
Re:Because.... (Score:5, Insightful)
Most people would just buy a tablet and optional Bluetooth keyboard for this purpose.
Integrating a second SoC into a laptop is actually more complex than you probably realize. For example, how are you going to do things like share the screen between the SoC and main GPU? Okay, you need an extra video switch... But the screen power and backlight are also controlled by the main laptop chipset, so you need to split that out and allow the SoC to access that functionality as well. Same for the keyboard, trackpad, USB ports, wifi, battery charging system, audio subsystem and amps...
Re: (Score:2)
You misspelt Raspberry Pi [amazon.com].
Why waste engineering time to add a SoC when there are dozens of dirt-cheap alternatives?
Re: (Score:2)
SplashTop (Score:5, Informative)
actually some companies have indeed exactly tried that, with products such as SplashTop:
some of the first Dell laptops to feature "Latitude On" where exactly that: a special custom SOC in a specially modified mini-PCIe card, that was able to run some restricted Linux (a web kiosk and a few built in apps. basically a distant ancestror of the chromebook concept), while accessing the nornal regular laptop screen and keyboard (but not much beyond that and certainly no access to any Sata mass storage).
it had a few minor advantage (mainly, instant power-on, and lower power usage of the SoC compared to the main CPU)
but a lot of disadvantage (complexity and restrictions due to the switching concept)
and cannot be used at the same time as the main CPU with Windows.
eventually, later version of "Latitude On" evolves into exaclty what you're suggesting: the mini-PCIe card evolved into an SSD with a Linux installation on it, and the main CPU simply dual booted into either the Linux installation on SSD or the Windows installation on SATA HDD.
Re: (Score:2)
"Expensive" because building a laptop for a market of half a dozen customers is expensive.
Re: (Score:2)
Re: (Score:3)
It's in your pocket (Score:5, Interesting)
That second system you are looking for, to browse and email and such, it's in your pocket.
It's called your phone.
The need you are describing is apparently not widespread nor strong enough for anyone to invest in implementing it in the way you describe.
Use your phone.
Re: (Score:2)
The need you are describing is apparently not widespread nor strong enough for anyone to invest in implementing it in the way you describe.
More simply, it is not really a need.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
--I saw a comment farther down by an AC that tripped a memory... Tails Live CD may be a cheap(er) solution than another SOC:
https://distrowatch.com/table.... [distrowatch.com]
Re: (Score:2)
I imagine there must be apps that let you "remote desktop" into your phone which is sitting in your pocket.
Actually it's better if the phone is in your briefcase/backpack. If it's sitting in your pocket it's best to have it turned off or in airplane mode to reduce the emissions to body tissue...
Duct tape another laptop to your main laptop (Score:5, Informative)
'If the women don't find you handsome, they should at least find you handy.' — Red Green
Re: (Score:2)
never mod points when i need them...
Dude... (Score:3)
Re: (Score:2)
ChromeBook. I love my Surface Pro, but for less money, hey.
Re: (Score:2)
Re: (Score:2)
Re:Dude... (Score:5, Insightful)
You have a dog in this fight. You need to stop replying and start listening. Take the advice/comments you like and ignore the others. Your use case is simply too narrow to justify development. At some point you'll need to accept this and move on to the other (seeming reasonable, IMO) suggestions. For example, if you really have a big ol' 17" CAD laptop that you have to lug around, then an extra, thin, light weight tablet is *not* going to be noticeable to you...and given that no commercial application like what you're looking for has been maintained beyond initial release due to lack of interest as a previous commenter pointed out, you should probably start to acknowledge that no matter how good the idea might seem to you and your specific situation, it's doesn't apply to enough other people to justify it.
And, BTW, referring to the extra IC as "little" and "small" over and over again isn't going to change the effort, complexity or market reality one bit. You're trying to trivialize the issue with verbal trickery. It's lame. Stop.
Re: (Score:2)
If you have a 17" CAD laptop I guarantee a surface pro would fit in it and you wouldn't notice any difference in size of weight
Re: (Score:2)
I travel all the time with 2 laptops, its a pain in the ass having to take them both out of the bag and put them in separate trays every time i pass through airport security...
Funny thing is one is a new macbook pro with the touchbar, which has its own SOC already.
Re: (Score:2)
I travel every day all the time with 2 laptops. It's far easier and lighter than just one laptop from a few years back. Harden up.
Virtualization is the answer. (Score:5, Interesting)
Virtualization is the obvious answer. Inside your VMs you can run Linux, or Windows, or whatever. It's quite safe. You should run your work-related stuff in one VM, and your personal stuff in another VM, and not use the native OS for anything except the virtualization software.
This is the most secure option you will find, and modern virtualization platforms (VMware, etc) will even let you set flashpoints where the VM is saved, and if there's an issue, you can rewind to the safe point and continue.
There's little to no performance penalty as long as the hosted OSes run natively on Intel.
Re: (Score:2)
Re: (Score:2)
I've seen this pretty regularly in doctors offices lately. Instead of some network-enabled software that pushes data to a backend, they all virtualize a desktop on some (maybe remote) server.
The only downside I've seen to virtualization is if you should need some graphically intense application to work. Don't even try running something like Starcraft II in a VM'd Windows. MS Office sure, but no 3D games.
Re: (Score:2)
The only downside I've seen to virtualization is if you should need some graphically intense application to work. Don't even try running something like Starcraft II in a VM'd Windows. MS Office sure, but no 3D games.
This hasn't been the case for years. IOMMU [wikipedia.org] makes it possible to passthrough your GPU to a VM, allowing near-native performance.
My primary home computer is a VM host (running Arch), and I have a handful of VMs on it for various purposes. One of them is a Windows 10 VM, to which I passthrough a GTX 970 (thinking about upgrading), and gaming benchmarks suggest it's within 5% of running Windows baremetal.
It's just easier to have a 2nd device (Score:2)
If it is that important that you don't trust a dual boot, you probably aren't going to trust anything that is in 1 package.
That being said, I carry 2 laptops (personal and business) and 2 phones. I have 2 phones as well, same reason.
Comment removed (Score:5, Funny)
Re: (Score:2)
Now I realise that technically speaking that's only one flaw but I thought that it was such a big one that it was worth mentioning twice.
VM's or DIY (Score:2)
There are 2-in-1 laptops (that flip into a tablet) but generally for various reasons they use the same chip. Just dual-boot or VM whatever you need. You can run Android or Linux on your x86 and boot Windows in a VM when you truly need it. Apply encryption to the hard drive with a strong password or even have your VM in a hidden partition/sectors of your system or if you have serious trouble with customs of various countries, have your data only available on a separate hosted server.
A system with 2 separate
VMs divide up your resources dynamically (Score:4, Informative)
A hardware division of your resources is problematic because they'll never be fully indepedent. They will at least share a keyboard, monitor and probably camera and microphone. So a route between each system is still possible to establish and may be difficult to protect with a hardware only solution.
From software side you can implement more complex policies and enforce them with virtualization. There are OSes specifically to address what you are looking for and do so at different layers, for example Qubes OS [qubes-os.org] lets you do a VM per window and color codes them. And something like BitVisor [bitvisor.org] has a narrower focus on protecting your VPN keys and encrypting your harddrive, from there you can dual-boot and have only your "business" system access certain encrypted partitions and use the VPN. without exposing that information to your personal system. (and vice versa if you choose)
But sadly there are a lot of problems with virtualization that is secure these days due to flaws in CPU architectures. I feel that these issues will be mostly if not completely resolved, but it may take two or three years.
Re: (Score:2)
there are a lot of problems with virtualization that is secure these days due to flaws in CPU architectures.
Actually, hypervisors can flush cache and TLB when switching guests, which prevents leaking. The guest OS can use the full spread of CPU technology as it sees fit and still can't pull off things like spectre and meltdown.
To Explain Where This Question Came From (Score:5, Interesting)
Re: (Score:2)
This question originated in a patent writing effort I was a part of 3 years ago. Basically, we were drafting the patent document for an invention on one PC that had no internet connection at all - to keep the invention safe from prying eyes until the patent could be filed.
Purely out of curiosity: did you ever file the patent application? If so, what is the application number? I'd be interested in
Re: (Score:2)
So the question came from you not knowing basic security?
Re: (Score:2)
There are many real-world situations where you DO need the power of a full Win 10/Core i7 PC to accomplish something, and DO need to look stuff up on the internet all the time while you are doing this - technical details or technical knowhow for example - but are constantly fretting that exposing the ENTIRE PC or laptop to the internet could result in your work being stolen.
No, there aren't. There are *some* situations where that *might* be of interest, but there are not *many*. You are fooling yourself into thinking that the size of your personal need is somehow indicative of the market size of that solution. It's most certainly not.
Hardware vs Software (Score:3)
You're trying to solve a problem in hardware. We're about twenty years past that. Hardware doesn't do anything anymore.
Back in my day, "drivers" were a bad thing -- there were modems, and there were winmodems, that latter needed software drivers. That logic has flipped. Now hardware does nothing without software driving it.
You're trying to double your hardware, and then add more hardware to switch between them. That's just not the equation anymore.
And in truth, you wouldn't want that. You wouldn't want to be using your SOC to browse the web, and then not be able to get that document/data/image onto your work hardware to, you know, actually work with it.
As far as protections are concerned, you're either using your SOC to access the internet to get sensitive data anyway (like e-mail) and hence you've secured absolutely nothing, or you're getting a file to transfer to your work machine, and hence you've breached your own security anyway.
If you know what you're doing, and it sounds like you could, then it's not difficult to secure your work data from your internet connection. Think about the easy things -- like a second hdd/ssd for the work file.
Secondary storage drives are easily turned off in device manager on a whim.
Don't visit terrible sites at all. Don't walk down dark alleys with your 10-year-old daughter ever.
Know how to clear buffers, and generally know that all's clear before spinning up that work drive.
But most of all, know:
that Ethan Hunt can always break in,
that there aren't as many Ethan Hunts as you've been led to believe,
that most of the time, Ethan Hunt doesn't actually harm you when he gets what he wants.
You aren't actually responsible for the edge cases, so don't expend all of your energy defending against them.
Re: (Score:2)
I [obviously] meant don't go down dark alleys with something to lose.
Re: (Score:2)
I don't believe I know your name.
Actually, there was at least one (Score:4, Informative)
My now-ancient ASUS G50VT [asus.com] included ExpressGate [computerhope.com]. Based on Splashtop, burned into the BIOS ROM, manageable. Rudimentary Firefox browser, email client, Skype, and obviously hard to update. But it ran independently of any OS installed on storage.
Splashtop is now done, but it was also used by ASUS on some motherboards, and then endured obscurity, competition [phoronix.com], and finally turned into something else.
It did work. It was pretty minimal, and could have been cool. And it certainly is possible today, even in BIOS, with flexibility and update capabilities, but somehow I don't see any of this on the market.
The obvious solution would be to embed ChromeOS or something similar, fairly lightweight and useful. This could let you keep your primary OS invisible.
Cost?
Zen/ESX (Score:2)
I've always thought it would be pretty neat to have ESX running on a laptop and swapping between the different OSes as needed.
Smartphone (Score:2)
I already have such a secured device, appropriately configured, with that added bonus that I can use it when my laptop's battery is empty, or the laptop is smashed up, or confiscated or in my checked baggage, or in front of me on the desk.
Live CD (Score:2)
Find/build a Live CD version of Linux that doesn't mount your hard drives, and you're pretty close.
Because solutions already exist (Score:3)
HyperSpace & Splashtop offered something simil (Score:2)
A few years ago, some laptops used to come with HyperSpace [wikipedia.org] or Splashtop [wikipedia.org], pre-installed cut down linux systems that could be used to surf the net, Skype, play music, etc. They didn't use separate SOCs, but HyperSpace at least could use virtualization to run both your main O/S and the HyperSpace O/S at the same time.
I think they were primarily intended to get around long boot times in situations where you wanted an instant-on web browser, and not as a security measure when connecting to a hostile local networ
Only complicates security (Score:2)
This is beyond niche and solved by access policy. What OP is describing only describes a way to make a weird, less secure (more attack surface area) edge case for the IT department to deal with.
Re: (Score:2)
EOMA68 and other modular computing cards (Score:3)
basically what you're asking for is perfectly reasonable but "not considered financially viable". even for EOMA68 (for which i'm the copyright holder of the Certification Mark), if you are expecting to have the power of a "modern" intel-based laptop in the form of a physically removable Computer Card where you would be able to isolate "work" from "external stuff", it's going to take another 4-5 years before the power reductions and performance increases from are sufficient so that it's actually even possible to fit a complete "high to medium performance" quad or octal core 3+ ghz computer plus 8 to 16 GB of RAM into such a small space.
the only *hardware*-level system that i ever heard of which had some form of dual (independent) processor system in it was about three to five years ago, it was announced here on slashdot: it was something like Lenovo or Dell who had put in an independent processor that could boot from the "BIOS" (if it's a full operating system it's hardly a BIOS but you know what i mean) into a complete and self-contained GNU/Linux OS with its own web browser.
aside from that, the only viable suggestions that you will get (and there will be some which will get lots of +1 moderations) will be dual-boot, or hypervisor-based (not that that means much any more with the spectres and meltdowns coming out the woodwork) virtual machining, or external USB memory-stick-based GNU/Linux OSes, and so on and so forth, all of which provide physical access to the drive, consequently *in theory* could actually maliciously be exploited and end up damaging the drive.
unless the work OS hard drive is removable. or the work OS hard drive *IS* the external USB stick and you swap over the USB sticks from work to "other" and back again. that would actually do the job that you're looking for, albeit with the performance penalty associated with some forms of external USB media, so you would have to do your research.
sorry it's not better news! honestly, though, if you absolutely really want to use the on-board (internal) drive, do consider virtualising the entire windows OS and sandboxing it... *and* sandbox the "other" OS as well. so that's 3 operating systems: the hypervisor / manager one (which you NEVER permit access to the internet) and that one should without a shadow of doubt be GNU/Linux-based. then you run Windows under QEMU (please don't use oracle virtualisation products), *AND* you run the "other" OS also under QEMU (or other suitable hypervisor system, do investigate XEN etc.) but... like i said: for all of these, you have to take into account the fuckups by Intel in the design of their processors where they prioritised profit over security: spectres, meltdowns and much more yet to be discovered.
That's adorable. (Score:2)
You think the most common OS on the planet by device installations, most commonly distributed in a heavily modified binary blob, is significantly more secure than Windows 10. How cute.
If you're worried about the dangers of free wifi, check your open ports and use a VPN, problem solved.
I keep the internet in my pocket. (Score:2)
VM + VPN (Score:2)
Strange that nobody suggested using a VPN.
If you care at all about security, you have no business connecting EITHER system to third-party WiFi (whether open at a coffee shop or closed at some other business) without employing a VPN.
The VPN should either terminate at your home/company router (hopefully you trust your own company's IT department to maintain a secure environment) or with a trusted third party. (i.e. your IT/security people should vet the company's security).
For your specific case (per your fol
Simple reason... (Score:2)
VAX on a chip? (Score:2)
For basic isolation -- I use my SmartPhone !! (with tape over the microphone & camera).
For even more isolation - I access YOUR PC at the coffee bar table next to me via the credentials I gathered via my pineapple that offered "Free WiFi".
The solution does exist. Due to the expense of having extra hardware to do this (the level of isolation you want) - most people dual boot using an encrypted file system or a local VM. TruCrypt had this feature -- a secret file system within another one hidden and acc
Has to be a hardware switch (Score:2)
To physically switch control of screen, keyboard, camera, microphone and so on. Otherwise non-work untrusted app can present work UI and steal your credentials. Even with a switch you could forget to flip it. A physical separate device is still best for security, even at the cost of a slight inconvinience.
Just guessing Economics. (Score:2)
My untested hypothesis would be 3 fold.
1) There isn't a huge market for such a thing so the cost of it would be prohibitive.
2) There is more profit in making hardware that will be bought by the 90% then the 10%
3) There are probably some work around that get you near what you want. ( also, my guess would be such systems probably do exist for military use , but you would probably be hard pressed to find them and unwilling to the pay the price if you could get one.).
What are we solving here exactly? (Score:2)
Let's take a step back and look at the problem you're trying to solve, as it sounds like the switching mechanism you describe might be over-engineering things a bit. You want to use sketchy public wifi with a mission critical work computer?
My first inclination would be not to risk using it in public places to begin with, or do my web browsing with a different personal device.
Otherwise, a VPN connection and VM would be the most elegant solution. Solves the trust issues with the local network, and (mostly/arg
Virtual machines? (Score:2)
Have you ever heard about them?
How would separate hardware be more secure?
My EUR 0.01 contribution: don't connect to untrusted networks and services at all and you won't need the pc inside a pc.
thumb drive (Score:2)
I agree with other responders that running Windows in a VM would probably be sufficient, but I'm old, and tend to want some kind of physical solution. My first thought was having a laptop with a removable drive bay (Apple need not apply) and swap out SSDs between your "work" instance and your "don't care if it's pwned" instance.
Barring that, I'd encrypt my main Windows drive and boot Mint (substitute your Linux of choice, or even Windows) off a low profile flash drive for browsing and email in sketchy envi
Laptops are inexpensive (Score:2)
Qubes-OS.org (Score:3)
.
Your NIC with its DMA controller is IOMMU constrained inside the sys-net VM, so it wont let it write to memory outside its own memory space. The sys-filewall VM and its iptables and nat keeps all your internal user VM's safe from the network.
Re: (Score:2)
Re: (Score:3)
What the hell is googling? Let me bing that...
Re: (Score:3)
In business unless you're working in IT, the security of your work laptop will be out of your hands as well as generally not your problem. If your work laptop gets compromised and you didn't hand out your credentials or physical access to someone then the IT dept didn't do their job properly.
Re: (Score:2)
An ARM SBC would fit quite nicely into the space previously occupied by an optical drive, which many laptops still come with but you're unlikely to ever use these days... You could then use that alongside the existing laptop hardware which will run just fine with the optical drive removed.