# Follow-up: I’m focused on security from targeted hacking, not anonymity (Linux distro) **URL:** https://discuss.privacyguides.net/t/follow-up-i-m-focused-on-security-from-targeted-hacking-not-anonymity-linux-distro/39408 **Category:** General **Created:** 2026-07-27T21:13:01Z **Posts:** 19 ## Post 1 by @josh4754 — 2026-07-27T21:13:01Z I want to clarify my threat model because my original post may have placed too much emphasis on privacy. I am **not particularly concerned about advertising trackers, Big Tech, government surveillance, or remaining anonymous online**. My main concern is protecting my computer and accounts from a targeted attacker—for example, a technically capable and hostile former partner attempting to compromise my device, email, passwords, or personal files. My everyday needs are basic: - Web browsing and email - A VPN - LibreOffice - Opening normal documents and attachments - A system that does not require advanced Linux command-line knowledge I understand that no operating system can protect me if I voluntarily enter my password into a phishing page or approve a malicious request. However, I would like a system that reduces the damage if I accidentally open a malicious link, attachment, or application. I am looking for something more secure than a typical Linux Mint installation, but not nearly as complicated or restrictive as Qubes OS. I want something practical that can remain my everyday computer. With this clarified threat model, what would you recommend? Would Fedora Silverblue, Secureblue, Fedora Workstation, or another distribution provide the best balance of security and usability? Does an immutable system such as Silverblue meaningfully help against this kind of personal, targeted attack, or should I focus more on browser isolation, application sandboxing, full-disk encryption, hardware security keys, and good account security? --- ## Post 2 by @Expert4870 — 2026-07-27T21:45:40Z Chromebook or GrapheneOS are both Linux and could be a good option. You should be fine using Fedora Linux, Chromium browser, and installing as **little software as possible**. Just stick to the browser and install a uBlock (or Brave) to prevent Malvertising --- ## Post 3 by @trilobyte — 2026-07-27T21:45:41Z Grapheneos, ios, or macos, unless it’s a money thing, over desktop Linux. These do what you want much better than desktop linux and will provide more protection against targetted attacks. I think macos is most like what you want and you can exclusively install open source programs if you want. Hold up, you already made this thread: > [@Looking for a secure and private Linux OS for everyday use](https://discuss.privacyguides.net/t/looking-for-a-secure-and-private-linux-os-for-everyday-use/39247?sort=top): > > I’m looking for a Linux distribution that offers strong security and privacy without being as complex or restrictive as Qubes OS or Whonix. Ideally, I want something that feels like the desktop equivalent of GrapheneOS: secure by default, well maintained, and reasonably easy to use. My needs are very basic—I mainly use a VPN, a web browser, email, and LibreOffice. I currently use Linux Mint, and it works well, but I’m wondering whether there is a more secure option that is still practical for … My advice is the same as it was in that thread. You can do this on mobile besides maybe Libreoffice, but you can use proton docs and sheets to write documents. Macos is also an option for desktop. If you go with desktop Linux anyway, Ubuntu or Fedora. Ubuntu has the most resources and support but has slower updates, but they patch the type of vulnerabilities that were in the news quickly. If you want to minimize time in the terminal or configuring settings it’s the safest bet. --- ## Post 4 by @null — 2026-07-27T21:50:01Z > [@josh4754](#): > > My main concern is protecting my computer and accounts from a targeted attacker—for example, a technically capable and hostile former partner attempting to compromise my device, email, passwords, or personal files. Qubes are made for it. > [@josh4754](#): > > restrictive as Qubes OS. When you say “restrictive,” what do you mean? And what extra do you need? When I look at your basic needs and threat model, Qubes would be a perfect match. Qubes isn’t that hard to learn as many people make it sound. > [@josh4754](#): > > - Web browsing and email Trivalent in a Fedora 44 VM if you just want security. > [@josh4754](#): > > - Opening normal documents and attachments [Use Disposable VM’s](https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-use-disposables.html#how-to-use-disposables) An alternative would be something like Fedora as a host and have [Whonix](https://www.whonix.org/) and [Kicksecure](https://www.kicksecure.com/) VMs in [Live Mode](https://www.kicksecure.com/wiki/Live_Mode) depending on needs or if you want to use Tor or not, but I would use Qubes at that point. --- ## Post 5 by @pine — 2026-07-27T22:00:25Z To answer your question whether immutable distros inherently add securitt, I think @racky puts it well in your previous thread: [Looking for a secure and private Linux OS for everyday use - #28 by racky](https://discuss.privacyguides.net/t/looking-for-a-secure-and-private-linux-os-for-everyday-use/39247/28) Specifically: > [@Looking for a secure and private Linux OS for everyday use](https://discuss.privacyguides.net/t/looking-for-a-secure-and-private-linux-os-for-everyday-use/39247/28): > > It is my impression an immutable distribution is more about package transaction management and native rollback ability like in case of corrupt packages or system than about security. [Would the security benefits alone justify using Silverblue as a desktop OS? - Fedora Discussion](https://discussion.fedoraproject.org/t/would-the-security-benefits-alone-justify-using-silverblue-as-a-desktop-os/88766) is an interesting discussion to read. Also Linux kernel itself has many vulnerabilities. A kernel exploit can just remap the filesystem to be mutable again, and do changes without revealing transactions, immutable distros can’t help here. In general, from the other thread, MacOS or GrapheneOS’ desktop mode likely offers you the most security, put simply. Comparatively, desktop Linux is widely considered inherently less secure. If you still want to consider Linux distros outside of Qubes OS, Secureblue offers more security than most at the cost of convenience (depending on use). For more convenience, consider Fedora with Trivalent (and secureblue’s SELinux policy), as your browser is more likely to be a central attack surface. --- ## Post 6 by @Expert4870 — 2026-07-27T22:27:54Z I assume secureblue wouldn’t give too many issues considering your limited use to the browser, VPN app and LibreOffice. Never used it though --- ## Post 7 by @null — 2026-07-27T22:32:13Z It is easy to lose hair with Secureblue :man_gesturing_ok: but is nice after troubleshooting a lot of annoying non-issues for normal distros. --- ## Post 8 by @any1 — 2026-07-27T22:39:29Z > [@josh4754](#): > > for example, a technically capable and hostile former partner attempting to compromise my device, email, passwords, or personal files. If physical attacks are also possible, you could maybe consider something like [https://www.buskill.in/](https://www.buskill.in/) --- ## Post 9 by @TheDoc — 2026-07-28T02:10:06Z > [@josh4754](#): > > I am **not particularly concerned about advertising trackers, Big Tech, government surveillance, or remaining anonymous online**. My main concern is protecting my computer and accounts from a targeted attacker In this case I wouldn’t limit yourself to Linux. Mac is the most secure desktop but I’m not sure if that’s an option for you. If you must use a PC, hardened Windows _might_ be worth considering? It has garbage privacy but could have more security features and exploit mitigations than most if not all desktop Linux distros. I’m not sure if it’ll make a real difference for you but it’s something to look into. > [@josh4754](#): > > I understand that no operating system can protect me if I voluntarily enter my password into a phishing page or approve a malicious request. Definitely learn about other aspects of security such as DNS blocking, email compartmentalization through aliasing, how to tell if you’re being phished, etc. > [@josh4754](#): > > I am looking for something more secure than a typical Linux Mint installation, but not nearly as complicated or restrictive as Qubes OS. I want something practical that can remain my everyday computer. If you’re willing to deal with some less usability, secureblue might be the best compromise if you prefer Linux over Windows. You may run into some issues but you can probably get around them by asking for help in the secureblue Discord. Otherwise the main user-friendly recommendation is [still](https://discuss.privacyguides.net/t/looking-for-a-secure-and-private-linux-os-for-everyday-use/39247/7) Fedora [Workstation or KDE](https://www.privacyguides.org/en/desktop/#fedora-linux). Regardless of which OS you choose, you may want to consider using a virtual machine for things like email and web browsing if you’re seriously at risk of being targeted by a skilled attacker. > [@josh4754](#): > > Does an immutable system such as Silverblue meaningfully help against this kind of personal, targeted attack, or should I focus more on browser isolation, application sandboxing, full-disk encryption, hardware security keys, and good account security? Definitely put more time into focusing on the latter. AFAIK immutable/atomic distros don’t provide any inherent security benefit, they exist more for stability and preventing the user from accidentally breaking their system which can sometimes come at a cost to usability. If you’re not gonna go with secureblue, I’d recommend Fedora Workstation over Silverblue. --- ## Post 10 by @Expert4870 — 2026-07-28T02:25:41Z Based on the threat model it would seem social engineering mitigations, OSINT prevention by minimizing data, would be more important than the OS specific security. Of course go ham with OS sec if you want, it doesn’t hurt. --- ## Post 11 by @trilobyte — 2026-07-28T02:33:01Z If they’re afraid to use terminal ([My main concern is that I have very little experience with terminal commands. Taking that into consideration, would you still recommend Secureblue…?](https://discuss.privacyguides.net/t/looking-for-a-secure-and-private-linux-os-for-everyday-use/39247/3)) and spending time on config then I think secureblue is a bad idea. If it’s literally just web browser (trivalent is good) and libreoffice (it has a flatpak and I think is in rpm-ostree) and nothing else then it should still be doable with enough time. Worst case they could post a thread here. > [@TheDoc](#): > > If you’re willing to deal with some less usability, secureblue might be the best compromise if you prefer Linux over Windows Notably the enterprise/business edition windows is what has more security features like disk encryption, from what I’ve read. If they’re worried about physical attacks other than theft (disk or even home folder encryption works here) I’d strongly recommend mobile or macos though. They’re much more sophisticated in protecting here. Though boot hijacking and hardware manipulation is specialized knowledge and not something most technically skilled people could pull off with limited time. --- ## Post 12 by @Expert4870 — 2026-07-28T02:35:05Z > [@trilobyte](#): > > They’re much more sophisticated in protecting here, though this is specialized knowledge and not something most technically skilled people could pull off with limited time. It’s not hard to be secure from physical attacks on these devices… Just use 6+digit passphrase and restart when threats are increasing. --- ## Post 13 by @trilobyte — 2026-07-28T02:37:53Z You caught me before my edit. I meant something like covertly adding a physical keylogger and recovering it later or hijacking the boot process via a USB vulernability is specialized knowledge and therefore possibly not what they need to be worried about, even if mobile and macos provide more protections here. --- ## Post 14 by @TheDoc — 2026-07-28T13:31:14Z > [@trilobyte](#): > > If they’re afraid to use terminal ([My main concern is that I have very little experience with terminal commands. Taking that into consideration, would you still recommend Secureblue…?](https://discuss.privacyguides.net/t/looking-for-a-secure-and-private-linux-os-for-everyday-use/39247/3)) and spending time on config then I think secureblue is a bad idea. That’s fair, I’m just basing this recommendation off of what they say they’ll use: > [@josh4754](#): > > - Web browsing and email > - A VPN > - LibreOffice > - Opening normal documents and attachments I haven’t tested it myself but I don’t see why secureblue shouldn’t be able to do all of this without any issues. One of the main usability issues I found was with installing Electron apps, but if this user sticks to the browser (most Electron apps are available as web apps anyways) they should be fine. > [@trilobyte](#): > > Notably the enterprise/business edition windows is what has more security features like disk encryption, from what I’ve read. With Windows 10 you needed Pro (or better) for full disk encryption. [Windows 11 seems much weirder](https://www.pcworld.com/article/624593/is-your-windows-11-pc-encrypted-the-answer-is-surprisingly-complex.html). From what I’ve read, Home supports basic full disk encryption if you sign in using a Microsoft account (which provides Microsoft with your decryption keys) but Pro (or better) supports all of BitLocker’s features, presumably including local full disk encryption? IIRC the benefit of Enterprise is having much greater control over permissions and policies, but it’s very expensive and only usable to IT folks. If OP reads this, maybe consider getting Windows 11 Pro instead of Home to be safe (if you go the Windows route). --- ## Post 15 by @sha123 — 2026-07-28T16:30:39Z > [@josh4754](#): > > My main concern is protecting my computer and accounts from a targeted attacker—for example, a technically capable and hostile former partner attempting to compromise my device, email, passwords, or personal files. What are we talking about exactly? Could the attacker get physical access to your devices? What does technically capable mean? Is he just someone who is good with computers or someone who has the knowledge and resources to deliver spyware and if so, only cheap off-the-shelf spyware or more expensive/sophisticated spyware? > [@Expert4870](#): > > Based on the threat model it would seem social engineering mitigations, OSINT prevention by minimizing data, would be more important than the OS specific security Agreed. For most cases of hostile former partners, that should have priority over OS optimization and even more so taking care of physical security. Also making sure that no spyware is already lingering, from the time the former partner still had physical access. --- ## Post 16 by @Expert4870 — 2026-07-28T17:44:49Z > [@sha123](#): > > Agreed. For most cases of hostile former partners, that should have priority over OS optimization and even more so taking care of physical security. Also making sure that no spyware is already lingering, from the time the former partner still had physical access. Agreed. Physical access is the easiest way to get huge access. Another thing the post didn’t mention a password manager as a needed app but hopefully it is used in is set up and all accounts are secured with it. --- ## Post 17 by @hydride — 2026-07-29T05:34:09Z Configuring Windows is much more difficult than configuring SecureBlue; the latter is basically out of the box. --- ## Post 18 by @hydride — 2026-07-29T05:36:05Z Atomic does barely nothing about security, and what SecureBlue does can also be applied to regular Fedora. They used the atomic version because it saved a lot of work. --- ## Post 19 by @JibJab — 2026-07-31T16:28:48Z Securing your local personal devices is a good step but you may be missing the big picture. Have you already set freezes at the big 4 credit reporting agencies, secured your Bigtech, email, SSA and IRS accounts with MFA and set a sim security pin with your telco?