I’m looking for a Linux distribution that offers strong security and privacy without being as complex or restrictive as Qubes OS or Whonix.
Ideally, I want something that feels like the desktop equivalent of GrapheneOS: secure by default, well maintained, and reasonably easy to use. My needs are very basic—I mainly use a VPN, a web browser, email, and LibreOffice.
I currently use Linux Mint, and it works well, but I’m wondering whether there is a more secure option that is still practical for daily use. I’ve heard that Fedora Silverblue could be a good choice because of its immutable system design.
Would Fedora Silverblue provide meaningful protection against malware or malicious phishing links opened through email or a web browser? I understand that no operating system can completely prevent phishing, especially if the user enters credentials or approves something, but would Silverblue’s isolation and immutable design reduce the potential damage?
Given my needs and threat model, what do you think would be the best way forward?
I’m not looking for an extreme threat-model setup—just something more secure than a traditional desktop distribution while remaining easy to use.
I would recommend looking at secureblue. It is roughly speaking a hardened version of silverblue (or, Universal blue I think more accurately) and has its own hardened chromium browser, Trivalent, which is based on Vanadium from GOS. From a security standpoint, I’ve found Trivalent pretty unparalleled on desktop. The SecureBlue defaults are pretty secure, and it’s easy to reenable features you need using ‘ujust’ commands in the terminal. It’s also easy to harden the os further using ‘ujust’ as well.
Thank you for the recommendation—Secureblue sounds very interesting, especially since it builds on Silverblue and includes stronger defaults.
My main concern is that I have very little experience with terminal commands. Taking that into consideration, would you still recommend Secureblue, or would regular Fedora Silverblue be easier and more practical for someone like me? Ideally, I would prefer something that works securely out of the box without requiring frequent use of just commands or manual hardening.
I would also appreciate your thoughts on malicious or phishing links. For example, if I accidentally opened a malicious link or attachment through email or the browser, would Secureblue provide meaningfully better containment than regular Silverblue? Is most of the protection in that situation coming from Trivalent’s browser sandbox, or does the immutable operating system also reduce the potential damage?
My needs are very basic—VPN, browser, email, and LibreOffice—so ease of use and reliable updates are important to me.
One of the main reasons I recommend secureblue is because of the Trivalent browser that’s integrated and sandboxed within the base system image. Any other browser option in Silverblue is either going to be more work to keep updated or is going to offer worse security.
An example of Trivalent hardening that’s proven useful is that I’ve seen it notify me when a site is attempting to connect to devices on my local network. You can then deny the site that ability. I’ve visited that same site in many other browsers (including Brave) and none of them have recognized this was happening or given an option to block it.
The ‘ujust’ commands I referenced are built into the terminal on secureblue (and also universal blue) and operate basically like a menu. I find them very user friendly and to require basically no technical knowledge. If you want the best experience with secureblue, I would recommend not enabling any of the additional hardening, as I’ve noticed that break some things.
I’ll have to let someone else answer your question about protection from phishing links. The email provider I use warns me about phishing, and I have it set to require an additional approval to open any links, which gives me a chance to look at it and make sure it’s actually what I want to open. My hunch is that savvy preventive behavior is much more effective against phishing than any technical measure.
You can install VPN with ujust, Trivalent is the default browser, and you can install LibreOffice via flatpak. I would use terminal because Bazaar (app store) takes too long to load the GUI sometimes (at least for me). After that, you should be able to use secureblue without any issues, and updates will run in the background.
You can also download a wireguard config file for your VPN and use it within the network manager in gnome. This is my preferred method for secureblue since it doesn’t require layering a package onto the base image. You can search “wireguard config file for ___ VPN” and it should point you in the right direction.
Unfortunately the options that exist today are either easier to use and less hardened (Fedora) or difficult to use but more secure (QubesOS). Secureblue is the closest thing to a “middle-ground” but it isn’t very easy to use and all their hardening can only improve Linux to a limited extent. If you’re just looking for something better than Linux Mint while remaining somewhat easy to use, Fedora is definitely the way to go.
There are some quirks with atomic distros (such as Silverblue), so Fedora Workstation might be a safer bet for you. Phishing protection is more about your browser and your personal security awareness than it is about your OS. I don’t know whether there is a lot of malware that would infect Linux Mint and not Fedora but it’s still worth upgrading to Fedora IMO. I think the best defense against most malware on Linux is being selective with what software you install and where you install it from. Sticking to verified Flathub Flatpaks and your official distro repository is generally best, be extra cautious of other software sources.
What makes you say secureblue isn’t easy to use? I’ve found it basically as easy as other atomic distros, which for the use cases the OP mentioned is pretty darn easy. The only thing they’ll have to do is install the VPN using a wireguard config (step by step instructions on their VPN’s website) or a ujust command to layer the package (assuming they are using Proton, Mullvad, or IVPN).
I haven’t tried it so I’m not 100% sure but I was under the impression certain common software or features didn’t work well OOTB such as Electron apps, though their FAQ is super unclear on that in particular.
“Electron massively rolls back Chromium security, breaks the sandbox and is a regularly backwards incompatible library used by applications so there’s a huge mess created by it.”
RoyalOughtness:
Yep, I think the right move here with regards to the topic of this ticket specifically is to discourage users from using electron at all if possible. Fortunately there are often alternatives to using electron apps:
Unfortunately that’s a big no-no for usability, many popular apps use Electron. Also, requiring people to use web apps wherever possible imposes significant security risks for E2EE apps: Web-based cryptography is always snake oil
Kicksecure is awful. Has a horrible choice of base OS for security and they don’t do valuable work to improve it. They sabotaged security efforts and are spreading misinformation about allocator hardening and other topics they don’t understand.
In what regard? Obviously if you’re using software you don’t trust, it’s best to use it as a web app rather than install it. I’m talking about using trustworthy software, especially applications meant to protect you such as apps utilizing E2E or client-side encryption (Element, password managers, etc).
That’s the first I’m hearing this. Sounds pretty cool but very few users are going to bother doing that or even know that they can. Dysfunctional Electron apps OOTB is still going to present a significant usability and (in the case of certain apps) security issue.
Electron bundles js runtime and the code itself for local execution thus enabling the developers to ship the code responsible for E2EE in an auditable manner. Is this chain of thought and conclusions clear enough?
weaker sandboxing, unsafe languages with weaker public scrutiny and hardenings (see the defaults of QT for example)
Why not? Seems like a win win situation to me.
So it’s not the technology itself, but the developers of said apps now…
It’s clear that you misunderstood what I said and are proving my point with some unnecessary snark. So to clarify what I said for you, the Secureblue devs suggest using web apps rather than Electron apps wherever possible and my point was that this is bad for E2EE apps.
It’s a good solution so if you know of a tutorial feel free to share it. But because it isn’t common knowledge that this is both possible and preferable (and it requires extra work), most people are going to be choosing between a standard Electron or web app.
Responsibility falls on both Secureblue and the app developers to create secure and usable software, since this isn’t a perfect world they have to make certain sacrifices based on what resources they have at their disposal and what pre-existing software they’re forced to build on. Whether Secureblue made the “wrong” choice in preferring stronger hardening over functional Electron apps OOTB is subjective based on where you’d like to draw the line. I didn’t express an opinion on it either way, but I am saying it’s one of the factors which disqualifies it from being considered a beginner-friendly Linux distribution which is a concern for OP.
I had a play around with SecureBlue (A hardened fork of Silverblue that gets the Privacy Guides seal of approval) but I occasionally play videogames and all the stuff I need to disable to make it worth makes me think I’m just defeating the point of SecureBlue at that point.
I’m running Fedora Kinoite (Silverblue but with the KDE Plasma desktop environment), and find it reliable and way better than Mint.