System Audit

Whonix ®

Download

Windows Linux Mac VirtualBox KVM Qubes USB ISO (coming soon) More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

• System Audit
• Security Reviews
• Media Mentions
• Certification
• Track Record against Real Cyber Attacks
• Reliable IP Hiding
• IP Hiding is an Outdated Threat Model
• Leak Tests
• Leaks and Compromise Indicators

Verifying the system is configured as intended

Audit

Whonix has not been subject to a formal audit, but that has little significance. At the time of writing, other privacy/anonymity-focused distributions like TAILS and Liberté Linux have not been audited either. Even major operating systems such as Debian, Ubuntu and Qubes OS have not had public, published audits to date.

We are unaware of any serious research concerning the above distributions in Free Haven's Selected Papers in Anonymity. Further, no experts such as Bruce Schneier for cryptography exist for a security-focused operating system review.

Even the usefulness of any published audit must be considered. Audits of software and operating system platforms are necessarily carefully defined and limited in scope due to the size of the undertaking. There are no all-encompassing audits that thoroughly examine or evaluate every possible aspect of security.

To explore this issue in further detail, consider the GNU wget computer program that retrieves content from webservers. Has wget ever been audited? Even if it has, what did the audit entail -- a professional company, providing software security audits as a service or some kind of certification? At present no such entities exist to provide this service in the Freedom Software Open Source ecosystem, meaning there are no quality seals for Linux distributions.

If the reader is aware of any such examples, please get in contact or edit this section. Also consider whether it is reasonable to expect a reputable organization or individual to make statements like: "GNU wget has been audited and no security vulnerabilities were found". In reality it usually happens the other way around; when someone reviews the source code and finds nothing wrong, nothing is reported. On the other hand, if a vulnerability is found that is worth some fame. In essence, anyone who claims beforehand to have found no security issues does not receive a boost to their reputation, but in fact risks looking bad if problems are discovered later on due to their previous statements about nil security issues.

Anybody undertaking an audit of Whonix is kindly asked to edit this section or get in contact so the outcome can be linked here.

Upstream

• Introduction: Whonix Documentation Introduction, User Expectations, Footnotes and References, User Expectations - What Documentation Is and What It Is Not
• Whonix is based on Kicksecure^™: Whonix inherits many features and principles from Kicksecure.
• Kicksecure is based on Debian: Kicksecure builds upon the stability of Debian.
• Inheritance: Therefore, Whonix is also based on Debian.
• Debian is GNU/Linux-based: Debian primarily uses the GNU/Linux as its foundation.
• Shared documentation benefits: Because one distribution is based on another:
  • Inherited documentation: Little specific documentation is required for each layer.
  • Shared principles: Features and principles often remain consistent across forks. Users can often follow the same instructions for both Whonix and Kicksecure.
• Keep using Whonix: This does not mean the user should switch to Kicksecure.
• Where to apply the instructions: The instructions should be applied inside Whonix.
• Wiki editors notice: This box is wiki template upstream_wiki. (Pages that link to it.)
• Comparison: Whonix versus Kicksecure
• Documentation compatibility: Since Whonix is based on Kicksecure, the user can follow these instructions for System Audit . Apply the instructions inside Whonix, not Kicksecure.
• Note: Re-interpretation...

Kicksecure: Perform these steps inside Kicksecure.

Instead the user should apply the instructions inside Whonix-Workstation.

Kicksecure for Qubes: Perform these steps inside Qubes kicksecure-17 Template.

Instead the user should apply the instructions inside whonix-workstation-17 Template.

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!