A poor man’s Qubes OS

We have talked about wrapping AutoFirma into its own VM to prevent it from modifying the host’s keychain and to keep it properly packaged and configured. I liked the approach and I have recently extended it to a few more things: I now use WhatsApp and Signal in single-app VMs in ChromeOS. Through this setup I’ll be able to access those services as long as I have one of my hardware keys and a recent-enough VM backup. When I started playing around with the idea, I wanted to achieve the equivalent of passkey-based logins to services and apps that don’t natively support passkeys. Both WhatsApp and Signal, for instance, require scanning a QR code with the corresponding mobile app to link a desktop client. I wanted something different: to be able to leave my main devices behind and still be able to access those services. I wanted to authenticate through a Yubikey and to securely get online even from a device that had just been wiped. The solution I came up with builds on ChromeOS VMs and…