Heads firmware and OS is more secure than Whonix, Qubes or Tails?

Question

Developers stated Heads combines physical hardening and flash security features with custom Coreboot firmware and a Linux boot loader in ROM. This moves the root of trust into the write-protected ROM and prevents further modifications to the bootup code. The hypervisor, kernel and initrd images are signed by keys controlled by the user, and the OS uses a signed, immutable root filesystem so that any software exploits that attempt to gain persistence will be detected.

Another important thing is that heads uses only free software, while Tails continues using non-free software. Non-free software can not be audited and as such cannot guarantee you security or anonymity. On the other hand, with heads you only use free software, meaning you can gain access to any source code that is included in heads, at any time. Using free software it is far easier to avoid hidden backdoors and malware that might be in non-free software. We hope this makes you a tad more aware of the importance of free software and its uses.

Does it make Heads more superior than Whonix, Qubes or Tails?

Answer 1

I use QubesOS and Whonix, know Tails and have briefly read https://github.com/osresearch/heads . It sounds that many of those things are orthogonal.

Heads is a boot environment that should be usable to boot any of those three. So, it is not question if you should use, say, either Qubes or Heads, you can use both, unless there is a fundamental incompatibility I am unaware of.

Qubes and Whonix are also rather complements than competitors. After all, Whonix is distributed as a VM template within Qubes. Qubes handles VM isolation and cooperation, while Whonix handles proper torification. They are two different tasks.

The only competition there I can see is Qubes(+Whonix) vs. Tails, because one is unlikely to reasonably use all three OSes together. My brief opinion: If you have a suitable hardware (enough RAM and compatible CPU and mobo), Qubes+Whonix will do much better for security.

Other comparisons (e.g., Heads vs. Tails, Heads vs. Qubes, Qubes vs. Whonix, Whonix vs. Heads) make sense as much as comparing safety of car wheel with safety of car bumpers. They do a completely different job, so they are not comparable.

Answer 2

You're comparing apples and oranges.

Heads (which uses Coreboot) is a replacement for UEFI Firmware (aka BIOS).

Whonix, Qubes, Tails, etc are Linux distributions, which are all compatible with Heads.

In-fact, a less-known feature of Heads is that it can verify the integrity of your .iso boot media. By default, Heads ships with the release keys of Qubes and TAILS in its GPG keyring. These distros are complimentary to Heads.

Resources

For more information about Coreboot & Heads, see:

1. Heads Website
2. Coreboot Website
3. Trusted Boot (Anti-Evil-Maid, Heads, and PureBoot)
4. Trammell Hudson's Heads @ 33c3