1

I have a decently powerful desktop running Windows that I use for 2 different use cases: playing games and storing/processing my personal data. As a security-aware person this makes me uncomfortable. A vulnerability on Steam, as I think has happened in the past, or any of the games themselves, can put my personal data at risk. I'm not a security expert by any means, but I have come up with a few options, and I'm not sure which one to go with. I'm not sure which one provides adequate security, so please let me know your thoughts. Here is a list of approaches, somewhat in order, from lowest effort/lowest cost:

  1. Running the games in Sandboxie - is this secure? Would they even run properly?
  2. Separate Windows user accounts, making sure the account for playing games is not an administrator account. If this is good enough, what else do I have to do?
  3. Combination of #1 and #2
  4. Dual boot, so I'll install Windows on a separate physical drive - each Windows instance will be separately BitLocker-encrypted with different passwords (I don't have a TPM chip on this PC), and somehow not allowing each instance access to the other's drive - how, exactly? I have no idea how to achieve that, other than physically unplugging them in turn. This is the method asked in this question > Isolate two hard drives with two operating systems. If total isolation is not possible, will BitLocker prevent data access and meaningful modification? Can malware on the game drive somehow infect the other drive even when encrypted? I am more concerned about data theft, so if malware infecting the game drive wipes out the other drive but can't access any of the data and can't infect the other Windows instance, it's a pain but still better than data theft, as I have data backups available, but if that's the case I need the data corruption to be immediately detected/noticeable.
  5. Running the games in a VM - I have never tried this, I know this is possible and I have both an integrated and dedicated GPU, but I'm not sure my technical skills are up to the task of PCIe passthrough of the GPU, etc. I have only ever run "basic" VMs.
  6. Building a separate machine entirely - I know this is the most secure way but it's one I really would like to avoid.
4
  • You should look up cubes OS – yeah_well Jan 18 at 15:00
  • I would like my main OS to still be Windows, and I doubt games would run well on Qubes – vpskbk8s83hak7df3_ir Jan 18 at 15:03
  • better security comes at the cost of usability – yeah_well Jan 18 at 16:40
  • 1
    I asked for a "good enough" security, Qubes OS is overkill for my needs – vpskbk8s83hak7df3_ir Jan 18 at 17:38
1

I think you would need to dual-boot, as installers often require elevated privs to do anything meaningful, and there would be no guarantee that some residual process isn't running that may access your higher-value data, encrypted or not - at some point you will unlock it.

On that note: you might consider VeraCrypt for your non-game system volume and data (encrypted at rest while your gaming os instance is running). At boot time, you would select this partition (or drive) and then you will be prompted for the password from which to derive the volume master key. (This occurs courtesy of a custom pre-boot authentication boot loader termed system encryption.)

If you find yourself needing to boot into Linux, cryptsetup can mount a VeraCrypt volume, which gives you additional recovery or access options.

One caveat: but if that's the case I need the data corruption to be immediately detected/noticeable - any of the ciphers for VeraCrypt will operate in XTS mode, which means there is no authentication of the ciphertext data block. This means that you won't receive any notice of corrupt blocks 'til you next try to use them. My understanding is that BitLocker also uses XTS mode.

To achieve this goal, you would need to check the integrity of your files from within the secure Windows instance using some hash, and you would need to store the previously calculated baseline hashes with authenticated encryption. (Even though XTS will provide confidentiality, of the files' contents as well as your database of file hashes, it can't validate the integrity of the encrypted data.)

Edit, eg: each line in your baseline file contains the filename and hash of each of your work files. Now, use a tool such as Gpg4win to store the signed+encrypted baseline file. All of this can be automated, except for your typing the password to unlock the private key used by GPG when it verifies the most-recent copy of the signed+encrypted baseline data file, before your script checks the integrity of your work files. You could also run this verification independently in a Linux live usb/ iso without even booting Windows.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.