Introduction[edit]

Printing is a risky endeavor ^[archive]. This risk is unrelated to Whonix ™ and is a general issue with printers.

The Electronic Frontier Foundation (EFF) notes: ^[1]

Imagine that every time you printed a document it automatically included a secret code that could be used to identify the printer - and potentially the person who used it. Sounds like something from an episode of "Alias" right?

Unfortunately the scenario is not fictional.

The EFF has confirmed that some color laser printer manufacturers encode identifying information on each page, in an effort to identify counterfeiters. Identifying information contained within forensic tracking codes can include the date, time and printer serial numbers attached to the printout. For instance, a sample script ^[archive] is provided by the EFF which deciphers these forensic dot patterns for the Xerox DocuColor laser printer. ^[2] The downside for privacy advocates is immediately apparent: this same technique can be used as a common tool for government surveillance.

DEDA (Tracking Dots Extraction, Decoding and Anonymisation toolkit) is a tool for countering the yellow dot watermarking threat. It may be packaged for Debian in the future.^[3]^[4] The technique it uses was criticized by the Metadata Anonymization Toolkit (MAT) developer for using a blacklist and not being a generic solution and recommends using black and white only printers as a safer solution.^[5]

Safety Principles[edit]

Workarounds exist for printing materials such as political leaflets safely:

This page ^[archive] has compiled a list of printers and whether or not they include forensic watermarking.
According to MIT, forensic markers are not present in black-and-white print-outs, so long as no color cartridge is present. ^[6]
Relying on a USB-Printer bought at a garage sale might be a good option to help maintain anonymity.

Note that these factors only apply to printers under a person's control. If a printer is used that is controlled by an adversary and they want to track down the source printer for particular documents, then color printing can be enforced at all times for this purpose.

Modern printers and scanners are embedded computers with their own dedicated internal storage. It has been discovered that scanned documents are saved by these devices, leaking the handling of sensitive documents. ^[7] One workaround is to use a cell phone that is only used for dedicated anonymous activities to take photos of the material, however this recommendation comes with its own caveats.

Finally, persons wanting to print anonymously must also consider non-technical issues, such as forensic traces related to physical fingerprints, DNA traces left on materials and so on.

Mitigating Printing Risk[edit]

Qubes-Whonix ™ only.

Warnings[edit]

Pairing Whonix ™ with network printers is strongly discouraged. This is because most (if not all) network printing relies upon insecure, unencrypted protocols. This means the documents being printed will likely be visible to attackers who are able to sniff the local network, or who control the (normally untrusted) Qubes NetVM. This is a limitation of modern printers and printing protocols and not something that can be solved by Qubes or any other OS. ^[8]

Particular care must be taken in Qubes to mitigate the risk of exposing dom0 to malware -- Qubes-Whonix ™ users should utilize a dedicated USB qube ^[archive] when using a USB printer. Further, printer driver plugins should never be installed in a trusted TemplateVM! The reason is many driver plugins are proprietary ^[archive] and most often downloaded from the vendor’s website in the form of ready-to-install packages. However, they are usually unsigned and only made available for download over HTTP connections. If these third-party driver plugins are installed in a trusted TemplateVM, the template may be compromised as well as every AppVM based upon it. ^[8]

Bearing in mind the risky nature of printing, the threats posed by printer driver plugins can be mitigated via several methods outlined below.

Install Printer Drivers: TemplateBasedVM[edit]

Warning: Some users may be tempted to use the AppVM's root filesystem as a non-persistent security feature ^[archive]. However, malware can persist if the AppVM is infected -- all data in the normal user filesystem, /home, /rw and /usr/local survives reboot. It is feasible that advanced malware (or malware specifically targeted at Qubes-based AppVMs) could install its hooks inside the user home directory files only. ^[9]

There is no reason to avoid installing software in TemplateBasedVMs. Therefore, it is possible to install the printer drivers in an AppVM which is based on the whonix-ws-16 template.

Create an AppVM based on whonix-ws-16. The untrusted AppVM should be named so it is not confused with a more trusted VM - for instance anon-printer.
Install the printer drivers in the anon-printer AppVM. Use Tor Browser or konsole to download the necessary drivers; see Install Software and Secure Downloads for more advice.
Once the drivers are installed, use the anon-printer AppVM for printing. Do not use it for any other sensitive activity!
Optional: Minimize the risk of user mistakes persisting to the next printing session. Once printing is complete, shutdown the anon-printer VM and remove ^[archive] it from the system. When further printing is required, repeat steps 1-3 to recreate another anon-printer AppVM.

Install Printer Drivers: TemplateBasedVM with Selective Persistence[edit]

Using selective bind-dirs ^[archive] persistence is currently undocumented. Further research is required to ascertain which files require persistence across VM reboots. This task would also be difficult.

Install Printer Drivers: StandaloneVM[edit]

Create a Standalone ^[archive] Whonix-Workstation ™ VM. The untrusted Standalone VM should be named so it is not confused with a more trusted VM - for instance anon-printer.
Install the printer drivers as per normal procedures. Use Tor Browser or konsole to download the drivers.
Once the drivers are installed, use the Standalone anon-printer VM for printing. Do not use this VM for any other sensitive activity because printer driver plugins can pose a serious risk to security and anonymity.

Footnotes[edit]

License[edit]

Whonix ™ Printing and Scanning wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Whonix ™ Printing and Scanning wiki page Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it under certain conditions; see the wiki source code for details.

Whonix ™ is Supported by Evolution Host DDoS Protected VPS. Stay private and get your VPS with Bitcoin or Monero.