qubes

There's an OS project run by Joanna Rutkowska and some other folks called Qubes that does exactly that.

Yes, see Qubes to understand the level of effort required for robust isolation between desktop AppVMs.

And I think Xen is better at isolating drivers, which for Qubes OS is a fundamental principle.

How would you rate a Qubes VM for this purpose?

Xen isn't perfect, but according to the Qubes team it's the best we've got.

Will this change block Qubes from running on Lenovo/Dell/HP computers?

The Qubes mailing list has relevant discussion.

The study also recommends Qubes and Tails.

But they'd be exposed to competition on support, and even today, external tools offer better support than windows in many case(for example security micro-virtualization like qubes/bromium) and many offer cheaper stuff - all this while the code is closed.

He was a great advocate for projects like Tor and the Qubes OS project, and he put these tools into the hands of people outside the tech circles who really needed them.

But then also don't forget about the recent VPN's ip leak through WebRTC which can be disabled with setting media.peerconnection.enabled to false If you're paranoid you can also use Qubes or Tails OS.

At user request, the Intel i7 CPU in the Purism 15 was chosen to include VT-d support (needed for Qubes security, which isolates the GPU to a single driver VM) and to exclude support for the black box Intel ME hardware (vPro).

On a laptop which frequently faces this threat, network access can be restricted to VMs which are isolated by use case: - host outbound traffic disabled except security updates & VMs - non-persistent "browser VM" for captive portal login - non-persistent VPN VM - user data VM(s), virtual NIC routed only to VPN VM This can be done with VMware, Parallels, Qubes, Xen, KVM, etc.

Qubes uses Fedora 20 for Dom0, so you get all the same graphics support as Fedora gives you.

VT-d and TPM to support Qubes) and privacy (hardware switches for camera, wireless and microphone).

Ubuntu's splash page reads as though LXD is the Qubes/Bromium to LXC's Sandboxie, using some aspects of hardware virtualization for additional security.