Secure & Privacy Laptop Setup

Device requirements and selection

At the moment we have a multitude of laptop manufacturers such as: Asus, Lenovo, HP, MSI, Dell and many others. But not all of them can provide laptops possessing really that can be considered reliable and safe. Mandatory Requirements:

At this time, we know of no alternatives for fwupd and will use the HSI:4 (v1.9.21) security level. We can immediately check if the model we are interested in is in the List of Devices as well as their Level of Security (Data may not be accurate). With a quick glance at the update statistics, we can see that Dell and Lenovo are actively supporting their users with constant updates via the fwupdmgr platform. This condition is not mandatory, but it greatly enhances the end-user experience. It saves him from the need to check for BIOS updates on the manufacturer's website, prevents erroneous installation of updates that are not intended for his device, as well as with other problems such as the lack of BIOS update via USB and most importantly often manufacturers publish updates in the form of .exe files that significantly complicates the ability to update for inexperienced users.

By creating a parser, we got the following result:

{ "HSI:4": [ "ASUSTeK COMPUTER INC. ROG Flow Z13 GZ301ZE_GZ301ZE ROG Flow Z13", "ASUSTeK COMPUTER INC. Vivobook_ASUSLaptop X1504VA_X1504VA Vivobook", "Dell Inc. Latitude 3420 Latitude", "Dell Inc. Latitude 5530 Latitude", "Dell Inc. Latitude 5330 Latitude", "Dell Inc. Latitude 5420 Latitude", "SAMSUNG ELECTRONICS CO., LTD. 950XED Galaxy Book2 Pro" ] }

This list is just a small fraction of all the devices that can have a supported HSI:4 level. It is always necessary to look at the processor specifications and BIOS capabilities of the manufacturer. All of these devices are roughly in the same price range ($1,170-$1,500), our choice immediately fell on Dell. Since our experience in using it for more than 5 years leads only to positive impressions. Namely the model: Dell Latitude 5531

Specifications:

Here we have support for all the features we need, thanks to Dell SafeBIOS.

BIOS setup

At computer startup, press F2 to enter BIOS setup. Then:

Exit & Save Changes.

OS Choice

We won't even consider Ubuntu, Mint or their counterparts. For maximum anonymity we recommend Qubes-OS, but for everyday and office work it will be difficult. Our choice is Fedora Silverblue.

OS Installation

During installation, you only need to select full-disk encryption (Encrypt disk)

Post OS Installation

Apps Managing

Browser

Office

Torrent

Code & Text Editor

Image Edition

Passwords

Communication

Email Providers

Remote Control

VPN Providers

Misc

What we got at the end