When you search for secure laptop over a search engine, you will see couple of choices.

First one is Librem. Don’t get it. They run libreboot which run on binary blob that I would never recommend.

They say there is a hardware block to speaker/cam. It does not even matter, I will tell you the reason soon with Qubes.

Second one you will see is Nitrokey. They are good, the only problem is they have all your recovery keys. I really don’t get it, why they would keep them?

Then there is Insurgo, they might have seen Nitrokey and asked the same question. They have a good reownership feature which is an automated process that runs on your first boot. And you change all the recovery keys by yourself and just for you. It has Nitrokey dongle with it and your laptop will not boot without it. Your hard drive is encrypted, so it will ask for its password as well.

So, at the end: Do not get any consumer / gaming laptops. Try to get Business Grade Laptops. Thinkpad from Lenovo is my favorite. My personal computer is Lenovo X230 with IPS screen.

After you get the laptop of your dreams, first thing without even connecting to internet is changing some BIOS settings.

• Disable Bluetooth completely.
• Disable Webcam and Microphone and Biometrics.
• Use BIOS password.
• Enable HDD/SDD password.
• Disable Secure Boot if you are going to use Qubes OS.

Then you will be using Qubes OS. Which is the most amazing Operating System I have ever used. And trust me I have used almost all versions of all Operating Systems.

So what is so special about Qubes?

• First, it is a Linux based on Xen, open source.
• It blocks almost all hardware; you cannot use GPU with it. It only runs on CPU, so you cannot use hardware acceleration with Firefox let’s say. It blocks USB, microphone, camera. So as in Librem you don’t need to disconnect them physically.
• At default it gives you couple of premade virtual machines, basically they are different computers which has no relation with each other. How do you use it? For example, I have created some Qubes: personal, trade, vault.

Personal is for daily activities. Mail, Discord, Telegram, watching videos, saving pdfs to read later, listening to music.

Trade is only for trading. It has Firefox, XMR wallet, Wasabi and nothing else. It has all the settings to make Firefox invincible. It has bookmark links to the banks I use. It has Metamask and this is all. I only open this VM when I am about to trade. I also use the Ledger hardware wallet connected to Metamask. So even when my browser gets hacked or I click on a link that I should not click, nothing will happen.

Vault has Keepassxc and my important files in it. It doesn’t have any connection to internet. So, without any physical hack, it is impossible to hack this computer. Even when someone gets my laptop, then they must get past Nitrokey security, dencrypt the hardware, then get past the OS password. If they do this, they can use my personal Qube, which has nothing personal in it. They need to open other Qubes and know their passwords and USB to get at my money.