How Secure Is Ubuntu

[bostonman]

I have an old laptop with XP and Ubuntu (dual OS obviously).

Is using Ubuntu for secure stuff safe, or, because it's an open-source it is vulnerable to hackers stealing information as I'm typing it?

[grumpydoc]

A hard question to answer - security is usually a compromise and you have to understand the trade-offs you are making.

If you store data which needs to be kept secure on a laptop with Ubuntu install and make sure it is locked in a safe when you are not using it, and never connect it to any networks it will be perfectly secure - and some environments might actually require that approach. Some might need even more such as using it in a soundproofed environment within a Faraday cage.

What is the cost of losing the data? What is your threat model?

[tunk]

Is your Ubuntu an (LTS) version that still get updates?
If yes, then it is (at least compared to XP which hasn't
got updates for almost 7 years).

[grumpydoc]

Is your Ubuntu an (LTS) version that still get updates?
If yes, then it is (at least compared to XP which hasn't
got updates for almost 7 years).

I'd certainly start by wiping XP 

If the threat model is the laptop & hard disk being stolen Ubuntu (certainly current versions) supports disk encryption.

If the threat model is dodgy websites stealing your personal data then you need to think about hardening the browser - and your own browsing practices as much as the OS.

If the threat model is data being siphoned in flight across the internet then use HTTPS (but be aware this risk vector is tiny to the point of not existing for ordinary individuals).

[bostonman]

I wasn’t thinking about including a threat model. I need to look at which version of Ubuntu but it does get updates.

Threat model would be just Internet. If I log into a secure site like my credit card or similar, and assuming no virus (or the possibility XP vulnerability bleeding into Ubuntu - something I’m uncertain of), is that safe?

[ataradov]

It is perfectly safe. I'm not even sure why this question comes up. There is such a bigger market for Windows vulnerabilities that not having the source code is not a factor at all. Even with the source code nobody cares to put a whole lot of effort into OS that holds 1% of the market (not that holes are much easier to find with the code).

[Marco]

Is using Ubuntu for secure stuff safe, or, because it's an open-source it is vulnerable to hackers stealing information as I'm typing it?

On any desktop OS it's best to assume local root exploits are infinite.

It's all about keeping attacks away from the OS, ie. using an up to date browser, not installing malware, not allowing inbound traffic to anything with a significant attack surface (ie. more than 10 lines of C code, which unfortunately includes the TCP/IP stack, so compromises have to be made).

[golden_labels]

Is using Ubuntu for secure stuff safe,

Using anything is as secure as the weakest link, which is nearly always YOU. So the answer is: if YOU use it in a secure manner, it is secure. Certainly much more secure than unmaintained software past its EOL, which comes from time before Microsoft was even caring about security in their consumer OS.

because it's an open-source it is vulnerable to hackers stealing information as I'm typing it?

Why do you think cryptographic primitives are open? Closed designs are never more secure: they are merely unverifiable.