Tails 2.0 is out
tails.boum.org
tails.boum.org
I wonder why they opted to preload it with AdBlock Plus instead of uBlock Origin. I'm sure gorhill would certainly give his blessing, and by all measurements it is just as effective with way less overhead.
Heck, they could go one step further and preload it with a uBlock Origin profile on a paranoid mode that proactively disables all JavaScript (last I remember using Tor I had to manually disable Javascript in the Firefox config).
And most privacy conscious people left Adblock Plus after they started allowing "acceptable ads" including from some pretty notorious trackers.
Click the eyedropper tool "enter element picker mode" https://www.dropbox.com/s/niy881lyaca4zmx/Screenshot%202016-...
Not only my blessing, I would be happy to work on whatever is deemed necessary to integrate into TAILS.
A volunteer worked to make uBlock Origin part of Debian earlier this month: https://packages.qa.debian.org/u/ublock-origin.html# -- this at least fulfill one of the condition for TAILS.
When Tails has had vulnerabilities it is often with one of these included apps[6].
The browser isn't sanboxed (it's in progress[3]), and the machine is still directly connected to the internet, so you're a single Firefox vulnerability and a drive-by download away from being deanonymized.
It is also a shame that both OS X and Windows make it difficult to write an OS to an USB stick and boot from it - the install requires an intermediary Linux OS either on DVD or USB, which a lot of users won't get by.
For a different approach, see Whonix[4] - a virtual machine based approach with an isolating proxy (very popular setup amongst black hats) and Qubes OS[4] which is built on Xen and runs processes in separate VM's
[1] https://tails.boum.org/doc/about/features/index.en.html
[2] https://www.cvedetails.com/vulnerability-list/vendor_id-1143...
[3] https://wiki.mozilla.org/Security/Sandbox
[6] https://blog.exodusintel.com/2014/07/23/silverbullets_and_fa...
Tails is significantly more secure than the common practice of running the Tor Browser Bundle on a Windows OS.
In theory it would make an excellent thin client to use with an OpenBSD isolating proxy - i'm actually curious to hear what others would think about using embedded Windows (XP or 8 or 10) in this way.
https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWT...
meaning the only way to route out is to proxy via Tor. IMO it's the only safe way to run Tor and remain anonymous.
If the browser leaks identifying client information through HTTPS or other encrypted protocols, the proxy (torify) will not be able to help. That is why Tor Browser is important.
I don't use torify or anything else - if the app doesn't support SOCKS or HTTP then I don't use it. Any browser leaks will just hit a wall against the router VM.
It's the whonix architecture - except I use my own router (wasn't comfortable with whonix's 1.6GB+ router) and client.
You didn't mention it, but you should revert to a clean VM snapshot after each time you use your VM (like they do in Qubes).
http://www.pendrivelinux.com/universal-usb-installer-easy-as...
So for instance in this case you could grab the gpg key, go into their IRC channel and ask for it again, etc.
I do agree HTTP makes it easier to MITM, but in theory if you are serious about security you should not be relying on HTTPS alone.
On those types of networks, MITM attacks are extremely easy, and there are tools to do it in seconds. It may be more likely for you to get MITM'd and have them modify the signature, than for the actual website to get hacked. Combined with the fact that some people would try to download Tails across these types of network for the added anonymity.
https://tails.boum.org/torrents/files/tails-i386-2.0.torrent
^^ given that, it is to me just as puzzling that they provide a torrent as it is for failing to use HTTPS by default for file transfers.
It's a problem that others can help fix by setting up mirrors on HTTPS. Ditto with hosting the website on a Tor hidden service.
apt-get install tails-installer
My main "inspiration" here is the fake bomb threat by the college kid to get out of mid terms, just before the email about the bomb was sent his IP downloaded Tor bundle. The service he was using also had the schools IP or something so administration could see it was sent from inside the school, but I think that is still valid concern. This kind of meta data about your actions can leak just as much information as actually seeing what you are doing.
My question therefor would be: should more people use Tails as their "daily driver"? Would that make it more anonymous/private for the people like whistle blowers? My only idea at the moment would be to pay for two separate trusted VPN provider (don't know how you would vet that trustworthiness) with bitcoin, to keep your anonymity/privacy with them as well. Then pipe all your traffic through one of the VPNs all the time. Then when you need to use Tor, you would simply pipe it through that same VPN when you would emerge with rest of the clients from same point and then pipe your Tor traffic through the secondary VPN. This way you would still get the benefits of encrypted tunnels all the way through with benefit of Tors anonymizing and it might not be so obvious you are browsing Tor to your ISP or whatever.
Maybe I'm thinking this is harder than it actually is
If you're this level of paranoid any email account used more than a handful of times has to be burned and never touched. You definitely should not ever access a cell network with a smartphone, which has to be burned as well every week or so. Social media use is also dead. If you don't use social media because of security concerns, that's fine, but 2.5 billion people do, so you're probably in the minority.
If you're going to whistle blow there are a bunch of other steps you should implement, running TOR being one of them, Tails if you're that high up of a risk (hint: you're probably not). If you're at that level 1.) you should be doing everything from various public wifi networks in cities nowhere near you and 2.) the fact that you downloaded TOR is not what anyone's interested in anyways, it's what you're saying and doing behind it.
Everyone keeps saying that you should "take a greyhound out to the boon to use their wifi to be anonymous", it's pretty suspect if suddenly you take a trip to somewhere you've never been to with no obvious motive and suddenly bunch of data related to you/your employer gets leaked.
About no one caring you download Tor, if it still gets hovered up in some NSA-database-type-thing you can be exposed years after the fact. Just like no one cares (right now) what kind of porn you watch, but maybe in future some suppressive regime gets to power and they don't like how you spend your past time.
Should be pretty bulletproof against all but the most capable adversaries.
ISP's or network providers know if you're running Tor, when you're online and when you're active (it has been used in criminal cases to link real people to online aliases)
Someone else in this thread pointed out that the download points for Tails are all HTTP - so you can't find it and download it anonymously.
The way to do it would be to find an HTTPS mirror (avoiding search engines) or a public terminal.
IMO you shouldn't use Tails as your personal machine. This isn't a technical decision more a question of OPSEC policy. The key to anonymity is compartmentalization - the concept of creating, maintaining and then isolating your different identities.
Your real identity will continue to use your computer, your phone number, your internet connection, etc. It might tighten up some privacy leaks. Your anonymous identity (which may have a name) will use Tor in a virtual machine as a gateway and Linux in another virtual machine as a client, or it will boot into Tails. The anonymous identity using Tor has nothing in common with the real identity that can be linked together by a passive or active attacker.
For ex. your anon identity is doing anonymous stuff on anonymous online markets, but then you use the same Tails session to login to your personal Gmail. You've just been de-anonymized. Don't share anything between the two identities (having the same interests, typing style, etc. to name a few) as that would tie an anonymous identity to a real one.
With this in mind, Tails is perfect for the use case of 'I need to do some anonymous stuff with my anonymous identity and then get back' which is exactly how a lot of journalists, black hats, etc. use it. The more 'comfortable' Tails is with features and programs the more likely you are to hang around and do something that will de-anonymize you :)
BTW, if you download a file of 1.1 GB from boum.org then the size of the download already pretty much gives away that you are downloading tails.. So https does not give you anonymous downloads, it gives you an increased certainty of origin. But as you should verify the signature instead (which is served over https)[2] I think it is fine to download via http.
[1] https://tails.boum.org/install/mac/dvd/index.en.html?overrid...
- the devs don't seem to be bothered by increasing their attack surface with systemd
- systemd makes life easier when building a distribution, so the tails-devs like it (not only because they are lacking manpower)
- sure you got to be a bit paranoid when working on this kind of project, but tails doesn't seem to be a very welcoming environment for contributors
follow tails irc / the mailinglist for a while to get your own picture and have a look at Whonix/Qubes for more security focused alternatives
Can you elaborate on this? I found that it mattered more what live-cd system an upstream distro used (e.g. dracut vs Debian's older tools)
Init, session tracking, DNS client, DHCP client, etc etc etc.
Not to go off on a rant, but this is what the "everyone must use https because we said so" edict is going to cause - it's not enough you use https, it has to be the right kind of https that involves a third party issuer of certs.
Can anyone fix that issue or link to a different page please?
Edit: Clock is automatically set via OSX. Not a problem with other sites.
Firefox says
tails.boum.org uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. (Error code: sec_error_unknown_issuer)
Sooooo..... I need a root certificate of some sort then? See, this is what we get to contend with - I can't read this site because reasons. And it's up to me to find out what the reasons are I guess. Wait till this hits the masses when certs get revoked, expire, etc. :)
If that is the case then your browser is exhibiting correct behavior.
For me, I can see that the root CA is USERTrust (SHA-384 sig, interestingly), and the server is presenting a valid intermediate (Gandi - also using a SHA-384 signature), then the site certificate (SHA-256 sig).
There is a secondary certification path though, coming from a old SHA1 AddTrust Root (but this is also in my trust store for Firefox).
Are there tools I can use to work my way through this?
OpenSSL is a good starting point:
openssl s_client -connect tails.boum.org:443
SHA-256 Fingerprint for tails.boum.org should be:
F8:DC:67:21:96:77:46:F5:9D:77:BD:7B:87:C1:39:42:C8:4E:4B:25:97:34:AC:E2:80:24:99:35:D9:81:9C:B6
If that doesn't match the value you see in the Firefox or Chrome certificate details page, please, send as many details about the chain as you can back, I'm very interested to see what's happening here considering you're not on a corp network and seeing this and even moreso because this is the Tails site, something that might very much interest some attackers...
But the problems seem to have gone away.
Me too, but I know why: my employer's proxy MITMs any SSL connections whose certificate authority it does not recognize as bona fide. Quite aggravating - but a very nice tool to explain SSL MITM to users... There's always a silver lining !
That's a very strange criteria; do you mean that anything that would have been a certificate error gets MITMed instead, rather than rejected? Very strange.
Further, real world MITMs are ad injection at the device (Lenovo Superfish) or ISP level, so they are persistent.
EDIT: As I send this, the app I'm using (Materialistic) isn't able to access the HN API when I'm using Orbot with transparent proxying. That's really annoying.
TAILS solves the problem of your individual privacy, but if you care about privacy in general you need to engage politically. Increasing TAILS use without increasing letters to congress increases the odds of anti-privacy legislation.