Hacker News Reader

Comment by nxzero | Hacker News Reader

Always been puzzled as to why the ISO release is provided by HTTP and not HTTPS; possible it doesn't make a difference, but if so, it's not clear why.

View on HN

You can also DL the ISO via bittorrent, which has some additional consistency checks.

https://tails.boum.org/torrents/files/tails-i386-2.0.torrent

Right, though my understanding is Tails' and TOR's position are not to torrent using either system: https://labs.riseup.net/code/issues/5991

^^ given that, it is to me just as puzzling that they provide a torrent as it is for failing to use HTTPS by default for file transfers.

Https only guarantees the origin and protects against MITM, they provide a GPG signing key and sign their isos so it does all that + guarantees that even if their websote gets compromised attackers wouldn't be able to distribute software unless they obtained the private key.

But if the file and site are both accessed over HTTP, it's possible for a bad actor to alter the file and then change the signatures+checksums listed on the page to reflect it.

That can happen regardless of HTTP/HTTPS, say if the site was hacked they could be serving a bad key/signature, which is why you should always obtain the public GPG key (in any scenario, really) via a trusted channel, or multiple ones.

So for instance in this case you could grab the gpg key, go into their IRC channel and ask for it again, etc.

I do agree HTTP makes it easier to MITM, but in theory if you are serious about security you should not be relying on HTTPS alone.

The fact is however, HTTPS offers massive improvements for security for the majority of users, especially those using public or shared Wi-Fi (i.e. Work or School), assuming they're using their own device. Assuming HSTS was set up, it would be impossible to strip SSL without causing most browsers to panic and refuse you access to the website.

On those types of networks, MITM attacks are extremely easy, and there are tools to do it in seconds. It may be more likely for you to get MITM'd and have them modify the signature, than for the actual website to get hacked. Combined with the fact that some people would try to download Tails across these types of network for the added anonymity.

You're right. At the moment it's difficult to download Tails anonymously, especially with everything we know about XKeyscore targetting.

It's a problem that others can help fix by setting up mirrors on HTTPS. Ditto with hosting the website on a Tor hidden service.

The main ISO link is able to be used via HTTPS (by adding an "s" to the URL) but it's got some compliance issue. HTTPS would likely not provide anonymity, since it leaks to much metadata; might be wrong, just my opinion.

If you use a distinct server for Tails then you could still spot the downloads, you'd need HTTPS and serving from a busy mirror that serves a lot of other apps and systems as well

You can also install tails in Debian using

apt-get install tails-installer

Reply on news.ycombinator.com