Tails 3.0 Released
tails.boum.org
tails.boum.org
* Tails 3.0 works on 64-bit computers only and not on 32-bit computers anymore. Dropping hardware support, even for a small portion of our user base, is always a hard decision to make but being 64-bit only has important security and reliability benefits. For example, to protect against some types of security exploits, support for the NX bit is compulsory and most binaries are hardened with PIE which allows ASLR.
* Update Tor Browser to 7.0 (based on Firefox 52 ESR) which is multiprocess and paves the way to content sandboxing. This should make it harder to exploit security vulnerabilities in the browser.
What do you guys think about dropping 32-bit?
EDIT to add: Always remember with solutions like this that the adversary isn't always the NSA and so on. The Tor users' page lists all kinds of people who need help against foes with limited budgets or knowledge who might not be able to break Linux or Tor.
Intel didn't release a mobile 64bit CPU until 2006/7 with Core 2 Duo.
Also the initial implementations of Intel64/EMT64 lack certain functions so even tho they technically support 64bit they might lack certain other features that are required by modern operating systems.
So overall if you have a 10 year old laptop you might not be able to use Tails 3.0.
I guess privacy is only for the rich.
I guess you could use an older version of Tails but I imagine this would become less and less secure as more and more vulnerabilities are found.
About time.
If they don't have any usage data, I think, they should provide old version and support it with critical security updates. If they have usage data, it depends, I guess.
If you're someone buying burner laptops these machines, which are very cheap, are now probably not a good idea.
I remember upgrading from 32-bit to 64-bit in-place a few times, which is a bit fiddly but not impossible with Debian. I wrote up a couple of guides once upon a time, but right now I can just find this old wiki-page discussing the process:
> Update Tor Browser to 7.0 (based on Firefox 52 ESR) which is multiprocess and paves the way to content sandboxing. This should make it harder to exploit security vulnerabilities in the browser.
Firefox 52 ESR sounds like mainline Firefox to me.
This is absolutely false. Especially if you're considering the alpha versions which include Selfrando.
See "Real-world Exploits against the Tor Browser" pages 9-10 where they conclude,
> The reason is that these function pointers are only accessed through an indirection layer, i.e., memory objects on the heap contain a pointer to a virtual table which is located in the code or data section of the application and contains a number of pointers to virtual functions. Since the attackers can only disclose the virtual table pointer, but not the virtual table itself, as it is not on the heap, they cannot disclose gadget addresses. Note that, when only ASLR is applied, the address of the virtual table is randomized with the same offset as the ROP gadgets. Therefore, such an attack can bypass ASLR but not selfrando.
> We therefore conclude that selfrando can thwart most real-world exploits. Attackers can only succeed in rare cases where they can disclose the complete heap and data section.
[1] : https://people.torproject.org/~gk/misc/Selfrando-Tor-Browser...
If 'Animats comments on tcp/ip you should trust it more than if I do.
If 'tptacek comments on app security it's sort of the same (though I don't know he has anything named after him).
Reputation matters if you want to buy something or if you want an expert opinion on a topic that you have no idea about. However I don't believe that reputation matters in a forum full of people who would be able to understand (and wish for) a reasoning behind a claim.
If you don't use the Tor Browser you're exposing yourself to all the fingerprinting attacks that the Tor Browser tries to protect from: https://www.torproject.org/projects/torbrowser/design/
Not only that, without the Tor Browser you wont have stream isolation, so all of your website browsing can be watched by a single exit node (whereas with the Tor Browser each site has its own circuit) which makes correlation attacks much damaging (whole browsing history in a session vs 1 site).
TorBundle devs have stripped out a tonne of things which increase attack surfaces and the fingerprintability of mainline Firefox. Best just blending in and looking like everyone else and use TorBundle.
[0]: https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-sta...
Not only that, using the particular setup you're describing, you wont have stream isolation, so all of your website browsing can be watched by a single exit node (whereas with the Tor Browser each site has its own circuit) which makes correlation attacks much damaging (whole browsing history in a session vs 1 site).
any other reason?
- Various people who are very interesting to intelligence agencies, police, organized crime syndicates, and private security for major corporations use Tor Browser, increasing the demand for and thus price of black market exploits specifically targeted at it.
- Tor Browser incorporates patches and default settings that receive less testing and review than the code and defaults of vanilla Firefox, making it more likely that vulnerabilities exist.
- Architecturally, Firefox lacks robust exploit mitigations, making it more likely that such vulnerabilities are actually exploitable.
- There's a delay between security fixes in vanilla Firefox and their release in a Tor Browser update.
- Exit nodes and root CA certificates may both be controlled by attackers, potentially giving them the ability to deploy exploits even to targets that only use HTTPS to trusted sites.
Adding all of the above together, it is not only plausible but likely that effective exploits specifically for Tor Browser currently exist in some attackers' toolkits.
If you're using Tails you'd probably be much better off using Whonix instead.
With Tails, an attacker capable of breaking your browser will m̶o̶s̶t̶ ̶l̶i̶k̶e̶l̶y̶ definitely also be capable of easily grabbing your IP address.
Why not just use Firefox?
Whonix runs TOR in a separate VM from your browser/user space. The idea is that even if you get hacked they don't get your IP address since they can only access the internet through the gateway VM that pushes all traffic through TOR.
Ideally you'd make sure the one responsible for going through tor isn't Firefox, too; IE at the very least a wrapper such as tsocks when running it or even better, a VM containing the browser and the entire VM connecting only through tor.
This is bad and dangerous advice that can potentially put people in trouble. As I said elsewhere in this thread: If you don't use the Tor Browser you're exposing yourself to all the fingerprinting attacks that the Tor Browser tries to protect from: https://www.torproject.org/projects/torbrowser/design/
Not only that, using the particular setup you're describing, you wont have stream isolation, so all of your website browsing can be watched by a single exit node (whereas with the Tor Browser each site has its own circuit) which makes correlation attacks much damaging (whole browsing history in a session vs 1 site).
And if you do use Tor Browser you're exposing yourself to an old insecure browser. This situation has dramatically improved recently, but it's still far from optimal.
I think for most people fingerprinting is the far lesser threat, especially when discussing an install that'll presumably always remain behind Tor.
>Not only that, using the particular setup you're describing, you wont have stream isolation, so all of your website browsing can be watched by a single exit node (whereas with the Tor Browser each site has its own circuit) which makes correlation attacks much damaging (whole browsing history in a session vs 1 site).
Both Firefox and Chrome should grab KDEs proxy settings and therefore automatically benefit from stream isolation on Whonix, no?
1) The Tor Browser is based on the Firefox 52 ESR, sure, it's not the most secure browser in the market, but it's far from being "old and insecure".
2) If you're considering the alpha Linux 64 version, it includes Selfrando, which should provide more protection than a vanilla Firefox. See "Real-world Exploits against the Tor Browser" pages 9-10 where they conclude [1],
> The reason is that these function pointers are only accessed through an indirection layer, i.e., memory objects on the heap contain a pointer to a virtual table which is located in the code or data section of the application and contains a number of pointers to virtual functions. Since the attackers can only disclose the virtual table pointer, but not the virtual table itself, as it is not on the heap, they cannot disclose gadget addresses. Note that, when only ASLR is applied, the address of the virtual table is randomized with the same offset as the ROP gadgets. Therefore, such an attack can bypass ASLR but not selfrando.
> We therefore conclude that selfrando can thwart most real-world exploits. Attackers can only succeed in rare cases where they can disclose the complete heap and data section.
It's only for Linux for now, but that may change in the future.
3) Would you consider the Tor Browser with the security slider set to High or even just Medium to be "insecure"?
4) You still provided no alternatives.
> I think for most people fingerprinting is the far lesser threat, especially when discussing an install that'll presumably always remain behind Tor.
Sorry, shoving up all your traffic through Tor while not caring about your browser's fingerprint is useless, 29 bits of identifying information just from screen resolution output alone. It's just too easy...
And it's not just about fingerprinting, I'm afraid, see the other problems mentioned in the Tor Browser Design document.[2]
> Both Firefox and Chrome should grab KDEs proxy settings and therefore automatically benefit from stream isolation on Whonix, no?
No, unfortunately, these two different browsers will use two different catch-all circuits, but you wont get _first party_ stream isolation on them, _which was my whole point_. In other words, your Chromium (I assume that Chrome in your comment was just a typo) will use a single circuit for all of your websites, whereas with the Tor Browser each website will get its own circuit. That means that it's much much easier for an adversary who controls a portion of Tor relays to de-anonymize ALL your traffic with Chromium, when he can de-anonymize only a single website with the Tor Browser.
Also since you mentioned Whonix, note that they actually recommend using the Tor Browser without Tor for clearnet browsing instead of other browsers since it's (quoting their lead dev) "better hardened than regular Firefox".[3]
[1] : https://people.torproject.org/~gk/misc/Selfrando-Tor-Browser... [2] : https://www.torproject.org/projects/torbrowser/design/ [3] : https://lists.torproject.org/pipermail/tbb-dev/2017-April/00...
nothing new really has been there since the beginning which is why tails doesn't even come close to whonix/qubesos which make this inherent insecurity a lot harder to exploit
No, you run `uname -m` and then download the appropriate version of Tails (although it appears Tails 3.0 is only available on 64-bit now).
If "uname -m" says "i686" it means that your kernels is 32-bit (or pretends¹ to be so). It doesn't necessarily mean that your hardware is not capable of running a 64-bit kernel.
So unless I'm missing something, the above procedure does not work correctly. Instead, you should run something like this:
$ lscpu | grep -w mode
CPU op-mode(s): 32-bit, 64-bit
Translated automatically.