Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tails is a portable OS that protects against surveillance and censorship

tails.net

Post reply on HN
Print view View original

171–180 of 192 posts

Re: Tails is a portable OS that protects against surveillance and censorship

#171

Post by palata »

coppsilgold wrote: post #153
bsdnoob wrote: post #55

Earlier quoted context omitted.

By any chance can you share how you do this practically?

I also use alpine as the main/root environment. But I rarely use any applications from alpine. For that I have Arch, Fedora and Debian rootfs dirs into which I pivot_root with the help of bubblewrap (bwrap) in shell scripts. There is no overhead and the GPU can be easily attached. You can also dynamically attach ro/rw CWD and target paths (`for arg in "$@"`). Everything that I care about just works and I get a separa…

> For kernel safety applications must be denied direct access to the host kernel, this is usually achieved with virtual machines.

And that is what QubesOS does, if I understand correctly?

Re: Tails is a portable OS that protects against surveillance and censorship

#172

Post by palata »

great_psy wrote: post #142

How does Tails(or Qubes, or etc) provide security in a real use case full time OS system? Say I log into Facebook, obviously I expect my identity to be exposed to Facebook, but do any of those OS have the ability to keep me private after I logged into some website ?

There are different things, for instance:

- QubesOS provides security by isolating components. So if your browser VM is compromised, your password manager VM is not. That does not make you anonymous at all.

- I don't know Tails, but I think that it is just not persistent. Which means that when you reboot, you know that there are no traces of your previous session (as opposed to a "normal" system that would keep cookies, for instance). Which may help you not being tracked. That does not necessarily make you anonymous: you may leak your IP. I would guess that another thing is that if you get some malware in your Tails session and reboot, then the malware is supposedly gone (could it infect the hardware, e.g. a USB webcam? Not sure).

There is no "one" security, it depends a lot on what you need (i.e. your thread model), and many tools provide many different features.

Re: Tails is a portable OS that protects against surveillance and censorship

#173

Post by [deleted] »

palata wrote: post #171
coppsilgold wrote: post #153

Earlier quoted context omitted.

I also use alpine as the main/root environment. But I rarely use any applications from alpine. For that I have Arch, Fedora and Debian rootfs dirs into which I pivot_root with the help of bubblewrap (bwrap) in shell scripts. There is no overhead and the GPU can be easily attached. You can also dynamically attach ro/rw CWD and target paths (`for arg in "$@"`). Everything that I care about just works and I get a separa…

> For kernel safety applications must be denied direct access to the host kernel, this is usually achieved with virtual machines. And that is what QubesOS does, if I understand correctly?

[deleted]

Re: Tails is a portable OS that protects against surveillance and censorship

#174

Post by qingcharles »

nostril wrote: post #123

Hi. We're building The Nose ( https://thenose.cc ), a safe haven for training data that can't be taken down with DMCA. Since this involves copyright infringement, strong anonymity is a requirement. I wrote up our security procedures here: https://news.ycombinator.com/item?id=37346620 The reason Tails isn't an option is because, as others have mentioned, there have been Tor browser exploits which reveal the IP address…

Are you currently hosted on Shinjiru now? I'm thinking about using them as a reverse proxy in front of a site that might suffer false DMCA attacks. I don't want my web host to ban me just because they can't deal with the hassle, so I'm thinking about proxying all the requests.

What does Shinjiru do if they receive a DMCA notice?

When I ran a huge private torrent tracker I paid a decent chunk to get a host that ignored every single request of any type that they received.

Re: Tails is a portable OS that protects against surveillance and censorship

#175

Post by Synaesthesia »

paravirtualized wrote: post #129
Synaesthesia wrote: post #14

Earlier quoted context omitted.

I know the TOR project was started by the US navy, and that now I2Pnis the preferred method of browsing the darknet, because many people believe it has been compromised.

> and that now I2Pnis the preferred method of browsing the darknet This is not true by any means. A "switch" to I2P never happened, and just a few months ago an exploit[1] that could deanonymize eepsites was published. Tor is still the only "method of browsing the darknet"; by most definitions. [1]: https://xeiaso.net/blog/CVE-2023-36325

Ok, I haven’t tried it out in a while so thx

Re: Tails is a portable OS that protects against surveillance and censorship

#176

Post by PrimeMcFly »

EVa5I7bHFq9mnYK wrote: post #147
woodruffw wrote: post #139

Could any HN users speak about their experience and rationale for using Tails? My outsiders’ perspective is that the threat model for these kinds of surveillance resistant tools is somewhat perverse: they trade indistinguishability (being lost in the crowd) for a nominally more anonymous but extremely unusual datapoint (a host/browser/etc. that basically looks like no other normal machine.) Put another way: without a…

You put the stick in, access forbidden web site (for example, Instagram). Take the stick out, police searches your computer, there are no traces. If you were using a regular OS, even through Tor, there are some incriminating traces left, in browser cache, in MFT, in pagefile etc. that can be recovered.

Much the same result can be achieved by using a portable browser stored on an encrypted volume run inside a sandbox. For example on Windows, you can use portable Librewolf stored on a veracrypt volume running iside a portable sandboxie-plus sandbox (also stored on the encrypted volume).

Re: Tails is a portable OS that protects against surveillance and censorship

#177

Post by EVa5I7bHFq9mnYK »

PrimeMcFly wrote: post #176
EVa5I7bHFq9mnYK wrote: post #147

Earlier quoted context omitted.

You put the stick in, access forbidden web site (for example, Instagram). Take the stick out, police searches your computer, there are no traces. If you were using a regular OS, even through Tor, there are some incriminating traces left, in browser cache, in MFT, in pagefile etc. that can be recovered.

Much the same result can be achieved by using a portable browser stored on an encrypted volume run inside a sandbox. For example on Windows, you can use portable Librewolf stored on a veracrypt volume running iside a portable sandboxie-plus sandbox (also stored on the encrypted volume).

Tails is stronger than this approach in respect of the following threats: the $5 wrench for the veracrypt, keylogger installed on the host OS, memory scanners, the pagefile

Re: Tails is a portable OS that protects against surveillance and censorship

#178

Post by EVa5I7bHFq9mnYK »

replwoacause wrote: post #167
EVa5I7bHFq9mnYK wrote: post #147

Earlier quoted context omitted.

You put the stick in, access forbidden web site (for example, Instagram). Take the stick out, police searches your computer, there are no traces. If you were using a regular OS, even through Tor, there are some incriminating traces left, in browser cache, in MFT, in pagefile etc. that can be recovered.

Huh? This sounds like fear mongering…

the instagram part?

https://www.insider.com/russian-influencer-veronika-loginova...

Re: Tails is a portable OS that protects against surveillance and censorship

#179

Post by PrimeMcFly »

EVa5I7bHFq9mnYK wrote: post #177
PrimeMcFly wrote: post #176

Earlier quoted context omitted.

Much the same result can be achieved by using a portable browser stored on an encrypted volume run inside a sandbox. For example on Windows, you can use portable Librewolf stored on a veracrypt volume running iside a portable sandboxie-plus sandbox (also stored on the encrypted volume).

Tails is stronger than this approach in respect of the following threats: the $5 wrench for the veracrypt, keylogger installed on the host OS, memory scanners, the pagefile

Oh, absolutely, but the approach I mentioned is a little more convenient in some instances and provides a good balance IMO.

Re: Tails is a portable OS that protects against surveillance and censorship

#180

Post by paravirtualized »

trw55 wrote: post #161
paravirtualized wrote: post #105

Tails has a very specific use case, very few people need anti-forensics. I suggest looking into Whonix[1] if you want something that you can truly use for privacy. It is also much more secure than Tails by design, and does not have any limitations like locking down the root user account. Summary from GitHub: "Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity net…

What isn't secure about Tails? Its been recommended by so many InfoSec podcasts that I've been poking around in it on a USB stick

Tails uses a less secure model because it relies on the system firewall to block any non-Tor connections. This means that any user to root vulnerability will leave you naked, deanonymized. Additionally, protocol leaks, or unintentional leaks are more likely to happen. Both of which have happened in the past and are not mere speculation.

I've commented in this thread that at one point, such a vulnerability was left unpatched in Tails for years despite being documented and a PoC existing.

Whonix on the other uses two VMs, one of which runs Tor and the other applications, and connects via an internal network. This means that non-Tor connections are impossible, as the VM where you run software is completely unaware of the real, external IP.

This raises the level of exploit needed substantially, from user to root, to remote kernel exploits or hypervisor escapes.

Post reply on HN