0

It's said that tails is the most secure OS ever, but has anyone tested it? i.e How is it known that tails does not do operations such as:

  • sniffing on your own network and sending your data to a 3rd party
  • sending your machine hardware information to a third party and so on

How is it proven that it's actually safe and not made by a bunch of hackers.

1
  • 3
    Things like sending data is easily determined with packet sniffers. Considering that many, many people who would use TAILS also would run sniffers as an added layer of protection, it can be easy to say that TAILS does not do these things.
    – schroeder
    Oct 27 '15 at 3:13
4

The Amnesiac Incognito Live System, or TAILS, is a project of the Tor Project.

One can attempt to verify whether or not such an OS is benign on their own in a lab environment. Of course, there is the possibility of third-party verification by combing signatures, looking for anomalous code, watching network traffic and otherwise looking to see what the OS does on test/lab machines to see if it is working as indicated.

As Bruce Schneier has astutely elucidated, security issues come down to a matter of trust. In this case the question is, do you trust the Tor project and the TAILS developers?

How do you know if you can trust Tor?

Start with the people: https://www.torproject.org/about/corepeople.html.en You can see one of their lead developers is Jacob Appelbaum, of NSA surveillance outing/WikiLeaks fame, among others of note.

Then look at the track record of the organization.

From there you may be able to come to your own conclusions about the Tor organization and whether or not you'd trust them. My personal opinion is, yes, for now I do trust them and they have strong and good ethics.

Also remember to verify signatures when downloading ISOs to ensure integrity in transit.

2
  • also going to ask you, as far as you know, does TIAL do any of the above bullets (packet sniffing and Hardware info sharing) Oct 27 '15 at 2:59
  • No, AFAIK it does not and would, by design, never do such a thing. All TAILS TCP/IP connections are done over Tor by default as well, making tracking them (unless they contain clearly identifying information) quite difficult. Oct 27 '15 at 3:02
3

TAILS is open source and can be audited freely, and then built from source. It's main attraction is not security (it is based on standard Debian), but rather preserving the anonymity and privacy of the user.

There are several ways that such a software package can be audited.

One is to channel all traffic through a proxy, such as another LAN computer, to analyze traffic. This can also be done in a virtual machine.

Another is to check the source code itself. Since TAILS is open source you can access the source code, and check for unusual code.

Neither method is foolproof, however, they are good enough for most people, and going further would require you audit your compiler.

4
  • so then as far as you know, does TIAL do any of the above bullets (packet sniffing and Hardware info sharing) Oct 27 '15 at 2:49
  • @cordlessphone AFAIK, no, but don't take my word for it. If you're worried, you should check.
    – timuzhti
    Oct 27 '15 at 2:50
  • You wrote: TAILS is open source and can be audited freely and then confirmed that this method is good enough for most people: I must disagree as this is far from being practical. I must say it is even impossible to ask a user to audit the source code of an operating system as a single user can not have the necessary knowledge understand how each aspect of an OS is functioning. Tails current ISO image is almost 1 GB of source code: so how do you dare to ask the OP to audit it?
    – user45139
    Nov 2 '15 at 15:04
  • @UserName So? Write a program that cuts out anything except IO functions. Use regexes. Team up with some other people. There are ways to make it practical. It's only the really paranoid people that need to audit the source code. The other people should be fine with the network methods, but they aren't foolproof. If the OP needs that security, he needs to audit the source code, and preferably the complier and hardware as well. Sure, there's probably no one paranoid enough to do that, but it is the most secure option.
    – timuzhti
    Nov 2 '15 at 23:47
1

If your machine is compromised for example, let's say your BIOS is infected, or an attacker with physical access to your machine installed a a nefarious software then yes, such information may be leaked.

But in practice, as for the precise information you wanted to know through the two bullets you highlighted, I have not heard of that before and I may say no -but not sure- AFAIK regarding how the whole system is functioning especially that Tails benefits from continuous audits and you can run this OS directly from a USB stick.

Apart from vulnerabilities that compromise user's anonymity such as disclosing the user's real IP addresses as it was the case with this vulnerability with Tails 1.1 version, there are two information you may need to know and that may answer partly the questions you raised (Does Tails collect information about its users?):

When Tails starts, two HTTPS requests are made automatically to our website through Tor:

  • A security check is performed to know if security issues have been announced for this version of Tails. The language of the working session is passed along with this request to display the notification in the preferred language of the user.
  • Tails Upgrader checks for newer versions. The version of the running Tails is passed along with this request.

We believe it is important to notify the user of known security issues and newer versions. We calculate statistics based on the security check to know how many times Tails has been started and connected to Tor. Those statistics are published in our monthly reports.

While Tails is recommended by Edward Snowden for anonymity and privacy concerns, it is not a foolproof system. You can find here a complete list of reported Tails security vulnerabilities.

While Tails is may be the best OS for privacy/anonymity concerns, and you can trust it more than other operating systems for this purpose, I would love to quote you this from Silver Bullets and Fairy Tails:

We publicized the fact that we’ve discovered these issues for a very simple reason: no user should put full trust into any particular security solution. By bringing to light the fact that we have found verifiable flaws in such a widely trusted piece of code, we hope to remind the Tails userbase that no software is infallible. Even when the issues we’ve found are fixed by the Tails team, the community should keep in mind that there are most certainly other flaws still present and likely known to others.

And remember that not all Tails security vulnerabilities are reported as there are those who find them but do not disclose them and prefer to make business with them; Exodus (from where I quoted the text above) itself sells 0-day vulnerabilities.

Note that a Black Hat security conference canceled the talk You Don’t Have to be the NSA to Break Tor: De-anonymizing Users on a Budget where the presenters intended to explain how, with a budget of $3000, hundreds of thousands of Tor users could be de-anonymized.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.