I'm wondering if Tails takes countermeasures to prevent the techniques that http://panopticlick.eff.org/ uses from identifying Tails users as such.

(Presumably adversaries could identify users that visit sites or search for info about, or download such OSes, so that this isn't the only concern.)

  • Partial answer on wikipedia: "On 3 July 2014, German public television channel Das Erste reported that the NSA's XKeyscore surveillance system contains definitions that match persons who search for Tails using a search engine or visit the Tails website". Whether Tails has been modified to address this isn't discussed. – Matthew Elvey Mar 27 '16 at 4:48

The answer from this thread may help answer your question.


There is two different levels on which you can be identified as a Tor or Tails user.

The website server you visit knows if you are using Tor or Tails

Tails users can be identified as such by its browser fingerprint. For example, Tails comes with AdBlock Plus, and Tor Browser Bundle (TBB) doesn't. The configuration in the browser also differs somewhat in other regards.

Since most TBB users download ads, but most Tails users doesn't, that allows to guess whether you are a TBB user or Tails users. The exact list of ads Tails blocks is also fixed for a certain Tails release, so a TBB user that have installed AdBlock Plus will probably not have the same list, which makes the guessing even easier.

Tails does try to keep its fingerprint as close as possible to the Tor Browsers however, which of course makes it somewhat hard to fingerprint. It will probably keep improving further in the future, for example: Tails have discusses whether or not to remove AdBlock Plus in a future Tails release.

See section "3.11 Fingerprint" in Tails design document.

https://tails.boum.org/contribute/design/#index4h1 Your ISP or network admin knows if you are using Tor or Tails

Tails does only send Tor traffic, whereas another operating system with TBB on will also sends non-Tor traffic (e.g. syncing clocks, checking for system updates, etc). If your computer only sends Tor traffic, it is probably Tails

| improve this answer | |
  • Thanks! The summary answer is the last sentence: "If your computer only sends Tor traffic, it is probably Tails." I guess a future Tails enhancement would be for it to act more like a normal OS with countermeasures causing it to generate more normal traffic even if it doesn't do anytying with the data - somewhat like some ad-blockers, which DO request ads but don't display them as a countermeasure to avoid detection. – Matthew Elvey Apr 22 '16 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.