4

In the Tails documentation there is something I find strange. They say that creating a live USB stick that will contain the Tails OS must be done in a two step process. This is true of most platforms - generic GNU/Linux, Mac, and Windows. All of which state something similar to the following.

As it is currently impossible to install Tails directly from Linux, this scenario requires creating an intermediary Tails on a second USB stick. This intermediary Tails lacks important security and usability features.

However, this is not the case for Debian based GNU/Linux systems which instead provide the tails-installer-launcher program that can do it in one shot.

The install documentation states the following.

On this intermediary Tails you won't benefit from important features like automatic security upgrades or the possibility to store some of your documents and configuration in an encrypted storage.

They mention that persistent storage is one of the features that is disabled on the first USB. Also, I don't plan on using networking or persistent storage. The first USB seems to work perfectly for my use case - key generation. It has a terminal and supports mounting other flash drives! This leads me to the following three questions.

  • On a non Debian based system, what are the technical reasons that this two stage process is required?
  • What other features are missing from the first USB?
  • Is there any reason not to use the first live USB stick in my use case?
6

The primary benefit of the two USB drives setup is that it provides a secure environment (the first Tails USB instance) to generate the encryption key for persistent storage: a non-Tails OS could unintentionally leak the encryption key, thus causing the persistent storage encryption to be comprised.

If you don't require encrypted persistent storage, then the first Tails USB drive should be acceptable as-is.

The tails-installer-launcher application available on several Linux distributions such as Debian does not require a second USB because it creates two partitions on the single USB drive: the first partition is used to house the Tails OS, while the second partition is used to house the persistent storage. The installer application only installs the Tails OS to the first partition, so the encrypted persistent storage is still only setup through the secure environment of Tails after you boot into it.

Theoretically, you do not require two USB drives to install the Tails OS with encrypted persistent storage -- even without the tails-installer-launcher application. You can perform the operation of the installer manually by simply partitioning your single USB drive into 2 partitions, installing Tails OS to the first partition, then later setting up the encrypted persistent storage from within Tails OS to the second partition.

See also

Can I Use Tails in One Stick of USB? ( 8Gb) instead of 2 (4Gb) Stick

0

You even state this in your question

On this intermediary Tails you won't benefit from important features like automatic security upgrades or the possibility to store some of your documents and configuration in an encrypted storage.

Those are generally considered essential. Do not use the intermediate one other than to install the second one.

In order to properly create the disk encryption drivers, that first install is needed - Linux or Windows don't have the capability (although Debian does)

  • what if you're not using persistent storage at all? – jj_ Jan 17 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.