1

One of tor's stated goals is to help individuals such as journalists, activists and whistleblowers protect against surveillance, and in many countries people in those lines of work or activities are usually subject to surveillance, especially targeted surveillance.

Given a scenario in which a journalist working in an environment where he is subject to active targeted surveillance, how would he safely download tor? Assume that the journalist in question is using a new computer with a freshly installed Linux distribution. In what ways could an adversary with man-in-the-middle capabilities affect or compromise the download?

Does using https to download TAILS or the distribution package manager to download tor provide enough security to protect from malicious third-parties? How can someone in this scenario safely download tor or TAILS?

Improve this question
5
  • I wold not say TLS is enough for downloading a software anonymously. Just think about DNS Requests for a specific site that contain your requested Page. In my opinion you need to connect to a VPN Server outside your country and download it over this tunnel
    – Cyberduck
    Commented Sep 10, 2020 at 6:08
  • Please define "safely download". If it is only about preventing some man in the middle from tampering with the download than HTTPS is enough. If it is about hiding potentially suspicious activity than even a VPN or a later use of Tails will not work since it can be at least detected that VPN or Tails get used - which might be suspicious enough.
    – Steffen Ullrich
    Commented Sep 10, 2020 at 6:27
  • The question concerns downloading tor safe from tampering or compromise. I assume that once it is downloaded, that would take care of the anonymity problem.
    – readyfireaim
    Commented Sep 10, 2020 at 6:34
  • If you download Tor over the Website with a TLS connection normally no one is possible to change any conntent without noticing it. Even by MITM you would not get any valueable information
    – Cyberduck
    Commented Sep 10, 2020 at 6:38
  • When downloading Tails from the Tails web site (tails.boum.org), users are redirected to one of Tails' mirror sites, where the user can then download the Tails ISO file through an HTTPS connection to the mirror site. The certificate will likely be legitimate, and the HTTPS connection may not be tampered with, but yet the user is downloading the ISO from a possibly untrusted site. That's why it's important to verify the signature on the ISO file, using Tails' public signing key.
    – mti2935
    Commented Sep 10, 2020 at 22:18

1 Answer 1

Reset to default
1

If the problem is that severe, you don't download directly. You call up a trusted 3rd party (a friend who would not be under scrutiny) to create a LiveCD and then have them mail it to you.

A sufficiently equipped government can successfully use a root certificate in your machine and substitute the download.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .