7

I've been reading Whonix's documentation and threads here to be more anonymous and secure.

For the best anonymity Whonix recommends having two different computers, one being the gateway and the other being the workstation. On the workstation, for the best anonymity and security, would it be wise to run Tails as a LiveCD or USB, along with the Whonix setup? I was unsure whether I should run Tails in a VM under Whonix workstation, run Tails as a LiveCD and the Whonix workstation as a VM, or just run Tails/the Whonix workstation. I assume that would provide the benefits of both operating systems? I'm not sure. (I've also had thoughts about running QubesOS and/or corridor as well, but then I had the thought that multiple types of OS's might increase my attack area). I have my gateway planned and almost setup but I do not have my workstation setup.

(As a side note, when referring to Tor -> Tails over Tails -> Tor for security, does that mean to run Tails as a LiveCD and use Tor browser, or use Vidalia and Tails in a VM? I'm guessing the former. I know Tails > Tor is Tor in Tails, however I couldn't come up with any way to do Tor > Tails without using my setup at the beginning of the post.)

Which configuration that I have mentioned or your own idea provides the most anonymity?

Improve this question
1
  • 1
    if you feel that your question has been answered, then please select an answer so that this question may be closed.
    – Paradox
    Jun 29, 2016 at 14:34

3 Answers 3

Reset to default
1

Never use Tor two times in a row!

This will deanonymize you very quickly. A single Tor process will ensure that it never uses the same relay for both your guard and your exit. If you do Tor twice in a row, the first process might select a relay for your guard, and the second process might select the same relay as your exit, effectively turning a highly-secure anonymity network into a cheap one-hop proxy. Because exit relays change every 10 minutes, the chance that you will get a "short circuit" that deanonymizes you increases greatly as time elapses. This is not a problem if you only use one Tor instance.

Put another way, process A chooses relays A1, A2, and A3 such that A1 ≠ A2 ≠ A3. Process B chooses relays B1, B2, and B3 such that B1 ≠ B2 ≠ B3. Because process A and B are not aware of what relays the other has selected, you may find yourself in a situation where A1 = B3!

Improve this answer
3
  • Let's say someone is monitoring the Exit node, and traffic goes Client->A1->A2->A3->B1->B2->B3(A1)-->Exit Node how would this deanonymize you? Exit node still can't see client, it only sees Hop B3/A1 --> ExitNode, no? (unless they control A1 too), but if anyone controls 2 dots on any line, they know exactly how the line runs. Legit question here.
    – Nomad
    Jun 20, 2018 at 8:13
  • 1
    @Nomad Because the B3(A1) is the exit node. If you use two Tor instances in a row, you could very well have the same exact relay acting as your guard (first hop) and your exit (last hop). Since exits change frequently, this becomes statistically likely.
    – forest
    Jun 20, 2018 at 12:27
  • Ah yes, in that case I understand, I thought you refered to the actual relays rather than included exit nodes. Thanks for clearing that out!
    – Nomad
    Jun 20, 2018 at 14:55
0

Well for the best anonymity in my opinion, I'd go with using obfuscated bridges with Tor ->VPN->Tor(or i2p)->virtual machine VPN chain linking using Whonix then Tails.

The reason for this is that Whonix virtualizes the gateway, so as to prevent your IP from being compromised by the workstation for whatever reason (malware installed through a browser attack such as XSS).
Obviously there are several other security and anonymity practices that need to be implemented in order to have the level of OPSEC that you are talking about, but using the Whonix->Tails method is probably the best option for you, since it seems you really want to use these those two different distros.

Improve this answer
1
  • This is fatally dangerous advice. Tor over Tor will deanonymize you.
    – forest
    Jun 20, 2018 at 2:18
0

Your answer is not clear as to the degree of anonymity you require. You do not want google to follow you? You do not want your IP to be traced in any way? You do not want to exist on the internet? You must weigh the gains vs. losses.

You can put your traffic crossing a set o chained proxies (Tor, I2P,etc) but remember: with such degree of proxying you are protecting yourself against potential agencies which control parts of those networks (not against google or your neighbor) and as you might have read NSA is also able to compromise VPNs. And if they are committed to disclose you may want to burn all your devices and stuck yourself into a hole because they will always be one step ahead of you. Also, more proxying == less browsing performance.

Now, as for your decisions. My answer would depend on the level of anonymity you want (how paranoid are you) and what you do on a daily basis, as well as how do you use your computers. Live CDs/USBs are kind of paranoid and poor usage of computer resources, unless you are a hacker or criminal which fears the day the police raids your house and retrieves your HDDs. If your point is not being traced or having your IP disclosed, create a VM and proxy all your workstation traffic through the VM. As for limiting the sources of compromising: enable vm isolation (no copy/paste or moves).

I use virtualization heavily to run things i do not trust and i even have anti-malware software on those machines to let me sleep at night. A fun thing is discovered about VMs is that if you use CPU virtualization facilities to run 64-bit machines you are more prone to have your computer compromised if the malware breaks out of the VM. I assume that happens because in 32-bits your VM is just a process easily isolated by the OS while with CPU facilities you are using more low level calls (my naive guess).

I hope i answered your question. Stay safe ;)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .