(untitled)

Does Lain know of any good alternatives to Tails with a bigger focus on security, rather than usability? I'll need a live system in the next time and I like the principles of Tails, but the software choices are incredibly insecure.

>>58633 the only alternative I can think of is Qubes OS + Whonix in a VM, but afaik it's not an amnesic solution. by the way, what is so insecure about Tails?

>>58636 It's Linux and Linux is not secure

>>58636 The default every-day programs mostly, the gnome media player has some rather inconvenient vulnerabilites, aiding in the deanonymization of users. It uses Pidgin by default, which is built on libpurple, a guide on how not to write software, electrum, the list goes on. Incredibly insecure might be overstepped, but it's not what I would chose for a distro with a big focus on anonymization like Tails.

>>58639 Care to elaborate?

>>58636 it can be made amnesiac by creating a temporary Whonix VM

>>58633 You can't treat usability as being separate from security. The point of Tails is to have a default configuration that does not need to be configured, because even expert users make technical mistakes that break their security and this is the most common reason for failures. An OS that encourages or requires manual configuration is inherently insecure.

>>58650 its bait, mate, just a troll

>>58651 >it can be made amnesiac by creating a temporary Whonix VM That's not true because the host could still be caching data or ram contents to disk. The VM guest has zero control over that. >>58649 You can hack your own live system by mounting the iso image and modifying the filesystem.squashfs (or whatever they call it) to include or exclude whatever you want.

>>58675 >>it can be made amnesiac by creating a temporary Whonix VM >That's not true because the host could still be caching data or ram contents to disk. The VM guest has zero control over that. Indeed. Fortunately the host is free software and is part of the distribution, signed with the same PGP key. Unless you distrust your cryptographic primitives or the Qubes developers (in which case I would ask why you trust the TAILS developers), the host is just as trusted as the guest. You're really grasping at straws here.

>>58677 >Fortunately the host is free software and is part of the distribution, signed with the same PGP key It's not about being malicious. Swapping RAM to disk when the system is under load is just a thing that operating systems do. So no matter how secure you think your VM is, the host could still be leaking data. >You're really grasping at straws here. Or you failed to understand the post you're responding to and started jumping to conclusions instead.

>>58679 Except Qubes doesn't do that. Xen guests can only allocate physical memory. Any swapping will be local to the disposable VM. Set swappiness=0 in the DispVM template to avoid this behavior if you want. They're also working on ephemeral encryption of DispVM virtual disks, looks like its not implemented yet though https://github.com/QubesOS/qubes-issues/issues/904

>>58663 >inherently insecure for retards. Security isn't infrastructure.

>>58681 >Except Qubes doesn't do that. As long as you actually checked and not just running on ignorance/assumptions. >Set swappiness=0 in the DispVM template to avoid this behavior if you want. Unless this is something specific to the hypervisor, swappiness=0 under general Linux does not actually disable swap, it is just a guideline to the kernel. It's also not only about swap. VMs can also do things like take snapshots which are normally useful for VM users but not what you want in this case. >They're also working on ephemeral encryption of DispVM virtual disks Indeed if all you're doing is deleting the VM virtual harddrive from the filesystem after shutdown then that is trivial to recover through forensic analysis. https://groups.google.com/g/qubes-devel/c/QwL5PjqPs-4 The reason Tails-like live systems exist is because running around trying to plug all the hole where data could leak out (that you know of) is not a great strategy. It's better to load everything into RAM and leave nothing persistent to write back to. But since VM images tend to be very large this is probably not a practical approach for something like Qubes.

>>58682 >Security isn't infrastructure. Idiot. All you have to do is install oPenBSD and everything will be magically secure against any attack.

>>58685 What did lain mean by this?

>>58687 >What did lain mean by this? Lain means to satirize the dumb, lazy, quasi-religious approach some people have to security which leads them to worship specific operating systems.

>>58684 >swappiness=0 under general Linux does not actually disable swap, it is just a guideline to the kernel. Or unmount swap, whatever. Anything that works to disable swap on TAILS will also work for qubes guests >Indeed if all you're doing is deleting the VM virtual harddrive from the filesystem after shutdown then that is trivial to recover through forensic analysis. "trivial" is an exaggeration. If we assume that the attacker already has your FDE password and the blocks haven't been repurposed for anything(AFAIK the COW file is kept around and overwritten whenever a DispVM guest is spawned, but I'm not positive) then its still going to take expertise and a lot of work. The Qubes lead apparently uses shred to get rid of old DispVM COW files. All of this needs to be counterbalanced with the fact that Qubes is much better at preventing data leaks at the network level. If your TAILS install is compromised, the attacker can both find your real IP address and create a persistent exploit by modifying your TAILS USB drive. This is not so with Whonix + Qubes.

>>58713 Meant to write "instance", not " install"

>>58664 In all fairness Linux is quite insecure compared to its competitors (MacOS/Windows), mostly imo in regards to its sandboxing, which by default there practically is none. Though this issue is irrelevant for something like Qubes where virtualization is used.

heads https://heads.dyne.org/

>>58715 I'm far from a security expert but there's more approaches to security then just sandboxing. Honestly from my very amateur perspective sandboxing seems like more of a band-aid fix then anything else. Wouldn't it be better, not only for security but for usability and simplicity of the operating system as a whole, to only install programs that where completely trusted? Why would I need to protect my whole system from a vulnerability when I could simply avoid installing applications with vulnerabilities in the first place? I know this is easier said then done but it seems like a more worthwhile solution to the problem. Having a smaller attack surface just makes the most sense to me. Also would you care to elaborate on how Mac or Windows handles sandboxing any better? Both of those operating systems have proven to be pretty insecure over the years so even if they're using sandboxing it doesn't seem to be helping much...

>>58713 >Anything that works to disable swap on TAILS will also work for qubes guests >qubes guests >guests Host. Do you still not understand what we're talking about? >disable swap on TAILS Tails has no persistent storage. Qubes does almost by necessity. >"trivial" is an exaggeration Deleting a file just removes its metadata from the filesystem. The file data itself is still on the disk until it is overwritten. It is trivial to recover such files with programs like foremost. >the Qubes lead apparently uses shred Shred only works if the disk doesn't do wear leveling (i.e. the OS can choose which physical sectors to overwrite on the hardware). Again, you need to check instead of just assuming it's fine. >If your TAILS install is compromised, the attacker can both find your real IP address Only if they get root and take down the firewall. >This is not so with Whonix + Qubes. If the system running Tor is compromised then the attacker can find your real IP address right away. If the system running firefox is compromised then the attacker needs to jump through an extra hoop to break out of the VM to get your IP address. So whonix is nothing but a sandbox for tor browser.

>>58715 >it's another daniel micay parrot fanboy

>>58722 Thanks lain, looks interesting, I'll give it a shot tomorrow hope it's still active, no news since 2018

>>58781 >>guests >Host. Do you still not understand what we're talking about? Do you? On qubes every container is a guest to the Xen hypervisor, controlled by the dom0 guest. Xen does hot have swap by default, guests are allocated blocks of physical memory. Its not at all a typical VM situation. >Tails has no persistent storage. Not quite true, you can set up persistent storage with TAILS. Its just not the default. >Deleting a file just removes its metadata from the filesystem. The file data itself is still on the disk until it is overwritten. It is trivial to recover such files with programs like foremost. I am aware, but those blocks/inodes can get re-used eventually. In that case the data is truly gone. >Shred only works if the disk doesn't do wear leveling (i.e. the OS can choose which physical sectors to overwrite on the hardware). Again, you need to check instead of just assuming it's fine. Even if the disk does do wear leveling, that doesn't men's every write is to a new sector. Overwriting multiple times increases the chances that the data was erased. >Only if they get root and take down the firewall. Which is easier than most people are comfortable with if you have an RCE exploit. >So whonix is nothing but a sandbox for tor browser. Firefox is by far the wider attack surface, so it makes sense to focus on isolating it. Especially if your main adversary is the people on the other end of your for circuit (which I think most peoples adversaries are)

>>58636 You can run Whonix with KVM on pretty much any distro, and it will be superior to Tails. Qubes-Whonix is best, but not necessary. Whonix has a live mode by the way, there is no reason to keep using Tails. You can use the live mode of Whonix or restore snapshots.

>>58792 >On qubes every container is a guest to the Xen hypervisor, controlled by the dom0 guest. Xen does hot have swap by default, guests are allocated blocks of physical memory. You are using all the wrong jargon but the general idea is correct, xen handles all memory and isolates each domain, so any swapping dom0 does won't include memory from any other domains. >Not quite true, you can set up persistent storage with TAILS. Its just not the default. In other words >>58781 is correct, tails can't write ram to persistent storage unless you take deliberate steps to make that happen. >I am aware, but those blocks/inodes can get re-used eventually. In that case the data is truly gone. In other words >>58781 is correct, "deleted" files can be recovered. >Even if the disk does do wear leveling, that doesn't men's every write is to a new sector. Overwriting multiple times increases the chances that the data was erased. In other words >>58781 is correct, shred is ineffective if the underlying storage uses wear leveling. >Which is easier than most people are comfortable with if you have an RCE exploit. This is just a baseless opinion. You've failed to make any kind of argument for why exposing a real ip address is easier or harder in qubes vs tails.

>>58781 I believe your reasoning is weak. If anything, Tails fares worse against an attack than Whonix. If your Tails gets rooted that is it. Whereas with Whonix, an attacker must root the system and break through the hypervisor which is no easy task. If the Gateway was compromised you could be de-anonymized, which is why you don't do anything that may compromise the Gateway (like making unnecessary downloads or alterations). Only a state level actor could root the system and break free. Rooting the system is already difficult considering the user has good OPSEC. You're essentially saying that in the event of a devastating attack Whonix fails. Tails would also fail. You portray the feat of an attacker rooting the virtual system and breaking free or compromising the Gateway as simple, when it is far from being so. Restoring Whonix snapshots after usage or running Whonix live is better than using Tails in my opinion.

>>60495 >In other words >>58781 is correct, yes, they never said anything wrong and I never said they said anything wrong. I disagree that shred, rm, etc. are *completely* ineffective, or that it's always possible to recover files from an SSD. >You've failed to make any kind of argument for why exposing a real ip address is easier or harder in qubes vs tails. did I need to? It seems blindingly obvious to me.

>>60493 The live features of Whonix and Tails are useless in the event of an attack. Disk writing is only prevented with software blocks. When you boot into Whonix in live mode you instruct Whonix to mount everything in read only mode, your virtual disk can have read only mode toggled through your virtualizer interface. Read only mode paired with Whonix live mode doesn't hook the virtual machine settings through controls to prevent disk writes, they are just software blocks. Low level hardware writing can occur within soft blocks. These soft blocks do not function as advertised. An attacker could bypass these soft blocks with an exploit, and make a write directly to the VM disk or in the case of Tails the USB, maybe even the hard drive somehow granting the Tails user had a poor configuration. Anyone using Tails, especially persistently, for serious activity is at risk of facing reprisals for whatever they may do when their machine is inevitably compromised. Tails makes no usage of virtualization, there is very little to protect a Tails user in the event of a serious attack. Thusly, Tails should be disregarded. Whonix has a much more secure design and philosophy. Use Whonix and save snapshots of your VMs or just start from a clean image when need be. Do not conduct any activities you wish to keep "anonymous" or private on your base system.

I have never tried http://fuguita.org/ myself.

>>58715 What is your definition of "secure"? If telemetry and feeding your data to the NSA Botnet / Fortune 500 and bill gates LIVE via a built in keylogger is secure to you then ok?

>>61811 Why don't you trust in Microsoft's capacity to provide a good, secure service to its customers? Are you some kind of schizophrenic man who thinks the world is out to get him? You're probably a pedophile or domestic terrorist.

>>58715 the feds literally struggle to identify someone using Tails, and facebook had to pay someone millions to develop a zero day to catch some pedo. linux is tremendously insecure in theory yes, but in practice you will be fine as long as your threat model doesn't include being actively a target of a major country. iirc even Snowden uses Tails. normal people only have to deal with stuff along the lines of: - avoiding getting fuarrrked by a major exploit being used in the wild - avoiding data collection by companies - dealing with your computer being stolen in this case, linux tends to have much fewer exploits in the wild as it's a smaller target. it also avoids the telemetry inherent to macOS and windows. if you encrypt your drives, you shouldn't really have anything to worry about with regard to theft, your data will be safe as long as the dude who's just trying to make a quick buck to eat that night isn't somehow a master hacker.

>>61813 Ok Bill Gates, now about Epsteins little Island that you so often visited...

>>61822 That was just business.

>but the software choices are incredibly insecure. what exactly is 'insecure'?

>>58633 Probably compiling your own openbsd os with all the security features you want and flashing it onto a usb without persistence

>>61824 normal business for filthy Germans like yourself

>>61814 There has never been a reported incident of Whonix leaking data. Tails is an inferior Whonix, it's time to grow out of that garbage. The only way to compromise a Whonix user with good OPSEC is to either root the workstation and break through the hypervisor which is immensely challenging, something only a state level actor could pull off. Or instead compromise the gateway with a malicious package, sneaking it into the repository. With Tails, all you have to protect yourself is the firewall. That is such a thin layer of protection. It is no better than your base system. You may as well take snippets of Tails' firewall and run it on your base system. People should stop trying to determine how "secure" their system is, they should determine how insecure their system is. If you are running Whonix with physical isolation, or even Qubes-Whonix with physical isolation, and killed the ME on the gateway, you essentially have the least insecure consumer configuration. There is no way for an attacker to leak your IP address at that point, the workstation is physically separated from the gateway. An attacker can root the workstation and break free, compromising the device. However the device is still airgapped. The IME in the gateway has had it's networking capabilities disabled, and the IME in the workstation cannot network since it is connecting to the internet via ethernet over USB. Use as many possible layers of protection as you can. See >>61437 https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908 >If the only thing between you and your negative outcome is a bug in Tor Browser Bundle, prepare to see your negative outcome

>>58781 Tails and whonix seem to focus on completely different directions from which someone using tor can be attacked. Tails mainly tries to secure the user from physical attacks where someone knows who you are but doesn't know what you're doing on tor while whonix by itself focuses on protecting from attacks originating from someone who doesn't know who you are physically but knows what you're doing through tor. Qubes+whonix provides more security from both physical attacks and remote attacks. Even though tails focuses mainly on physical security the same or better physical security can be achieved on qubes+whonix. Qubes by default uses FDE, so even if someone tries to analyze contents of your disk and the system uses swap all of the data on will be encrypted. If you use qubes it will be your only OS, while if you're using tails you'll probably be booting it from a usb stick. Tails claims that >https://tails.boum.org/about/index.en.html >You don't have to worry about the computer having viruses because Tails runs independently from the other operating system and never uses the hard disk. But, Tails cannot always protect you if you install it from a computer with viruses or if you use it on a computer with malicious hardware, like keyloggers. Which is bullshit: >https://legbacore.com/Research_files/HowManyMillionBIOSesWouldYouLikeToInfect_Whitepaper_v1.pdf >We, and others, have demonstrated numerous attacks against firmware that can easily be launched over a remote connection. Qubes+whonix additionally provide way more security than tails: - drivers for network card are isolated and run inside sys-net vm - usb devices are also isolated and run in sys-usb vm - VM I/O emulation is also virtualized in contrast to KVM where it's only ran as a non privileged process. - you can quickly open untrusted files in disposable VMs I really don't know why tails is so praised as it provides barely any more protection than just using a regular linux live usb with tor installed. Even if it did provide way more physical security which it seems to focus at it wouldn't matter, because the most common threat model of tor users is remote attacks. >>58715 I don't know about MacOS, but what extra sandboxing does Windows provide? Windows may have more AV software available, but if someone can find an RCE zero day for the software you're using then you're fuarrrked anyway, no matter if you're using AV or not as it's not that hard to bypass. The only thing AV can protect you from is soykafty malware downloaded from a random website, which isn't that much of a problem for linux as you should download software from your distro's repo. And if by sandboxing you mean this: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview then that's the first time I've heard about this and it's not even supported on home edition. Also linux does have tools for sandboxing like firejail and selinux. >>61814 Snowden uses qubes https://nitter.net/Snowden/status/781493632293605376 and if your threat model is what you've posted then using some random linux distro with vpn and fde + some common sense is probably enough. It all depends on how paranoid you are and on your threat model.

Use whonix. See >>61869 But, none of this matters if your network is fuarrrked,and most are since no one changes the default router from the isp which is ass. And no one changes the default password "password" or what they stickered in bold bright colored font on the side of the box sometimes, so someone can grab your wifi password and run tcpdump on a pi, pick it up the next day and fuarrrk you in your ass. The only time you need a live system is if you are doing something you can't leave a forensic trace of because cops, private investigators, or feds are after you, in which case the cop is just squeeky done using tails/heads, the PI requires you to fix your network because he has less rules about what he can do, and the glowniggers will just make something up if they can't find anything and then convict you in secret court to go to secret jail to have super rape instead of regular rape.

>>58722 >>58789 Workaround, non-Libre (FSDG), however, still without systemd, and Live: https://devuan.org/ https://distrowatch.com/table.php?distribution=devuan https://exegnulinux.net/ https://distrowatch.com/table.php?distribution=exe https://refracta.org/ https://distrowatch.com/table.php?distribution=refracta

>>61886 >The only time you need a live system Exactly. That applies only to you.

>>61869 >>If the only thing between you and your negative outcome is a bug in Tor Browser Bundle, prepare to see your negative outcome Good quote. It is also well worth considering the benefits of security by obscurity, both in terms of space and time. For example, if in addition to physical isolation one's actual internet connection itself is made from afar in a highly populated area, and the connection is made for as little time as possible going through as little bandwidth as possible, there will be difficulty in going from identifying your stream as 'suspect' enough to warrant attack --> recon --> preparation and bureaucracy --> launching of exploit in such a short time. It is extremely well worth noting that if you avoid using a pseudonym, your adversary has no way to accurately predict what you will do next and will probably not be able to say in advance, 'when the target connects to X we launch Y exploit against Z identified component of their network/machine' because they have no idea who the 'target' is. Ideally you ensure that your adversary has little to no opportunity to analyze or interact with you or your machines in realtime.

>>61889 If you live entirely off of live systems without forensic traces, then tails or whonix will do the task for you. They're both great, they're well designed. Mozilla is like kicking dead whales down the beach and the Tor Project fear mongers about browser condoms like uBlock. Both of those do great, fix Mozilla and everything is peachy.

>>61890 Using public internet or a network which is not your own can be highly beneficial but most people should avoid such a configuration due to TEMPEST. Your computer processes could be monitored by individuals properly equipped. Your processes could inadvertently be monitored and logged by smart (spying) devices. It would not be unreasonable to theorize the potential of having an encryption key pulled by a smart device in a close proximity to a secure device. A targeted individual should especially avoid using WiFi, they are at a high risk of a sophisticated, powerful TEMPEST attack being deployed against them to extract information about them. If I was to use WiFi I would not input any data which could leak information about myself into the device I was using, no matter what precautionary measures I had taken to secure that device. Physical machine isolation, Tor only connections, FDE, etc, all of these things are circumvented by TEMPEST. I would run my device in a true live mode. That true live mode being a configuration that physically prevents disk writing, not soft blocking placebo like Tails. If you do not use WiFi, keep a 30 meter radius around your device clear of wireless devices, phones, routers, etc. WiFi is intrinsically evil. https://military-history.fandom.com/wiki/Tempest_(codename) https://www.schneier.com/blog/archives/2015/06/tempest_attack.html https://www.rambus.com/blogs/tempest-side-channel-attacks-recover-aes-256-encryption-keys/ https://en.wikipedia.org/wiki/Tempest_(codename) http://tscm.com/TSCM101tempest.html https://cryptome.org/nsa-tempest.htm https://cryptome.org/tempest-old.htm https://www.schneier.com/blog/archives/2016/02/practical_tempe.html 'Four researchers have demonstrated a TEMPEST attack against a laptop, recovering its keys by listening to its electrical emanations. The cost for the attack hardware was about $3,000. For half a century this has been a nation-state-level espionage technique. The cost is continually falling.' 'TEAPOT refers to the investigation, study, and control of *intentional compromising emanations such as those hostilely induced or provoked* from telecommunications and computer equipment.'