10 ms·
Tails 2.0 is out
- xd1936 11y agoAwesome! I can't wait to output the last few lines of all my files on the command line with this!
- bphogan 11y agoFirefox refuses to let me look at this page because of a certificate problem. Not to go off on a rant, but this is what the "everyone must use https because we said so" edict is going to cause - it's not enough you use https, it has to be the right kind of https that involves a third party issuer of certs. Can anyone fix that issue or link to a different page please?
- ZoF 11y agoYou can't proceed past the certificate warning?
- bphogan 11y agoI can proceed if I add an exception. But I don't know if I want to add an exception. Edit: Clock is automatically set via OSX. Not a problem with other sites. Firefox says tails.boum.org uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. (Error code: sec_error_unknown_issuer) Sooooo..... I need a root certificate of some sort then? See, this is what we get to contend with - I can't read this site because reasons. And it's up to me to find out what the reasons are I guess. Wait till this hits the masses when certs get revoked, expire, etc. :)
- ultramancool 11y agoAnd you shouldn't - this page uses a valid certificate for me. Either your clock is set wrong, you're missing CAs or you're being MITM'd. Verify your time, check the certificate chain on the site (should be UserTrust -> Gandi -> site) and try to check fingerprints against https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm if you can.
- darkr 11y agoYeah.. That's suspicious.. Firefox uses it's own CA list, so if your install of firefox is up to date, and your system clock is correct then you are potentially being MITM'd... If that is the case then your browser is exhibiting correct behavior. For me, I can see that the root CA is USERTrust (SHA-384 sig, interestingly), and the server is presenting a valid intermediate (Gandi - also using a SHA-384 signature), then the site certificate (SHA-256 sig). There is a secondary certification path though, coming from a old SHA1 AddTrust Root (but this is also in my trust store for Firefox).
- bphogan 11y agoSame results on Chrome. I am not on a corporate network - I am at home. Are there tools I can use to work my way through this?
- 11y ago
- xd1936 11y agoWorking fine for me on Firefox/Linux. Is your system clock set right?
- Splines 11y agoI suspect there is a non-trivial number of users for whom the entire internet is broken for this simple reason.
- tomschlick 11y agoSame with Chrome 47 on OSX
- wyldfire 11y agoWorks for me on firefox 34.0 linux. Are you sure you aren't encountering a MITM from a corporate proxy?
- liotier 11y ago> Firefox refuses to let me look at this page because of a certificate problem. Me too, but I know why: my employer's proxy MITMs any SSL connections whose certificate authority it does not recognize as bona fide. Quite aggravating - but a very nice tool to explain SSL MITM to users... There's always a silver lining !
- JoshTriplett 11y ago> whose certificate authority it does not recognize as bona fide That's a very strange criteria; do you mean that anything that would have been a certificate error gets MITMed instead, rather than rejected? Very strange.
- liotier 11y agoNot just the self-signed ones - also some others... I wonder what the whitelist is. The proxy is the infamous McAfee Web Gateway - I don't know if the list is user-maintained or supplied by the vendor.
- superuser2 11y agoYes it must, because self-signed carts offer no defense against MITM.
- jessaustin 11y agoTo be more precise, they offer no defense against MITM on first visit. Once I've pinned a particular self-signed cert for a particular site, I'll be quite suspicious if that cert ever changes.
- superuser2 11y agoOkay, but that only helps the tiny subset of HNers who are manually pinning certs for a random website. Further, real world MITMs are ad injection at the device (Lenovo Superfish) or ISP level, so they are persistent.
- jnagro 11y agosuspicious.
- AdmiralAsshat 11y agoTor Browser 5.5 introduces protection against fingerprinting but due to an oversight it is not enabled in Tails 2.0. However, this is not so bad for Tails users since each Tails system has the same fonts installed, and hence will look identical, so this only means that it's easy to distinguish whether a user of Tor Browser 5.5 uses Tails or not. That is already easy given that Tails has the AdBlock Plus extension enabled, unlike the normal Tor Browser. I wonder why they opted to preload it with AdBlock Plus instead of uBlock Origin. I'm sure gorhill would certainly give his blessing, and by all measurements it is just as effective with way less overhead. Heck, they could go one step further and preload it with a uBlock Origin profile on a paranoid mode that proactively disables all JavaScript (last I remember using Tor I had to manually disable Javascript in the Firefox config).
- ultramancool 11y agouBlock Origin's advanced mode is also a lot nicer for JS blocking than NoScript and similar tools even as it allows you to unblock a CDN for a certain domain but not others, so you don't wind up allowing *.cloudfront.com for the whole internet. And most privacy conscious people left Adblock Plus after they started allowing "acceptable ads" including from some pretty notorious trackers.
- jrcii 11y agoI use AdBlock Plus because of the Element Hiding Helper addon, which lets me easily and perpetually hide whatever DOM element I decide is annoying me or taking up unnecessary space. To my knowledge there is no similar addon for uBlock Origin.
- Nadya 11y agoIt works the same exact way. You can select a DOM element and blacklist it. Manually or by using the Eyedropper tool. See: http://i.imgur.com/s2pVQ1V.png http://i.imgur.com/s2pVQ1V.png
- ensignavenger 11y agoI am using uBlock Origin 1.5.5, and it has a Block Element feature. Not sure how it differs from AdBlock Plus's implementation, though.
- nxzero 11y agoAlways been puzzled as to why the ISO release is provided by HTTP and not HTTPS; possible it doesn't make a difference, but if so, it's not clear why.
- deleted 11y ago[deleted]
- mpeg 11y agoHttps only guarantees the origin and protects against MITM, they provide a GPG signing key and sign their isos so it does all that + guarantees that even if their websote gets compromised attackers wouldn't be able to distribute software unless they obtained the private key.
- roddux 11y agoBut if the file and site are both accessed over HTTP, it's possible for a bad actor to alter the file and then change the signatures+checksums listed on the page to reflect it.
- mpeg 11y agoThat can happen regardless of HTTP/HTTPS, say if the site was hacked they could be serving a bad key/signature, which is why you should always obtain the public GPG key (in any scenario, really) via a trusted channel, or multiple ones. So for instance in this case you could grab the gpg key, go into their IRC channel and ask for it again, etc. I do agree HTTP makes it easier to MITM, but in theory if you are serious about security you should not be relying on HTTPS alone.
- someguy1233 11y agoThe fact is however, HTTPS offers massive improvements for security for the majority of users, especially those using public or shared Wi-Fi (i.e. Work or School), assuming they're using their own device. Assuming HSTS was set up, it would be impossible to strip SSL without causing most browsers to panic and refuse you access to the website. On those types of networks, MITM attacks are extremely easy, and there are tools to do it in seconds. It may be more likely for you to get MITM'd and have them modify the signature, than for the actual website to get hacked. Combined with the fact that some people would try to download Tails across these types of network for the added anonymity.
- nikcub 11y agoI appreciate a lot of the work that the Tails guys do - but for a privacy and security focused distribution there are far too many included apps for my liking[1], which increases the attack surface. LibreOffice, Gimp and Audacity are just some of the apps - and many have a horrible history of vulnerabilities[2]. When Tails has had vulnerabilities it is often with one of these included apps[6]. The browser isn't sanboxed (it's in progress[3]), and the machine is still directly connected to the internet, so you're a single Firefox vulnerability and a drive-by download away from being deanonymized. It is also a shame that both OS X and Windows make it difficult to write an OS to an USB stick and boot from it - the install requires an intermediary Linux OS either on DVD or USB, which a lot of users won't get by. For a different approach, see Whonix[4] - a virtual machine based approach with an isolating proxy (very popular setup amongst black hats) and Qubes OS[4] which is built on Xen and runs processes in separate VM's [1] https://tails.boum.org/doc/about/features/index.en.html https://tails.boum.org/doc/about/features/index.en.html [2] https://www.cvedetails.com/vulnerability-list/vendor_id-11439/product_id-21008/Libreoffice-Libreoffice.html https://www.cvedetails.com/vulnerability-list/vendor_id-1143... [3] https://wiki.mozilla.org/Security/Sandbox https://wiki.mozilla.org/Security/Sandbox [4] https://www.whonix.org/ https://www.whonix.org/ [5] https://www.qubes-os.org/ https://www.qubes-os.org/ [6] https://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/ https://blog.exodusintel.com/2014/07/23/silverbullets_and_fa...
- swinglock 11y agoThe Whonix approach is very reasonable. Tails must be considered inadequate when used as a complete solution as long as the browser isn't fully isolated from the Tor underlay.
- sultansaladin 11y agoHow secure is this os?
- godgod 11y agoThis thread is being monitored. Searching for the word SLIAT in any search engine flags you as a terrorist and extremist subject to NSA monitoring.
- awinter-py 11y agoThink twice before clicking this link. A bunch of non-crazy newspapers have reported that merely reading about privacy tools (tails & tor) will make you a link in the NSA surveillance graph.
- kozukumi 11y agoWhich is exactly why everyone should click it!
- lamby 11y ago.. And what about those who have contributed to the project?
- imjustsaying 11y agohttps://www.youtube.com/watch?v=WWKG6ZmgAX4 https://www.youtube.com/watch?v=WWKG6ZmgAX4
- cyphar 11y agoWhich is why you should be using Tor to read it. You shouldn't accept someone's attempt to subvert your right to the freedom to read. Fear tactics like that shouldn't be accepted. Besides, everyone is already in NSA's database. Looking up Tor just adds more data that can be correlated with you later. On the plus side, if you then go on to use Tor, that's the last piece of data that can be correlated with you (assuming good enough opsec). EDIT: As I send this, the app I'm using (Materialistic) isn't able to access the HN API when I'm using Orbot with transparent proxying. That's really annoying.
- awinter-py 11y agoI'm not sure tracking privacy-seekers is a fear tactic. It may have more to do with consolidating bureaucratic power -- the more an agency can collect, the more convincing it can be when it asks congress for money. TAILS solves the problem of your individual privacy, but if you care about privacy in general you need to engage politically. Increasing TAILS use without increasing letters to congress increases the odds of anti-privacy legislation.
- Sleaker 11y agoHmm inclusion/switch to systemd on something that purports to be a 'secure' OS for private browsing seems counter-intuitive.
- bemused 11y ago- the tails project lacks the manpower take a different path than its debian mothership - the devs don't seem to be bothered by increasing their attack surface with systemd - systemd makes life easier when building a distribution, so the tails-devs like it (not only because they are lacking manpower) - sure you got to be a bit paranoid when working on this kind of project, but tails doesn't seem to be a very welcoming environment for contributors follow tails irc / the mailinglist for a while to get your own picture and have a look at Whonix/Qubes for more security focused alternatives
- voltagex_ 11y ago>systemd makes life easier when building a distribution Can you elaborate on this? I found that it mattered more what live-cd system an upstream distro used (e.g. dracut vs Debian's older tools)
- digi_owl 11y agoIt think its about how much systemd comes with. Init, session tracking, DNS client, DHCP client, etc etc etc.
- 746F7475 11y agoI'm sure I'm not first to question this, but if you download Tails or Tor browser or whatever, wouldn't that be sort of obvious? I mean it leaves traces. Then if you only use it to do something specific be it chat with friends, browse for porn, take part is activism or to buy illegal products for example wouldn't it be easy to see that: your computer went offline, then something new (Tails) went up, took anonymous connection to somewhere and then X happened, then Tails went away and your main OS/machine went back up. My main "inspiration" here is the fake bomb threat by the college kid to get out of mid terms, just before the email about the bomb was sent his IP downloaded Tor bundle. The service he was using also had the schools IP or something so administration could see it was sent from inside the school, but I think that is still valid concern. This kind of meta data about your actions can leak just as much information as actually seeing what you are doing. My question therefor would be: should more people use Tails as their "daily driver"? Would that make it more anonymous/private for the people like whistle blowers? My only idea at the moment would be to pay for two separate trusted VPN provider (don't know how you would vet that trustworthiness) with bitcoin, to keep your anonymity/privacy with them as well. Then pipe all your traffic through one of the VPNs all the time. Then when you need to use Tor, you would simply pipe it through that same VPN when you would emerge with rest of the clients from same point and then pipe your Tor traffic through the secondary VPN. This way you would still get the benefits of encrypted tunnels all the way through with benefit of Tors anonymizing and it might not be so obvious you are browsing Tor to your ISP or whatever. Maybe I'm thinking this is harder than it actually is
- cguess 11y agoI mean... you could do this, but it would completely depend on your threat level. The problem with this idea is that using your computer in any way that's remotely convenient or normal is impossible. Eventually everyone screws up/gets frustrated/let's their parent or SO use the machine. Right then all of this is mute. If you're this level of paranoid any email account used more than a handful of times has to be burned and never touched. You definitely should not ever access a cell network with a smartphone, which has to be burned as well every week or so. Social media use is also dead. If you don't use social media because of security concerns, that's fine, but 2.5 billion people do, so you're probably in the minority. If you're going to whistle blow there are a bunch of other steps you should implement, running TOR being one of them, Tails if you're that high up of a risk (hint: you're probably not). If you're at that level 1.) you should be doing everything from various public wifi networks in cities nowhere near you and 2.) the fact that you downloaded TOR is not what anyone's interested in anyways, it's what you're saying and doing behind it.