5 ms·

Always been puzzled as to why the ISO release is provided by HTTP and not HTTPS; possible it doesn't make a difference, but if so, it's not clear why.

by nxzero 11y ago

deleted 11y ago
[deleted]
mpeg 11y ago
Https only guarantees the origin and protects against MITM, they provide a GPG signing key and sign their isos so it does all that + guarantees that even if their websote gets compromised attackers wouldn't be able to distribute software unless they obtained the private key.
- roddux 11y ago
  But if the file and site are both accessed over HTTP, it's possible for a bad actor to alter the file and then change the signatures+checksums listed on the page to reflect it.
  - mpeg 11y ago
    That can happen regardless of HTTP/HTTPS, say if the site was hacked they could be serving a bad key/signature, which is why you should always obtain the public GPG key (in any scenario, really) via a trusted channel, or multiple ones. So for instance in this case you could grab the gpg key, go into their IRC channel and ask for it again, etc. I do agree HTTP makes it easier to MITM, but in theory if you are serious about security you should not be relying on HTTPS alone.
    - someguy1233 11y ago
      The fact is however, HTTPS offers massive improvements for security for the majority of users, especially those using public or shared Wi-Fi (i.e. Work or School), assuming they're using their own device. Assuming HSTS was set up, it would be impossible to strip SSL without causing most browsers to panic and refuse you access to the website. On those types of networks, MITM attacks are extremely easy, and there are tools to do it in seconds. It may be more likely for you to get MITM'd and have them modify the signature, than for the actual website to get hacked. Combined with the fact that some people would try to download Tails across these types of network for the added anonymity.
jnagro 11y ago
You can also DL the ISO via bittorrent, which has some additional consistency checks. https://tails.boum.org/torrents/files/tails-i386-2.0.torrent https://tails.boum.org/torrents/files/tails-i386-2.0.torrent
- nxzero 11y ago
  Right, though my understanding is Tails' and TOR's position are not to torrent using either system: https://labs.riseup.net/code/issues/5991 https://labs.riseup.net/code/issues/5991 ^^ given that, it is to me just as puzzling that they provide a torrent as it is for failing to use HTTPS by default for file transfers.
nikcub 11y ago
You're right. At the moment it's difficult to download Tails anonymously, especially with everything we know about XKeyscore targetting. It's a problem that others can help fix by setting up mirrors on HTTPS. Ditto with hosting the website on a Tor hidden service.
- nxzero 11y ago
  The main ISO link is able to be used via HTTPS (by adding an "s" to the URL) but it's got some compliance issue. HTTPS would likely not provide anonymity, since it leaks to much metadata; might be wrong, just my opinion.
  - nikcub 11y ago
    If you use a distinct server for Tails then you could still spot the downloads, you'd need HTTPS and serving from a busy mirror that serves a lot of other apps and systems as well
dandelion_lover 11y ago
You can also install tails in Debian using apt-get install tails-installer

Always been puzzled as to why the ISO release is provided by HTTP and not HTTPS; possible it doesn't make a difference, but if so, it's not clear why.

by nxzero 11y ago

Always been puzzled as to why the ISO release is provided by HTTP and not HTTPS; possible it doesn't make a difference, but if so, it's not clear why.

deleted 11y ago

[deleted]

mpeg 11y ago

Https only guarantees the origin and protects against MITM, they provide a GPG signing key and sign their isos so it does all that + guarantees that even if their websote gets compromised attackers wouldn't be able to distribute software unless they obtained the private key.

roddux 11y ago
But if the file and site are both accessed over HTTP, it's possible for a bad actor to alter the file and then change the signatures+checksums listed on the page to reflect it.
- mpeg 11y ago
  That can happen regardless of HTTP/HTTPS, say if the site was hacked they could be serving a bad key/signature, which is why you should always obtain the public GPG key (in any scenario, really) via a trusted channel, or multiple ones. So for instance in this case you could grab the gpg key, go into their IRC channel and ask for it again, etc. I do agree HTTP makes it easier to MITM, but in theory if you are serious about security you should not be relying on HTTPS alone.
  - someguy1233 11y ago
    The fact is however, HTTPS offers massive improvements for security for the majority of users, especially those using public or shared Wi-Fi (i.e. Work or School), assuming they're using their own device. Assuming HSTS was set up, it would be impossible to strip SSL without causing most browsers to panic and refuse you access to the website. On those types of networks, MITM attacks are extremely easy, and there are tools to do it in seconds. It may be more likely for you to get MITM'd and have them modify the signature, than for the actual website to get hacked. Combined with the fact that some people would try to download Tails across these types of network for the added anonymity.

jnagro 11y ago

You can also DL the ISO via bittorrent, which has some additional consistency checks. https://tails.boum.org/torrents/files/tails-i386-2.0.torrent https://tails.boum.org/torrents/files/tails-i386-2.0.torrent

nxzero 11y ago
Right, though my understanding is Tails' and TOR's position are not to torrent using either system: https://labs.riseup.net/code/issues/5991 https://labs.riseup.net/code/issues/5991 ^^ given that, it is to me just as puzzling that they provide a torrent as it is for failing to use HTTPS by default for file transfers.

nikcub 11y ago

You're right. At the moment it's difficult to download Tails anonymously, especially with everything we know about XKeyscore targetting. It's a problem that others can help fix by setting up mirrors on HTTPS. Ditto with hosting the website on a Tor hidden service.

nxzero 11y ago
The main ISO link is able to be used via HTTPS (by adding an "s" to the URL) but it's got some compliance issue. HTTPS would likely not provide anonymity, since it leaks to much metadata; might be wrong, just my opinion.
- nikcub 11y ago
  If you use a distinct server for Tails then you could still spot the downloads, you'd need HTTPS and serving from a busy mirror that serves a lot of other apps and systems as well

dandelion_lover 11y ago

You can also install tails in Debian using apt-get install tails-installer