3 ms·

The Whonix approach is very reasonable. Tails must be considered inadequate when used as a complete solution as long as the browser isn't fully isolated from th

The Whonix approach is very reasonable. Tails must be considered inadequate when used as a complete solution as long as the browser isn't fully isolated from the Tor underlay.

dublinben 11y ago
>Tails must be considered inadequate Tails is significantly more secure than the common practice of running the Tor Browser Bundle on a Windows OS.
- nikcub 11y ago
  I built a custom VMWare install of Windows Embedded (well, they're all custom) running just Chromium. I think it's pretty secure - the footprint is tiny, I was actually more concerned about switching off some of the fancier features of Chromium (such as Canvas and WebGL). In theory it would make an excellent thin client to use with an OpenBSD isolating proxy - i'm actually curious to hear what others would think about using embedded Windows (XP or 8 or 10) in this way.
  - bcook 11y ago
    A proxy cannot anonymize encrypted traffic.
    - nikcub 11y ago
      Isolating proxy: https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/IsolatingProxy https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWT... meaning the only way to route out is to proxy via Tor. IMO it's the only safe way to run Tor and remain anonymous.
      - bcook 11y ago
        That only tunnels traffic through Tor, right? If the browser leaks identifying client information through HTTPS or other encrypted protocols, the proxy (torify) will not be able to help. That is why Tor Browser is important.
        nikcub 11y ago
        yep, the way it is setup is you create a private network in VMWare, the proxy/router box has a live IP address on one end and is running a DHCP server on the private network. The client VM's connect to the Tor daemon on the proxy/router using SOCKS or HTTP I don't use torify or anything else - if the app doesn't support SOCKS or HTTP then I don't use it. Any browser leaks will just hit a wall against the router VM. It's the whonix architecture - except I use my own router (wasn't comfortable with whonix's 1.6GB+ router) and client.
  - jmnicolas 11y ago
    Well apart from Chromium you're relying on a closed source "stack", I'm not sure it's pretty secure. You didn't mention it, but you should revert to a clean VM snapshot after each time you use your VM (like they do in Qubes).

The Whonix approach is very reasonable. Tails must be considered inadequate when used as a complete solution as long as the browser isn't fully isolated from the Tor underlay.

dublinben 11y ago

>Tails must be considered inadequate Tails is significantly more secure than the common practice of running the Tor Browser Bundle on a Windows OS.

nikcub 11y ago
I built a custom VMWare install of Windows Embedded (well, they're all custom) running just Chromium. I think it's pretty secure - the footprint is tiny, I was actually more concerned about switching off some of the fancier features of Chromium (such as Canvas and WebGL). In theory it would make an excellent thin client to use with an OpenBSD isolating proxy - i'm actually curious to hear what others would think about using embedded Windows (XP or 8 or 10) in this way.
- bcook 11y ago
  A proxy cannot anonymize encrypted traffic.
  - nikcub 11y ago
    Isolating proxy: https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/IsolatingProxy https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWT... meaning the only way to route out is to proxy via Tor. IMO it's the only safe way to run Tor and remain anonymous.
    - bcook 11y ago
      That only tunnels traffic through Tor, right? If the browser leaks identifying client information through HTTPS or other encrypted protocols, the proxy (torify) will not be able to help. That is why Tor Browser is important.
      - nikcub 11y ago
        yep, the way it is setup is you create a private network in VMWare, the proxy/router box has a live IP address on one end and is running a DHCP server on the private network. The client VM's connect to the Tor daemon on the proxy/router using SOCKS or HTTP I don't use torify or anything else - if the app doesn't support SOCKS or HTTP then I don't use it. Any browser leaks will just hit a wall against the router VM. It's the whonix architecture - except I use my own router (wasn't comfortable with whonix's 1.6GB+ router) and client.
- jmnicolas 11y ago
  Well apart from Chromium you're relying on a closed source "stack", I'm not sure it's pretty secure. You didn't mention it, but you should revert to a clean VM snapshot after each time you use your VM (like they do in Qubes).