5 ms·

Unfortunately based on my experience training activists/journalists all over the world, the average user at risk in the field struggles to use TAILS.

micaksica 10y ago
What's their biggest struggle with it? PS, if you're ever on the US West Coast or in Singapore, drop me a DM. I'll buy you a drink someplace.
- secfirstmd 10y ago
  Honestly? Many things: -It's tricky for a non-technical user to setup -It disrupts their regular workflow -People get frustrated with speeds of Tor etc -People get frustrated with Captcha (Dam Cloudflare!) and other things caused by using Tor in a safe manner. -People get annoyed as it doesn't solve their problems and exposure on mobile -You have to restart to run it -They can't run their regular programs on it - MS Office, Outlook, Adobe, etc. -It's Linux based, so a big mental jump for most people coming from Windows (or most people not at the command line on OS X) -It's hard to access files on other drives -Documentation and TAILS is only available in certain languages -It often has driver problems - e.g Macbook Pro 2015 WIFI issues -In developing states, computer literacy is low, so anything other than the norm (Windows) is confusing -In developing states, hardware tends to be slow (often counterfeit) so running TAILS in RAM is slow -People lose the USB sticks they put TAILS on (also many counterfeits, so they often fail or have a false size) -TAILS often requires training, which not everyone has access to -Skills fade for digital security training with journalists/activists is often quite high, especially if they don't need it that often. -the list goes on............ Don't get me wrong, I think it's great (as is Qubes, Subgraph etc) but we need to be realistic about it's limitations for the majority of people. Especially if we want to be sensible and try to tailor advice, training and tools to their realistic threat models. P.S Definitely, I'm on the West Coast probably once a year. Ditto you if your ever in Dublin (Ireland, not that fake one in California :) or London!
  - micaksica 10y ago
    What's their threat model, then? If you're going to be actively targeted by exploits like this, then you shouldn't give a damn about some of these tradeoffs. If you have journalists/activists willing to go to information war with a nation-state, they shouldn't be surprised when their adversaries have the resources to pwn them. If David wants to fight goliath, they will need to take this into account. The guys with guns and power want their heads. If the activists/journalists/whatever don't want to take the necessary precautions to use computers to talk to people in a way in which they are protected from capable adversaries, then I'm not sure what it is that they are expecting. Also, I was recommending these users simply defending in depth by using Tails as a sandbox for a leaky browser, to require a chain of expensive exploits (browser 0day + VM escape 0day). Training someone to install VirtualBox or VMWare and run an ISO from it doesn't really disrupt too much workflow and defends in depth against the browser issues, then again I am likely wrongfully assuming VT-x/VT-d and a lot of RAM on the activists' computers.
    - secfirstmd 10y ago
      If the activists/journalists/whatever don't want to take the necessary precautions to use computers to talk to people in a way in which they are protected from capable adversaries, then I'm not sure what it is that they are expecting. I get what your saying but humans are humans, journalists are busy and security is a pain for most people (until they need it). The threat model really depends and so is too wide for me to make any sweeping statements. Clearly a US journalist working on drone strikes is a different threat model to an democracy activist in Sudan.
      - tmptmp 10y ago
        >>I get what your saying but humans are humans, journalists are busy and security is a pain for most people (until they need it). ...until they see they need it. Sad, as most people may not even know that they need to go to these kind of depths. For them, TBB seems more than enough.
        10y ago

micaksica 10y ago

What's their biggest struggle with it? PS, if you're ever on the US West Coast or in Singapore, drop me a DM. I'll buy you a drink someplace.

secfirstmd 10y ago
Honestly? Many things: -It's tricky for a non-technical user to setup -It disrupts their regular workflow -People get frustrated with speeds of Tor etc -People get frustrated with Captcha (Dam Cloudflare!) and other things caused by using Tor in a safe manner. -People get annoyed as it doesn't solve their problems and exposure on mobile -You have to restart to run it -They can't run their regular programs on it - MS Office, Outlook, Adobe, etc. -It's Linux based, so a big mental jump for most people coming from Windows (or most people not at the command line on OS X) -It's hard to access files on other drives -Documentation and TAILS is only available in certain languages -It often has driver problems - e.g Macbook Pro 2015 WIFI issues -In developing states, computer literacy is low, so anything other than the norm (Windows) is confusing -In developing states, hardware tends to be slow (often counterfeit) so running TAILS in RAM is slow -People lose the USB sticks they put TAILS on (also many counterfeits, so they often fail or have a false size) -TAILS often requires training, which not everyone has access to -Skills fade for digital security training with journalists/activists is often quite high, especially if they don't need it that often. -the list goes on............ Don't get me wrong, I think it's great (as is Qubes, Subgraph etc) but we need to be realistic about it's limitations for the majority of people. Especially if we want to be sensible and try to tailor advice, training and tools to their realistic threat models. P.S Definitely, I'm on the West Coast probably once a year. Ditto you if your ever in Dublin (Ireland, not that fake one in California :) or London!
- micaksica 10y ago
  What's their threat model, then? If you're going to be actively targeted by exploits like this, then you shouldn't give a damn about some of these tradeoffs. If you have journalists/activists willing to go to information war with a nation-state, they shouldn't be surprised when their adversaries have the resources to pwn them. If David wants to fight goliath, they will need to take this into account. The guys with guns and power want their heads. If the activists/journalists/whatever don't want to take the necessary precautions to use computers to talk to people in a way in which they are protected from capable adversaries, then I'm not sure what it is that they are expecting. Also, I was recommending these users simply defending in depth by using Tails as a sandbox for a leaky browser, to require a chain of expensive exploits (browser 0day + VM escape 0day). Training someone to install VirtualBox or VMWare and run an ISO from it doesn't really disrupt too much workflow and defends in depth against the browser issues, then again I am likely wrongfully assuming VT-x/VT-d and a lot of RAM on the activists' computers.
  - secfirstmd 10y ago
    If the activists/journalists/whatever don't want to take the necessary precautions to use computers to talk to people in a way in which they are protected from capable adversaries, then I'm not sure what it is that they are expecting. I get what your saying but humans are humans, journalists are busy and security is a pain for most people (until they need it). The threat model really depends and so is too wide for me to make any sweeping statements. Clearly a US journalist working on drone strikes is a different threat model to an democracy activist in Sudan.
    - tmptmp 10y ago
      >>I get what your saying but humans are humans, journalists are busy and security is a pain for most people (until they need it). ...until they see they need it. Sad, as most people may not even know that they need to go to these kind of depths. For them, TBB seems more than enough.
      - 10y ago