3 ms·
I've started running Tails on my laptop on a daily basis. It's great. https://tails.boum.org/ https://tails.boum.org/ It runs off a USB stick and presents a pr
by jstanley 8y ago
I've started running Tails on my laptop on a daily basis. It's great. https://tails.boum.org/ https://tails.boum.org/
It runs off a USB stick and presents a pristine system each time you boot. Modifications to the filesystem go on a ramdisk "overlay", which disappears as soon as you power it off.
It does support "encrypted persistent storage", but there is quite fine-grained control over what things are allowed to go in it. In particular, nothing to do with the web browser persists across a reboot unless you go quite far out of your way to make it persist. And each time you boot, you can opt not to unlock the persistent storage if the work you want to do is either liable to get you infected with malware, or just doesn't need any of your persistent data.
Additionally, all of the networking is done over Tor, and the firewall blocks non-Tor traffic, so you can't even miss out Tor by accident. (But if you don't want to use Tor, it's probably not for you, although having used Tor in the past, I was pleasantly surprised how much faster it is now than it was then).
EDIT: And for those who don't know, OP is developer of https://www.qubes-os.org/ https://www.qubes-os.org/ which I tried out for a while, and really like the premise of, but found just slightly too inconvenient to use, and I currently prefer Tails.
Qubes has multiple container VMs. All applications run inside a VM, but the I/O is transparently multiplexed into one desktop environment. The window decorations tell you which VM each application is running in. You can copy and paste, and share files, between different VMs, but only where you explicitly want to. You can create VMs to separate data for different purposes (e.g. one just for email, one just for web browsing, and different ones for working on different projects). The VMs can even run different OS's, and there are VMs included by default that route all of their internet over Tor. It is great.
- StavrosK 8y agoI would like it if laptops had a semi-persistent storage area that you could only flash after authenticating, and then you could enter a password if you needed to unlock your persistent data. It's a great way to ensure you don't get any viruses, but it seems a bit too inconvenient for everyday use.
- Fnoord 8y agoLike Apple's secure enclave or Intel's SGX? Or a physical jumper which would require physical access to move?
- nickpsecurity 8y agoEEPROM + physical jumpers are what I always recommended. Blocks most if not all software attacks, makes physical attacks more noticeable (eg at a cafe), and still leaves control in hands of owner. Just a bit of inconvenience but quite usable.
- deepsun 8y agoI don't think it's relevant to the article. If your host machine has malware in CPU firmware, then it doesn't matter whether you boot from [stateless] USB, because malware sits between your kernel and, say, keyboard, network card, or display.
- justifier 8y agosounds horrifying can you point to any resources on a few things: (o) examples of these kinds of malware, either code or writeups (i) ways of detecting these kinds of malware (ii) ways of removing these kinds of malware (iii) ways of preventing these kinds of malware from getting installed
- efp 8y agohttps://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7... http://spritesmods.com/?art=hddhack&page=5 http://spritesmods.com/?art=hddhack&page=5 https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf
- justifier 8y agoit looks like all of your links are basically only addressing my initial list item the first link is about modifying a system's c compiler which the op's tails live usb is infact a solution to the second is about altering firmware on harddrives, which is an engrossing writeup, thank you, but does fall short of suggesting ways to identify and remedy such an invasion your third one is about intel's ME which i figured i'd see someone link to unfortunately, the really interesting listed elements in my original post are the preventative and resolutive elements