Why is the "administrator" password not saved in Tails?

Question

I can use any password to be administrator for each particular session [as long as I type it twice], at Tails boot.

That seems like a g a p i n g security hole if an adversary were to get/have access to our USB-copy of Tails: they could immediately login as "administrator".

My very-limited understanding of Tails/Debian/Linux leads me to think that anyone who has "administrator" privileges on a particular system can do anything that they want to on that system. Regarding that, the issue of primary concern to me is the privacy of the "Persistent" storage.

Answer 1

Correct however anyone with access to the physical media need not set the administartor password to gain the equivalent of root access.

From that perspective disabling the ability to ever be root would break the experience of more advanced Tails users while also not stopping an adversary with physical access to the boot media from exploiting it.

1. Gaining physical access to the boot media gives them only the ability to tamper with the live system, which only contains a stock Tails image, there is no user stored information available.
2. Anyone who was able to access the media to boot from it would be able to far more easily tamper with the boot sector instead of having to login to Tails, providing them with a more powerful and simpler means to subvert the users operating system.
3. This actually applies to most operating systems, from Microsoft's Ten Immutable Laws Of Security: "Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore." While the attack surface for any adversary has been reduced this is still mostly true today for almost all operating systems and computers and defending against it is expensive, limited and difficult.

So, if someone was able to gain physical access they could not access your Encrypted Persistent Storage because it is encrypted. Unless they had knowledge of the passphrase to unlock the persistent volume, or the passphrase for the persistent volume was sufficiently weak that they could guess it efficiently.

However, instead they'd take the approach of tampering with the boot process and subverting the Linux kernel before it was able to start, in this way they could use it to keylog your entry of the passphrase and later decrypt the persistent storage.

Keep your Tails boot media safe:

• Don't plug it into untrusted hardware.
  • This would be a vector for lateral movement, for an attacker to move from that system and infect your Tails installation.
• Don't boot it on untrusted systems.
  • See above.
• Don't leave it in places where you think it might be tampered with.

• Don't use an untrusted USB device as your Tails boot media.

  • A USB with maliciously altered firmware could perform the aforementioned attacks regardless of the Tails installation itself being good and untampered.

• Do try to keep your boot media safe and either in use, in a safe storage place or on your person.

• Do use strong passphrases even if you try to keep your boot media out of malicious hands..