3

Let's suppose my goal is to prevent someone from tampering with my TAILS session while I'm absent from my laptop, and let's suppose that shutting down every time I go for a walk isn't an option.

The lock-screen password is good, but let's suppose that it is not enough for me. There could be a security hole that bypasses the lock-screen or someone could know my password.

Does suspending the laptop then physically removing the USB drive provide better security? On a first glance, it seems pretty secure:

  • If the lid is opened without inserting the USB drive first, the laptop will immediately shut down, and the attacker wouldn't even know why (they could just assume I used the webcam or something else to detect unauthorized persons).
  • If I notice the laptop is turned off when I come back, I will be alarmed and I can check for signs of tampering or consider buying a new laptop.
  • If they install a 'fake TAILS' on the laptop and turn it back on, I will notice that all my session state is gone and I will also be alarmed.
  • If someone wants to open the laptop without triggering shut-down, they'll need to a) know that I am using TAILS in this way, b) own the same brand of USB-drive that I used, and c) know which USB port I plugged the USB drive into. Even after this, they'll still need to break the lock-screen.
  • Installing a hardware backdoor surely must be a bit more difficult while the hardware is still turned on, and if they ever accidentally open the lid just a little bit, it's game over.
  • No one can install malware on my TAILS USB if I carry it with me at all times.

Am I missing anything? Why isn't this a widely recommended practice? The only minor downsides that I see:

  • you could accidentally trigger shutdown yourself.
  • the session RAM can still be read physically on the hardware-level (but this could be prevented if there was an option to suspend to the USB stick instead of to RAM).
Improve this question
1
  • I wouldn't trust the linux kernel to properly handle the USB device enumeration if you were unlucky enough to plug the key into a different port. I'm aware that tails is run in memory, but you might get a nasty surprise when you try to save your persistent storage as you shut down your session later in the day. Plus, some laptops will see USB hotplug as a wake-able event. So you suspend, unplug, then your laptop wakes up since you unplugged. I'd try it on your particular HW 3 or 4 times and if it works, then its a good solution for you. Maybe not for all.
    – Dan
    Commented Jan 3, 2019 at 5:28

2 Answers 2

Reset to default
2

you should search about cold boot attack: hibernation to the usb is better than suspend because you will carry the data with you.

if someone steal your laptop will have all the time he want to prepare the attack.

Improve this answer
1
  • Yes, I'm tempted to suggest to take the laptop with your walk.
    – U. Windl
    Commented Jan 26, 2020 at 0:31
0

You have not specified your threat model. But…

There could be a security hole that bypasses the lock-screen or someone could know my password.

It sounds like you are worried about something much more serious than a busybody who stumbles across your laptop. There are probably threats that you and I have both missed, but here are two of the more obvious issues:

  1. The procedure you describe is hard for people not used to it – which I am guessing is just about everyone. Anything that is hard is bad. People are less likely to do it to begin with and more likely to get it wrong when they do try to do it. And that, in itself, can be a security issue.
  2. Suppose someone guesses that you are suspending Tails sessions, perhaps by monitoring your network traffic, and also notices that you always remove the USB drive. This behaviour might be suspicious.
Improve this answer

You must log in to answer this question.