So I was suggested to use Tails on a VirtualBox software. But as I was going thru the documentation, I saw this security limitation

"Both the host operating system and the virtualization software are able to monitor what you are doing in Tails."

I would like to know what changes should be made to host machine(XP,Vista,Win7) and to the VirtualBox software so that the info cannot be traced.

4 Answers 4


This one irks me, especially when the "VMs are magic" crowd provide answers like:

If you are using your own computer, it is probably safe.

As the documentation states there are limitations. The "guest" (Tails) cannot do anything about the actions of the "host". It is running inside a virtualized environment that Tails expects and believes to be hardware. Some of Tails' properties only hold if it is running in the environment that it expects!

It has anti-forensic properties, Tails is meant to not leave forensic evidence on the system. If you run Tails inside of a VM on a host system that uses a pagefile or swap, chunks of the memory in use by the Tails virtual machine will be written to disk. This means information about the website your were browsing, your cryptographic keys, your plaintext instant messenging and email may just be written to disk in plaintext. Worse still if the systems support hibernation or suspend-to-disk, it will write the entire contents of memory(!!) to disk! Everything in your Tails session would be stored on the filesystem of the Host machine.

Tails cannot be amnesic anymore. The VM, too, is possibly storing unexpected information about it's state even if you've disabled paging/swap (can you even fully do this under Windows?) and hibernation.

Using full disk encryption isn't even a great solution, many Linux installers only encrypt the swap with the same master key as is used for your system partition. Ideally swap should be encrypted with a random key generated each boot. This means on shutdown the key is purged from memory and swap is, for all intents and purposes, irrecoverable. However in the current LVM-on-LUKS setups as used by Debian, Ubuntu, et al. the swap persists and your system key can be used to reveal your past activities. Infact previously "Full Disk Encryption" solutions like Bitlocker used to write to a hibernation file outside of the encrypted partition, meaning your encryption key for the disk was written in plaintext...to the disk. So everything your computer was doing at the time of hibernation (or the last time it hibernated) would be readable by anyone with physical access.

Be very careful when second guessing the design decisions of, and especially the large warning signs created by, the Tails team. They are not arbitrary decisions.

  • Out of curiosity, if one never hibernated (to disk I mean, not suspend to RAM) and has no swap, is your primary concern whether or not the VM is storing information somewhere (like a log or some ~/. file)?
    – Hendy
    Commented Jul 8, 2017 at 20:46

If you are using your own computer, it is probably safe. If you worry about backdoors, read the source code of linux, compile it, and use it.

  • Quick question, if I use my laptop to a coffee shop / some place that offers WiFi, is there a possibility of being tracked? Commented Apr 18, 2016 at 4:48
  • see superuser.com/questions/398776/tor-public-wi-fi-safe
    – v7d8dpo4
    Commented Apr 18, 2016 at 7:05
  • and how to stop virtual box from monitoring what I'm doing while using Tails? Commented Apr 18, 2016 at 13:29
  • By default, virtualbox doesn't record your activities.
    – v7d8dpo4
    Commented Apr 18, 2016 at 13:34
  • "Both the host operating system and the virtualization software are able to monitor what you are doing in Tails." Commented Apr 18, 2016 at 13:50

Disable Swap in Proxmox

First, use the following command to turn off the SWAP space:

swapoff /dev/pve/swap

Next, deactivate the SWAP logical volume with the following command:

lvchange -a n /dev/pve/swap

Finally, remove the SWAP logical volume with this command:

lvremove /dev/pve/swap

You can see there is no longer swap mentioned:



Basically, if it's physically your machine locally where it's running - it's OK. Use KVM with AMD SEV to make things more secure. About the antivirus on a VM host machine - you don't need it, actually: it runs a bare Linux with SSH and KVM virtualization, so nothing to defend. If you are running it at home - you don't have to even enable the SSH, so no entrance to your host except the local physical console. If you're running it at home - just put it behind the router's NAT and limit the connections to the update sites used, like deb.debian.org - it will need no more, because Tor can work through the proxy server specified - run it on a separate box and you will be secure enough and fine

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .