1

Does tails have a penetrable firewall?

Currently tails firewall has a very complicated structure to it. It is difficult to say if the firewall is penetrable or not. One might think it is not when it is.

Currently tails firewall allows both encrypted and unencrypted TCP data to go through it. This is evident as tails still has the unsecured browser. Tails may be made a more secure OS by preventing the firewall from allowing unencrypted data. This may prevent a local hack against tails or an attack directed against tails from the ISP or an attacker hacking the ISP to hack a tails OS. There are some OS that are used on routers that can route based on protocol. It may be possible to route of TLS/SSL data. This is called policy based routing. Policy based routing is present in DD-WRT routers. This routing method combined with dropping all the packets that are not in the policy may result in a pure encrypted data. I am not saying to make tails a routing OS but use something similar to this function to make tails OS more secure. Using this in tails OS or something similar like that may prevent the unintended (unencrypted) data packets from getting through the firewall in tails OS. This may make tails a more secure OS. Yes this will mean that the unsecured browser will need to be removed from the tails OS. I believe that the Unsecured browser is hardly used on tails and would not be missed. I for one have never used it. If you need to keep the unsafe browser for captive portals then you could may be have it be included as an option on start up like the browser used for hidden services and start tails in an unsecured mode.

Would it be more secure if tails were to drop all TCP unencrypted data? Could this be done to tails firewall?

  • I updated to answer to match your edits. Rephrasing things slightly doesn't stop it being wrong, you know? – cacahuatl Jul 26 '16 at 18:05
  • 1
    What do you mean by "more secure"? There's no point in discussing "security" without knowing what you're trying to protect against. What's the threat vector you're worried about? All security is a trade off; "more secure" is somewhat meaningless without context. – Sam Whited Jan 23 '17 at 1:32
1

"Tails may be made a more secure OS by preventing the firewall from allowing unencrypted data."

No. There is no meaningful way to discern between "encrypted" an "unencrypted". Furthermore day-to-day network usage (DHCP, etc) depend on it being able to send unencrypted traffic and access to "captive portals" and local resources are required by many of it's use cases.

"This may prevent a local hack against tails or an attack directed against tails"

No, there's no reason the attacker couldn't exfiltrate and serve the attack over an encrypted channel.

"There are some OS that are used on routers that can route based on protocol."

Many Pluggable Transports don't appear as a distinct or recognisable protocol for their transport encryption. A packet filter could not recognise them. This would break censorship circumvention.

"I for one have never used [the Unsafe Browser]"

That's great but Tails wasn't built for you alone and plenty of legitimate use cases depend on it. The suggestion to only enable it if the user requires it is a nice idea but as mentioned access to local resources is within it's intended use cases.

Enabling the Unsafe Browser from the greeter alone is probably a reasonable step to take (though I'm not convinced you actually understand why this might be, and hopefully in the near-future will be irrelevant) but since local network access is required for general use (DHCP, etc) it is not trivial to stop entirely. It would require significant effort to implement and would likely not provide coverage of these vectors.

"Would it be more secure if tails were to drop all TCP unencrypted data?"

No.

"Could this be done to tails firewall?"

No packet filter can provide this functionality (just ask Godel).

Also, Tails' iptable rules are generated by ferm which has a far more readable config file that it generates the rules from, with comments too. See config/chroot_local-includes/etc/ferm/ferm.conf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.