I can use any password to be administrator for each particular session [as long as I type it twice], at Tails boot.

That seems like a g a p i n g security hole if an adversary were to get/have access to our USB-copy of Tails: they could immediately login as "administrator".

My very-limited understanding of Tails/Debian/Linux leads me to think that anyone who has "administrator" privileges on a particular system can do anything that they want to on that system. Regarding that, the issue of primary concern to me is the privacy of the "Persistent" storage.

Correct however anyone with access to the physical media need not set the administartor password to gain the equivalent of root access.

From that perspective disabling the ability to ever be root would break the experience of more advanced Tails users while also not stopping an adversary with physical access to the boot media from exploiting it.

  1. Gaining physical access to the boot media gives them only the ability to tamper with the live system, which only contains a stock Tails image, there is no user stored information available.
  2. Anyone who was able to access the media to boot from it would be able to far more easily tamper with the boot sector instead of having to login to Tails, providing them with a more powerful and simpler means to subvert the users operating system.
  3. This actually applies to most operating systems, from Microsoft's Ten Immutable Laws Of Security: "Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore." While the attack surface for any adversary has been reduced this is still mostly true today for almost all operating systems and computers and defending against it is expensive, limited and difficult.

So, if someone was able to gain physical access they could not access your Encrypted Persistent Storage because it is encrypted. Unless they had knowledge of the passphrase to unlock the persistent volume, or the passphrase for the persistent volume was sufficiently weak that they could guess it efficiently.

However, instead they'd take the approach of tampering with the boot process and subverting the Linux kernel before it was able to start, in this way they could use it to keylog your entry of the passphrase and later decrypt the persistent storage.

Keep your Tails boot media safe:

  • Of course I did not suggest that users be denied the ability to ever be root -- that would obviate the whole trust-building notion of "open" software. [See my Title] – agd Jan 24 '17 at 5:49
  • However, I did think that our passphrase was used to gain access to the encrypted storage; in the same way that a password gains access to anything, by being compared against a stored copy thereof. Your answer indicates that our passphrases are used more directly, and are mathematically applied to our data, through an encryption algorithm; with NO need to store our passphrase on our media. So that the ONLY way in which our passphrases are actually "stored" on our media is by the way in which our stored data is altered by our passphrase? 1)Correct? – agd Jan 24 '17 at 5:49
  • If I follow your "However, instead..." correctly: the vulnerability you describe being exploited there implies that an adversary would have ongoing surreptitious access; and corrupt and return the media to me, so that I would inadvertently provide my passphrase to their keylogger; and they would then need to reaccess my media to get my info. 2)Correct? – agd Jan 24 '17 at 5:52
  • I did think that if an adversary could readily be root, that they could much more easily try to decrypt our information; and at the least transfer our encrypted data to a different system where passphrases could be much more rapidly presented to our data. {It seems that today's "strong" passphrase is tomorrow's "weak" passphrase. As has already occurred with passwords; and is hinted at by the increasing sizes of cryptocurrencies.} I did not realize that anyone with access to the media had the equivalent of root access. – agd Jan 24 '17 at 5:53
  • As to your assertion [at your "2."] that tampering with a boot sector is "simpler" than providing any password of their choice twice [e.g. >>1<< >>1<<]; I think you have erred. – agd Jan 24 '17 at 5:54

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.