Tor users can be identified as Tor users one way or the other. Now Tails users are subset of Tor users. Can this subset be identified as Tails users? Or this subset can not be distinguished from other Tor users. The point being, anonymity is in numbers, and total Tor users are probably orders of magnitude larger than Tails users. If Tails user in any way become distinguishable from other Tor users, The probability that he can be de-anonymized will increase by orders of magnitude.

  • 1
    +1, very good question. My guess would be that there may (or could) be some settings and configurations that could expose Tails. And if so, like you said, this would make you stand out more. Unfortunately I don't have any evidence that this is the case, but will look into it. Jan 25 '14 at 13:09

There is two different levels on which you can be identified as a Tor or Tails user. It is not clear from your question which you means, so I will answer both.

The website server you visit knows if you are using Tor or Tails

Tails users can be identified as such by its browser fingerprint. For example, Tails comes with AdBlock Plus, and Tor Browser Bundle (TBB) doesn't. The configuration in the browser also differs somewhat in other regards.

Since most TBB users download ads, but most Tails users doesn't, that allows to guess whether you are a TBB user or Tails users. The exact list of ads Tails blocks is also fixed for a certain Tails release, so a TBB user that have installed AdBlock Plus will probably not have the same list, which makes the guessing even easier.

Tails does try to keep its fingerprint as close as possible to the Tor Browsers however, which of course makes it somewhat hard to fingerprint. It will probably keep improving further in the future, for example: Tails have discusses whether or not to remove AdBlock Plus in a future Tails release.

See section "3.11 Fingerprint" in Tails design document.


Your ISP or network admin knows if you are using Tor or Tails

Tails does only send Tor traffic, whereas another operating system with TBB on will also sends non-Tor traffic (e.g. syncing clocks, checking for system updates, etc). If your computer only sends Tor traffic, it is probably Tails.

  • Sorry, I did not understand your last paragraph. Would you please elaborate on this. "Tails can also be identified as such by your local network administrator, as Tails does only send Tor traffic, whereas another operating system with TBB on will also sends non-Tor traffic
    – Roya
    Jan 26 '14 at 21:09
  • 1
    I updated the answer. That issue was separate, I tried to make that clearer, and tried to give an example. Hope that helped.
    – Rhin
    Jan 28 '14 at 14:48
  • Hosts running Whonix also send both Tor and non-Tor traffic.
    – mirimir
    Jul 28 '14 at 11:46

The remote end (websites and exit nodes) can distinguish between TBB and Tails: An ad blocker is installed by default in Tails' browser (but not TBB), so the two typically have differing request patterns.


well many sites now use methods like browser fingerprinting which will not only identify the OS but generate a unique hash for the box itself. These are the processes that lead to to advanced ad targeting, but they can also be employed for malicious and adversarial purposes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.