Let's suppose my goal is to prevent someone from tampering with my TAILS session while I'm absent from my laptop, and let's suppose that shutting down every time I go for a walk isn't an option.

The lock-screen password is good, but let's suppose that it is not enough for me. There could be a security hole that bypasses the lock-screen or someone could know my password.

Does suspending the laptop then physically removing the USB drive provide better security? On a first glance, it seems pretty secure:

  • If the lid is opened without inserting the USB drive first, the laptop will immediately shut down, and the attacker wouldn't even know why (they could just assume I used the webcam or something else to detect unauthorized persons).
  • If I notice the laptop is turned off when I come back, I will be alarmed and I can check for signs of tampering or consider buying a new laptop.
  • If they install a 'fake TAILS' on the laptop and turn it back on, I will notice that all my session state is gone and I will also be alarmed.
  • If someone wants to open the laptop without triggering shut-down, they'll need to a) know that I am using TAILS in this way, b) own the same brand of USB-drive that I used, and c) know which USB port I plugged the USB drive into. Even after this, they'll still need to break the lock-screen.
  • Installing a hardware backdoor surely must be a bit more difficult while the hardware is still turned on, and if they ever accidentally open the lid just a little bit, it's game over.
  • No one can install malware on my TAILS USB if I carry it with me at all times.

Am I missing anything? Why isn't this a widely recommended practice? The only minor downsides that I see:

  • you could accidentally trigger shutdown yourself.
  • the session RAM can still be read physically on the hardware-level (but this could be prevented if there was an option to suspend to the USB stick instead of to RAM).
  • I wouldn't trust the linux kernel to properly handle the USB device enumeration if you were unlucky enough to plug the key into a different port. I'm aware that tails is run in memory, but you might get a nasty surprise when you try to save your persistent storage as you shut down your session later in the day. Plus, some laptops will see USB hotplug as a wake-able event. So you suspend, unplug, then your laptop wakes up since you unplugged. I'd try it on your particular HW 3 or 4 times and if it works, then its a good solution for you. Maybe not for all. – Dan Jan 3 at 5:28

you should search about cold boot attack: hibernation to the usb is better than suspend because you will carry the data with you.

if someone steal your laptop will have all the time he want to prepare the attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy