Let's suppose my goal is to prevent someone from tampering with my TAILS session while I'm absent from my laptop, and let's suppose that shutting down every time I go for a walk isn't an option.
The lock-screen password is good, but let's suppose that it is not enough for me. There could be a security hole that bypasses the lock-screen or someone could know my password.
Does suspending the laptop then physically removing the USB drive provide better security? On a first glance, it seems pretty secure:
- If the lid is opened without inserting the USB drive first, the laptop will immediately shut down, and the attacker wouldn't even know why (they could just assume I used the webcam or something else to detect unauthorized persons).
- If I notice the laptop is turned off when I come back, I will be alarmed and I can check for signs of tampering or consider buying a new laptop.
- If they install a 'fake TAILS' on the laptop and turn it back on, I will notice that all my session state is gone and I will also be alarmed.
- If someone wants to open the laptop without triggering shut-down, they'll need to a) know that I am using TAILS in this way, b) own the same brand of USB-drive that I used, and c) know which USB port I plugged the USB drive into. Even after this, they'll still need to break the lock-screen.
- Installing a hardware backdoor surely must be a bit more difficult while the hardware is still turned on, and if they ever accidentally open the lid just a little bit, it's game over.
- No one can install malware on my TAILS USB if I carry it with me at all times.
Am I missing anything? Why isn't this a widely recommended practice? The only minor downsides that I see:
- you could accidentally trigger shutdown yourself.
- the session RAM can still be read physically on the hardware-level (but this could be prevented if there was an option to suspend to the USB stick instead of to RAM).