1

How safe is Tails, since the Zero-day flaws? Are they fixed, and do we really trust it?

3
  • Can you confirm which version of Tails you mean? Which Zero-day flaws do you mean? Linking to or describing specifically helps other users understand what you're asking. Jul 30, 2014 at 0:06
  • Dear, Please read EXODUS link before you make your mind about the extend of the problem. blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails
    – Roya
    Jul 30, 2014 at 11:34
  • This is essentially the same question as tor.stackexchange.com/questions/3703/…. Although this one is older, the other is better stated, I think. They should be merged or differentiated.
    – mirimir
    Jul 30, 2014 at 15:32

3 Answers 3

2

Since the bug affects I2P, which is not started by default, it is safe to use Tails 1.1 if you disable I2P and follow the instructions provided by the Tails developers under the heading "Temporary Solutions" in their response to this issue: https://tails.boum.org/security/Security_hole_in_I2P_0.9.13/index.en.html

Temporary solutions

You can protect yourself from this security hole until it is corrected.

Do not start I2P in Tails 1.1 and earlier. You can protect yourself further by removing the i2p package every time you start Tails:

  1. Set an administration password.

  2. Run this command in a Root Terminal:

    apt-get purge i2p

However, if you really need to use I2P in Tails 1.1: before you start I2P, disable JavaScript globally with NoScript in the Tor Browser.

This vulnerability in I2P has been fixed upstream in I2P version 0.9.14: https://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release. Hopefully there will soon be a new Tails release which includes this updated version.

On the Tails dev mailing list, there is currently a discussion about further measures to harden/sandbox I2P in Tails in future releases: https://mailman.boum.org/pipermail/tails-dev/2014-July/006459.html.

2
1

Well, I can say it is very safe. Like all software, there will be 0days. The developers of TAILS are very committed to their work, and security is very important to them, since its their business. They have not fixed the most recent 0day found, but they are working on it. The release of the 0day has been delayed to accommodate the users' security. End answer: It is safe enough for you to do confidential activities on it, otherwise there wouldn't be any marketplaces on I2P

Resources: http://www.pcworld.com/article/2458640/until-the-tails-privacy-tool-is-patched-heres-how-to-stay-safe.html

http://blogs.computerworld.com/malware-and-vulnerabilities/24177/zero-day-broker-exploits-vulnerability-i2p-de-anonymize-tails-users

2
  • Dear, Where do you get all of this confidence from? Is it based on your belief or based on facts?. Please read the EXODUS link before you make your mind. blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails
    – Roya
    Jul 30, 2014 at 11:21
  • Of course I agree with EXODUS's statement on not trusting a service completely, but I do stand with my decision on trusting the security of TAILS. If truly wished, you could use a VPN with TAILS, but with all the news I've read, I personally come to the conclusion that it is not needed.
    – user3226
    Jul 30, 2014 at 22:51
0

The zero day flaw is not fixed yet. Be advised that this flaw was there for ages, so you maybe already uncovered. Since the detail of the zero day flaw will be published in few days or few weeks, it is prudent to refrain from using Tails until the details become public. EXODUS has informed Tails folks about this zero day flaw, it is interesting to read their blog about this subject.

http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/

P.S. There are other issues beside this zero day flaw too.

On July 4 2014 we found a group of relays that we assume were trying to de-anonymize users. They appear to have been targeting people who operate or access Tor hidden services. The attack involved modifying Tor protocol headers to do traffic confirmation attacks.

Read Tor security advisory for detail.

https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .