1

How safe is Tails, since the Zero-day flaws? Are they fixed, and do we really trust it?

2

Since the bug affects I2P, which is not started by default, it is safe to use Tails 1.1 if you disable I2P and follow the instructions provided by the Tails developers under the heading "Temporary Solutions" in their response to this issue: https://tails.boum.org/security/Security_hole_in_I2P_0.9.13/index.en.html

Temporary solutions

You can protect yourself from this security hole until it is corrected.

Do not start I2P in Tails 1.1 and earlier. You can protect yourself further by removing the i2p package every time you start Tails:

  1. Set an administration password.

  2. Run this command in a Root Terminal:

    apt-get purge i2p

However, if you really need to use I2P in Tails 1.1: before you start I2P, disable JavaScript globally with NoScript in the Tor Browser.

This vulnerability in I2P has been fixed upstream in I2P version 0.9.14: https://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release. Hopefully there will soon be a new Tails release which includes this updated version.

On the Tails dev mailing list, there is currently a discussion about further measures to harden/sandbox I2P in Tails in future releases: https://mailman.boum.org/pipermail/tails-dev/2014-July/006459.html.

| improve this answer | |
1

Well, I can say it is very safe. Like all software, there will be 0days. The developers of TAILS are very committed to their work, and security is very important to them, since its their business. They have not fixed the most recent 0day found, but they are working on it. The release of the 0day has been delayed to accommodate the users' security. End answer: It is safe enough for you to do confidential activities on it, otherwise there wouldn't be any marketplaces on I2P

Resources: http://www.pcworld.com/article/2458640/until-the-tails-privacy-tool-is-patched-heres-how-to-stay-safe.html

http://blogs.computerworld.com/malware-and-vulnerabilities/24177/zero-day-broker-exploits-vulnerability-i2p-de-anonymize-tails-users

| improve this answer | |
  • Dear, Where do you get all of this confidence from? Is it based on your belief or based on facts?. Please read the EXODUS link before you make your mind. blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails – Roya Jul 30 '14 at 11:21
  • Of course I agree with EXODUS's statement on not trusting a service completely, but I do stand with my decision on trusting the security of TAILS. If truly wished, you could use a VPN with TAILS, but with all the news I've read, I personally come to the conclusion that it is not needed. – user3226 Jul 30 '14 at 22:51
0

The zero day flaw is not fixed yet. Be advised that this flaw was there for ages, so you maybe already uncovered. Since the detail of the zero day flaw will be published in few days or few weeks, it is prudent to refrain from using Tails until the details become public. EXODUS has informed Tails folks about this zero day flaw, it is interesting to read their blog about this subject.

http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/

P.S. There are other issues beside this zero day flaw too.

On July 4 2014 we found a group of relays that we assume were trying to de-anonymize users. They appear to have been targeting people who operate or access Tor hidden services. The attack involved modifying Tor protocol headers to do traffic confirmation attacks.

Read Tor security advisory for detail.

https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.