How safe is Tails, since the Zero-day flaws? Are they fixed, and do we really trust it?
Since the bug affects I2P, which is not started by default, it is safe to use Tails 1.1 if you disable I2P and follow the instructions provided by the Tails developers under the heading "Temporary Solutions" in their response to this issue: https://tails.boum.org/security/Security_hole_in_I2P_0.9.13/index.en.html
You can protect yourself from this security hole until it is corrected.
Do not start I2P in Tails 1.1 and earlier. You can protect yourself further by removing the
i2ppackage every time you start Tails:
Set an administration password.
Run this command in a Root Terminal:
apt-get purge i2p
This vulnerability in I2P has been fixed upstream in I2P version 0.9.14: https://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release. Hopefully there will soon be a new Tails release which includes this updated version.
On the Tails dev mailing list, there is currently a discussion about further measures to harden/sandbox I2P in Tails in future releases: https://mailman.boum.org/pipermail/tails-dev/2014-July/006459.html.
Well, I can say it is very safe. Like all software, there will be 0days. The developers of TAILS are very committed to their work, and security is very important to them, since its their business. They have not fixed the most recent 0day found, but they are working on it. The release of the 0day has been delayed to accommodate the users' security. End answer: It is safe enough for you to do confidential activities on it, otherwise there wouldn't be any marketplaces on I2P
The zero day flaw is not fixed yet. Be advised that this flaw was there for ages, so you maybe already uncovered. Since the detail of the zero day flaw will be published in few days or few weeks, it is prudent to refrain from using Tails until the details become public. EXODUS has informed Tails folks about this zero day flaw, it is interesting to read their blog about this subject.
P.S. There are other issues beside this zero day flaw too.
On July 4 2014 we found a group of relays that we assume were trying to de-anonymize users. They appear to have been targeting people who operate or access Tor hidden services. The attack involved modifying Tor protocol headers to do traffic confirmation attacks.
Read Tor security advisory for detail.