I have been using the online upgrade process offered by Tails in the pop-up dialog. But, I got to thinnking (paranoid) that maybe I should download a new iso, burn to CD/DVD, boot to CD/DVD and then install to USB drive, instead. Upgrading while online seems to me like an additional vulnerability, since I have no way of knowing what is being downloaded/uploaded or what is going on. Any thoughts/concerns/recommendations? Thanks.
1
-
You should definitely download the new ISO, unless you're using something like VMWare or VirtualBox.– encrypTORCommented Sep 25, 2014 at 22:04
Add a comment
|
2 Answers
I don't see how running a Tails virtual machine (if that is what you mean by "... unless you are running something like VMWare or VirtualBox."), has any mitigating impact on my scenario/concern. I believe that anything that could be done to a physical instance of Tails (hack/snoop/sniff/etc.), can be done to a virtual instance of Tails, can it not?
-
1This is not an answer. Please use your original "unregistered" account (access credentials are stored in cookies) and add this as a comment to your question. Thank you. Commented Sep 27, 2014 at 20:39
I don't know of any additional vulnerabilities introduced specifically by the Tails online update process. However, when a new version of Tails comes out, I now download the new .iso because:
- The new updated version in .iso format has a SHA256 Checksum that can be used to verify the cryptographic signature of the image. You do not get that with the online upgrade that I am aware of, unless it is done silently during the online upgrade process.
- Doing a clean install from the iso wipes the USB thumb drive that could remove any malware on the drive if there is any on it from prior use.
For these 2 reasons, imo it is better to do a clean install from a new .iso image. But it is not as convenient.
