I have been using the online upgrade process offered by Tails in the pop-up dialog. But, I got to thinnking (paranoid) that maybe I should download a new iso, burn to CD/DVD, boot to CD/DVD and then install to USB drive, instead. Upgrading while online seems to me like an additional vulnerability, since I have no way of knowing what is being downloaded/uploaded or what is going on. Any thoughts/concerns/recommendations? Thanks.

  • You should definitely download the new ISO, unless you're using something like VMWare or VirtualBox.
    – encrypTOR
    Sep 25 '14 at 22:04

I don't see how running a Tails virtual machine (if that is what you mean by "... unless you are running something like VMWare or VirtualBox."), has any mitigating impact on my scenario/concern. I believe that anything that could be done to a physical instance of Tails (hack/snoop/sniff/etc.), can be done to a virtual instance of Tails, can it not?

  • 1
    This is not an answer. Please use your original "unregistered" account (access credentials are stored in cookies) and add this as a comment to your question. Thank you.
    – pabouk
    Sep 27 '14 at 20:39

I don't know of any additional vulnerabilities introduced specifically by the Tails online update process. However, when a new version of Tails comes out, I now download the new .iso because:

  1. The new updated version in .iso format has a SHA256 Checksum that can be used to verify the cryptographic signature of the image. You do not get that with the online upgrade that I am aware of, unless it is done silently during the online upgrade process.
  2. Doing a clean install from the iso wipes the USB thumb drive that could remove any malware on the drive if there is any on it from prior use.

For these 2 reasons, imo it is better to do a clean install from a new .iso image. But it is not as convenient.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.