2

I have been using the online upgrade process offered by Tails in the pop-up dialog. But, I got to thinnking (paranoid) that maybe I should download a new iso, burn to CD/DVD, boot to CD/DVD and then install to USB drive, instead. Upgrading while online seems to me like an additional vulnerability, since I have no way of knowing what is being downloaded/uploaded or what is going on. Any thoughts/concerns/recommendations? Thanks.

1
  • You should definitely download the new ISO, unless you're using something like VMWare or VirtualBox.
    – encrypTOR
    Sep 25, 2014 at 22:04

2 Answers 2

1

I don't see how running a Tails virtual machine (if that is what you mean by "... unless you are running something like VMWare or VirtualBox."), has any mitigating impact on my scenario/concern. I believe that anything that could be done to a physical instance of Tails (hack/snoop/sniff/etc.), can be done to a virtual instance of Tails, can it not?

1
  • 1
    This is not an answer. Please use your original "unregistered" account (access credentials are stored in cookies) and add this as a comment to your question. Thank you. Sep 27, 2014 at 20:39
0

I don't know of any additional vulnerabilities introduced specifically by the Tails online update process. However, when a new version of Tails comes out, I now download the new .iso because:

  1. The new updated version in .iso format has a SHA256 Checksum that can be used to verify the cryptographic signature of the image. You do not get that with the online upgrade that I am aware of, unless it is done silently during the online upgrade process.
  2. Doing a clean install from the iso wipes the USB thumb drive that could remove any malware on the drive if there is any on it from prior use.

For these 2 reasons, imo it is better to do a clean install from a new .iso image. But it is not as convenient.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .