1

On the site about trusting the tails key, there is a lot of information about verifying that you have downloaded the genuine Tails signing key. I was wondering whether this paranoia is justified. To ask specifically:

  1. As far as is known, has anyone ever hacked the tails website in general, and particularly has anyone edited the key maliciously to fool people?
  2. Are there any recorded cases of someone being the victim of a man-in-the-middle attack while downloading the tails key?
  3. Are there any known malicious versions of tails that have some key associated with them?

(for the record, my download of the key is here: http://pastebin.com/vdXiW9Vz. If that's not the real one, tell me :)

Improve this question
1
  • It is a very bad approach to wait till something bad happens and solve the problem afterwards. – pabouk Oct 24 '14 at 7:24
2

Yes. In fact, researchers recently discovered a rogue exit node that was modifying binary files! Know that Tor protects your anonymity, but that without end to end encryption you are vulnerable to MITM attacks. Some might say you are even more vulnerable since you're more of a target by using Tor.

It is an unfortunate fact that computer security is and always will be an ongoing process. Tools like Tor successfully make it much easier to 'do the right thing', but so far there are no perfect easy-to-use end to end solutions. Always validate everything you pull down using Tor (or off the internet in general for that matter).

Improve this answer
2

Tails website got defaced by 'accident' a while back, luckily it did not become a larger issue then that, but it does show that you do need to be careful.

More info here: http://news.softpedia.com/news/Tails-OS-Website-Defaced-No-Need-to-Worry-448831.shtml

The problem is also that it can be very hard to detect that you have been a victim of a man in the middle attack unless you actually use the keys and verify your downloads. I always download from the official website and verify with the keys, better to be safe then sorry.

When exploits and such are discovered they are always posted on tor project's blog, or tails blog, and promptly fixed. I have not seen any information about compromised keys.

The bugtracker for Tails is located here: https://labs.riseup.net/code/projects/tails/issues?query_id=108 and can be searched.

As for malicious versions of tails - there is probably some floating around various torrent sites and such (which is unsafe to use regardless since they are unofficial ).

Improve this answer
1
  • You're not actually answering any of my specific questions (except first part of first question, which wasn't the main)... – ike Oct 23 '14 at 17:43
1

About reported victims: If such an attack really succeeds you will most likely never find out.

There have been various attacks in the past of the same governments that (want to) block Tor. There have been numerous occasions of governments even faking SSL signatures of websites, so you really want to make sure this isn't the case.

If you take time to download Tor or Tails you really should take that few seconds to minutes time to verify the signature.

Improve this answer
0

Yes, it is very required. You can be a victim of man-in-the-middle attack without anybody else even noticing, so relying on an empty list of publicly known hacks is not satisfactory. Tails has an ambition to be resistive even from a government's surveillance (to the highest possible extent), and these guys have no problem forging the Tails certificate and carrying out a targeted attack.

It is a good practice to always verify the download, and also check your version of the PGP key with your friends, or taken from various machines, over a period of time...

Improve this answer
3
  • Can you answer the question "has anyone ever tried to forge the Tails signing key?" "these guys have no problem forging the Tails certificate and carrying out a targeted attack": source? Has it ever been done? If you read my question closely, you'll see you haven't answered it. – ike Oct 24 '14 at 2:00
  • I was trying to point out that a) it does not matter if such an attack is publicly known, because b) if they do it in a targeted attack form, nobody would now anyway. About the government agencies having the ability to forge certificates, that's very simple - they either own trusted CAs or can force them to comply (by law). CA trust model is very broken, that's a well known thing (but another topic - you can surely find tons of information about this). – knaperek Oct 24 '14 at 9:00
  • 1
    Oh, by the way, if you still doubt the power of government agencies, here's just a tip of an iceberg (recent news about Chinese authorities doing MITM attack on iCloud and other popular services). – knaperek Oct 25 '14 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.