When You Need An Envelope - Part II

I originally wrote about TAILS, The Amnesic Incognito Live System, back in November of 2012 when I first started playing around with it.  TAILS is a live OS, a Debian Linux implementation, designed to be a complete, ready to use OS that you can keep on a thumb drive, and which offers anonymity to users.  Back in that post, tails was distributed as version 0.14.  It has been regularly updated since then, and the community finally felt it was ready to release as a "finished" version (as if that ever exists):  TAILS 1.0 was released at the end of April. 

That TAILS page is complete information for getting started, and the download itself is an .iso file, the kind used for either creation of a CD or DVD (from Windoze, as most of us are, use something like ImgBrn to burn the disk).  The TAILS link has instructions and a link to a method of transferring the .iso file to a USB memory stick, or you can do what I do: boot from the CD, and use the built in utility to clone the OS to the USB drive.  I have a 4GB miniature thumb drive (more the size of a thumbnail drive) that holds TAILS and some other files I'd want to bring with it. 

Tails is based on TOR, The Onion Router, and it's helpful to think of the layers of an onion as a model for what TOR does.  It uses hidden layers of routing information, hidden tunnels if you prefer, with messages bouncing around through different routers at all times, to discourage (I'm reluctant to say "defeat") traffic analysis, one of the most common forms of intelligence gathering the three letter agencies use.  TOR helps to reduce the risks of both simple and sophisticated traffic analysis by distributing your transactions over several places on the Internet, so no single point can link you to your destination. The idea is similar to using a twisty, hard-to-follow route in order to throw off somebody who is tailing you — and then periodically erasing your footprints.  In addition to that, TOR negotiates one time encryption keys with other nodes on this network, one hop at a time, and each relay along the way knows only which relay gave it data and which relay it is giving data to. No individual relay ever knows the complete path that a data packet has taken.

All of your actions - web use, emails, anything, are run through anonymizers.  Web searches go through Startpage.  Your address is blocked.  Security is built in from the ground up.  All to keep you anonymous.  The "Amnesic" part in TAILS is because the system forgets everything you've done when you shut it down.  Pull that USB drive and it's deaf, dumb and blind.  What you sacrifice for this security is speed.  Because of all of these hops around the network, TAILS is slower than your regular internet communications.  In a sense, the decision is an old one:  would you rather be fast or invisible?  TAILS' intent is to make users invisible; to allow anonymous communications for people in delicate or deadly situations.  Reporters in conflict zones, NGOs monitoring sensitive areas, and while this will rile some people, the US military has used it.  The most famous use of TAILS (reportedly) was by Edward Snowden.  If anyone made more of the general population aware of TAILS, it was Snowden.  From the TOR overview page.

Groups such as Indymedia recommend Tor for safeguarding their members' online privacy and security. Activist groups like the Electronic Frontier Foundation (EFF) recommend Tor as a mechanism for maintaining civil liberties online. Corporations use Tor as a safe way to conduct competitive analysis, and to protect sensitive procurement patterns from eavesdroppers....

A branch of the U.S. Navy uses Tor for open source intelligence gathering, and one of its teams used Tor while deployed in the Middle East recently. Law enforcement uses Tor for visiting or surveilling web sites without leaving government IP addresses in their web logs, and for security during sting operations.

The variety of people who use Tor is actually part of what makes it so secure. [pdf warning]  Tor hides you among the other users on the network, so the more populous and diverse the user base for Tor is, the more your anonymity will be protected.

All of that is the positive side.  In the dark underside of the internet, groups like sex slave traders, pedophiles, black hat hackers, and criminals of all stripes have been drawn to TOR as a way to obscure themselves.  When that happens, the police, FBI, and other agencies have to follow into the onion to try to keep up with the undesirables.  

How secure is TOR?  More secure than an envelope in the postal system, but not perfect.  One thing the open source community around TOR (and TAILS) is really good at doing, is reviewing attacks on their tools and continually improving them.  Just remember, as my favorite XKCD cartoon above depicts, you don't attack the adversary's strong points, you attack the weak points - and that's what the three letter agencies are doing.  According to a report on Help Net Security this week, Andy Malone, founder of the Cybercrime Security Forum and Microsoft MVP, warns that using Tor does not guarantee the information you're trying to keep hidden won't be compromised.

The security of the Tor network itself has not yet been broken (as far as we know), but Malone says that Tor leaks can occur through third-party apps and add-ons. "If I was doing forensics on you and thought you were on Tor, I wouldn't attack the network I'd attack the weak areas around it," says Malone.

Users should also be aware that the NSA and the GCHQ are installing hundreds of Onion Routers in order to capture and analyze traffic. If they visit the Deep Web, they should also know that among the different websites there are also honeypot ones created (or hijacked and turned into honeypots) by law enforcement agencies to catch criminals.

If you're using TOR because you need to send email that you really don't want to be snooped on, encrypt it!  An envelope within an envelope.  One time pads are mathematically unbreakable if used properly.  If you're running some sort of operation that you don't want tracked, don't use the same computer in the same location all the time.  In other words if you're running a criminal enterprise, don't do it from your living room!  TOR was intended - and works best - for individuals like reporters or operators in a hostile country or war zone trying to get information out.  The kind of people who might use a laptop or tablet in a hotel one night and a public computer somewhere else on another day.   

So add TAILS/TOR to your toolbox, but don't think it's the be-all and end-all of security.  It does some things very well, but it won't solve every problem.