Tails OS - A safer way to use the DarkNet

Security, Linux

Though my views aren’t as extreme as Richard Stallman’s, he does have a point: A decade ago we’d be up in arms about relatively trivial privacy-invading crap in operating systems, but it’s since become the norm, with most smartphones and laptops having things pre-installed that send personal data in the background to Google, Microsoft and whichever assortment of corporations. A state of affairs brought about by a confluence of what we collectively surrendered for convenience. Basically our personal devices are already compromised more than they should be, and most certainly for anyone whos threat model includes an adversary with access to considerable resources. The security of modern devices is generally quite good, but too opaque to know the extent to which they’re backdoored.

So, what can be done, if we want anonymity when using the Internet? Obviously, it’s not enough to simply use Tor or a VPN, as that only masks a person’s IP address, and that’s not much protection for someone using a device with a myriad of things pinging various corporations, and consequently enabling those corporations to log the VPN/Tor address alongside his/her identity. When someone uses the Dark Net for something that attracts the interest of law enforcement, it typically doesn’t take much to identify that person, probably not even a court order, largely because of this.

Anonymity is going to require maintaining a separation between your our real-world identity and ouur online activities, in both an OPSEC and a technical context. In the OPSEC context, Internet anonymity is only realistically maintainable for limited purposes, such as maintaining a blog, organising a protest, communicating information about something to a journalist, and using one or two forums to communicate with a small group. In those scenarios, it’s good OPSEC to keep Internet-based comms to a minimum, and to a small handful of services. Anonymity isn’t maintainable for typical Web activity.

In the technical context, this can be done either by running a Linux operating system in a virtual machine, or loading the operating system from a USB drive. Other options include installing UNIX or Linux as our primary operating system and engineering it to be highly secure, but that’s time-consuming and requires expertise.

Most laptops are capable of loading some brand of Linux from a USB instead of loading the default Windows operating system. Tails OS is a brand of Linux that’s engineered for Internet anonymity and privacy.

To get started with Tails, we need:

  • A spare USB drive with a decent amount of storage (8GB minimum). I recommend using a 32GB+ drive.
  • The Tails OS image. This will be an ISO file about 1.3GB in size, available from the Tails OS developers’ Web site.
  • The Etcher software, which is used to install Tails onto the USB drive.

Setup

Getting Tails installed and running was a little easier said than done, but that was more to do with the nature of most Windows laptops these days. Still, I managed it in about twenty minutes.

Running Etcher, it took a couple of attempts to flash the USB drive. Don’t give up if it doesn’t happen the first time. Try it again, and failing that, use an alternative USB flashing application.

After I flashed the USB drive with Tails installed, I needed to access the UEFI settings for the laptop, and set the USB drive as the primary boot device. This causes the laptop’s firmware to load Tails instead of loading Windows from the hard drive. The method for doing this will depend on your laptop.

After Tails loads, we get the old-fashioned Gnome desktop interface, or a minimalistic version of it. Most the menu options are self-explanatory. On a typical Linux system, personal files would be stored in the /home/username directory. With Tails, though, all the personal files are instead stored in /home/amnesia/Persistent, if persistent storage is set up.

The applications included with Tails include Libre Office and the standard text editor, which are useful for blogging and journalism. GIMP is handy for processing images before publication. Audacity can be used for recording podcasts, interviews, etc. Additionally, there are more specialised tools for OpenPGP key management (Kleopatra), hash signature checking (GtkHash), metadata scrubbing (Metadata Cleaner), a BitCoin wallet and hosting content on the DarkNet.

Tor

Tails provides a Tor client and the Tor browser by default for browsing the clear Web and the DarkNet. A lot of Web sites really don’t like people accessing them over Tor, and will make life hard as possible in ‘verifying’ anyone doing that. Again, anyone who needs anonymity is going to avoid the mainstream social media services. Also, your ISP and network administrators (where applicable) can know you’re using Tor, unless the client is configured to use a bridge.

The Tor Browser, as configured here, works pretty well with most sites I’ve visited, though.

Persistent Storage

The next question: Since Tails is a live distro, where can a blogger, journalist or researcher store their sensitive data? We have several options, all of which involve encrypted storage.

The primary option with Tails is the Persistent Storage feature. This will create an encrypted partition on the USB drive for storing your personal configurations, additional software and sensitive data, and it should always be available when you load Tails and enter the password. It uses LUKS, which is the common file system encryption method for Linux, and, in my opinion, it provides far more security than most encrypted USB drives on the market.

Another option is to use a VeraCrypt container, which is also one of the safest methods of encrypting data. I recommend setting up such a container as backup storage for things like OpenPGP keys and Tor Browser bookmarks. Using the application included with Tails, I was able to decrypt one of my containers and copy files to it.

Additionally, there is the option to use Klepatra to encrypt files or a folder before copying them to another USB drive or a Tor-friedndly cloud storage service. In most cases I wouldn’t recommend using PGP-based file encryption, as that actually creates an encrypted copy of the original file, and the latter can be recovered.

Software Installation

The default setup can be limiting for anyone who’s used to having a large collection of software, and especially for an experienced Linux user, but it’s a lot safer than the rather complex security configuration I have on my everyday system.

Using Tails for the best anonymity and privacy, we’re limited in the range of software that could be installed, and that’s not really a bad thing unless we have very specific requirements.

For anyone who hasn’t done much with Linux before, the process for installing additional software can be a learning curve because it involves using a terminal, and because the package manager will output a list of arcane software components as well as software applications themselves. Synaptic and APT are included in Tails. Both have graphical interfaces, but I found that software can only be installed in the terminal, after setting an administrator password at the Welcome screen, and then using the ‘apt-get install’ command.

So, in summary, Tails is highly usable, it’s highly recommended for the aforementioned use cases, and definitely worth giving it a try.