Tails 3.0 Released

https://tails.boum.org/news/version_3.0/index.en.html

by sr2 • 9 years ago

188 73 9 years ago

tails.boum.org

d33• 9 years ago

Those two changes seem particularly important:

* Tails 3.0 works on 64-bit computers only and not on 32-bit computers anymore. Dropping hardware support, even for a small portion of our user base, is always a hard decision to make but being 64-bit only has important security and reliability benefits. For example, to protect against some types of security exploits, support for the NX bit is compulsory and most binaries are hardened with PIE which allows ASLR.

* Update Tor Browser to 7.0 (based on Firefox 52 ESR) which is multiprocess and paves the way to content sandboxing. This should make it harder to exploit security vulnerabilities in the browser.

What do you guys think about dropping 32-bit?

codewiz• 9 years ago

What do you guys think about dropping 32-bit?

About time.

kakarot• 9 years ago

32-bit is insecure. There's no good reason to support it. Get a cheap old laptop if you have 32-bit machine for some reason, it's good to have separate hardware for this type of thing anyway.

venomsnake• 9 years ago

Has there been any pure x86 processor in the last 10 year at all?

jwilk4• 9 years ago

Early Intel Atom CPUs in 2008 were 32-bit only.

skraelingjar• 9 years ago

I wonder if this will effect journalists and activists in parts of the world where old machines are still used (Africa, Middle East, parts of Asia). Not being able to make use of newer browser versions (without updating every time or taking the risk of using a persistent volume) could put them at greater risk.

jwilk4• 9 years ago

Previous versions of Tails already had exuberant hardware requirements.

I guess privacy is only for the rich.

Laforet• 9 years ago

I don't think it is unreasonable to assume everyone already has a 64-bit capable PC considering the most recent mainstream 32-bit only CPU is 2004's first gen Prescott Pentium 4.

openmosix• 9 years ago

You can run Tails on a supercheap chromebook. It seems a right product compromise.

barbs2• 9 years ago

I understand thst 32-bit is inherently less secure than 64-bit but if you had no choice but to use a 32-bit computer, what would be the best way to provide yourself with similar security features?

I guess you could use an older version of Tails but I imagine this would become less and less secure as more and more vulnerabilities are found.

nickpsecurity• 9 years ago

The 32-bit computers are the only thing available to lots of poor people or those just relying on other people's computers. People's teenagers, people using libraries, workers with legacy systems, and Internet cafes come to mind. Dropping it is a mistake if both could be supported. If it was lack of contributions or funding, I can understand the perspective of focusing on most secure one.

EDIT to add: Always remember with solutions like this that the adversary isn't always the NSA and so on. The Tor users' page lists all kinds of people who need help against foes with limited budgets or knowledge who might not be able to break Linux or Tor.

https://www.torproject.org/about/torusers.html.en

mrmondo• 9 years ago

I can't honestly say I've seen a 32bit computer in what must be nearly a decade now?

stevekemp• 9 years ago

A lot of hosting companies run KVM/qemu/Xen or even UML with 32-bit guests by default. But yeah in terms of physical computers 64-bit has long been the default.

I remember upgrading from 32-bit to 64-bit in-place a few times, which is a bit fiddly but not impossible with Debian. I wrote up a couple of guides once upon a time, but right now I can just find this old wiki-page discussing the process:

https://wiki.debian.org/Migrate32To64Bit

Tepix• 9 years ago

Sure but cheap Intel Atom N270 netbooks are probably still being used in poor countries even though they were released around 2008/2009.

vbezhenar• 9 years ago

What do you guys think about dropping 32-bit?

If they don't have any usage data, I think, they should provide old version and support it with critical security updates. If they have usage data, it depends, I guess.

teekert• 9 years ago

I still occasionally use My Asus 1000HE (early 2009) and my Sony Vaio FE11S (2006), both still run fine with Arch/Ubuntu and Mate. Getting more and more difficult to find distro's though.

akerro• 9 years ago

freebsd, debian won't drop 32bit any time soon.

DanBC• 9 years ago

There are a bunch of new machines that have 64 bit processors but tiny amounts of RAM. The low ram makes 64 bit OSs unfun to use, and most recommendations (Microsoft, Arch, Debian, etc) are to avoid 64 bit OSs on these machines.

If you're someone buying burner laptops these machines, which are very cheap, are now probably not a good idea.

slashink• 9 years ago

This is great. I very much appreciate the work done by the contributors to the Tails project and I trust & agree with their technical decisions for this release. As Internet keeps getting more monitored, Tails serves as an important tool in maintaining the balance of privacy and allowing for the anonymous sharing of information going forward. Big thanks to the Tails team.

jwilk4• 9 years ago

https://tails.boum.org/news/version_3.0/index.en.html#news-v... says you should run "uname -m" under Tails to see if "your computer is 64-bit". How does that work? Does Tails automatically choose kernel version appropriate for your hardware, or what?

jnbiche2• 9 years ago

How does that work? Does Tails automatically choose kernel version appropriate for your hardware, or what?

No, you run `uname -m` and then download the appropriate version of Tails (although it appears Tails 3.0 is only available on 64-bit now).

jwilk4• 9 years ago

I mean, "uname -m" gives you information about the kernel, not about the hardware.

If "uname -m" says "i686" it means that your kernels is 32-bit (or pretends¹ to be so). It doesn't necessarily mean that your hardware is not capable of running a 64-bit kernel.

So unless I'm missing something, the above procedure does not work correctly. Instead, you should run something like this:

  $ lscpu | grep -w mode
  CPU op-mode(s):        32-bit, 64-bit

¹ http://man7.org/linux/man-pages/man8/i386.8.html

an27• 9 years ago

None of the machines available to me worked with the previous release, I guess it's time to try again for the x64 subset...

tptacek6• 9 years ago

For the love of Christ don't use Tor Browser. Every other modern browser, including mainline Firefox, is safer.

WillyOnWheels2• 9 years ago

do you suggest I should be running Firefox in Tails?

ryanlol3• 9 years ago

The safer solution is to run the modern browser of your choice (probably chrome) in an isolated VM routed through a torified gateway. Hardware isolation would of course be preferable.

If you're using Tails you'd probably be much better off using Whonix instead.

With Tails, an attacker capable of breaking your browser will m̶o̶s̶t̶ ̶l̶i̶k̶e̶l̶y̶ definitely also be capable of easily grabbing your IP address.

metalliqaz• 9 years ago

From another comment elsewhere in this thread:

Update Tor Browser to 7.0 (based on Firefox 52 ESR) which is multiprocess and paves the way to content sandboxing. This should make it harder to exploit security vulnerabilities in the browser.

Firefox 52 ESR sounds like mainline Firefox to me.

tptacek6• 9 years ago

Literally the same version of Firefox as underpins Tor Browser will tend, pretty much at all times, to be safer than Tor Browser. You can use the search bar at the bottom of the page to find out why, or search the Internet for "grugq tor browser" if you want more people explaining the issue.

Diederich• 9 years ago

I'm not necessarily doubting you, but I wonder if you can say why you think the Tor project is distributing such an unsafe browser? If that's a very poor decision, does it call into question other decisions the project has made?

tptacek6• 9 years ago

The problem is intrinsic to what Tor is trying to do; it's not simply a bad engineering decision on the project's part.

dublinben• 9 years ago

This makes a lot of assumptions about the threat model of Tor users.

tptacek6• 9 years ago

No, it does not.

nathan_f77• 9 years ago

Is there an article or post I can read with more information? I was about to downvote before I noticed your username!

barbs2• 9 years ago

I think it's reasonable to downvote if his comment is just an assertion with no evidence. It shouldn't matter who he is or how high his karma is.

unexistance• 9 years ago

since there's no reply, I'm guessing it's because Tor Browser is using Firefox ESR, even though Fx ESR are guaranteed for a security update...

any other reason?

0xcde4c3db• 9 years ago

IIRC, the highlights of the anti-Tor-Browser argument are something like:

- Various people who are very interesting to intelligence agencies, police, organized crime syndicates, and private security for major corporations use Tor Browser, increasing the demand for and thus price of black market exploits specifically targeted at it.

- Tor Browser incorporates patches and default settings that receive less testing and review than the code and defaults of vanilla Firefox, making it more likely that vulnerabilities exist.

- Architecturally, Firefox lacks robust exploit mitigations, making it more likely that such vulnerabilities are actually exploitable.

- There's a delay between security fixes in vanilla Firefox and their release in a Tor Browser update.

- Exit nodes and root CA certificates may both be controlled by attackers, potentially giving them the ability to deploy exploits even to targets that only use HTTPS to trusted sites.

Adding all of the above together, it is not only plausible but likely that effective exploits specifically for Tor Browser currently exist in some attackers' toolkits.

dredmorbius• 9 years ago

Please sustantiate this with either rationale or references.

jerheinze5• 9 years ago

For the love of Christ don't use Tor Browser.

If you don't use the Tor Browser you're exposing yourself to all the fingerprinting attacks that the Tor Browser tries to protect from: https://www.torproject.org/projects/torbrowser/design/

Not only that, without the Tor Browser you wont have stream isolation, so all of your website browsing can be watched by a single exit node (whereas with the Tor Browser each site has its own circuit) which makes correlation attacks much damaging (whole browsing history in a session vs 1 site).

sr2• 9 years ago

There are people that customize Firefox with plugins to make it look like TorBundle. All you need is FoxyProxy[0] hooked up to tor and a useragent spoofer which mimics common TorBundle useragent strings and you're set. This is very dangerous though as FoxyProxy could potentially leak your IP, aswell as a slew of other things that could go wrong.

TorBundle devs have stripped out a tonne of things which increase attack surfaces and the fingerprintability of mainline Firefox. Best just blending in and looking like everyone else and use TorBundle.

[0] https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-sta...

jerheinze5• 9 years ago

Indeed, https://www.torproject.org/projects/torbrowser/design/

Not only that, using the particular setup you're describing, you wont have stream isolation, so all of your website browsing can be watched by a single exit node (whereas with the Tor Browser each site has its own circuit) which makes correlation attacks much damaging (whole browsing history in a session vs 1 site).

claudiojulio• 9 years ago

Tails should use Devuan. It does not have systemd. What do you think?

Translated automatically.

detaro• 9 years ago

Assuming Debian Stretch still uses non-systemd networking configuration (which was the default case in 8 at least), or Tails switches back to it, systemd shouldn't impact what Tails tries to do in any way.

moosingin3space• 9 years ago

Why is that important? Especially considering Tails has worked fine using systemd in their previous version based on Jessie. Additionally, Tails has used systemd's service namespacing functionality as part of a defense-in-depth strategy. Switching to Devuan makes little to no sense based on this track record.

hendry• 9 years ago

https://webconverger.com/ is still 32 bit and keeps a clean slate.

rallycarre• 9 years ago

I recently started using Tails so for security reasons coughbackdoorwindowsioscough,.. and found that it worked surprisely well. It has a disk utility, liber office, and the drivers even worked for my wireless dongle! Kudos to the Tails team!

Tails 3.0 Released

Related Stories