Slashdot Mirror
Snowden Used the Linux Distro Designed For Internet Anonymity
Hugh Pickens DOT Com writes: "When Edward Snowden first emailed Glenn Greenwald, he insisted on using email encryption software called PGP for all communications. Now Klint Finley reports that Snowden also used The Amnesic Incognito Live System (Tails) to keep his communications out of the NSA's prying eyes. Tails is a kind of computer-in-a-box using a version of the Linux operating system optimized for anonymity that you install on a DVD or USB drive, boot your computer from and you're pretty close to anonymous on the internet. 'Snowden, Greenwald and their collaborator, documentary film maker Laura Poitras, used it because, by design, Tails doesn't store any data locally,' writes Finley. 'This makes it virtually immune to malicious software, and prevents someone from performing effective forensics on the computer after the fact. That protects both the journalists, and often more importantly, their sources.'
The developers of Tails are, appropriately, anonymous. They're protecting their identities, in part, to help protect the code from government interference. 'The NSA has been pressuring free software projects and developers in various ways,' the group says. But since we don't know who wrote Tails, how do we know it isn't some government plot designed to snare activists or criminals? A couple of ways, actually. One of the Snowden leaks show the NSA complaining about Tails in a Power Point Slide; if it's bad for the NSA, it's safe to say it's good for privacy. And all of the Tails code is open source, so it can be inspected by anyone worried about foul play. 'With Tails,' say the distro developers, 'we provide a tongue and a pen protected by state-of-the-art cryptography to guarantee basic human rights and allow journalists worldwide to work and communicate freely and without fear of reprisal.'"
The developers of Tails are, appropriately, anonymous. They're protecting their identities, in part, to help protect the code from government interference. 'The NSA has been pressuring free software projects and developers in various ways,' the group says. But since we don't know who wrote Tails, how do we know it isn't some government plot designed to snare activists or criminals? A couple of ways, actually. One of the Snowden leaks show the NSA complaining about Tails in a Power Point Slide; if it's bad for the NSA, it's safe to say it's good for privacy. And all of the Tails code is open source, so it can be inspected by anyone worried about foul play. 'With Tails,' say the distro developers, 'we provide a tongue and a pen protected by state-of-the-art cryptography to guarantee basic human rights and allow journalists worldwide to work and communicate freely and without fear of reprisal.'"
What's that? Have any unknown in your life? Just insert the NSA?
Don't have the source code? The NSA must be behind it.
Don't know who spread a worm? Must be the NSA.
Don't know who authored BitCoin? NSA.
Don't know who packaged up TAILS? NSA.
The NSA sent his heavenly son to die for our sins.
Well, at least it will slow down the other Adam Henrey's with their personal, "needs." Where can I download a copy, today's a good day to start again.
May want to keep an eye out in the development community of the OS for a sudden influx of programmers "just wanting to help out." Or existing members suddenly driving new sports cars and acting strange.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
almost gushing in agreement world wide? what a gig...
What's that? Have any unknown in your life? Just insert the NSA?
Don't have the source code? The NSA must be behind it.
Don't know who spread a worm? Must be the NSA.
Don't know who authored BitCoin? NSA.
Don't know who packaged up TAILS? NSA.
The NSA sent his heavenly son to die for our sins.
No.
So let me get this straight... Some funny Linux distro magically makes you anonymous on the internet. So all of a sudden no servers log your IP address and no ISPs can look at your traffic - simply because you loaded a special distro? I think not. Unless "anonymous on the internet" means something different to you than to the rest of the world. Now immune to local forensics - sure. But on the internet? Not so much.
Incognito Linux did not impress me. You can be more anonymous using Backtrack.
Did they provide evidence for this claim?
Comment of the year
The CIA etc notes that its employees 'serve in silence,' surely this team has advanced the cause of freedom and liberty more than them, in silence.
Well for a start we know that the NSA exists. I can go on but what I've just said pretty much destroys the analogy.
Tails doesn't store any data locally,' writes Finley. 'This makes it virtually immune to malicious software, and prevents someone from performing effective forensics on the computer after the fact. That protects both the journalists, and often more importantly, their sources.'
Traffic sniffing does not require files on the target and this is the biggest source of data for agencies like the NSA. It may protect you from key loggers being installed (unless they were inserted ahead of time).
I'm pretty sure that part of Snowden's leaked information showed that exploits are occurring at the hardware level as well as software. Entry points like LOM modules were explicitly called out in the leaked presentations.
I'd agree that forensics becomes extremely difficult, if not impossible (memory analysis can still occur). I don't agree that the systems are immune to malicious software at least in a general sense. Immunity would require a lot of control for the hardware running the OS, and monitoring to make sure things have not been tampered with. Relying on a repository build of an OS imaged is still a target for potential a MITM attack feeding a user a kitted image.
It's all good in my opinion, I'm just being picky about the terminology chosen. Immunity implies absolute safety, and very little in the world is absolute.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Allegedly.
And all of the Tails code is open source, so it can be inspected by anyone...
Yeah. Because that peer review process worked out so well for OpenSSL... Sorry, but the defence of "it's open source so don't worry" doesn't really inspire quite the same degree of confidence it once did.
Their disinformation tactic worked! That slide was a plant to sew trust in Tails, when in reality it was written by Admiral Mike Rogers himself!
The only true way to remain anonymous is write your own code, live in a fenced in, soundproof room you built yourself, solder your own electronics to build your own hardware, and store all of your excreted bodily fluids in jars around your jar so they can't trace your DNA.
how do we know it isn't some government plot designed to snare activists or criminals? A couple of ways, actually. One of the Snowden leaks show the NSA complaining about Tails in a Power Point Slide
And that, ladies and gentleman, is how you play the Really Long Game.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Well, personally my first thought after reading the summary was "but how do you trust the BIOS?" A few years ago I'd have immediately said that's conspiracy theory and dismissed it (along with the other items you listed). But after a year of exposure to the Snowden and RSA revelations and everything else, it pains me to say these NSA questions aren't so far fetched any more.
Sure they may not be probable but they could be possible. No matter how rational you think you are, it really messes with one's mind. Subtle paranoia, if you will.
That sounds like something the NSA would post.
And it's Slashdotted.
Get your own free personal location tracker
Write Tails, fabricate memo complaining about it, convince hordes of evil doers that you can't crack it. Isn't it obvious?
NSA 'compaining' about tails? Oh, no, please don't throw me in that briar patch!
http://americanfolklore.net/fo...
The Amnesic Operating System. Shouldn't it be amnesiac? Or is this another English/American English difference like aluminium?
Get your own free personal location tracker
Snowden would have had a much harder time had he been using legal Microsoft products.
"The average reporter we talk to is 27 years old......They literally know nothing." - Ben Rhodes
"We cannot confirm or deny the existence of an organization allegedly named the NSA."
Turn on your Heartbleed,
Let it shine, wherever you go
Let it make a happy glow
For the NSA to see...
"Flyin' in just a sweet place,
Never been known to fail..."
What do you bet that "Tails" used OpenSSL as part of its security?
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
Unless you compile from vetted source code on an un-compromised system using an un-compromised compiler, etc., you can't be certain the binary they provide is the same as what compiling the source code would provide.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
I had a few other questions as well...
This does nothing to protect against tampered hardware (keyloggers, screen captures, etc.). If you're using USB, you also have to trust that you really only have a flash device in that circuitry. Plus, you have to trust that any certificates you use aren't compromised, any exit nodes you use don't belong to the NSA (a large number do), etc.
All in all, this really only protects you if you weren't already a surveillance target and weren't using compromised systems.
Still, it's better than the alternative. Just not "completely secure".
Wouldn't this be the ultimate honeypot for the NSA to create? Since the authors are anonymous who's to say none of them weren't the NSA?
More like a satan than a god.
Seriously, what kind of a person would willingly work for such a vile organization? I'm guessing the kind of person that would fuck you over for 50 cents.
I get the impression TAILS doesn't include a full system encryption on boot which means if the USB is discovered they could check whats on it. I assume Snowden wrote the retrieved data to the same usb stick. Maybe Trucrypt isn't available for linux distros but i am sure there are plenty of alternatives that do a similar full system os encryption.
Lol.. not only that, man in the middle, and that point about the NSA complaining so it isn't them strikes me odd. A lot of gay bashers are closet homosexuals complaining about the gays in order to stop you from thinking they are gay. It's one of the oldest forms of deciet- fake outrage while being behind it.
A few years ago I'd have immediately said that's conspiracy theory and dismissed it
Then you weren't paying attention, depending on how long "a few years" is to you. The NSA did all sorts of crap decades ago, and there was strong and justified suspicion even back in 2005 that the NSA was conducting illegal surveillance.
Are you able to verify all of the distribution yourself? Are you able to vet the contributors? Are they able to vet each other? Is Tor really safe?
It all comes down to a matter of degree but in the end... Trust No One
Anything which encourages better security is healthy.
If paranoia about the NSA encourages better tools and more people to use them, fine with me!
The only way to be truly secure is to communicate using a computer that you bought for cash and is only used for that purpose, via someone else's internet connection using their wi-fi . Of course you would need to be careful not to be videoed while traveling to and from the wi-fi site.
It doesn't matter if the feds can place something on your computer if they don't know where the computer is or who it belongs to.
https://www.whonix.org/
Magnet links:
magnet:?xt=urn:btih:A031805E690BB0E03114A8FEB52485517218D3CE&dn=Whonix-Gateway-8.1.ova&tr=http%3a%2f%2fannounce.torrentsmd.com%3a6969%2fannounce&ws=http%3a%2f%2fwebseed.whonix.org%3a8008%2f8.1%2fWhonix-Gateway-8.1.ova
magnet:?xt=urn:btih:AB89247534553946C500EDF3A78E9C30F9C956ED&dn=Whonix-Workstation-8.1.ova&tr=http%3a%2f%2fannounce.torrentsmd.com%3a6969%2fannounce&ws=http%3a%2f%2fwebseed.whonix.org%3a8008%2f8.1%2fWhonix-Workstation-8.1.ova
And here's the magnet link for Tails v0.23 for good measure:
magnet:?xt=urn:btih:B7EE06A2568630EED830CFFBF45B6BFD5DE796D4&dn=tails-i386-0.23&tr=http%3a%2f%2ftorrent.gresille.org%2fannounce
Hail Eris, full of mischief...
E pluribus sanguinem
Snowden, Your hero, is doing a bang up job over there in the USSR.
I hope he gets a front line gig when they invade the West, you can greet him with flowers and candy.
Tails in fact *DOES* have a persistent storage option for installing on a usb thumb drive (and in fact will refuse to install/upgrade if you try and install it on a Hard Disk, although there's no technical reason you couldn't). It then creates a fat32 primary partition which contains the 'livecd' part of the filesystem, making it easy to upgrade, and then has a secondary partition which may be configured from the desktop as Persistent storage (normally the rest of the disk unless you manually partitioned) which is password protected with some potentially immeasurably long password you set for it.
So yes, Tails does allow both persistent and non-persistent operation.
In fact the only *REAL* issue with Tails is that without swap space, you're limited to what apps you can cram into memory, and if you cram in too many the system will hang. Not an issue if you're just going to have one web browser and a pidgin session running. But dozens of tabs, i2p, or a large and active pidgin session might hang the system forcing you to either kill X or restart the computer.
It does however make tor, i2p, etc dead simple to use. The killer OS imho in regards to p2p network topologies, as well as turnkey filesystem security.
One of the ways the NSA (and other organizations) have benefited from the leaks is the fear instilled in those that would otherwise speak out about injustice/corruption/etc..
Easy BitCoins
How much do they pay you for these NSA flagellation? I'd like a second income, and it appears you don't have to put any effort into it at all.
Don't know who did 9-11? No carrier
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
TAILS sounds like a honeypot to me. What's wrong with just booting off a KNOPPIX CD-ROM or an Ubuntu CD-ROM? I expect some stuff might get written to a tmp directory somewhere but you could always shred any files there before rebooting the machine.
> Tails is a kind of computer-in-a-box
Obligatory neckbeard remark: all computers I've seen were operating in a box of sorts.
Except for that tangled mess that I made once on the table, just for testing purposes.
Just physically unplug the hard drive before booting off a live CD? I have to admit, though, that my first reaction was also "Anonymously produced live CD promises to protect your secrets? Sounds legit."
Rampant carbon sequestration destroyed the Dinosaurs' tropical paradise. I'm here to help repair the damage.
Sort of my first thought... he used this secure software to thwart the NSA, while the NSA supposedly 'owned' OpenSSL that the software likely used. Kind of ironic.
-- I ignore anonymous replies to my comments and postings.
Has anyone tried to boot tails from the grub2 menu yet? I do know archbang does not work. Otherwise it should be easy.
In the novel "1984", Big Brother made sure you knew you were being watched.
"Fire him! He's too clever for us!"
I am anarch of all I survey.
It was not his choice to get stuck there, the US govt pretty much made sure. You know, even getting the Swiss to force down the plane of a president and search it, because he might be on board... really, your comment is unintentionally ironic: the invasion already happened -- that is, your external enemies ain't shit compared to the internal ones you bred yourself -- and it's YOU who is bending over and cheering.
How about just sending the stuff by snail mail? I'd bet my cup of coffee that they completely lost the expertise and interest on this form of communication.
They will put developers to work on the open source code who will "accidentally" insert bugs that open holes in the security -like the hole that was recently discovered in https. Tails may have been a problem for them in the past, but with the NSA's nearly infinite budget it seems unlikely that Tails would remain a problem for long.
computer-in-a-box? is that how you explain a live cd to a tech crowd?
We need a Harry Tuttle to show up at night in our apts to offer us an alternative BIOS chip.
Trying to out spook the spooks? Compared to their espionage skill set, their coding skills are pretty poor (sic).
For all we know, the Open Source movement is one big front for the spooks.
To quote George Smiley, "in my world we call that a good cover".
Welcome to the Big Picture
All your Tails are belong to us - NSA.
Sure enough, the cow costume was hanging up next to the superhero outfit and sailors uniform. (S,Spud)