Tor at the Heart: Tails

Shari, many thanks for the "Tor at Heart" series, which I hope will persuade many citizens (and journalists) worried about the prospects for

o more state-sponsored cyberattacks on multitudes of ordinary citizens

o more government censorship disguised as programs to filter out "fake news"

o more state-run propaganda, comment trolling, and other "effects campaigns"

to donate generously to ensure that the Project continues to perform its many vital roles in the modern Internet and in sustaining free speech, access to good information about local and global events, and indeed democracy itself around the world.

Sometimes disasters engender an unexpected beneficial consequence. If the election of a authoritarian government in USA leads to huge direct citizen support for Tor, that would be good thing.

It is certainly very strange to find enemy actors such as CIA openly repeating the same warnings some dissidents have attempted to make for many years, that nations such as RU and CN (and of course USA!) have long engaged in extensive state-sponsored hacking targeting such critical resources as local/national election rolls, personal health records and other information of essentially every citizen of "target countries". And also very strange to find people like John Bolton echoing warnings from Glenn Greenwald and cybersecurity experts that elaborate (and risky!) "false flag" operations which attempt to discomfit another nation are not uncommon in the world of spookery. One thing for sure: everyone who reads any source of news now seems to be well aware that we are now all living in an Age of Cyberwar which explicitly targets any and all persons living or dead, no matter how innocent or "small fry" they may be.

And thanks for highlighting Tails, which I use for almost everything. I'd like to point out that while some people might find it initially disconcerting to go through the trouble of booting Tails from a R/O DVD (burned after verifying the detached key) using an encrypted USB stick to transfer bridge fingerprints etc during the initial connection to the Tor network, with a bit of practice this becomes routine and hardly noticeable.

On the dark side, I worry about the effects of apparent lack of a really good source of entropy when using Tails soon after booting from a DVD for creating a GPG key or using other encryption. As I understand it, Tails team is working on this, but good fixes may require additional hardware such as entropy keys which are currently hard to obtain. But sophisticated statistical tests of currently available entropy keys suggest that they may not provide high quality entropy suitable for cryptography. I have also experienced issues with creating new LUKS encrypted USB data sticks (i.e. placing an encrypted volume on a USB stick) using recent editions of Tails, and hope other users will test this.

Many people now use the Bonneau version of Diceware word list (see eff.org) to generate long passphrases for encrypted data sticks or detachable hard drives. But my own very modest tests of a common Diceware method (tossing five dice in a box) suggests that the dice appear to tend to stick like face to like face, due to static charges, which could possibly substantially reduce the provided entropy by substantially altering the statistics of pentathrows from what they would be if all five dice were tossed independently (as defined in probability theory).

In all use cases, it is important to educate Tor users in testing their entropy sources, in particular pseudorandom number generators, which unfortunately is well beyond most people's sophistication unless good test suites (e.g. Marsaglia's venerable Diehard test suite) are provided with user friendly interfaces and simple user commands. The Open Source community needs to change that!

Promoting the growth of a global consumer privacy industry which sells things like entropy keys, Faraday cage bags, Tor phones, spectrum analyzers suitable for testing one's own devices for unexpected RF emissions or communications, etc, as low-cost mass-produced consumer items is one of the most urgent things the Project can do, I think.