I wonder why they opted to preload it with AdBlock Plus instead of uBlock Origin. I'm sure gorhill would certainly give his blessing, and by all measurements it is just as effective with way less overhead.

Heck, they could go one step further and preload it with a uBlock Origin profile on a paranoid mode that proactively disables all JavaScript (last I remember using Tor I had to manually disable Javascript in the Firefox config).

When Tails has had vulnerabilities it is often with one of these included apps[6].

The browser isn't sanboxed (it's in progress[3]), and the machine is still directly connected to the internet, so you're a single Firefox vulnerability and a drive-by download away from being deanonymized.

It is also a shame that both OS X and Windows make it difficult to write an OS to an USB stick and boot from it - the install requires an intermediary Linux OS either on DVD or USB, which a lot of users won't get by.

For a different approach, see Whonix[4] - a virtual machine based approach with an isolating proxy (very popular setup amongst black hats) and Qubes OS[4] which is built on Xen and runs processes in separate VM's

[1] https://tails.boum.org/doc/about/features/index.en.html

[2] https://www.cvedetails.com/vulnerability-list/vendor_id-1143...

[3] https://wiki.mozilla.org/Security/Sandbox

[4] https://www.whonix.org/

[5] https://www.qubes-os.org/

[6] https://blog.exodusintel.com/2014/07/23/silverbullets_and_fa...

My main "inspiration" here is the fake bomb threat by the college kid to get out of mid terms, just before the email about the bomb was sent his IP downloaded Tor bundle. The service he was using also had the schools IP or something so administration could see it was sent from inside the school, but I think that is still valid concern. This kind of meta data about your actions can leak just as much information as actually seeing what you are doing.

My question therefor would be: should more people use Tails as their "daily driver"? Would that make it more anonymous/private for the people like whistle blowers? My only idea at the moment would be to pay for two separate trusted VPN provider (don't know how you would vet that trustworthiness) with bitcoin, to keep your anonymity/privacy with them as well. Then pipe all your traffic through one of the VPNs all the time. Then when you need to use Tor, you would simply pipe it through that same VPN when you would emerge with rest of the clients from same point and then pipe your Tor traffic through the secondary VPN. This way you would still get the benefits of encrypted tunnels all the way through with benefit of Tors anonymizing and it might not be so obvious you are browsing Tor to your ISP or whatever.

Maybe I'm thinking this is harder than it actually is

Not to go off on a rant, but this is what the "everyone must use https because we said so" edict is going to cause - it's not enough you use https, it has to be the right kind of https that involves a third party issuer of certs.

Can anyone fix that issue or link to a different page please?

https://www.whonix.org/wiki/Qubes

http://www.pendrivelinux.com/universal-usb-installer-easy-as...

ISP's or network providers know if you're running Tor, when you're online and when you're active (it has been used in criminal cases to link real people to online aliases)

Someone else in this thread pointed out that the download points for Tails are all HTTP - so you can't find it and download it anonymously.

The way to do it would be to find an HTTPS mirror (avoiding search engines) or a public terminal.

IMO you shouldn't use Tails as your personal machine. This isn't a technical decision more a question of OPSEC policy. The key to anonymity is compartmentalization - the concept of creating, maintaining and then isolating your different identities.

Your real identity will continue to use your computer, your phone number, your internet connection, etc. It might tighten up some privacy leaks. Your anonymous identity (which may have a name) will use Tor in a virtual machine as a gateway and Linux in another virtual machine as a client, or it will boot into Tails. The anonymous identity using Tor has nothing in common with the real identity that can be linked together by a passive or active attacker.

For ex. your anon identity is doing anonymous stuff on anonymous online markets, but then you use the same Tails session to login to your personal Gmail. You've just been de-anonymized. Don't share anything between the two identities (having the same interests, typing style, etc. to name a few) as that would tie an anonymous identity to a real one.

With this in mind, Tails is perfect for the use case of 'I need to do some anonymous stuff with my anonymous identity and then get back' which is exactly how a lot of journalists, black hats, etc. use it. The more 'comfortable' Tails is with features and programs the more likely you are to hang around and do something that will de-anonymize you :)

If you're this level of paranoid any email account used more than a handful of times has to be burned and never touched. You definitely should not ever access a cell network with a smartphone, which has to be burned as well every week or so. Social media use is also dead. If you don't use social media because of security concerns, that's fine, but 2.5 billion people do, so you're probably in the minority.

If you're going to whistle blow there are a bunch of other steps you should implement, running TOR being one of them, Tails if you're that high up of a risk (hint: you're probably not). If you're at that level 1.) you should be doing everything from various public wifi networks in cities nowhere near you and 2.) the fact that you downloaded TOR is not what anyone's interested in anyways, it's what you're saying and doing behind it.