I’ve been looking around for a nice anonymity and security-focused live-bootable Linux distro. Things I’d expect from one include…
- a hardened kernel and a strict packet filter setup
- MAC address randomization on all interfaces
- a randomized, but natural-sounding hostname generated on each bootup
- absolutely no outbound network traffic “by default” (ie. no AVAHI, no SAMBA, no cloud anything, no remote error reporting)
- no ports open on the outside
- DNSCrypt & DNSSec enabled by default
- a reliable, DNSCrypt & DNSSec supporting global DNS service used for name resolution, never the local, DHCP-provided servers
- a somewhere-between-sane-and-paranoid Privoxy setup
- a hardened, privacy-focused Firefox build
- encryption tools with Smart Card support
- maybe some pentest tools
- maybe the TOR Browser bundle
Now notice what I didn’t include. Almost every non-pentesting security distro routes all Internet traffic through some kind of anonymization service by default, most likely TOR. Which makes them completely useless in my view.
Where did this whole idea come from? Well, it comes from Tails Linux, popularized at one time by (or using the name of) Edward Snowden. I’m not saying it’s a bad distro, and it might make some sense in a case of someone such as Snowden… It makes less sense in many other cases.
Like I wonder if anyone had noticed that most web sites treat TOR users as spammers by default. “Lots of spammers come from TOR. You come from TOR. Therefore you are a spammer.” This means that many sites won’t allow registrations or logins through TOR.
Now I do use TOR time to time, and think it’s an invaluable tool for online freedom. That said, would I want to route all my traffic through TOR all the time? No. Sure as hell no.
While IP addresses allow for some level of tracking, an IPv4 address contains precious little information. Most tracking happens these days via browser fingerprinting, cookies and similar bull. If you log onto the wifi at a coffee shop somewhere, the sites you visit, and all the eavesdroppers out there, will see you use the same single IP address as all the other forty people banging away around you.
However, your computer may leak identity in a variety of ways, such as…
- your hardware MAC address
- list of saves wifi SSIDs
- persistent hostname sent in DHCP request
- local service discovery and broadcast protocols (AVAHI, SAMBA, etc.)
- unencrypted DNS queries
- automatic cloud logins
- anti-theft tracing services (such as Computrace or Find My iPhone)
- browser fingerprint
- cookies
- etc.
Some of this is stuff you normally need in your everyday computing life, like to use printers connected to the network, or your Dropbox or mail account. So disabling it all on your everyday-use OS is probably not worth it.
Some of it can be mitigated with a little work and no drawbacks in most common use cases, such as randomizing your MAC addresses, or activating DNSCrypt.
However, you might want to go undercover for a specific thing (like posting an article disparaging the sitting president of your country, or blowing the whistle on the multi-trillion dollar company you work for).
TOR might be the right tool for this, or not. TOR can give you a false sense of security, and work against you. It can limit your access to many web sites. I think Tails is seriously missing the point. Leaving your phone home, going to a coffee shop you don’t frequent, paying in cash, and using a low-attack-surface Linux installation as I described in the beginning, should give you as good, or better results for anonymous work than TOR.
So… why has nobody made a live distro like this?… :D Lol.
