New alpha release: Tor 0.4.1.3-alpha

> 3. What exactly goals have TAILS? What a negative points it have? It can be run without a USB-device?

I use Tails for almost everything but off-line in-home stuff, so I'll take a stab at that.

The goal of Tails is to provide a complete Debian based "amnesiac" system which works "out of the box" by booting Tails from a DVD or bootable USB. Booting from a DVD is more secure but booting from a USB is more convenient because you can use Tails not only to create the bootable USB (once you are running Tails booted from a DVD) but to create a LUKS-encrypted "persistent volume" where you can store files, and also to download a few of the most useful applications (such as steganography or additional crypto tools) not included in default Tails, which will be installed (in RAM, i.e. in the virtual machine) next time you boot from the Tails USB from data stored in your persistent volume.

"Amnesiac" means Tails tries hard to avoid leaving any traces in hardware of your activity during a Tails session, which can be critically important for human rights workers, medical aid workers, journalists, union organizers, opposition politicians, corporate executives, diplomatic officers, oil/mineral explorers, doctors, cybersecurity researchers, LEA liasons, and others who may need to travel frequently, sometimes in dangerous countries, and who need to communicate or work while traveling without risking a dangerous adversary (often the host country government) from breaking down doors, snatching a laptop, and claiming to find evidence of "human trafficking" or whatever else is the locally favored method of attempting to discredit some NGO or political party.

Case in point: the dozens of individually identified "high value targets" (HVTs) who were targeted by what appears to be a sophisticated and long-running CN government cyberespionage program which entailed establishing covert APT presence inside the networks of dozens of international telecoms, apparently for the purpose of tracking metadata and possibly content of communications involving the HVTs, would very likely have been better served if they had used Tails and OnionShare rather than vulnerable smart phones and insecure telecom companies to enable them to stay in touch with their personal calling circle (for "legitimate" government business, conniving with corporate lobbyists, political scheming, plus managing bribery, kickbacks, money-laundering, off-shoring, tax-evasion, assassination plots, and other "business as usual" for high government officials--- or so one gathers from reading what is know so far about the covert activity of such malign figures as MBS and DJT).

The best way to obtain Tails is probably to download the latest ISO image from tails.boum.org (either via software like curl or via torrents), verify the detached signature, if possible verify the signing key using the Web of Trust, burn the DVD on a trustworthy (we hope) computer (i.e. not one which some nations customs people have stuck their dirty paws into), and then make disposable Tails USB sticks with persistent volumes to use while traveling with a disposable laptop-- possibly one bought with cash "in-country". For example.

You can boot Tails in a more secure "off-line" mode when you are not planning to venture onto the internet, which can considerably enhance your security when you are writing story for your paper or a report on your mineral findings (for example), which you certainly would not want to fall into the hands of an adversary or competitor. To this end, applications provided in Tails include Libreoffice, Gimp, and many other standard tools in the Linux arsenal, which can be used offline.

Tails also includes some networking tools such as airodump-ng which can be useful when you boot in on-line mode with WiFi enabled, for example to check out nearby WiFI access points. In the ever evolving arms race between repressive governments and the courageous reporters who write about their ugly activities, it is becoming more common for reporters to avoid physically meeting their sources "in-country". Rather one can arrange to be close enough for the source to log onto a temporary private WiFi AP the reporter has created for the solve purpose of communicating with the source. Of course, the opposition must might be savvy enough to be looking for a strange private WiFi AP popping up when they observe someone they are physically following booting up their laptop. OnionShare is probably much safer. As always, making the initial connection in order to set up communication is the most dangerous stage, so you should use counter-surveillance methods, which is where some of those extra networking apps can come in handy. For example, targets of government surveillance can often intercept the unencrypted(!) video feeds of fixed surveillance cameras hidden inside "concealments", an increasingly common feature of many urban environments. Watching them watch you on closed circuit TV is pretty good evidence that this is not the best moment to meet your source.

Tails has suffered in the past from some horrific security vulnerabilities, including a devastating bug in the shell ("Shellshock"), and in common with pretty much every OS it is likely vulnerable to newly discovered members of the seemingly vast family of attacks exploiting the inherent insecurity of "speculative execution" CPU architectures. But these are rapidly fixed in new releases of Tails as soon as they are disclosed. Which is alarming but there is really nothing out there which does any better. Furthermore, we know from the Snowden leaks that as of 2012 NSA and GCHQ teams assigned to crack Tails were having a very hard time. So evidently NSA did not know about Shellshock either, and hopefully learned of it the same way the rest of us did, when Google's cybersecurity lab revealed it. That's very solid evidence that Tails is trustworthy (i.e. does not deliberately cooperate with spooks) and probably as secure as anything you are going to find anywhere, including very expensive proprietary commercial products which might very well have easily exploited holes. At least with open source you have the chance that a white hat will spot a big problem before the particular black hats who are on your tail, no pun intended.

NGOs can sometimes obtain free security training from Tor Project or like minded organizations, I think, but for-profit companies should hire a reputable security consultant, budget permitting.