Field Notes

entity

Tails

StatusStableReviewdue UpdatedStands on5 sourcesSupportsnotes

Tails is a Debian-based operating system (OS) that boots from a Universal Serial Bus (USB) stick, runs entirely in random-access memory (RAM), routes all network traffic through Tor, and forgets everything when the machine powers down. The name expands to The Amnesic Incognito Live System. It has been developed since 2009, and since September 2024 it has been maintained inside the Tor Project, which absorbed the Tails organization after Tails approached it about merging operations.1 Releases are frequent: version 7.10 shipped on 23 July 2026.2

Tails is the fourth system in the wiki’s desktop security cluster, alongside Qubes OS, Whonix, Kicksecure, and secureblue, and it is the only one whose central design assumption is that the computer is not yours and that nothing should remain on it.

Amnesia as the organizing property

The other hardened desktops in this cluster protect a system you own and keep using. Tails inverts that. Its documentation describes a system that “always starts from the same clean state,” runs from RAM that is “entirely deleted when you shutdown,” and touches the internal disk only if the user deliberately asks it to.3

Two consequences follow that no amount of hardening reproduces. A machine that never wrote to disk has nothing for later forensic examination to recover, which matters wherever a device may be seized or inspected — the concern running through Post-seizure digital recovery and Mobile-device extraction and evidentiary selection. And a system that starts identically every boot cannot accumulate a compromise: malware that lands in one session is gone at power-off, because there is nowhere for it to persist.

The exception is Persistent Storage, an optional LUKS-encrypted area on the USB stick holding chosen files, configuration, and credentials. Every byte in it is a deliberate exception to the property the rest of the system provides, which makes its contents the natural first target for anyone who obtains the stick.

How Tor enforcement is implemented

Tails does not ask applications to use Tor; it removes the alternative. The design specification describes netfilter rules that drop all outbound traffic except Tor’s, discard non-TCP protocols because Tor carries only the Transmission Control Protocol (TCP), and redirect Domain Name System (DNS) queries to Tor’s DNSPort.4

Enforcement is organized around separate system users rather than application configuration:

User Network access
debian-tor Runs Tor itself, unrestricted
amnesia The ordinary desktop user, reachable only via Tor’s transparent proxy
clearnet Narrow exceptions, including the Unsafe Browser and clock-setting

An onion-grater proxy filters Tor’s control port per application, so a compromised program cannot ask Tor for information that would identify the host.

flowchart LR
  App[Desktop applications as amnesia] --> Proxy[Tor transparent proxy]
  Proxy --> Tor[Tor client as debian-tor]
  Tor --> Net[Internet]
  App -. blocked by netfilter .-> Net
  Unsafe[Unsafe Browser as clearnet] --> Net

The architectural limit Tails accepts

The Tor client runs on the same machine as the user’s applications. That is the design difference that separates Tails from Whonix, and it is not incidental. A root compromise on Tails puts the attacker on the machine that knows its own Internet Protocol (IP) address and can rewrite the firewall rules protecting it, so the anonymity property fails. Whonix’s Gateway and Workstation split exists precisely so that a fully compromised Workstation has no real IP address to leak, and the Whonix comparison with other anonymity systems page makes this argument at length.

Tails does not dispute it. Its design specification calls application isolation “minimal,” implemented with AppArmor confinement and bubblewrap sandboxing, and states plainly that this reduces kernel attack surface without preventing a compromised process from exploiting a vulnerability.4

The trade is coherent rather than careless. Whonix buys leak resistance under compromise with a persistent system and a hypervisor to run it in. Tails buys amnesia and portability with a single-machine Tor client. Neither dominates: they fail in different directions, and the right question is which failure the user can afford.

Reproducible images

Tails ships reproducible installation images and has done so since version 3.3 in November 2017, when it produced one of the first reproducible Linux ISO images.5 Anyone building from a given Git tag should obtain a byte-identical image, so a backdoor introduced in the project’s build infrastructure is detectable by any independent rebuilder.

This is Source-to-binary correspondence achieved for a whole operating system image rather than a single application, and it is a meaningful distinction within this cluster: of the systems compared here, Tails is the one whose shipped artifact can be checked against its published source by an outsider. That check, which Reproducible builds makes possible, is worth more than a signature alone.

What Tails does not protect against

The project’s warnings page is candid, and opens by stating that Tails “cannot protect you from everything — even if they pretend to.”6 The documented gaps fall into three groups.

Below the OS. Firmware is loaded before Tails is, and the project states that no operating system can defend against a firmware attack. Hardware keyloggers and physically tampered machines defeat it for the same reason, which is a live concern given that Tails is designed to be carried to computers the user does not control. An Evil maid attack is the case where these assumptions meet. Installing Tails from an already-compromised system can also corrupt the installation itself.

Inherent to Tor. Exit nodes observe unencrypted traffic and can attempt machine-in-the-middle attacks on plain HTTP. An adversary observing both ends of a circuit can correlate timing; no low-latency anonymity network defeats this, a limit Whonix has in the same terms, and When mixnets fail examines it for the designs that try. Using Tor is itself visible to an ISP, which bridges obscure but do not eliminate.

Above the OS. Documents carry metadata naming location, time, and device, which is why Tails ships a metadata cleaner. And running two identities in one session links them through a shared Tor circuit, a failure of use rather than of software.

Where it fits

Tails suits bounded, high-sensitivity sessions on untrusted or borrowed hardware: the classic case is a source contacting a journalist, and it generalizes to any task where leaving no local trace matters more than a comfortable persistent workspace. It is a poor daily driver, because every session starts from nothing and the amnesia that provides the protection is also the thing that makes ordinary work tedious.

For a persistent hardened desktop, Kicksecure or secureblue answer a different question, and Desktop operating system security comparison sets the five systems against each other directly.

See also

  1. Tor Project and Tails join forces, 26 September 2024, on the merger and the reasons Tails gave for seeking it. ↩

  2. Tails official documentation, release news, for version 7.10 of 23 July 2026. ↩

  3. Tails official documentation, overview page, on the clean-state boot and RAM-only operation. ↩

  4. Tails official documentation, design specification, on netfilter enforcement, the per-user split, onion-grater, and the description of application isolation as minimal. ↩↩

  5. Have your cake and eat it, too!, announcing reproducible ISO images in Tails 3.3, November 2017, and Verifying a Tails image for reproducibility for the current per-Git-tag procedure. ↩

  6. Tails official documentation, warnings page, on firmware, hardware tampering, exit nodes, correlation, metadata, and identity linking. ↩

Built on 5 sources (5 external).

Working out connections…