Field Notes

source

Tails official documentation

StatusStableUpdatedStands on3 sourcesSupportsnotes

About. Warnings. Design specification.

Three pages captured from the Tails project’s own site on 28 July 2026: the user-facing overview, the documented list of what Tails does not protect against, and the developer-facing design specification. Together they state the product claim, the threat model, and the mechanism.

What the pages establish

The overview describes a portable operating system (OS) booted from a Universal Serial Bus (USB) stick, running from random-access memory (RAM), which is “entirely deleted when you shutdown Tails.” Internet traffic is routed through Tor, and “applications are blocked automatically if they try to connect to the Internet without Tor.” Optional encrypted Persistent Storage lets selected files and settings survive a session.

The design specification supplies the mechanism behind the enforcement claim. Outbound traffic other than Tor is dropped by netfilter rules; non-TCP protocols are dropped because Tor carries only Transmission Control Protocol (TCP); Domain Name System (DNS) queries are redirected to Tor’s DNSPort. Enforcement is organized around separate system users: debian-tor runs Tor itself, the ordinary amnesia user reaches the network only through Tor’s transparent proxy, and a distinct clearnet user carries the narrow exceptions, including the Unsafe Browser. An onion-grater proxy filters Tor’s control port per application, blocking commands that would leak identifying information. Application isolation is described as “minimal,” using AppArmor confinement and bubblewrap sandboxing, and the document is explicit that this reduces kernel attack surface without preventing a compromised process from exploiting a vulnerability.

What the project says it does not cover

The warnings page is unusually direct, opening on the point that Tails “cannot protect you from everything — even if they pretend to.” It disclaims protection against firmware attacks (“all operating systems, including Tails, depend on firmware to start and run”), hardware keyloggers and physical device tampering, installation from an already-compromised OS, Tor exit nodes observing unencrypted traffic, and end-to-end correlation by an adversary watching both ends. It also names two user-behavior failure modes that no mechanism addresses: document metadata revealing location, time, and device, and using one session for identities that should not be linked.

Reading these as evidence

These are primary-source project documents describing design intent and self-assessed limits, not independent evaluation. The warnings page is nonetheless the most useful of the three for the wiki’s purposes, because a project cataloguing its own failure modes argues against its own interest.

Competitor comparisons need more care, and the Whonix comparison with other anonymity systems page shows why: it evaluates Tails 2.4, released in 2016, and records Tails as lacking deterministic builds. Tails has published reproducible images since version 3.3 in November 2017, so that entry was already stale when captured and is now nine years out of date. The architectural claims on that page still hold, because they follow from designs neither project has changed; the feature-by-feature rows do not.

Built on 3 sources (3 external).

Working out connections…