Field Notes

entity

Whonix

StatusStableReviewdue UpdatedStands on4 sourcesSupportsnotes

Whonix is a free and open-source desktop operating system (OS) designed so that all network traffic is routed through the Tor anonymity network. It is built on Kicksecure, the hardened Debian derivative documented in Kicksecure security features documentation, and its defining design is a two-VM architecture that enforces Tor routing structurally rather than by configuration alone.1 The project is founded and led by Patrick Schleizer, who publishes under the handle “adrelanos.”2

The gateway/workstation split

Whonix ships as two virtual machines (VMs) joined by an isolated internal network. The Whonix-Gateway runs the Tor processes and firewall rules that permit traffic to leave only through Tor. The Whonix-Workstation runs user applications and has no route to the physical network at all: its only path out is through the Gateway, and it never learns the host’s real IP address, so DNS leaks are structurally impossible rather than merely unlikely.3 The security claim follows from the split: even a fully compromised application — or a fully compromised Workstation — cannot leak the real IP through ordinary network paths, because the Workstation does not possess it. An adversary would have to break out of the VM or compromise the Gateway, a deliberately minimal attack surface.

Distribution forms

Whonix is distributed as VirtualBox and KVM images, as Qubes OS templates (where it is the standard Tor-routed compartment), and as a physical-isolation configuration in which Gateway and Workstation run on separate hardware for stronger isolation than one hypervisor provides.3 Because it is Kicksecure-based, Whonix inherits that distribution’s hardening — kernel self-protection settings, package minimization, secure time synchronization — and Whonix is in turn Kicksecure’s best-known downstream.

Honest limits

Whonix’s own documentation is unusually candid about what the design does not cover. Tor’s low-latency circuit design offers no protection against a global passive adversary who can observe both ends of a connection and correlate timing. Browser fingerprinting survives Tor routing: a Workstation that cannot leak its IP can still be identified by the fingerprint its browser presents. And no VM architecture defends against compromise of the endpoint hardware itself — a keylogger or compromised firmware on the host sees everything before the isolation applies.

Against Tails

Tails is the other well-established Tor-enforcing OS, and the projects differ on one decision from which most other differences follow: where the Tor client runs. Tails runs it on the same machine as user applications, so a root compromise reaches a host that knows its own IP address and can rewrite the firewall protecting it. Whonix moves the Tor client to a separate VM, so the same compromise lands on a Workstation with nothing to disclose.4

The cost is symmetric and Whonix’s own comparison records it: Tails is amnesic by default, while Whonix persists unless Live Mode is enabled and cannot be amnesic at all under Qubes. Whonix protects the identity of a user under active compromise; Tails protects the record of what the user did from whoever examines the machine afterwards.

Treat that comparison page as an argument rather than a finding. It is maintained by one of the two projects, its feature rows describe Tails 2.4 from 2016, and at least one row is now demonstrably wrong. The architectural claim is the part that survives, because it follows from a design decision neither project has changed.

See also

  1. Whonix, About, on the Kicksecure base, the two-VM architecture, and supported hypervisors. ↩

  2. Whonix, Patrick Schleizer, identifying the founder and lead developer and the “adrelanos” handle. ↩

  3. Whonix, Technical Introduction, on the Gateway/Workstation design, the leak-resistance argument, and physical isolation. ↩↩

  4. Whonix comparison with other anonymity systems, on Tor client placement, root compromise, and amnesia, together with the staleness of its per-feature rows. ↩

Built on 4 sources (4 external).

Working out connections…