[Tails-dev] TAILS Mobile via USB or dual-boot

[Nathan of Guardian]

Hello, everyone. Finally joining this list.

I'd like to start an overdue discussion on how we can bring TAILS to
smartphone or tablet hardware in a usable way. I know we can produce a
firmware/ROM based on Android or possibly Ubuntu Touch that matches
the TAILS spec, but the question for me has been how do we match the
"boot from CD/USB" aspect of TAILS.

There are two interesting developments on this front:

1) An increasing amount of devices allow you to mount USB storage [0]
from the Micro USD port. This might be an opportunity to create a
recover/bootloader that can load a TAILS Mobile image from attached
storage.

2) Ubuntu has just released a dual boot system[1] that allows easy
switching between Android and Ubuntu on one device. If TAILS Mobile
were to be based on Ubuntu Touch, then this would allow for a nice
device with a standard Android system for daily use, and then an easy
to access TAILS mode for more sensitive work.

Apologies if I have missed any discussion or progress on TAILS Mobile
distribution, but better late than never!

All the best,
+n8fr8


[0]
http://www.gadgets4geeks.com.au/product/micro-usb-to-usb-otg-cable-adapter-motorola-moto-x

[1]
http://developer.ubuntu.com/2013/12/announcing-ubuntu-and-android-dual-boot-developer-preview/

[Thomas Benjamin]

Nate,

My R&D group has actually been doing some work along these lines. I've
been working to get our current work open sourced so we can share some of
the lessons we have learned and some or all of our relevant code. I'm not
sure how long it will take for me to get permission, but I am hoping it
will be some time this month. Keep me in the loop on this discussion (if
it moves outside of this list, I already read this list).

One of the key issues here is that the "boot off CD" model for desktops /
laptops translates poorly into the main model of SD card boot on Android
devices. Most Android devices will not boot automatically from an SD card,
which means that in general traces must be left on the phone (we are
currently just working with phones) of the fact that you use / have used
Tails. We can ensure that anything that happens during a Tails session is
encrypted before it can touch persistent store, but we want the same level
of deniability offered by CD or USB boot on a laptop. If possible on an
un-rooted phone even.

On the same note: If someone has or wants to build a list of devices that
will automatically boot from SD card if it is inserted, or if some magic
key combination is pressed during boot, I would be insanely happy. I think
we have part of such a list which is one of the things I want to open up
when I can. I know there are some, but we want to build a solution for a
broader range of devices, and it seems like auto-SD boot is rare on phones.



On Thu, Jan 2, 2014 at 1:56 PM, Nathan of Guardian <

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello, everyone. Finally joining this list.
I'd like to start an overdue discussion on how we can bring TAILS to
smartphone or tablet hardware in a usable way. I know we can produce a
firmware/ROM based on Android or possibly Ubuntu Touch that matches
the TAILS spec, but the question for me has been how do we match the
"boot from CD/USB" aspect of TAILS.
1) An increasing amount of devices allow you to mount USB storage [0]
from the Micro USD port. This might be an opportunity to create a
recover/bootloader that can load a TAILS Mobile image from attached
storage.
2) Ubuntu has just released a dual boot system[1] that allows easy
switching between Android and Ubuntu on one device. If TAILS Mobile
were to be based on Ubuntu Touch, then this would allow for a nice
device with a standard Android system for daily use, and then an easy
to access TAILS mode for more sensitive work.
Apologies if I have missed any discussion or progress on TAILS Mobile
distribution, but better late than never!
All the best,
+n8fr8
[0]
http://www.gadgets4geeks.com.au/product/micro-usb-to-usb-otg-cable-adapter-motorola-moto-x
[1]
http://developer.ubuntu.com/2013/12/announcing-ubuntu-and-android-dual-boot-developer-preview/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBAgAGBQJSxbZTAAoJEKgBGD5ps3qpqh0P/0/zi6VAsXwdeXSK/Fh/3vKQ
25CwQrE4oQW51agzWPhl/NwbPV3o7u/zHUsOk3ric1ZeKMSJuKiQ7Ax8BwcaLvIH
6TCXMoEKLe4A2tDsAgO4oe4NFhiQG7u9VrBEU241rgXtlT0SXd66Z2pYqRpOecrm
b7f5v5C+ModKfqnEjfV0W2KTBFG6dSI6jmaRJB7A7dViGT+XcIJSzMoeHyyH55pO
6qc66tFLgPZlv+sPX7rlthwYHD+/4fWb2dU0gdPGv1vJkypg4mzHXeNLzuTUjUPZ
cA5dAGUHPanTsr4mt0AMuBQHOrLOwILZ0q2Wh5nGw6P8TWJcfAjjq4fQLysZfRiX
g2vzvcjow/iI79QG6zZq9YBwiuRQUqULJlqUnyG/0b3wNj9CV7JVIcld8SHFlRZI
YqjswnmibAEw0VXw2m+5B3WKi+Bor6DPFjnEXHrU68PvcBwLB/3nEUyRCwS0ROpH
JAfK6idoLHs0k8IBmBNvoBS8jn4m/MiWSn/mNosET8PBAImMt1Uba9euqSIRS8cu
iceMhZqt6kIQZS8SEylGNJQdu62uLs4zOL8QP1+3VcfZpqeouZRzZUFtiva8TlLQ
4Q3t22n893mPqfuAbvpgMvqS+Z4gjmxQKCVhs0B5CFOh98GCLxm3VTv8aaYAcc9Y
X1e/osSLlhMaxRL5q1Ys
=8sbU
-----END PGP SIGNATURE-----
_______________________________________________
tails-dev mailing list
https://mailman.boum.org/listinfo/tails-dev

[Nathan of Guardian]

Post by Thomas Benjamin
My R&D group has actually been doing some work along these lines.

Hi, Tom!

Post by Thomas Benjamin
One of the key issues here is that the "boot off CD" model for desktops
/ laptops translates poorly into the main model of SD card boot on
Android devices. Most Android devices will not boot automatically from
an SD card,

Yes, in fact, I have only known the early Nook Color devices to do this.
Are there other devices on the market that have this capability?

What I am wondering is if the Ubuntu devs have come up with a dual-boot
system, if that can be modified to load a system image from an SD or USB
storage system. Perhaps it is also something CyanogenMod could support.
I will need to ask them and dig into the code, but if you have any clues
that would be great.

Post by Thomas Benjamin
which means that in general traces must be left on the phone
(we are currently just working with phones) of the fact that you use /
have used Tails. We can ensure that anything that happens during a
Tails session is encrypted before it can touch persistent store, but we
want the same level of deniability offered by CD or USB boot on a
laptop. If possible on an un-rooted phone even.

Right, and again that was what made the Nook so awesome. You didn't even
have to root, I believe.

For now, I am willing to give up on deniability, as long as we can match
the security of the Tails session itself.

Post by Thomas Benjamin
On the same note: If someone has or wants to build a list of devices
that will automatically boot from SD card if it is inserted, or if some
magic key combination is pressed during boot, I would be insanely happy.
I think we have part of such a list which is one of the things I want
to open up when I can. I know there are some, but we want to build a
solution for a broader range of devices, and it seems like auto-SD boot
is rare on phones.

Yes, see my earlier comments. I will see if we can start a list on our wiki.

Thanks for the feedback.

+n

[Nathan of Guardian]

Post by Nathan of Guardian
What I am wondering is if the Ubuntu devs have come up with a dual-boot
system, if that can be modified to load a system image from an SD or USB
storage system. Perhaps it is also something CyanogenMod could support.
I will need to ask them and dig into the code, but if you have any clues
that would be great.

I have answered my own question... MultiROM Android App:

http://www.addictivetips.com/ubuntu-linux-tips/dual-boot-android-ubuntu-touch-or-firefox-os-on-nexus-4-7-with-multirom/

"A great thing about MultiROM is the way it doesn’t require a lot of
tweaking on the user’s part to get things to work – there are no custom
bootloaders to flash, no configuration files to manually tweak or move
around; it all just works. Even better – it also supports USB flash
drives on devices such as the Nexus 7 that support USB OTG out of the
box, and even on Nexus 4 with hardware hacks that enable it."

***

This means on a Nexus 4, 7 or any USB OTG enabled-device, we can boot a
custom Tails edition of Android or Ubuntu Touch from a USB drive. Awesome!

Open-source, as well: https://github.com/Tasssadar/multirom

Happy day!

+n

[intrigeri]

Post by Nathan of Guardian
This means on a Nexus 4, 7 or any USB OTG enabled-device, we can boot a
custom Tails edition of Android or Ubuntu Touch from a USB drive. Awesome!

Wooohoo!

(Sorry for the newbie question.) Any idea what proportion of mobile
devices (e.g. tablets) have a x86 emulation mode that allows one to
start e.g. Tails without porting it to ARM first? Isis told me she had
seen Tails boot on such hardware at least once, thanks to
this feature.

Cheers,

[Nathan of Guardian]

Post by intrigeri
(Sorry for the newbie question.) Any idea what proportion of mobile
devices (e.g. tablets) have a x86 emulation mode that allows one to
start e.g. Tails without porting it to ARM first? Isis told me she had
seen Tails boot on such hardware at least once, thanks to
this feature.

I personally know of no mainstream mobile phones or tablets that support
this feature. Even if it worked, I would imagine the performance and
usability to be pretty terrible.

I think our best bet will be to start with Ubuntu Touch or Firefox OS,
and strip it back to something you all are comfortable with putting the
Tails name on.

Ubuntu Touch: https://wiki.ubuntu.com/Touch/Porting

Firefox OS:
https://developer.mozilla.org/en-US/Firefox_OS/Building_and_installing_Firefox_OS/Firefox_OS_build_overview

+n

[intrigeri]

Hi Nathan,

Post by Nathan of Guardian
I think our best bet will be to start with Ubuntu Touch or Firefox OS,
and strip it back to something you all are comfortable with putting the
Tails name on.

It seems that the "TAILS" (sic) name has already been put on it quite
prominently:

* http://www.dailydot.com/technology/tor-anonymous-os-tails-freitas/
* http://www.dailydot.com/technology/tor-anonymous-mobile-os-tails/

I'm glad you are making progress on this (and I would be very happy to
see the code and design documentation), but my personal feeling is
that it's a bit premature to assume we'll be comfortable putting the
Tails name on this, and let journalists think it will definitely be
the case.

Cheers!

[Nathan of Guardian]

Post by intrigeri
Hi Nathan,

Post by Nathan of Guardian
I think our best bet will be to start with Ubuntu Touch or Firefox

OS,

Post by Nathan of Guardian
and strip it back to something you all are comfortable with putting

the

Post by Nathan of Guardian
Tails name on.

It seems that the "TAILS" (sic) name has already been put on it quite
* http://www.dailydot.com/technology/tor-anonymous-os-tails-freitas/
* http://www.dailydot.com/technology/tor-anonymous-mobile-os-tails/
I'm glad you are making progress on this (and I would be very happy to
see the code and design documentation), but my personal feeling is
that it's a bit premature to assume we'll be comfortable putting the
Tails name on this, and let journalists think it will definitely be
the case.
Cheers!

I 100% agree. That journalist basically crawled the Tor winter meeting notes wiki and asked me some questions via email. I wrote back after the story came out and told him that he went way overboard with both the headline and the projection.

What I was trying to do was promote how great TAILS is now, and how in our mobile work we seek to emulate it.

[Nathan of Guardian]

On 03/07/2014 08:48 AM, Nathan of Guardian wrote:

[intrigeri]

Post by Nathan of Guardian
I 100% agree. That journalist basically crawled the Tor winter meeting notes wiki and
asked me some questions via email. I wrote back after the story came out and told him
that he went way overboard with both the headline and the projection.

Thanks a lot for the clarification!

[s***@pimienta.org]

Post by Nathan of Guardian
Hello, everyone. Finally joining this list.

Welcome!

Post by Nathan of Guardian
I'd like to start an overdue discussion on how we can bring TAILS to
smartphone or tablet hardware in a usable way. I know we can produce a
firmware/ROM based on Android or possibly Ubuntu Touch that matches
the TAILS spec, but the question for me has been how do we match the
"boot from CD/USB" aspect of TAILS.

Maybe you know that already, but at the moment our team is struggling
quite a bit to keep the project sustainable on the long-run. We have a
quite challenging roadmap [1] to get there, and are very busy with
keeping Tails relevant on PC.

With this, I'm not saying that porting Tails to other devices is of no
interest; it is far from being the case. But we'll probably have very
little time to dedicate to those issues before things calm down on the
PC side. But it's great if you are moving this forward, and you are
surely much more knowledgeable in this field than us.

[1]: https://labs.riseup.net/code/projects/tails/roadmap

[Nathan of Guardian]

Post by s***@pimienta.org
Maybe you know that already, but at the moment our team is struggling
quite a bit to keep the project sustainable on the long-run. We have a
quite challenging roadmap [1] to get there, and are very busy with
keeping Tails relevant on PC.

My hope is to do what I can to drive interest and adoption in the core TAILS project, by showing it is still fully relevant in a mobile device age. Rather than invent yet another secure Linux variant, we want to build upon the existing vision, in the same way we have done with Tor, OTR and GnuPG on Android. In short, I hope this can be a part of the solution to address the sustainability issue.

Post by s***@pimienta.org
With this, I'm not saying that porting Tails to other devices is of no
interest; it is far from being the case. But we'll probably have very
little time to dedicate to those issues before things calm down on the
PC side. But it's great if you are moving this forward, and you are
surely much more knowledgeable in this field than us.
[1]: https://labs.riseup.net/code/projects/tails/roadmap

I will talk with others who have responded here or privately, and report back when there is anything useful to share.

Thx +n

[intrigeri]

Post by Nathan of Guardian
In short, I hope this can be a part of the solution to address the
sustainability issue.

I hope too :)

Post by Nathan of Guardian
I will talk with others who have responded here or privately, and
report back when there is anything useful to share.

Great!

Cheers,

[intrigeri]

[...] but the question for me has been how do we match the "boot
from CD/USB" aspect of TAILS.

Frankly, I personally am much less experienced in this area than you,
so I'm afraid I cannot help much.

Cheers,

[Nathan of Guardian]

Post by intrigeri

[...] but the question for me has been how do we match the
"boot from CD/USB" aspect of TAILS.

Frankly, I personally am much less experienced in this area than
you, so I'm afraid I cannot help much.

Just want to announce some exciting progress made on the idea of a
TAILS Mobile edition booted from USB to an Android device. This is
just a hobby project right now, something to do in the spare time I
really don't have. However, like any interesting problem, I just can't
stop thinking about it :)

So, I have boot from USB key working on my Nexus 7 (the original 2012
wifi only edition), and am able to boot a locked down version of
Android from my Micro USB drive. This is enabled by rooting the
device, and flashing the MultiROM recovery firmware and app, which
handles the boot time switching. The point being that the main device
does not need to be modified an extraordinary amount, and can even
still run the stock firmware. It only requires root at this point.

This is all thanks to the amazing MultiROM project, of course, so I am
mostly just reporting back on testing:
https://github.com/Tasssadar/multirom

I can easily switch between the internal ROM and the USB booted ROM by
simply performing a device reboot and selecting the desired ROM to
boot from on startup, just like with a standard PC BIOS.

All user data is persisted to the USB drive, and I can setup Orbot to
autoboot with full transproxy, GnuPG for Android, ChatSecure etc. I am
going to try to setup full disk encryption on the USB booted firmware,
and will see how that goes. I have also run SecDroid on this which
effectively disables all unneeded services and turns off the ability
to install new apps.

There is a noticeable lag/freeze at times when the OS is
reading/writing from the USB, but it is not terrible. It may also be
related to the quality of the cheap noname USB flash drive I bought.
(ADATA
http://www.newegg.com/Product/Product.aspx?gclid=CIe9taeVg7wCFcFj7AodFnEAXQ&Item=N82E16820211829&nm_mc=KNC-GoogleAdwords&cm_mmc=KNC-GoogleAdwords-_-pla-_-USB+Flash+Drives-_-N82E16820211829&ef_id=UtgPqAAABF9bnY5c:20140116165816:s)

Sony has a new one coming out (micro USB OTG support) that I will test
with soon, that is also very very small physically, which matters if
you are going to have something hanging off your device's USB port.

I can also boot Ubuntu Touch from USB, but I am sad to say the state
of Ubuntu Touch is quite poor, at least running on this hardware
(which is actually fairly powerful). It is very slow and crashes quite
a bit. I will test more on the Nexus 7 2013 edition. I really need to
reach out to Ubuntu to understand their device support roadmap, and to
check out the reality of building upon their work vs. Android.

Otherwise, still investigating booting other variants of Debian on ARM
to see how easily we could "port" the existing TAILS work to a
solution like this, versus building something "similar but different"
from the ground up.

All the best!

+n

[intrigeri]

Hi Nathan,

Post by Nathan of Guardian
So, I have boot from USB key working on my Nexus 7 (the original 2012
wifi only edition), and am able to boot a locked down version of
Android from my Micro USB drive.

Congrats!

Post by Nathan of Guardian
Otherwise, still investigating booting other variants of Debian on ARM
to see how easily we could "port" the existing TAILS work to a
solution like this, versus building something "similar but different"
from the ground up.

I'm very glad you're considering this option.

The Debian Mobile team might be of some help (no idea how active they
are these days): https://wiki.debian.org/Mobile

This page might also be useful (no idea how up-to-date it is either):
https://wiki.debian.org/DebianOnHandhelds

Cheers,