I was wondering why Kicksecure doesn’t force all the traffic to go through Tor. This is something that Tails OS does. I understand that the Whonix gateway needs to connect to the clearnet to prevent Tor on Tor. This can be done by running virt manager as another user which is not protected by Tor. Tails uses an infrastructure called unsafe browser and some projects connect directly to this to access the clearnet bypassing the Tor infrastrcuture. This needs to developed in conjuction with the firewall. I assume this operating systems’ development has matured as it can run on modern machines. Is this currently in development?
Anonymity features that do not have a meaningful positive impact on security besides making the user anonymous are out of scope for Kicksecure:
Kicksecure is meant to give you a base to do whatever you want securely, without forcing you to use it for any one thing. Tails and Whonix are both more like purpose-built appliances for doing things anonymously (and have different strengths and weaknesses).
Enabling all traffic to go through Tor by default was one of the design goals of Kicksecure which is meant to be running Whonix as a VM. Fully torrifying Kicksecure traffic is not “meaningless“ as it has multiple security advantages say malware is running and decides to phone home a lot of details regarding the user can be exfiltrated. A good design policy would be to eliminate direct network leaks by torrifying traffic, ensuring that the host itself cannot bypass the anonymity layer by leaving it exposed to clearnet traffic and expose the user’s real identity, IP address, or activity. A Tor only network policy makes privacy the default rather than something that depends on user discipline. If Kicksecure is meant to run as a host OS to support Whonix then enabling non-tor traffic widens the attack surface as a user running Tor can be seen as suspicious and malicious state actors can try to deanonymize and identify the user.
I’m unsure if you’re saying that this should be a design goal, or if you believe that it is a documented design goal. If you mean the latter, this is (at least as of today) false, the wiki page shared above states the current design goal. If you mean the former, I disagree; Kicksecure is intended to be a general-purpose Linux operating system, not simply a host for Whonix VMs (although it is recommended for that purpose). There are many use cases that Tor outright blocks or makes very complicated (i.e. anything involving UDP traffic, use of websites that block or restrict Tor, etc.).
Trying to make Kicksecure tunnel its own traffic through Tor would not meaningfully avoid this. Given the frequency of LPE vulns in the Linux kernel, malware can often elevate to root if it can compromise your host system, at which point it can rewrite firewalls, load drivers, or do whatever else it needs to in order to get a clearnet connection. This is why Whonix exists; if malware infects the Workstation, it can’t get a clearnet connection because the Workstation has no method to connect to the Internet without going through the Gateway, and the Gateway (which the malware has no control over) forces everything through Tor.
Security and anonymity absolutely require user discipline. There is no alternative to this, nor will there be, without preventing the user from using their computer as a general-purpose computing device, which would be a bad thing. (See: General Threats to User Freedom) A disciplined user will understand that if only things in a Whonix VM are anonymous, doing sensitive work on the host may be a bad idea. An undisciplined user will likely leak their identity on accident regardless of what protections are set up, and protections that block the user from doing what they want with their computer will directly harm disciplined users.
I fail to see how pushing more traffic through Tor will hide the fact that a user is using Tor from a network-observing attacker. See:
(I’m assuming a network-observing attacker here, since other kinds of attackers aren’t directly relevant when considering the risks of using mixed clearnet and torified traffic versus purely torified traffic.)
Forcing all traffic to go through Tor is a design goal of Kicksecure aka Whonix-Host. Also See this. You say Kicksecure is meant to be a general purpose Linux operating system. Incorrect it was specifically meant to be run as a host for Whonix because none existed previously. Ubuntu seems to fit that purpose way more clearly. There are other security operating systems such as Kali and Parrot each appealing to their own subset of users. Malware gaining root access is the ultimate security nightmare but in a non-torrified OS any piece of malware able to run on kicksecure can easily phone home no root access is needed. A Torified host is not intended to stop a fully compromised kernel-level attacker, but to prevent accidental leaks, reduce exposure from non-root compromises, and ensure that applications running outside Whonix do not silently create an identifiable clearnet footprint. Security mechanisms do not need to defeat every attacker to be valuable; they need to reduce realistic risks. A Tor-only policy can coexist with user freedom by being an explicit security mode rather than the only operating mode.
A security-focused OS should provide additional protections for users with stronger threat models. Many users on Windows and other general-purpose operating systems already choose to use VPNs because they want an extra layer of privacy and security beyond what the default system provides. I am mentioning VPNs as an analogy to Tor. For users running Whonix and using the host as part of a privacy-oriented setup, forcing all traffic through Tor provides a similar defense-in-depth approach by preventing clearnet leaks, reducing exposure, and ensuring the host does not bypass the anonymity model. Torifying the host is not meant to replace Whonix isolation or stop a fully compromised system, it is an additional security layer for users who intentionally choose a security-focused environment.
Kicksecure is not Whonix-Host. Whonix-Host does not exist yet except for a concept and a very outdated and unusable prototype. Whonix-Host is still planned for development eventually (and that will do something similar to what you’re asking for), but Kicksecure is not the same thing.
I am certain that this has never been the case. Wiki page Privacy Goals and Non-Goals of Kicksecure had been added to very much clarify exactly this. I’ve always been most careful to avoid mixing the goals of the 2 projects.
It’s not aka at all. It’s different projects, different websites.
I personally would like to see ways to force specific apps without the whole system through Tor and ways for users that can’t use Tor to disable Tor easily in sysmaint without just masking the service as mentioned and without loosing sdwdate. Which besides apt seems to be the only thing utilizing tor?
Disabling Tor and keeping working sdwdate are mutually exclusive. sdwdate exists solely to set the system time from timestamps fetched securely over Tor. It can’t work without Tor, not even in theory (it can’t fetch timestamps via an encrypted protocol without Tor if the system time is wrong, which is the very condition it’s intended to fix, and if it fetched timestamps without an encrypted protocol, it wouldn’t be secure any longer).
If tor is not running via a kicksecure OS name check logic and use a clearnet site list?
(This is separate topic then this thread and getting off topic)
TLS/HTTPS breaks when the system clock is too far wrong, or worse, it doesn’t break and now an attacker can use a stolen TLS certificate to serve whatever data they want to you.
But yes, this would be better in a different thread.
