Commit b020b094 authored by anonym's avatar anonym
Browse files

Merge remote-tracking branch 'origin/master' into stable

parents 321f8b9d af809722
......@@ -21,7 +21,7 @@ Tails developers <amnesia@boum.org>
=head1 LICENSE AND COPYRIGHT
Copyright (C) 2011 Tails developers <amnesia@boum.org>
Copyright (C) 2011 Tails developers <tails@boum.org>
Licensed under the GNU GPL version 3 or any later version.
......
See the Tails website (https://tails.boum.org/), whose source lies
in the "wiki" directory of this very Git repository.
For copyright and licensing information, see `debian/copyright`.
Copyright:
Copyright (C) Amnesia <amnesia@boum.org>
Copyright (C) Tails developers <tails@boum.org>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
......
[[!meta title="DAVE 2"]]
Parent ticket: [[!tails_ticket 12328 desc="DAVE 2: Migrate to Web Extensions and support Chrome"]]
[[!toc]]
Scope
=====
With the port to Web Extension, we are:
- Moving the download outside of DAVE
- Adding a Chrome extension
Relevant threads:
- [Initial discussion on tails-ux](https://mailman.boum.org/pipermail/tails-ux/2017-May/thread.html)
- [Decision on moving the download outside of DAVE](https://mailman.boum.org/pipermail/tails-ux/2017-June/003394.html)
Goals:
- Prevent people from using unverified ISO images.
- Proposed solution: Split the download in a different step and adjust
the "Next" link to what the user is doing on the page to discourage
(but still make it possible) skipping the verification.
- Encourage BitTorrent download when DAVE is not supported.
- Proposed solution: Explain better the benefits of BitTorrent and how
to use it.
- Make it easier to do a direct download for power users who do OpenPGP.
- Proposed solution: Have a "Direct download" button and embed the
OpenPGP instructions on the same page.
Variations
==========
- 2 download techniques:
- Direct download
- BitTorrent download
- 3 verification techniques:
- Browser add-on (Firefox, Chrome, or Tor Browser)
- BitTorrent
- OpenPGP (either on top of instead of the two others)
- 6 variations of the same screen depending on the browser:
- Supported browser but no DAVE
- Supported browser and DAVE already
- Supported browser but outdated DAVE
- Supported but outdated browser (eg. Firefox < 38)
- Unsupported browser (eg. Internet Explorer)
- Browser without JavaScript
External resources
==================
- Market shares of browsers:
- [Kleiner Perkins: 2017 Internet trends](http://www.kpcb.com/internet-trends)
- Browser detection code by Firefox (support.mozilla.org)
Wireframes
==========
Made with [*WireframeSketcher*](http://wireframesketcher.com/) which is
proprietary but has a Debian package that works on Tails :)
### Screens
- [[supported_browser.screen]]: Supported browser but no DAVE
- [[unsupported_browser.screen]]: Unsupported browser (eg. Internet Explorer)
- [[outdated_browser.screen]]: Supported but outdated browser (eg. Firefox < 38)
- [[no_JS.screen]]: Browser without JavaScript
- Moving parts (to be used to simulate interactivity during paper prototyping):
- [[moving_parts_1.screen]]
- [[moving_parts_2.screen]]
- OpenPGP instructions (to be displayed on all screens when scrolling):
- [[OpenPGP_1.screen]]
- [[OpenPGP_2.screen]]
- [[OpenPGP_3.screen]]
- [[OpenPGP_4.screen]]
### Assets
[[!map pages="blueprint/DAVE_2/assets/*"]]
<?xml version="1.0" encoding="UTF-8"?>
<model:Screen xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:model="http://wireframesketcher.com/1.0/model.ecore">
<widgets xsi:type="model:Panel" id="99" x="12" y="48" width="800" height="600" measuredWidth="800" measuredHeight="600"/>
<widgets xsi:type="model:Text" id="100" x="42" y="152" width="605" height="105" text="If you know OpenPGP, you can also use it to verify your download instead, or in addition to, verifying using Firefox or BitTorrent.&#xA;&#xA;1. Download the [Tails signing key] (last updated on 2017-08-30).&#xA;&#xA;2. Download the [Tails 3.1 OpenPGP signature] and save it to the same folder where you saved the ISO image." measuredWidth="605" measuredHeight="105">
<font/>
<items x="89" y="48" width="87" height="16" text="Tails signing key"/>
<items x="89" y="80" width="149" height="16" text="Tails 3.1 OpenPGP signature"/>
</widgets>
<widgets xsi:type="model:Label" id="101" x="40" y="292" text="Basic OpenPGP verification" measuredWidth="289" measuredHeight="40">
<font size="24px"/>
</widgets>
<widgets xsi:type="model:Label" id="102" x="40" y="466" text="Authenticate the signing key through the OpenPGP Web of Trust" measuredWidth="688" measuredHeight="40">
<font size="24px"/>
</widgets>
<widgets xsi:type="model:Text" id="103" x="42" y="514" width="589" height="61" text="Authenticating our signing key through the OpenPGP Web of Trust is the only verification technique that can protect you in case our website is compromised. It is also the most complicated technique and might not be possible for everyone to perform because it relies on trust relationships between individuals." measuredWidth="589" measuredHeight="61">
<font/>
</widgets>
<widgets xsi:type="model:Text" id="104" x="42" y="340" width="605" height="59" text="Verifying using OpenPGP but without authenticating our signing key through the OpenPGP Web of Trust is equivalent in terms of security to verifying using Firefox or BitTorrent because it relies on downloading a genuine signing key from our website." measuredWidth="605" measuredHeight="59">
<font/>
</widgets>
<widgets xsi:type="model:Link" id="105" x="42" y="571" text="Read more about authenticating the signing key through the OpenPGP Web of Trust." measuredWidth="439" measuredHeight="24">
<font/>
</widgets>
<widgets xsi:type="model:Label" id="106" x="40" y="100" text="Verify using OpenPGP (optional)" measuredWidth="401" measuredHeight="44">
<font size="28px"/>
</widgets>
<widgets xsi:type="model:Link" id="107" x="41" y="398" text="See instructions for basic OpenPGP verification." measuredWidth="252" measuredHeight="24">
<font/>
</widgets>
<widgets xsi:type="model:Note" id="108" x="12" y="7" width="800" height="32" text="This screen appears below the fold." measuredWidth="800" measuredHeight="32" textAlignment="Left">
<font/>
</widgets>
<hRuler/>
<vRuler>
<guides position="2305"/>
</vRuler>
<font size="12px"/>
</model:Screen>
<?xml version="1.0" encoding="UTF-8"?>
<model:Screen xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:model="http://wireframesketcher.com/1.0/model.ecore">
<widgets xsi:type="model:Panel" id="131" x="12" y="48" width="800" height="600" measuredWidth="800" measuredHeight="600"/>
<widgets xsi:type="model:Text" id="116" x="42" y="102" width="657" height="535" text="The verification techniques presented until now (Firefox extension, BitTorrent, or OpenPGP verification) all rely on some information being securely downloaded using HTTPS from our website:&#xA;&#xA;- The checksum for the Firefox extension&#xA;- The Torrent file for BitTorrent&#xA;- The Tails signing key for the OpenPGP verification&#xA;&#xA;But, while doing so, you could download malicious information if our website is compromised or if you are victim of a man-in-the-middle attack.&#xA;&#xA;The OpenPGP verification is the only technique that allows you to verify the ISO image even better by also authenticating the Tails signing key through the OpenPGP Web of Trust. Relying on the OpenPGP Web of Trust is the only way to completely protect you from malicious downloads.&#xA;&#xA;If you are verifying an ISO image from inside Tails already, for example to do a manual upgrade, then the Tails signing key is already included in Tails. You can trust this signing key as much as you are trusting your Tails installation already because you are not downloading it.&#xA;&#xA;One of the inherent problems of standard HTTPS is that the trust we usually put in a website is defined by certificate authorities: a hierarchical and closed set of companies and governmental institutions approved by your web browser vendor. This model of trust has long been criticized and proved several times to be vulnerable to attacks as explained on our warning page." measuredWidth="657" measuredHeight="535">
<font size="12px" bold="false"/>
</widgets>
<widgets xsi:type="model:Note" id="132" x="12" y="7" width="800" height="32" text="These instructions appears when the user clicks on &quot;Read more about authenticating...&quot;." measuredWidth="800" measuredHeight="32" textAlignment="Left">
<font/>
</widgets>
<hRuler/>
<vRuler>
<guides position="2305"/>
</vRuler>
<font size="12px"/>
</model:Screen>
<?xml version="1.0" encoding="UTF-8"?>
<model:Screen xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:model="http://wireframesketcher.com/1.0/model.ecore">
<widgets xsi:type="model:Panel" id="131" x="12" y="48" width="800" height="600" measuredWidth="800" measuredHeight="600"/>
<widgets xsi:type="model:Text" id="116" x="42" y="102" width="657" height="529" text="We believe that, instead, users should be given the final say when trusting a website, and that designation of trust should be done on the basis of human interactions.&#xA;&#xA;The OpenPGP Web of Trust is a decentralized trust model based on OpenPGP keys that can help solving this problem. Let's see this with an example:&#xA;&#xA;1. You are friend with Alice and really trust her way of managing OpenPGP keys. So you are trusting Alice's key.&#xA;&#xA;2. Furthermore, Alice met Bob, a Tails developer, in a conference and certified Bob's key. So Alice is trusting Bob's key.&#xA;&#xA;3. Bob is a Tails developer who directly owns the Tails signing key. So Bob fully trusts the Tails signing key.&#xA;&#xA;In this scenario, Alice found a path to trust the Tails signing key without the need to rely on certificate authorities.&#xA;&#xA;If you are on Debian, Ubuntu, or Linux Mint, you can install the debian-keyring package which contains the OpenPGP keys of all Debian developers. Some Debian developers have certified the Tails signing key and you can use these certifications to build a trust path. This technique is explained in detail in our instructions on [installing Tails from Debian, Ubuntu, or Linux Mint using the command line].&#xA;&#xA;Relying on the Web of Trust requires both caution and intelligent supervision by the users. The technical details are outside of the scope of this document.&#xA;&#xA;Since the Web of Trust is actually based on human relationships and real-life interactions, the best is to get in touch with people knowledgeable about OpenPGP and build trust relationships in order to find your own trust path to the Tails signing key.&#xA;&#xA;For example, you can start by contacting a local [Linux User Group], [an organization offering Tails training], or other Tails enthusiasts near you and exchange about their OpenPGP practices.&#xA;&#xA;After you built a trust path, you can certify the Tails signing key by signing it with your own key to get rid of some warnings during the verification process." measuredWidth="657" measuredHeight="529">
<font size="12px" bold="false"/>
<items x="0" y="256" width="652" height="32" text="installing Tails from Debian, Ubuntu, or Linux Mint using the command line"/>
<items x="251" y="416" width="89" height="16" text="Linux User Group"/>
<items x="346" y="416" width="194" height="16" text="an organization offering Tails training"/>
</widgets>
<widgets xsi:type="model:Note" id="132" x="12" y="7" width="800" height="32" text="These instructions appears when the user clicks on &quot;Read more about authenticating...&quot;." measuredWidth="800" measuredHeight="32" textAlignment="Left">
<font/>
</widgets>
<hRuler/>
<vRuler>
<guides position="2305"/>
</vRuler>
<font size="12px"/>
</model:Screen>
<?xml version="1.0" encoding="UTF-8"?>
<model:Screen xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:model="http://wireframesketcher.com/1.0/model.ecore">
<widgets xsi:type="model:Panel" id="99" x="12" y="48" width="800" height="600" measuredWidth="800" measuredHeight="600"/>
<widgets xsi:type="model:Text" id="70" x="44" y="79" width="657" height="266" text="This section provides simplified instructions:&#xA;&#xA;- [In Windows with Gpg4win]&#xA;- [In macOS with GPGTools]&#xA;- [In Tails]&#xA;- [Using the command line]&#xA;&#xA;This basic OpenPGP verification provides a level of verification equivalent to HTTPS, like the Firefox and Chrome extension or BitTorrent, unless you also authenticate the signing key through the OpenPGP Web of Trust.&#xA;&#xA;IN WINDOWS WITH GPG4WIN&#xA;&#xA;See the [Gpg4win documentation on verifying signatures].&#xA;&#xA;Verify the date of the signature to make sure that you downloaded the latest version.&#xA;&#xA;If the following warning appears:" measuredWidth="657" measuredHeight="266">
<font size="12px" bold="false"/>
<items x="20" y="16" width="137" height="16" text="In Windows with Gpg4win"/>
<items x="20" y="32" width="131" height="16" text="In macOS with GPGTools"/>
<items x="20" y="48" width="37" height="16" text="In Tails"/>
<items x="20" y="64" width="125" height="16" text="Using the command line"/>
<items x="41" y="176" width="249" height="16" text="Gpg4win documentation on verifying signatures"/>
</widgets>
<widgets xsi:type="model:Text" id="74" x="44" y="426" width="657" height="271" text="Then the ISO image is still correct according to the signing key that you downloaded. To remove this warning you need to authenticate the signing key through the OpenPGP Web of Trust.&#xA;&#xA;IN MACOS USING GPGTOOLS&#xA;&#xA; 1. Open Finder and navigate to the folder where you saved the ISO image and the signature.&#xA;&#xA; 2. Right-click on the ISO image and choose Services ▸ OpenPGP: Verify Signature of File." measuredWidth="657" measuredHeight="271">
<font size="12px" bold="false"/>
</widgets>
<widgets xsi:type="model:Image" id="75" x="59" y="350" width="655" height="59" measuredWidth="655" measuredHeight="59" src="assets/1.png"/>
<widgets xsi:type="model:Note" id="101" x="12" y="7" width="800" height="32" text="These instructions appears when the user clicks on &quot;See instructions for basic OpenPGP verification...&quot;." measuredWidth="800" measuredHeight="32" textAlignment="Left">
<font/>
</widgets>
<hRuler/>
<vRuler>
<guides position="2305"/>
</vRuler>
<font size="12px"/>
</model:Screen>
<?xml version="1.0" encoding="UTF-8"?>
<model:Screen xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:model="http://wireframesketcher.com/1.0/model.ecore">
<widgets xsi:type="model:Panel" id="125" x="12" y="48" width="800" height="600" measuredWidth="800" measuredHeight="600"/>
<widgets xsi:type="model:Text" id="118" x="43" y="529" width="657" height="111" text=" Verify the date of the signature to make sure that you downloaded the latest version.&#xA;&#xA;USING THE COMMAND LINE&#xA;&#xA; 1. Open a terminal and navigate to the folder where you saved the ISO image and the signature.&#xA;&#xA; 2. Execute:" measuredWidth="657" measuredHeight="111">
<font size="12px" bold="false"/>
</widgets>
<widgets xsi:type="model:Image" id="119" x="87" y="418" width="447" height="82" measuredWidth="447" measuredHeight="82" src="assets/notification_in_tails.png"/>
<widgets xsi:type="model:Note" id="126" x="12" y="7" width="800" height="32" text="These instructions appears when the user clicks on &quot;See instructions for basic OpenPGP verification...&quot;." measuredWidth="800" measuredHeight="32" textAlignment="Left">
<font/>
</widgets>
<widgets xsi:type="model:Text" id="127" x="44" y="355" width="657" height="41" text=" 4. After the verification finishes, click on the notification counter in the bottom-right corner and on the notification with a &#xA; transparent background on the right of the notification area:" measuredWidth="657" measuredHeight="41">
<font size="12px" bold="false"/>
</widgets>
<widgets xsi:type="model:Image" id="128" x="86" y="209" width="315" height="124" measuredWidth="315" measuredHeight="124" src="assets/verifying_in_tails.png"/>
<widgets xsi:type="model:Text" id="129" x="44" y="79" width="660" height="120" text="IN TAILS&#xA;&#xA; 1. Open the file browser and navigate to the folder where you saved the ISO image and the signature.&#xA;&#xA; 2. Right-click on the signature and choose Open With Verify Signature.&#xA;&#xA; 3. The verification of the ISO image starts automatically:" measuredWidth="660" measuredHeight="120">
<font/>
</widgets>
<hRuler/>
<vRuler>
<guides position="2305"/>
</vRuler>
<font size="12px"/>
</model:Screen>
<?xml version="1.0" encoding="UTF-8"?>
<model:Screen xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:model="http://wireframesketcher.com/1.0/model.ecore">
<widgets xsi:type="model:Panel" id="128" x="12" y="48" width="800" height="600" measuredWidth="800" measuredHeight="600"/>
<widgets xsi:type="model:Text" id="108" x="58" y="138" width="657" height="20" text=" The output of this command should be the following:" measuredWidth="657" measuredHeight="20">
<font size="12px" bold="false"/>
</widgets>
<widgets xsi:type="model:Image" id="109" x="70" y="86" width="641" height="28" measuredWidth="641" measuredHeight="28" src="assets/2.png"/>
<widgets xsi:type="model:Image" id="111" x="71" y="176" width="640" height="105" measuredWidth="640" measuredHeight="105" src="assets/3.png"/>
<widgets xsi:type="model:Text" id="125" x="60" y="304" width="657" height="54" text=" Verify the date of the signature to make sure that you downloaded the latest version.&#xA;&#xA; If the output also includes:" measuredWidth="657" measuredHeight="54">
<font size="12px" bold="false"/>
</widgets>
<widgets xsi:type="model:Text" id="126" x="60" y="429" width="657" height="38" text=" Then the ISO image is still correct according to the signing key that you downloaded. To remove this warning you need to &#xA; authenticate the signing key through the OpenPGP Web of Trust." measuredWidth="657" measuredHeight="38">
<font size="12px" bold="false"/>
</widgets>
<widgets xsi:type="model:Image" id="127" x="71" y="370" width="644" height="37" measuredWidth="644" measuredHeight="37" src="assets/4.png"/>
<widgets xsi:type="model:Note" id="129" x="12" y="7" width="800" height="32" text="These instructions appears when the user clicks on &quot;See instructions for basic OpenPGP verification...&quot;." measuredWidth="800" measuredHeight="32" textAlignment="Left">
<font/>
</widgets>
<hRuler/>
<vRuler>
<guides position="2305"/>
</vRuler>
<font size="12px"/>
</model:Screen>
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment