Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
T
tails
  • Project overview
    • Project overview
    • Details
    • Activity
    • Releases
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 944
    • Issues 944
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Merge Requests 13
    • Merge Requests 13
  • CI / CD
    • CI / CD
    • Pipelines
    • Jobs
    • Schedules
  • Operations
    • Operations
    • Incidents
    • Environments
  • Analytics
    • Analytics
    • CI / CD
    • Repository
    • Value Stream
  • Members
    • Members
  • Collapse sidebar
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
  • tails
  • tails
  • Issues
  • #17532

Closed
Open
Opened Mar 18, 2020 by sajolida@sajolidaMaintainer

Clarify the privacy implication of setting a locale

Originally created by @sajolida on #17532 (Redmine)

Question raised in https://lists.autistici.org/message/20200103.094500.22ffbd74.en.html

Answered in https://lists.autistici.org/message/20200228.074212.684e7e99.en.html

First, most, if not all, exploited applications have access to
locale configuration.

Wrt. network fingerprinting:

  • We have to assume that some applications may expose the system’s
    locale configuration as part of their network activity.
  • For Tor Browser and Thunderbird, our configuration tries to avoid
    this (best effort) but it’s impossible to prove we did not
    miss anything.

Wrt. local storage:

  • If an adversary can read the content of the persistent storage, I’m
    pretty sure that the locale configuration can be easily inferred
    from that.
  • If/once we allow persisting the locale in cleartext on the system
    partition, this information will be available to an adversary
    who seizes the Tails device.
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information
Assignee
Assign to
None
Milestone
None
Assign milestone
Time tracking
None
Due date
None
Reference: tails/tails#17532