Download Tails 3.7.1

Questa sezione fornisce istruzioni semplificate:

• In Windows con Gpg4win
• In macOS con GPGTools
• In Tails
• Usando la riga di comando

In Windows con Gpg4win

Guarda la documentazione Gpg4win su come verificare le firme.

Verify that the date of the signature is at most five days earlier than the latest version: 2018-06-10.

Se compare il seguente avviso:

Not enough information to check the signature validity.
Signed on ... by tails@boum.org (Key ID: 0x58ACD84F
The validity of the signature cannot be verified.

Significa che l'immagine ISO è ancora corretta secondo la chiave di firma che hai scaricato. Per rimuovere questo avviso devi autenticare la chiave di firma attraverso la Web of Trust OpenPGP.

In macOS usando GPGTools

1. Apri il Finder e naviga nella cartella dove hai salvato l'immagine ISO e la firma.
2. 1. Clicca con il tasto destro sull'immagine ISO e scegli Services ▸ OpenPGP: Verify Signature of File.

Su Tails

1. Apri il navigatore di file e arriva nella cartella dove hai salvato l'immagine ISO e la firma.
2. Clicca con il tasto destro sulla firma e scegli Open With Verify Signature.
3. La verifica dell'immagine ISO inizierà automaticamente:

   

4. After the verification finishes, you should see a notification that the signature is good:

   

   Verify that the date of the signature is at most five days earlier than the latest version: 2018-06-10.

Usare la riga di comando

1. Apri un terminale e naviga nella cartella dove hai salvato l'immagine ISO e la firma.

2. Esegui:

   gpg --no-options --keyid-format 0xlong --verify tails-amd64-3.7.1.iso.sig tails-amd64-3.7.1.iso

   L'output di questo comando dovrebbe essere il seguente:

   gpg: Signature made Sat 09 Jun 2018 08:54:10 PM UTC
   gpg:                using EDDSA key CD4D4351AFA6933F574A9AFB90B2B4BD7AED235F
   gpg: checking the trustdb
   gpg: marginals needed: 3  completes needed: 1  trust model: pgp
   gpg: depth: 0  valid:  21  signed:  68  trust: 0-, 0q, 0n, 0m, 0f, 21u
   gpg: depth: 1  valid:  68  signed: 388  trust: 9-, 6q, 1n, 52m, 0f, 0u
   gpg: depth: 2  valid: 161  signed: 400  trust: 48-, 58q, 1n, 53m, 1f, 0u
   gpg: depth: 3  valid: 132  signed: 277  trust: 83-, 28q, 3n, 18m, 0f, 0u
   gpg: depth: 4  valid:  14  signed:  78  trust: 10-, 0q, 0n, 4m, 0f, 0u
   gpg: next trustdb check due at 2018-06-10
   gpg: Good signature from "Tails developers <tails@boum.org>" [full]
   gpg:                 aka "Tails developers (offline long-term identity key) <tails@boum.org>" [full]
   

   Verify that the date of the signature is at most five days earlier than the latest version: 2018-06-10.

   Se l'output include anche:

   gpg: WARNING: This key is not certified with a trusted signature!
   gpg: There is no indication that the signature belongs to the owner.
   

   Significa che l'immagine ISO è ancora corretta secondo la chiave di firma che hai scaricato. Per rimuovere questo avviso devi autenticare la chiave di firma attraverso la Web of Trust OpenPGP.

The verification techniques that we present (browser extension, BitTorrent, or OpenPGP verification) all rely on some information being securely downloaded using HTTPS from our website:

• La checksum per l'estensione Firefox
• Il file Torrent per BitTorrent
• The Tails signing key for OpenPGP verification

It is possible that you could download malicious information if our website is compromised or if you are a victim of a man-in-the-middle attack.

OpenPGP verification is the only technique that protects you if our website is compromised or if you are a victim of a man-in-the-middle attack. But, for that you need to authenticate the Tails signing key through the OpenPGP Web of Trust.

One of the inherent problems of standard HTTPS is that the trust put in a website is defined by certificate authorities: a hierarchical and closed set of companies and governmental institutions approved by your web browser vendor. This model of trust has long been criticized and proved several times to be vulnerable to attacks as explained on our warning page.

Noi pensiamo che, invece, gli utilizzatori dovrebbero avere la parola finale sulla fiducia verso un sito internet, e che la fiducia vada riposta sulla base di interazioni umane.

The OpenPGP Web of Trust is a decentralized trust model based on OpenPGP keys that can help with solving this problem. Let's see this with an example:

1. You are friends with Alice and you really trust her way of making sure that OpenPGP keys actually belong to their owners.
2. Alice met Bob, a Tails developer, in a conference and certified Bob's key as actually belonging to Bob.
3. Bob is a Tails developer who directly owns the Tails signing key. So, Bob has certified the Tails signing key as actually belonging to Tails.

In this scenario, you found, through Alice and Bob, a path to trust the Tails signing key without the need to rely on certificate authorities.

Affidarsi alla Web of Trust richiede sia cautela che supervisione intelligente da parte degli utilizzatori. I dettagli tecnici sono al di fuori degli scopi di questo documento.

Since the Web of Trust is based on actual human relationships and real-life interactions, it is best to get in touch with people knowledgeable about OpenPGP and build trust relationships in order to find your own trust path to the Tails signing key.

Per esempio, puoi iniziare contattando un Linux User Group, un'organizzazione che offra training su Tails, o altri entusiasti di Tails vicino a te e scambiare informazioni sulle loro pratiche OpenPGP.