Account management risks of booting into Tails OS from USB using a "partially air-gapped" Linux PC

Question

My threat tolerance is around a 3 out of 5 on the paranoia scale. What are the practical account management risks of using a flash drive loaded with Tails OS to boot into a Linux PC, which will only be offline when using Tails for account management?

My understanding is that if I boot into Tails via flash drive, after a system shutdown, the Tails OS environment will be sandboxed from the underlying host OS environment. So, if there's software process isolation and partial network isolation would it really matter if the system is intermittently online? Are there any plausible and significant risks to recommend against this approach?

For context, I've been reading this GitBook on Ethereum account management "best practices". Unfortunately, it doesn't go into much depth on this specific variation in the recommended wallet set-ups. Note: I'd prefer not having to buy any additional hardware for this particular use case.

Answer 1

In an environment like this, there is essentially no threat from the OS in the host computer, but it can't hurt to simply remove any nonvolitile storage from the computer. Then your major threats are harware or firmware - level threats.

Some simple things you could do to mitigate this risk:

• Remove any network cards from the host computer if at all possible
• Remove any hard drives/ other nonvolitile storage from the host so that nothing can persist past your Tails session.
• Ensure that your Tails USB is never again connected to a networked computer

Essentially, the goal is that data produced during your offline phase should never be transferred to a networked computer. You should assume that any storage medium connected during the session contains a full record of everything you did.