Tirdad in Whonix VMs is pointless

Development
1

tirdad in Whonix does not make the packets have tirdad chosen ISN. Host machine choose ISN. (“Fourth security report” from my bug reports thread.)

Therefore, Whonix tirdad is useless. Should be removed from documentation. Unless to specify it must install on host to be effective. Possibly should be removed from Whonix.

Some historical posts had concerns about fixing broken tirdad. Bug report, module tirdad fails to load . Seems those concerns wasted. Since even working tirdad in Whonix would do nothing.

Possibly medium/high issue found by Opus 5.5.

Seems tirdad is useless on VirtualBox with NAT, KVM with passt. Sent packets from WS have host chosen ISN. Not tirdad chosen.

Seems to conflict with documentation https://www.whonix.org/wiki/About#Full_Spectrum_Anti-Tracking_Protection

Surveillance Technology  Impact on your Privacy  Whonix Tracking Protection Technology
TCP ISN / network stack fingerprinting 	Some fingerprinting techniques analyze patterns in network packets such as TCP initial sequence numbers (ISN). 	tirdad
(TCP ISN randomization)

Since tirdad seems to do nothing.

VirtualBox with NAT, KVM with passt, both are default settings for Whonix. Therefore, tirdad may be useless for all Non-Qubes-Whonix.

Cannot confirm if Qubes-Whonix has tirdad. Possibly not. If not, seems tirdad completely useless.

Whonix version | Non-Qubes-Whonix
Affected component(s) or functionality | tirdad
Steps to reproduce the behavior | See POC
Expected behavior | Sent packets have tirdad chosen ISN
Actual behavior | Sent packets have host chosen ISN
Context | AI search inspired by https://forums.whonix.org/t/whonix-ai-security-usage/23555
Relevant Documentation that was consulted | https://www.whonix.org/wiki/About#Full_Spectrum_Anti-Tracking_Protection https://www.whonix.org/wiki/Time_Attacks

I ran POC, both quick and full check. Only VirtualBox.

No human text beyond this line. All AI. Opus 5.5 POC writing: (omitted)
2

It’s worth noting that tirdad is also used on Kicksecure, which can run on baremetal, and where it is useful. Therefore users who want to work around this technical limitation can use a Kicksecure host, or, if that isn’t an option, install the tirdad kernel module on the host.

(This is simply to supplement the information posted above, not contradict it.)

3

Agree. Works if host installs tirdad.

Should be removed from most Whonix documentation. Documentation describes as a default Whonix protection, in multiple places, we know now it is not true.

https://www.whonix.org/wiki/Time_Attacks

https://www.whonix.org/wiki/Features

https://www.whonix.org/wiki/About#Full_Spectrum_Anti-Tracking_Protection

https://www.whonix.org/wiki/Comparison_with_Others

https://www.whonix.org/wiki/Whonix_versus_VPNs

Possibly systemcheck should mention tirdad failure is irrelevant on Whonix. Or remove module from Whonix completely. (Do not know if possible. Since Whonix based on Kicksecure.)

In my experience tirdad failed in history. At that moment I was worried. Now know there was no reason to worry. Users worry about a protection failing that does not exist.

4

I do still need to double-check that tirdad does indeed fail to do anything (you provided reproduction steps already, I just need to run through them), but once that is done, then yes, it should be adjusted. I would probably prefer replacing places that mention tirdad to state that tirdad must run on the host to be effective instead of removing it entirely.