How Heads Differs from Tails

Updated

Heads and Tails solve different problems. Tails is designed as a stateless operating system that leaves no trace of its presence on the computer; Heads is built for the case where you need to store data and state on the machine. Heads is not a Linux distribution at all — it is an open source custom firmware and OS configuration for laptops and servers that aims to provide slightly better physical security and protection for data on the system. If your goal is amnesia (nothing persists after you shut down), Tails is the closer fit. If your goal is a machine whose boot process you can verify and whose disk is unlocked by hardware-backed keys, Heads is the closer fit.

The core difference: amnesia vs. boot integrity

The two projects start from opposite assumptions about persistence.

Dimension Tails Heads
Primary aim Stateless OS that leaves no trace on the computer Slightly better physical security and data protection on a system that keeps state
Where trust is anchored The live OS session The write-protected region of the SPI flash
What is verified Not the machine's own boot chain Every step of boot firmware and configuration, measured into the TPM
Disk handling No persistent state by design TPM used as hardware key storage to decrypt the drive once the system is in a known good state
Scope An OS you boot Custom coreboot firmware plus a Linux boot loader in ROM, with hardware-specific hardening

Heads' own documentation draws this contrast directly: unlike Tails, Heads is intended for the case where you need to store data and state on the computer.

How Heads moves the root of trust

Heads combines physical hardening of specific hardware platforms and flash security features with custom coreboot firmware and a Linux boot loader in ROM. This moves the root of trust into the write-protected region of the SPI flash and prevents further software modifications to the bootup code. On platforms that support it, Bootguard enforces verified boot of the firmware.

Controlling the first instruction the CPU executes lets Heads measure every step of the boot firmware and configuration into the TPM. That measurement makes it possible to attest — to the user or to a remote system — that the machine has not been tampered with. Once the system is in a known good state, the TPM is used as hardware key storage to decrypt the drive. The hypervisor, kernel and initrd images are additionally signed by keys the user controls.

One honest caveat from the project: modern Intel CPUs require binary blobs to boot. These non-Free components are included in the measurements and are at least guaranteed to be unchanging — they are measured, not eliminated.

What Heads does and does not protect against

Heads addresses several classes of attacks against the boot process and physical hardware that have been neglected in traditional installations, hopefully raising the difficulty beyond what most attackers are willing to spend. The project is explicit that these firmware and software changes do not secure the system against every possible attack vector.

The 33C3 talk by Trammel Hudson introduces Heads and catalogues specific attack classes with their mitigations — for example, Thunderstrike (DMA over Thunderbolt rewriting SPI flash), which is countered by enabling IOMMU/VT-d and by coreboot disabling the relevant exposure. That talk is a useful reference for understanding which threats the design targets.

Choosing between them

  • Choose Tails when the requirement is that the computer retain no trace of the session — for example, using a borrowed or untrusted machine for a sensitive task and leaving it as you found it.
  • Choose Heads when the machine is yours, data must persist on it, and the threat you care about is tampering with the boot chain or physical access to the firmware and disk. Heads assumes state exists and protects how that state is unlocked and verified.
  • They are not substitutes. Heads does not provide amnesia, and Tails does not give you a measured, attested boot chain rooted in write-protected flash.

Practical notes before you commit

Heads is platform-specific: it depends on physical hardening of specific hardware platforms, so support is tied to particular laptop and server models rather than being installable on arbitrary hardware. The wiki's main menu separates laptop/workstation guidance from server guidance (BMC/SSH/Console), which reflects that split.

Heads and the wiki are free and open source, but the project states that keeping them maintained is ongoing work that is not free; it lists GitHub Sponsors (tlaurion) and Open Collective (Insurgo) as support channels, with details on the Community page. Start with the wiki's "Learn more about Heads" material to confirm your hardware is covered before planning a deployment.