This article presents the handful of steps necessary to get the Trezor web wallet (https://wallet.trezor.io/) to work with Tor Browser on a Tails 4.11 Live session.

• On the initial Tails setup screen, set an administrative password. This is necessary since root privileges are needed to install the Trezor Bridge package and to set an iptables rule.
• Once the Tails Live session finishes starting up, setup your network as usual.
• Open a terminal and run the following commands
  • cd /tmp/
  • wget https://keybase.io/stick/pgp_keys.asc
  • gpg --import pgp_keys.asc
  • wget https://wallet.trezor.io/data/bridge/2.0.29/trezor-bridge_2.0.29_amd64.deb
  • gpg --verify trezor-bridge_2.0.29_amd64.deb
  • sudo dpkg -i trezor-bridge_2.0.29_amd64.deb
  • sudo /sbin/iptables -I OUTPUT 3 -o lo -s 127.0.0.1/32 -d 127.0.0.1/32 -p tcp --syn --dport 21325 -m owner --uid-owner amnesia -m conntrack --ctstate NEW -j ACCEPT
• Navigate to https://wiki.trezor.io/Tor in Tor Browser and follow the instructions to change the FireFox configuration. Since Tails 4.11 uses Tor Browser 10.0, only the configuration for network.proxy.no_proxies_on needs to be set to 127.0.0.1:21325.
• Connect your Trezor device to the computer's USB port.
• After unlocking and entering your Trezor's PIN, verify that the udev rules took effect by running
  ls -al /dev/trezor*
• Start Tor Browser and navigate to https://wallet.trezor.io/

Notes

The sha256sum of trezor-bridge_2.0.29_amd64.deb is 51068a4f7dca66c43e5058aa7e89f27110b533b85c0ece074176586065de4dba.

The fingerprint of the key that is used to verify the package signature is 86E6792FC27BFD478860C11091F3B339B9A02A3D.

In the Tails distribution, the wget command used above is actually a shell script that configures wget to fetch the file over Tor instead of clearnet.

You can run the lsusb command from the command line to verify that your Trezor device is recognized by the system.