Actually I made a mistake, you would need to type over ciphertexts from the internet facing machine to the isolated machine as well. You could use CD to copy over ciphertexts and public keys from the internet facing machine to the isolated machine, or ciphertexts from the isolated machine to the internet facing machine, but not in both directions. What if the malware is encrypted in the GPG message along with an exploit for a vulnerability in the GPG decryption engine , and you are rooted as soon as you decrypt the message? If it sounds far fetched it isn't, there have been a few remote code execution vulnerabilities in GPG that worked in similar ways to this. That would qualify for a sophisticated piece of malware . Also if the internet machine is infected with malware you will need to end up hand counting the bytes instead of just typing them over, and I think it would still be rather risky. Good hackers can do amazing things and they are good at hiding that attacks have taken place. Yup. Iran learned that the hard way with stuxnet. They had a network with no internet and considered it to be air gapped but it had external USB devices plugged into it that had been exposed to the internet. Well a USB is not a read only device. Also it could be possible for the attacker to write to the hard drive. But primarily what I mean is that the attacker is concerned with your RAM to exploit and root you, everything else is just for persistence. In fact there are some viruses that can hide in persistent memory in locations that you would never expect, such as your keyboards firmware. It is not impossible for you to be pwnt using a live CD, the attacker becomes persistent in your keyboard and then infects your hard drive when you boot into your non-live OS. Live CD and USB do absolutely nothing to prevent you from being pwnt, that all happens in RAM. They just make it harder to become persistent. But not impossible, especially for a USB. I think you confuse malware and exploits and backdoors. You seem to be worried about a backdoor. In general there are two types of backdoor, code that has vulnerabilities intentionally left in it to be exploited by the creator at a later point in time, and then things like subseven or back orifice where there is actually malicious code included in the software instead of the harder to detect exploitable code intentionally left in the software. I think you may not realize that an attacker can exploit vulnerabilities in code to remotely install software onto your machine. That is the sort of exploit / malware I am discussing, not so much malicious code included in the program from the start. And 99.9999999% of software has vulnerabilities that can be exploited for remote code execution. It is on my list of things to do . Operating systems implement ASLR differently. I think OpenBSD may be the only OS that has full ASLR by default. You need to be using a 64 bit OS to take full advantage of ASLR because with a 32 bit OS it can be brute forced. Some operating systems don't even have ASLR, FreeBSD actually does not although it uses some other technique instead. Some operating systems support ASLR but you need to specifically compile your software with the special PIE (position independent executable) flag for it to be able to take advantage of it. Are you worried about general malware or a targeted attack against you? Because just using Linux, although a good step in the right direction, is not enough to protect you from a skilled targeted attack. Anonymity does not protect you from malware unless you are running a bunch of listening network applications like Apache and because they are hidden services an attacker can not port scan the entire server looking for alternative paths to attack instead of only what is directly presented to them. In your case as a non-server client anonymity doesn't do a damn thing to protect you from malware, you are still exposing the exact same amount of attack surface when you browse a website with Tor as when you do without Tor. You have a very fundamental misunderstanding of how hacking works. Let's say that firefox has a vulnerability in it's code, an attacker who pwns SR could then for example craft malicious javascript that runs client side on your computer in memory (RAM) and then buffer overflows into attack code that they then get firefox to run on your system, and which itself installs a virus onto your computer from one of their servers. Hacking is all about remotely installing viruses on computers, you do not need to know their IP address you only need to have some vulnerable path to them, that can be in the form of Firefox, a PDF reader, an instant message program, GPG decryption engine, ANYTHING that you put potentially malicious input into. Rootkits are installed by exploits in order for the hacker to cover their tracks. There are a lot of Firefox vulnerabilities that can be exploited without any scripting being enabled, although by not having scripting enabled you can remove the ability of a hacker to exploit some vulnerabilities and also you can make others harder to exploit. Yes that would be possible to do but it does not remove the chance of being exploited. A lot of Firefox vulnerabilities are through font rendering even, there are a lot more areas to cover than just scripts. You will not reach a website like dkn255hz262ypmil.onion but you will have no trouble reaching fbi-ip-address-gathering-server.gov Attacker finds vulnerability in Firefox code. Attacker crafts code that exploits it with javascript. You go to attacker controlled website with this javascript and it runs on your machine client side, exploits the firefox vulnerability. Attack code overflows a buffer and the attacker gets it to execute with the abilities of firefox. Firefox is in a x window. There is no isolation between x windows, every x window gets keystrokes to all other x windows, so the attacker can already entirely keylog you at this point, including getting your root password when you su. Attacker can also have firefox install whatever they want onto your system that it is privileged to do, so they take over root on your computer with the password they just sniffed and install a rootkit and backdoor for persistence. You do not need a special CPU to make it very hard to compromise properly implemented encryption...but skilled attackers spend less time trying to crack encryption than they do on trying to bypass it by hacking around it. I made polyfront, although it is out dated and I would not try to keep it alive personally. Someday when I get more time I will write a new one that will be much better, it has been a running thing for several years now actually where I periodically compile my security knowledge and make tutorials and such. I can do way better than Polyfront now. But I am currently busy developing software and learning new things. Maybe in half a year you will start to see a lot of new cool things from me . I hear the feds quite enjoyed polyfront at one of their conferences , glad to know that they were so impressed and circumstances allowed me to hear about it !!