Best security setup for online banking?

[Fabula]

Myself and my girlfriend would like to do online banking, but she is rather worried about security issues.

I am planning on setting up a separate partition and xp-pro install specifically for online banking. Anyone have any advice for making it as secure as possible, as nothing else is needed on the install?


Internet access is through a wireless network that is reasonably secure, and I'm prepared to consider all options. My girlfriend is not particularly computer literate, so just having a secure setup she can use happily seems a good idea.


All advice appreciated.

[djfluff]

A couple of tips :
*Make sure you have up-to-date anti-virus software
*If you keep doccuments on your PC containing sensitave information,
you can use software like Truecrypt (Free from www.truecrypt.org) to make sure
that it's safe.
*Use the on screen keybord (accessability tool) for entering online-banking passwords,
that way, no-spyware or keyloggers can steal your password!!

[jimbouk]

Natwest posted me a card reader to plug into my computer rather than typing in my ID, pin and password. I don't know if it's any better, got posted to my mum's house so it'll wait there till christmas when I'm home.

For the connection, make sure the wireless is WPA, not WEP. You might be able to add mac-address filtering depending on the router.

For software; antivirus and firewall (I just use a hardware firewall on the router, depends who else can connect to the router and how much you trust them/their computers).

Firefox has the option to delete all saved information, history, cookies, cache. You can set it up to automattically do it on exit. You could get her that to only use for banking and nothing else.

For downloading bankstatements, you could just tel her not to, save having to worry about keeping them safe. Paper ones still work

It should be generally ok, so long as you keep your login details safe and don't have a virus/spyware logging what you're doing. Just don't reply to any email asking for login details...

[Funkstar]

I would be more inclined to look into your banks security measures, rather than going to the trouble of setting up seperate installs etc.

The Royal Bank of Scotlands system is prtty good. You have a login ID which is your DoB plus a number (probably the nth person to have that DoB in their system). You have a 4 digit pin code, from which you are asked for three digits in a random order. Then you have your password. Again they only ever ask for three random digits.

You never get email from them and they will never ask for all of your information in a telephon conversation or online. So i is it wasy to spot phishing emails.

It is probably a good idea to completely close your browser and open a fresh one before loggin in, then close it when you are finished before continuing to other sites.

Most online fraud is from phishing (good old fasioned social engineering really) and dodgy retailers selling or using your card details.

[arthurleung]

A couple of tips :
*Make sure you have up-to-date anti-virus software
*If you keep doccuments on your PC containing sensitave information,
you can use software like Truecrypt (Free from www.truecrypt.org) to make sure
that it's safe.
*Use the on screen keybord (accessability tool) for entering online-banking passwords,
that way, no-spyware or keyloggers can steal your password!!

I think that is going a bit too far?

If you have sensitive information, put it in a USB thumbdrive and lock it in your cabinet, not encrypt it. If you encrypt it, and you forget the password 10 years later you gonna be screwed. Also, you think that piece of software is going to work 10 years later? In case you break the harddrive, because it is encrypted you can't decrypt it unless the file is recovered in good shape.

On screen keyboard is actually more dangerous because anyone outside your window will be able to see your password being typed in. It is as bad as being looked at when you type in your PIN at the cash machine. And why would you have a keylogger installed in the first place.

For my bank (Halifax), you need to wait a few hours to setup transfers to accounts not under your name and you get an email about the setup. Basically you will know if someone planning to move away your money, and you sure have enough time to notify the bank to reverse transaction.

It will be safe enough to use it on a firewalled fresh XP SP2 install.

If you don't install anything weird there should be nothing to worry about.

The only thing is do not use internet banking on any public computer as quite a lot of them do have some really evil spyware/malware

[directhex]

Myself and my girlfriend would like to do online banking, but she is rather worried about security issues.

I am planning on setting up a separate partition and xp-pro install specifically for online banking. Anyone have any advice for making it as secure as possible, as nothing else is needed on the install?


Internet access is through a wireless network that is reasonably secure, and I'm prepared to consider all options. My girlfriend is not particularly computer literate, so just having a secure setup she can use happily seems a good idea.


All advice appreciated.

you're buying an entire xp pro retail license (£230) for online banking?

that's quite, quite mad

hey, if you're taking security THAT far, how much do you trust your software? can you be SURE nobody's written any backdoors into it? how would you check? no source, no security

[ikonia]

the security concern is not yours above and beyond your home PC, which is mentioned above. Latest Operating system patches, latest antivirus definitions etc etc.

The thing YOU need to do is apply common sense. Make sure the URL in the URL bar your visiting is actually for your bank, correct spelling, correct domain, and not an ip address or missspelled URL. Make sure you are transfered to a verified SSL site without a warning (the little padlock icon in your browser).

Most security issues don't come from the bank/your PC being exploited, but from a user inputting his details in the wrong site (eg: a fraud site from an email).

Make sure YOU always type the URL, make sure YOU verify the URL and SSL status, not others, links or emails

[peterb]

Natwest posted me a card reader to plug into my computer rather than typing in my ID, pin and password. I don't know if it's any better, got posted to my mum's house so it'll wait there till christmas when I'm home.[/QUOTE

Actually they sent you a device that generates a response to a challenge number that appaers on the site for certain transactions. (Essentilly a pseudo random number generator that is seeded by your servicecard. There is no attachment to the computer (other tna via your screen, eyes, brain, fingers, keyboard)

For the connection, make sure the wireless is WPA, not WEP. You might be able to add mac-address filtering depending on the router..

WPA is more secure than WEP, but unless you are specifically targeted, WEP is probably good enough. However your banking transactions will be SSL encrpted at the browser. If you are really concerned about security in this instance, use a wired connection!

For software; antivirus and firewall (I just use a hardware firewall on the router, depends who else can connect to the router and how much you trust them/their computers).

Good advice, but of course you aren'r running your computer user account with administrator priviliges are you? If you are, or are using the dault set up account, stop now and set up a user account with minimal priviliges required for daily use. If you are sharing one machine, set up separate accounts - one each. (although admin can, witha bit of effort) see into all folders. Some routers allow for wirelesws connections to only allow outbound internet connections and keep the internal network protected. So if anyone did hijack your wireless connection, they couldn't access your computers.

Firefox has the option to delete all saved information, history, cookies, cache. You can set it up to automattically do it on exit. You could get her that to only use for banking and nothing else.

However these work when you shut down the browser - although since the SSL encryption is session based, just shutting down the browser when you have finished the banking session.

For downloading bankstatements, you could just tel her not to, save having to worry about keeping them safe. Paper ones still work

Statements are no more vulnerable than any other documents, but if you want to keep them private, set up a separate folder for bank statements and password protect it. If you are really paranoid then download GnuPGP (bit clunky on windows - it is a command line interface althouigh there are some additional graphical front ends, like gpgee) and encrypt the stored bank statement files that way.

It should be generally ok, so long as you keep your login details safe and don't have a virus/spyware logging what you're doing. Just don't reply to any email asking for login details...

Absolutely - most of the additional sy measures (apart from admin accounts) are not really required so long as you practice sensible basic sy measures. (like not opening suspicious e mails, using your router firewall, avoiding dodgy websites etc)

[DR]

I think you are taking it too far

Remember, the bank has insurance against fraud but the above tips of

- Make sure Operating System is up to date
- Look for the Padlock
- Make sure you have anti-virus installed and up to date...

I'd be more concerned about using a Wireless network which isn't 100% secure than worrying about having a seperate XP install for it...

[nvening]

I know im probably just jumping on the linux is more secure band waggon but would there be any advantages? Or is there not much difference?

[redlight]

Anybody else got one of those card reader things from Natwest.

[jackvdbuk]

tbh if your THAT worried dont use online banking

i suppose as long your pc isnt riddled with lots of spyware adware and malicious junk, youd be fine with the appropiat firewall,antivirus e.t.c

Anybody else got one of those card reader things from Natwest.

did ING have card readers? i think i saw one aaaages ago

[bydandie]

As everyone else has said, check windows update daily (Before you start browsing). Use a good AV suite (KIS is currently the best IMHO and I have moved from free to paid for AV becuase of it) that has some kind of decent protection builtin.

Use your grandmother's maiden name when they ask for your mother's maiden name, use a separate email address for banking and online shopping. Don't use the same password for these as you use for your normal email, and use passphrases instead of passwords (ie Sentences that don't make sense - StealWireSheepFromTesco is an example). The following are the most common secure wireless encryption methods in order of strength - WPA2, WPA WEP. Use a non-descriptive SSID and a long passphrase. Makes sure that none of the above are the same/similar to each other. Use encryption to protect your data on your PC/laptop from physical theft.

An online identity needs to be protected; the steps above help, but you also need a level of scepticism.

[peterb]

Anybody else got one of those card reader things from Natwest.

Yes - see my other post in this thread.

[directhex]

I know im probably just jumping on the linux is more secure band waggon but would there be any advantages? Or is there not much difference?

it's slightly less mad than spending £230 on XP again (what with it being free), but generally speaking, outside the usual "there's less spyware etc" arguments, there'd be no benefit

a bigger question is over browsers - it can be particularly bad in some cases (e.g. in korea, all online banking by law needs to use a particular 32-bit msie activex control)

[aidanjt]

a bigger question is over browsers - it can be particularly bad in some cases (e.g. in korea, all online banking by law needs to use a particular 32-bit msie activex control)

That sounds very dubious, sounds like spyware to me (and well, it *is* korea). In most cases I'd trust online banking that stick to html form/ssl/ssi over elaborate authentication systems any day, the former tends to have less compatibility issues and security issues.