Washington Post Says Use Linux To Avoid Bank Fraud

christian.einfeldt writes "Washington Post Security Fix columnist Brian Krebs recommends that banking customers consider using a Linux LiveCD, rather than Microsoft Windows, to access their on-line banking. He tells a story of two businesses that lost $100K and $447K, respectively, when thieves — armed with malware on the company controller's PC — were able to intercept one of the controller's log-in codes, and then delay the controller from logging in. Krebs notes that he is not alone in recommending the use of non-Windows machines for banking; The Financial Services Information Sharing and Analysis Center, an industry group supported by some of the world's largest banks, recently issued guidelines urging businesses to carry out all online banking activities from 'a stand-alone, hardened, and completely locked down computer system from where regular e-mail and Web browsing [are] not possible.' Krebs concludes his article with a link to an earlier column in which he steps readers through the process of booting a Linux LiveCD to do their on-line banking." Police in Australia offer similar advice, according to an item sent in by reader The Mad Hatterz: "Detective Inspector Bruce van der Graaf from the Computer Crime Investigation Unit told the hearing that he uses two rules to protect himself from cybercriminals when banking online. The first rule, he said, was to never click on hyperlinks to the banking site and the second was to avoid Microsoft Windows."

Comments

What about the banks?

[Profane MuthaFucka]

A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

Re:What about the banks?

[Shakrai]

And asking me for my Mother's maiden name is really that much better? Or how about showing me an image that I picked out but will soon ignore after seeing that it never changes?

I like the security token concept myself. It doesn't rely on easy to figure out (Mother's maiden name, hospital you were born at, etc.) information and is easy enough that most lusers can figure it out quickly. I don't understand why more financial institutions haven't adopted them.

Re:What about the banks?

[AvitarX]

Countrywide had a nice system.

I had to enter my user name, and then then the password screen came up, I would type in my password, and then click on one of about 40 images on the screen.

I had to click the one that was my image (this was rather than a sign in button).

Also, I think a security token can count as a second factor of authentication, and I agree on security questions, never help at all, and often I can't find options with an obvious answer (for myself).

Re:What about the banks?

[nmb3000]

A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

If your computer has been compromised in this fashion, you've already lost. For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

Re:What about the banks?

[FooAtWFU]

Security tokens are the second factor in two-factor authentication. The banks are just convinced that another-password is good enough, mostly because it's cheaper than doing it right.

Re:What about the banks?

[Shakrai]

If your computer has been compromised in this fashion, you've already lost. For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

Re:What about the banks?

[Tynin]

What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

This computer is protected by retaliatory DoS attacks? I guess that is the best we can hope for until we work out a better implementation of PoIP (Punched over Internet Protocol).

Re:What about the banks?

[Cousarr]

You realize that the way two factor security is supposed to work is that is requires you to know something and have something right? The way that two factor security is usually done from what I've seen is requiring a password that the client knows and a rolling code from a small device the client has. As long as a bank does not allow that same rolling code to be used twice it doesn't matter what kind of keystroke logging, mouse gesture capturing, or screen recording is used nor how fast it is sent to the bad guys.

For you car enthusiasts, it's like taking the engine with you when you leave the car. Even if the car is hot-wired, it's not going anywhere without that thing you still have.

Re:What about the banks?

[greenbird]

mostly because it's cheaper than doing it right.

Of course it's cheaper than doing it right. They've managed to twist bank robbery do to their lack of adequate security into identity theft that they blame on the costumer and force the costumer to suffer all the financial consequences. It's the perfect scam. If you walk into the bank with a fake id and steal money it's never been blamed on the costumer.

Re:What about the banks?

[some_guy_88]

The Commonwealth bank in Australia (and probably many others) sends you a random code via SMS to your phone that you have to type back in to the site in order to transfer money to an account you've never transfered to before.

Re:What about the banks?

[DarkFencer]

Though I agree two factor authentication is useful, the 'taking the engine' analogy overestimates the difficulty of breaking through it.

All the scammers have to do is instead of recording your keystrokes, gesturing, etc., they display a 'fake' copy of the bank to you through whatever software they have installed on your computer. They take the information you think you are sending to your bank (but are sending to them instead) and instantly have their scripts login to the site from their own systems (or some other bot on the net).

If they prevent your initial login to the site from happening, they can use your username + password + rolling code themselves if their software auto logs in.

This of course requires a user to go to a phishing site (miscellaneous.scammersite.com or something more complex), or requires the phisher to own the user's computer enough that they can intercept their connections & deal with the SSL certificate issues) while the phisher's automated software automatically goes to the real miscellaneousbank.com site.

Re:What about the banks?

[trawg]

And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

The way it works here with some banks in Australia is they send you a code via SMS when you try to issue a transfer from Internet banking. You need to enter the code into the website to continue the transaction. So the extra factor here of having the phone offers a pretty useful extra layer.

My bank doesn't offer it; I wish it did.

Re:What about the banks?

[jamstar7]

A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

Per TFA, the banks in the two cases mentioned in the summary used two factor authentication. The hackers' malware delayed their access, and the hackers used a VPN tunnel to access the bank through the compromised computer.

Re:What about the banks?

[JumpDrive]

"This computer runs Windows 7"
The most secure operating system yet.
And it will stay that way , Mr Balmer, as long as you don't release it.

Re:What about the banks?

[schon]

And asking me for my Mother's maiden name is really that much better? Or how about showing me an image that I picked out but will soon ignore after seeing that it never changes?

Those are both the same factor, just like a user's password.

Security factors are

1. something you know
2. something you have
3. something you are

In order to qualify as "two factor", you must have two of those (no, having two of the same factor doesn't count.)

So passwords, personal question, and favourite image are all examples of "something you know", and don't represent two-factor authentication.

The Security-token would be an example of "something you have", and thus combining them with a password would be two-factor authentication.

Re:What about the banks?

[mjwx]

And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

Because a 2 factor authentication token like an RSA key changes every 10 or so seconds so by the time Bad Guy #1 has finished parsing that log the 2nd authentication factor is out of date. The far cheaper way of doing this which most banks in Australia have started using is a one time password sent to you via SMS. This password works one time only (hence we call it a one time password, geddit) so if the Bad Guys(TM) get the entire password in real time and are reading their logs in real time then they still cant use it as the password has already been used.

Yes it's a band aid solution but at least it's a decent kind of band aid. The alternative is complaining that it doesn't work and then having nothing happen because no one has a better practicable idea.

Re:What about the banks?

[Inner_Child]

What in the holy hell do people who make costumes have to do with any of this? I would be more concerned about the banks blaming things on their customers.

Re:What about the banks?

[shird]

And do you realise this authentication scheme has also been broken?

The crooks these days are breaking into your account in real-time by using your security token code as you login, and preventing you from logging in.

Read the article, he mentions this.

Re:What about the banks?

[shird]

This can be automated easily enough.

Also, it's trivial to redirect the POST to login.cgi or add an entry to /etc/hosts for bank.com to a different site that just presents a 'failed to login' instead of logging in. Meanwhile your password, security code etc has been sent off to the bad guys machine which does an automated "transfer *.* funds to x" script using these credentials.

It's been done.

Re:What about the banks?

[Compholio]

Because a 2 factor authentication token like an RSA key changes every 10 or so seconds so by the time Bad Guy #1 has finished parsing that log the 2nd authentication factor is out of date. The far cheaper way of doing this which most banks in Australia have started using is a one time password sent to you via SMS. This password works one time only (hence we call it a one time password, geddit) so if the Bad Guys(TM) get the entire password in real time and are reading their logs in real time then they still cant use it as the password has already been used.

None of this will work with the problems described in the article, if someone has control of your computer then you're screwed no matter what kind of authentication you have. In one of the examples they specifically stated that crackers used the token code and delayed the customer's request:

Johnston's bank requires customers to enter the code from a Vasco security token. But the thieves - armed with malware on the company controller's PC - were able to intercept one of those codes when the controller tried to log in, and then delay the controller from logging in. Indeed, Johnston said the company's computer logs show that the controller logged into the system while the series of thefts was already in progress.

So, instead of the cracker getting blocked the customer would have been blocked because the "malware" made the customer's request come in AFTER the cracker's. If you were really clever you'd program the thing to intercept all the communication before it gets encrypted to go out to the bank and then fake the returned data so the user doesn't know that you're toying with them (yes, you can intercept the crypto library calls - I toyed with this some to get the Red Alert 3 Beta working on Wine). I don't know about you, but I can't think of a solid way around this interception (except having the bank only allow logins from a special custom browser that they load on a Live CD).

Re:What about the banks?

[Profane MuthaFucka]

That's not two factor, it's one factor. It's something you know, in two parts. A key fob introduces something you have.

A big problem with what you described is that 40 images to choose from is like adding one more character to your password, allowing lowercase, numbers, and 4 other punctuation marks only.

It doesn't add much to security at all, in other words.

Re:What about the banks?

[HangingChad]

And it will stay that way , Mr Balmer, as long as you don't release it.

Good one. That was the same story we heard when XP came out. Yeah, yeah, Windows 7 is all over that now.

For about six months.

Re:What about the banks?

[Profane MuthaFucka]

A banking chip on every motherboard? Sure, why not.

Connect a very very inexpensive terminal with a protected nonvolatile memory to it and you can enter banking codes. Banks could invent sealing and anti-tamper systems so, like a gas pump or electric meter, the seal is visible to the user where it can be verified to be intact, offering a bit of physical security.

Re:What about the banks?

[ShooterNeo]

Wrong.

Security tokens store internally a crytographic key or a one time pad. It is mathematically impossible to find out what the secret key/OTP is on these devices from readouts on the display. You have to steal the device and read the bits using an electron microscope. Even if you could do that, it would be very difficult to create a cloned copy of the device and return it to the owner's possession in any length of time.

Thus, the inherent security is obvious : in order to break into an account protected by a keyfob, one absolutely HAS to steal the actual keyfob. That vastly limits the vulnerability : if the user still possesses the card, they KNOW they haven't been hacked to 99.9999999% certainty. Furthermore, only individuals who come in direct contact with the user have a chance to steal the card, and they cannot do so secretly - you could freely give your credit card to a waiter at a restraunt and have him use the keyfob with the secret code displayed, and know that the card could not have been skimmed.

And, of course, the moment the user of the card notices that it is missing, he can call the bank and cancel it and ask for a replacement, eliminating any further losses. If your account information had been compromised, you might not realize for month(s).

I will agree with you on "something you are" authentication. Even if you owned some kind of biometric reader and used it to log on to your bank, it is not any more secure than a password because a fingerprint or DNA sequence is a static piece of authentication. Well, ALMOST....

Theoretically, using technology not yet available, you could give the bank a sample of your genetic material and essentially have security whereby the bank asks your home DNA scanner "give me n->Z portion of the user's genome". This would only be a practical security measure if whole genome sequencing were still very expensive.

Re:What about the banks?

[AnyoneEB]

None of this will work with the problems described in the article, if someone has control of your computer then you're screwed no matter what kind of authentication you have.

That's not entirely true. If there is some sort of challenge-response scheme that involves the "what you have" part of the authentication (either by a lookup in a table of single-use tokens or by typing the challenge into a security token-like device) and the challenge is based on what the user is requesting to do (ex. the user explicitly types the amount and target account number into their security token and then feeds the response into the website), then you can avoid unauthorized transfers even from a compromised computer.

Of course, it would be best if computers weren't compromised, and booting an OS off a CD is good way to be relatively sure of that, but, realistically, most bank customers are going to be using computers with some amount of malware on them for the foreseeable future.

Re:What about the banks?

[sapphire wyvern]

An SMS code sent to your phone is just a poor-man's RSA "rolling code" security token. The instant you begin to type that code on your keyboard, you've lost the battle again. The running malware can intercept the form submission attempt and then use the code you typed in to do whatever it wants while it delays or just fails your real login request. This isn't a theory, it's a proven fact that's already in use by malware in the wild.

It's possible to engineer that out. Instead of sending you a code to "authorise your login", which can then be stolen by the software, the bank sends you a code to authorise a *specific action* which has been requested (either by you or by the pwnage bot). The SMS would contain details of the requested transaction. That way, you get to view the details of the transaction *that was actually lodged*, rather than the transaction that you thought you were lodging, on a much more trustworthy interface.

The next step, I guess, would be Windows malware that attempts to compromise any phones that are connected to the PC so that the bad guys can somehow interfere with the bank SMSs at the phone end of the link. That would be significantly more challenging for the bad guys, though.

Re:What about the banks?

[Eivind]

True, but it doens't have to be that expensive to do right. My bank offers two different solutions for the second-factor. One is s crypto-key tokenthing that they send you to hang on your keychain. (so you log in with a password + a 5-digit security token from the gadget)

The other is, quite simply your mobile phone. You enter your username and password, if correct, they send you a SMS with a 5-char one-time-password, you enter this and are in.

Yes, it adds 10 seconds to the login-procedure, but it's a very efficient way of stopping keyloggers and malware from learning how to access your account. Even if they successfully snoop your password, that doesn't help them aslong as they can't ALSO intercept SMS-traffic to your cellphone. This isn't IMPOSSIBLE offcourse, but it sure as hell raises the bar.

Re:What about the banks?

[ShooterNeo]

I just thought of a solution to the man in the middle attack.

In order to do a large transfer of funds, or anything else that a hacker could benefit from, you would be required to enter a code from the keyfob a SECOND time. That is, you would have to enter the code once to log into your online bank, and a SECOND time with a new code in order to move any serious amount of money. PER major transaction.

This would be vastly more difficult to do a man in the middle attack on.

Re:What about the banks?

[rohan972]

There is no way to prevent this that I can see as long as the information is being entered into an invalid PC. The only possible way I can think of to bypass it would be by using SMS but requiring the user's registered cellphone to text (not receive) one of the codes to the banking authority - this would mean that at least one password travels across a system that is (hopefully) not compromised.

If it is a one time code used not to give access but to complete a particular action then it doesn't make any difference if the attacker gets it from the compromised PC. It only gives them the ability to complete the transaction initiated by the user. The SMS with the code should also have the details of the transfer requested.

Re:What about the banks?

[Animaether]

The ING bank in NL uses three forms (mostly after fully incorporating the Postbank).

I should note that these are all for authorizing a transaction. Logging into your account still only requires a username and password. Should those be acquired by a malicious party somehow, they will be able to see your balance, your recent transactions (and if they see you always withdraw $200 from a specific ATM every tuesday at 10am, that's dangerous enough, tyvm), and change several settings including your password (but none of the transaction authorization methods).

So, transaction authorization then...
A. You go to complete the transaction and are presented with the challenge.. some long-ish unique number. You whip out an annoying little calculator device that you have to stick a smart card into. You enter that number, and you get the response..another number. You enter that number into the website form and the transaction has been authorized. Problems with these things are rife, from not having the calculator on you, not having the card on you, the device being broken (be that dirty contacts or truly broken), etc.
It's relatively secure, of course, as they'd have to steal your card (the calculators are the same across all clients, of course)

B. TAN-by-phone. You go to complete the transaction, and are presented with just a form where you enter a TAN. At the same time, a text message with that TAN is sent to your phone, along with the amount total. The amount total is shown so that -if- at any point some sneaky man-in-the-middle managed to add a transaction to your session, you should be able to see that, and stop the transaction, notify your bank, etc. Anyway, if all is well, you enter the response, and you're done again. Problems with this might be not having your phone on you, or dead battery, no signal, no carrier, etc. etc.

C. TAN-by-list. You go to complete the transaction and are presented with a challenge, which is basically a number from 1-100, or 101-200 if you've already made more than 100 transactions, etc. Basically 3-digit, maybe 4 if you make transactions all day long. This number can be found on a printed list that was sent to you beforehand by secure mail. Just find the number, and read the TAN code next to it, and enter that. Done. No technological problems with this one, but obviously it does have the weakness that it includes 100 TAN numbers and, if compromised (photo, scan, etc.), can be used multiple times without your direct knowledge until it's too late.

Of all the systems, I very much prefer option C. If I don't want to carry around a piece of paper, I can even move the list over to my phone if I were so inclined (and incur the issues of option B, of course). Its weakness is also easily solved by rotating the look-up relative to the TANs. I.e. shift all the TAN codes by N, say 50. You get a challenge asking you for the TAN code listed by number 80. Those who have a copy of your list go to number 80, enter the value, and the bank tells them 'nuh-uh.. try again, 2 attempts left'. Good luck to them figuring out that they -really- should have been looking at number 80+50 = 130. 130-100 = 30.

This is easily -as- secure as the calculator+smart card, if not -more- secure, a lot less prone to problems both technological and logistical.

Sadly, I think the EU will be mandating the smart card route in the nearish future. So I'll have to carry another card around in my wallet (which is already a nice theft target, but where the f else do I keep it?), drag a calculator with me all the time especially if going abroad (what, you think a Highway 9 Motel is going to stock online banking calculators for dozens of nations? Maybe a Hilton or above might, as a free service included with $500/night rooms.), worry about batteries (I dunno why they haven't made them solar-fed yet; I used to find solar calculators in laundry detergent boxes in the late 80's!), keeping contacts clean, etc. etc.

Re:What about the banks?

[Lord Bitman]

technically, a key fob still uses "what you know", it's just "what you know that you are unlikely to know without what you have", which is good enough for now.

Re:What about the banks?

[jimicus]

Mitchell & Webb put this pretty well:

http://www.youtube.com/watch?v=CS9ptA3Ya9E

Re:What about the banks?

[Jason Levine]

As a victim of Identity Theft, I can tell you that banks and credit agencies just don't care. The bank writes off the loss due to fraud. The credit agency shrugs their shoulders at bad information in your credit file and tells *you* to fix it (while they happily go on reporting the bad information). In the case of stolen credit card numbers, the credit card company simply issues a new card and reverses the fraudulent charges. Meanwhile, the thief has their new television and the store is out a few thousand dollars.

In my case, the credit card company opened a line of credit for "me" even though the online application contained the wrong Mother's Maiden Name. I only found out about it because the thieves put in for a rush delivery of the card and *then* changed the address on the account. The card wound up at my house instead of their house/drop box/whatever. The incorrect maiden name and quick address change didn't set off any fraud alerts. Neither did "me" trying to get a $5,000 cash advance on the card prior to activating it. And when I called them about it, they refused to give me any information because "I might run out and kill the thief and then they're liable." They even gave the police department the runaround.

As I said, they just don't care. They'll do everything in their power to protect themselves. Even if protecting themselves in the short term means the identity thief gets away and commits more fraud against their business in the long term. In the end, you are only important to them insofar as how much green they can make off of you.

Re:What about the banks?

[Eivind]

It's not a "usb-fob" it's a completely disconnected fob with a small lcd-display from which you read the one-time-pass and enter it into the login-form, using your eyes and fingers.

Sure, it could be sniffed on entry, that's where the "one-time" comes in, the info is useless, because next login, a different pass will be required.

Re:What about the banks?

[Eivind]

The point of two-factor authenthication is that when you need TWO factors, which are independent, it's a lot harder for a criminal to learn both than if you need only one.

To get into my account a criminal need to know my password AND intercept an SMS sent to my mobile phone.

This is a lot harder to do than *only* know my password. A keylogger or virus on my computer could conceivably steal my passwords and mail them to russia or wherever. It'd have a harder time doing that -AND- intercepting SMS-traffic to my mobile phone.

As I said, SMS by itself isn't impossible to intercept. But when you need to do that in -addition- to sniffing my password, the bar is raised significantly.

Re:What about the banks?

[wh1pp3t]

I had to click the one that was my image (this was rather than a sign in button).

The image you choose is used by Countrywide (BofA) to provide you with the verification that you are not signing into a phishing site, not as part of your login credentials.

Re:What about the banks?

[AvitarX]

I actually think if I have a grid of 40 images, and need to click on the proper one it is part of credentials.

though the other poster mentioned it is only adding one character to your password.

I still think it is more secure than a security question, and easier to remember too.

Re:What about the banks?

[MBGMorden]

Some have gotten a little better.

Both my credit card accounts are now setup so that if I login on a NEW computer (and after a period of time on a computer I've been using), they'll ask me for the answers to 3 security questions. If you get those correct you are then prompted for the password along with a message you entered when you first registered. The idea there being that if the phrase doesn't match, then you're not really on their site and it's a phishing attempt.

It's still not great, but it's decent. Ironically enough though my WoW account is FAR more tightly secured (via Blizzard's Authenticator) then my actual bank accounts :(.

Re:What about the banks?

[PitaBred]

If you do account locking after a certain amount of tries (as every bank I know of does), it most certainly does add security.

Re:What about the banks?

[dissy]

Its a device with a 1 time pad in rom (or similar). The 1 time pad could be easily read off of rom if you crack it open

At least on that point, they have planned for it already.

RSA fobs hold their secret key in RAM, not rom.
The battery is held on by the plastic case and not fastened to it in Any way.

If you pop open the case, the battery comes off the contacts and you lose the key.

Additionally, the ram, firmware, and CPU (as well as LCD driver) are all the same single chip.
You really do need an electron microscope to read them. I have attempted to run one through our xray machine at work as well, and the chips die is such a small nm length that you can't see anything of use anymore than photographs of any chips silicon are.

http://www.svtii.com/images/IC_Chip2_SVTI.gif

That is an image of a chip from 20 years ago. Shrink the width of the traces by a factor of 4x (at least) and now imagine how useful that same resolution image is.
Most people don't even have access to an xray machine, let alone a device with the needed resolution.

Even then, all you get is firmware (which RSA is a publicly known formula, so you can get that much easier)
The private key being in RAM will make it extremely hard to read out with only physical access to the fob.

This is also why the fobs have an expiration date on the back. The battery can not be replaced, by design.

Re:What about the banks?

[Profane MuthaFucka]

Hence TWO factor. The key fob number proves you have the key fob. The PIN proves you know the password.

Hence TWO factor. Something you have and something you know.

Re:VM?

[Techman83]

Keyloggers could still capture the input from the Host OS.

Re:VM?

[shird]

Because as the author explains in the comments, key loggers can run at the low level device driver level. At this level, it can hook key presses in a VM just as well as the host OS.

It's a pain, because nobody wants to go to the trouble of rebooting twice for the sake of paying a few bills. But it's the only way to be sure of a clean environment, unless your BIOS has been hacked. It's at least one good argument for the trusted platform, TPM, or whatever it is. In theory you could be sure that you are running only un-altered digitally signed executables and nothing else.

Its not just Linux, its trusted boot...

[nweaver]

Its not just "linux vs Windows" but "trusted boot": All you need to rely on is that the live CD is OK and your BIOS is not corrupted and you can effectively safely connect to your bank.

I use it myself for my Schwab account, with the added bonus of there is enough math to show active traders lose big, so don't trade active, which goes into play here.

Re:Just Linux?

[sqrt(2)]

We're trying to SAVE money here

Alternate Headline

[Minwee]

"Washington Post Urges Thieves To Distribute Linux LiveCDs"

A few racks full of CDs in a highly visible place, or even cheap preloaded USB drives delivered right to the mark's front door along with a friendly letter explaining how running Linux would help improve security and thwart The Bad Guys could make your job of stealing from the clueless even easier than before.

Re:Alternate Headline

[fermion]

Exactly. The problem is that many users click on any thing that is bright and shiny. While some problems are caused without user interactions, other clearly come from users navigating towards "carefully constructed web pages". There is really no way to stop this. One CD with 'naked women version of secure linux' on it, and it would be open season for the office bank accounts.

The only real solution is to make banks liable for online bank fraud, just like credit cards are liable for credit fraud. The customer has to pay $50, the bank covers the rest. This is really the value of credit cards. You are using someone else's money, so they take the risk. Once it is your money, your are at risk even if the banks security is at fault.

Re:Alternate Headline

[fwarren]

Why is the purchase price of wisdom in the hand of a fool seeing he has no heart for it? - Proverbs

I have spent the last 26 years immersed in computers. Computers I know about. Cars, even though I drive one, I do not know about.

I can re-gap a spark plug, do a tune-up on an older model car, change my oil and change a flat. However, I am vastly ignorant about troubleshooting and doing most work on a car. Am I stupid? No. But I have no skill, no knowledge and no real inclination to learn everything I would need to know about a car to be an expert and be able to do most of my own repairs. Yet I can still drive a car just fine, even if I can't fix it. I know the difference between a computer and a car. There are people actively trying to hack into my computer or tempting me to run software that will let them hack me. The same is not true for cars. There is no one tempting me to drive to the bad side of town to be mugged. Tempting me to pour water in my gas tank or running around and cutting my break lines.

There are plenty of other domains that holds true for as well. Medical, fine arts, producing music, how to perform stand up comedy, etc.... I go to the doctor and take advice, I appreciate some sculptures, music and paintings. I listen to CDs and MP3's. I enjoy watching stand up comedy. Just because I have not learned how to do these things does not mean I do not have them in my life. It just means I am not an expert at understanding them, their ins and outs. Nor am I willing to invest the time to learn. I may pick up a fact here or there, but for the most part if you shoot to much information at me about these things it will just bounce off my head and I won't absorb it.

Sadly, this is the way it is for "Joe Sixpack" and most other average computer users. They can use a computer to some degree, may know an interesting fact or two about them. However they lack the knowledge to properly be able to secure a computer or tell if it has been compromised.

The average user is just not going to allow themselves to be educated about computers. As I said I have been doing this stuff for 26 years. I have one adult child and 2 kids still in high school. None of them remember a world before the Internet. They can all touch type. But none of them ever had the desire to learn how to program or how a computer works at a deep down level. They are more computer savvy than most of their friends and that frightens me. To them a computer is an office suite and a web browser with adobe flash player. We have lost the battle. Most users won't learn how to find files they have saved when working with said office suite or something downloaded with their web browser. They also will not learn enough about computer security to be safe. Microsoft does not help either. Every 3 years we hear "This is the most secure version of Windows Ever" and people think it must be safer. Education will not get the job done...people have for the most part decided NOT learn about computers.

Re:VM?

[fuzzyfuzzyfungus]

Presumably, if one is handling enough money that 100K or 450K could be stolen, one could afford a second computer and a 2 way KVM switch.

That doesn't solve the "but joe user doesn't want to reboot just to get to his overdrawn checking account" problem; but with real computers routinely showing up for $300 and lower, it isn't exactly an extremist position to suggest banking from dedicated hardware for any nontrivial amount of money.

To be safe...

[Antony-Kyre]

Well, don't do online banking.
Or, use a totally separate computer to do online banking. Only use the web browser to access one's bank account.
Or look for those "freeze" type software, which makes the harddrive essentially read only.
Also, it doesn't hurt to check which processes you are running, and whether any of those are unusual.

Re:Just Linux?

[AvitarX]

I think the point is Boot CD, not Linux.

This would preclude any with an intelligent GUI (actually I am quite fond of Gnome at this point, but that wasn't what you meant).

If I am correct, using a Linux boot CD would make sense for Linux users too.

Re:terrible advice

[fuzzyfuzzyfungus]

Unless your browser is listening for incoming connections, or your bank is running third party banner ads(in which case, switch right the fuck yesterday), does a browser vulnerability really matter?

If you are using the LiveCD as a dedicated banking only environment, the only input your browser will see is your bank's website. If you can't trust user behavior, and want to really be sure, you could have it set to reject anything that doesn't have the bank's SSL cert. If your bank wants to 0wn you, you are already doomed. If no other site can reach your browser, your browser cannot be owned, no matter how buggy.

Re:terrible advice

[Anonymous Coward]

Ya, it stops key loggers, and that's great

Yeah, it is great, because a huge part of on-line fraud is from keyloggers. Modern ones even record 'screencast' movies of you using your computer.

but it aint going to do much for your browser security unless you keep your LiveCD up to date

Between booting up and getting a DNS record for your bank how are they going to exploit a browser security problem? You could safely use unpatched IE5 to do online-banking. There might be some null-prefix type problems, but in reality going directly to your bank's site is pretty hard to get in between.

who says your CD burning software isn't infected - implications on trusting trust and all.

There are lots of different CD burning software, lots of different distributions, lots of AV software that might detect the modifications, and high risk of some paranoid geek with sha1 finding it out. Compared to just setting up a 'enter your password and win a free chocolate bar' site, it's not cost effective to do this.

Re:terrible advice

[black3d]

Browser security is only an issue if you're visiting other sites, in the same session, on the same boot, on your LiveCD. Browsers on LiveCDs don't magically download malware from the internet by themselves - you have to direct them to. And most conventional malware must install itself - which won't happen on a LiveCD. There are a very few flash/js based attacks that work live in the same session - but really, if your either (a) your bank has third-party inline flash ads or (b) you don't trust java content from your bank's own website, then why are you banking with them online?

And going as far as questioning whether your CD burning software is infected is ridiculous. You can't be any more certain that your mouse doesn't have imbedded circuitry tracing your movement pattens, or your keyboard doesn't have a keylogger built directly into it, or the aliens aren't tapping directly into your cablings electromagnetic intereference patterns to directly access your bank account as you do. You're going to extremes purely for the point of argument, but although it may have passed you by, it was established several thousands years ago that "nothing is certain".

If you can imagine up scenarios like malware built into your cd-burning software specifically to target LiveCDs being used for online banking, I can't fathom how you trust a banks own employees enough to actually keep your money with them instead of under the mattress.

The browser may be out of date

[HalAtWork]

The browser on a LiveCD may be out of date. How about a USB flash drive that can save your ISP settings and can update the browser? Banks could distribute them for the price of the flash drive as a safer option for online banking.

Devil's advocate: Deepfreeze?

[mlts]

Devil's advocate here:

Of course, a diskless system running Linux would reduce the chance of malware on clients, but perhaps if a company is dependent on Windows, almost as good security (and I state almost) would be obtained from denying admin access and using something like DeepFreeze, Windows SteadyState, or similar?

Combine DeepFreeze with AppLocker, some decent enterprise antivirus utilities, BitLocker, and the usual physical and BIOS protection on a machine, and one can make a decently locked down terminal that can cleanly run Windows apps. Should additional software be needed, no need to install it, just use something like VMWare ThinApp and have it runnable from a central location.

There is nothing wrong with a diskless system and booting from a CD-ROM. However, unless one creates a custom image with reliable enterprise level auditing tools, it becomes difficult to extract data from a group of PCs (and this is important for larger businesses come tax season, or regulatory compliance), and it is definitely an issue to add or update software without a reboot, unless it is a precompiled binary on a central server that people run.

Also, instead of running live CDs, why not consider going to a vendor like Wyse and going with truly thin technology? This way, there is little to no fiddling with the client side. If a thin terminal has a problem, just swap it out for another one, chuck the old one in the RMA box and be done with it. This is arguably a lot easier than the cost for maintaining standard PCs [1].

[1]: I'm primarily intending enterprise level here. For some SMBs, it is a lot cheaper to go with a boot CD and a generic PC, but for larger companies, it may mean more futzing around with stuff for their IT staff, especially on the scale of thousands of endpoints. If I had a startup with a call center of 5 people, PCs are a lot more economical. However, 500 to 1000 people in a non-technical call center, then I'd take a serious look at thin terminals and a beefy internal network fabric.

it's not a matter of Linux vs. Windows...

[SuperBanana]

...it's more a matter of a read-only medium. If people start doing this is greater numbers, all the evil people will do is start distributing hacked ISOs pretending they're legitimate. This also doesn't do much for machines which have been hacked at a BIOS/bootloader level. In fact, if the PC is set to boot to the hard drive and the trojan supervisor is smart and puts up a boot menu that looks bios-ish (ie, allowing you to select the boot device), 95% of users would never notice. So unless Linux LiveCDs start running checks to see if they're being virtualized, this isn't a very good safety net.

Also, honestly, how many people do you think check the MD5 sum on an ISO? Hell, I've never had a RedHat/Fedora disc that passed its self-check. I gave up on that ages ago.

Re:terrible advice

[QuantumG]

sigh. Just off the top of my head I can think of about a dozen attacks one could direct against a bank user who thinks they're bulletproof because they're using a Linux LiveCD. For example, booting off a LiveCD won't save you from the truncated SSL cert attack that was demonstrated in the direction of PayPal the other day.. only having an up-to-date browser will do that. Encouraging people to use unpatched known-vulnerable software to do their banking just so they can avoid malware on their regularly patched machines makes no sense at all. Of course, that's the extreme case.. suggesting people use a LiveCD of Linux instead of an unpatched copy of Windows XP SP1 is a different kettle of fish.

A smart bank would be ALL over this...

[davide marney]

A bank with any technical savvy would be immediately preparing a LiveCD/USB distro that boots as quickly as possible into a browser pre-configured with the bank's portal page set as the home page. The distro would contain nothing extraneous -- just enough for fast, safe banking. It would, of course, be thoroughly branded, but completely legit vis a vis source code and license notices. Give them away in the mail, or even sell USB drives.

Re:terrible advice (akamai and cross site?)

[fuzzyfuzzyfungus]

In the immediate term, that seems like a terrible plan. Akamai are a reputable outfit; but they carry stuff for all sorts of people. Any domain-level trust/validation mechanism isn't going to tell you very much about something from them. Barring a fix, the financial site should host their own javascript.

In the broader term, it might be worth looking into further cryptographic mechanisms. For instance, with debian packages, you can safely download from an untrusted mirror or an http mirror that might be subject to man-in-the-middle attack because the packages themselves are signed by the original distributor. Cryptographically, putting forged packages on a 3rd party mirror would be as difficult as man-in-the-middle attacking an SSLed connection to the original distributor. At worst, you disclose the fact that you downloaded package X to a hypothetical adversary(that isn't optimal; but it is far less than it might be).

If, for economic reasons, web sites that need to be secure wish to use 3rd party hosting for some of their material, a similar signing mechanism might be employed.

I connect to https://www.hypotheticalbank.com/ SSL assures me that I am in fact talking to the right people. hypotheticalbank.com says "Please obtain 'functionsandstuff.js' from '3rdpartyhosting.org', 'functionsandstuff.js' has been signed with our key and has SHA-1 hash XYZ, verify before loading." This would still be incrementally less secure than pure 1st party hosting, since 3rdpartyhosting.org can, by looking at my requests, infer that I am likely accessing hypotheticalbank.com at a given time; but it prevents an attacker, even if they control 3rdpartyhosting.org, from mucking with the code that my browser will end up executing.

Re:terrible advice

[black3d]

A dozen? I can only think of three. Excluding such fanciful attacks as "camera over the shoulder". Indeed, a forged cert combined with DNS poisoning could be used as a possible MITM attack. However, as in my post below, you can explore possible attack vectors for the sake of argument into infinite regression. Opposite to your argument is the fact that my bank always requires the latest version of Java to be installed to use its online banking. Each time Java is updated and my LiveCD thus becomes out-of-date, I'd be forced to burn a new LiveCD which would throw in all the browser security improvements that go along with it. My argument is, it's not "terrible advice". At worst, it's "good advice which could be improved upon."

Re:terrible advice

[Draek]

hey, who says your CD burning software isn't infected - implications on trusting trust and all.

I understand there's only a fine line between safety and paranoia, but the idea of a CD burning software having been compromised to detect Linux LiveCD ISOs and add a software keylogger to the system included therein is so far up in 'paranoia' territory it already got full citizenship and is considering running for president against "Elvis is hidden in Area 51" and "9/11 was planned by Israel to draw the US into the middle east".

Re:VM?

[Straker Skunk]

What about a Windows XP Live CD?

"Sir, there are some gentlemen here who say they are from an organization called the BSA. They want to see the license certificates for those Windows CDs we've been handing out..."

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:terrible advice

[jhol13]

How does those malware affect live Linuxes?

Re:Non-random bits on LiveCD can compromise securi

[PhrstBrn]

Huh? Random number generators can be seeded with other data from your hardware, such as the system clock time, reading PCI devices, or some random data off your hard drive. Every single time you reboot your system clock has changed. If you have a hard drive, the data on there has probably changed too, so you can just read some information off the drive at the block level (you don't need to mount it). Every user who uses a live CD has different hardware.

The problem is trivial at best to solve. It may not be the absolutely perfect solution, and probably not good enough if you need a true random number generator, but good enough for this purpose. You definitely won't be in the same state every time you reboot (at the very least the time changed).

Re:terrible advice

[QuantumG]

Yes, because everyone else has patched the bug.. Microsoft hasn't. But if you're using a LiveCD from before they patched the bug, then you are no more protected than the bozos using IE5.

Re:Non-random bits on LiveCD can compromise securi

[slimjim8094]

Not Linux. Randomness comes from the time (hardware, persistent), but also from the randomness of network traffic and other driver miscellanea such as HDD head seek times, mouse movements, keystrokes, CPU temperature data, electrical noise on the power supply (with the right hardware)...

I can't say for sure, but I think Linux actually has the most secure random-number generator of any OS - excluding dedicated hardware. Enough that it can probably be fairly called true RNG instead for PRNG, as long as you use /dev/random instead of urandom.

Re:Non-random bits on LiveCD can compromise securi

[tomhudson]

Every single time you reboot your system clock has changed.

My battery is dead, you ignorant clod!

Actually, something like that happened at the Montreal Casino. The machines were shut down every day, so they would end up generating the same sequence of numbers. A guy named Daniel Corriveau noticed, played the numbers, won $600,000.

He initially claimed that he used chaos theory, and the casino claimed it was a bad random number generator. The reality was that the cmos batteries had been removed during development to make testing easier, and nobody put them back in, so every day, they started with the same seed. Simple incompetence. They paid the money after 2 weeks.

No it isn't

[Sycraft-fu]

So in the case of a properly designed security token, it ISN'T just data on the Internet. The reason is that it isn't as though the "something you have" is a card with a number on it or the like. If that were the case then yes, discover the data and you are good. However they don't work like that. There are two related systems that I've seen:

1) A card that gives you a number. What happens is when you want to log in, you push a button on the card/device and it hands you a number. However the number isn't fixed, it changes with time. You need the right number for the right time. The way it works is a crypto system. It uses the time and a key in the device to provide the output. The other end then can calculate the correct number needed. The only want to get the number is to have the device, or find out what the key is on the particular device.

2) A challenge/response system. Here you plug in a USB key or smart chip. The device you are connecting to then sends a challenge to your device, usually something in the form of "Sign/encrypt this message." Then again, public key crypto comes in to play. Your device encrypts the challenge or signs it or whatever and sends it back. The server checks that result against what it ought to get. If the answer is right, in you go.

In either case, the only way to get the data is to either find out the key, or to get your hands on the device. A simple intercept won't do it.

As for your "gun to the head" thing, well of course that gets around it. There is NO SUCH THING as perfect, unbreakable security. I think some geeks delude themselves in to thinking there is because you can build a computer that is at least seemingly perfectly secure. However in the real world there is no such thing as perfect security. There is only security that is better than what anyone is going to try.

I mean I can secure against your gun to my head thing: I hire armed, trained, guards. You try to come at me with a gun, they take you out. So you can counter that, you get trained snipers to kill them at long range. So I counter by traveling only in secure armored vehicles, so you counter by kidnapping my family, so I counter by securing the too, and so on. However at some point, I got past what you could reasonably do, and more importantly what you'd reasonably do. In fact, with good two factor authentication, I am already past it. You will not come and put a gun to my head to get at my bank account. The money isn't worth the risk. So I don't need to worry about that kind of attack. My security is good enough.

That's all it is ever about. That's even what it is in the case of extreme security. The government does not delude itself in to thinking that having tons of armed guys around, say, the CIA headquarters makes it impervious to attack. There are always ways to attack it. So why bother? Because it makes it impervious to any attack that anyone might actually be able to try to pull off. Yes, in theory you could find a way to kill all the guards, take the right people hostage, etc, etc. In reality, you couldn't even come close, you know this, and thus you won't even try.

It is secure against REAL threats, and that is what matters. Same deal applies to your bank account, however since you are protecting a small amount of money and not national secrets, two factor authentication and some vigilance on your part will suffice, armed guards are not necessary.

Re:terrible advice

[SanityInAnarchy]

Browser security is only an issue if you're visiting other sites, in the same session, on the same boot, on your LiveCD.

Wrong. Any security compromise on the same boot lends a possibility of compromising that session. Not all vulnerabilities will lead to that, but some can.

And going as far as questioning whether your CD burning software is infected is ridiculous. You can't be any more certain that your mouse doesn't have imbedded circuitry tracing your movement pattens, or your keyboard doesn't have a keylogger built directly into it,

No, the question is not whether the software came pre-0wned. The question is, once this practice becomes widespread, won't malware authors target the ISO downloading and/or CD burning process? If malware attaches itself to Nero, and Nero injects something into your shiny new livecd, what are you going to do? Ask it to verify itself?

or the aliens aren't tapping directly into your cablings electromagnetic intereference patterns to directly access your bank account as you do. You're going to extremes purely for the point of argument,

Which is exactly what you just did, right there.

See, keyboards with embedded keyloggers do exist, though mostly as proof of concept. While I'm not sure a mouse-movement-logging-mouse exists, it's not hard to imagine how one might be built.

There isn't any convincing evidence that aliens exist, and if they are here, we have no idea how they could be monitoring our thoughts.

All beside the point, of course, which is that this truly is security through obscurity, in two ways:

First, because it'd be much harder to write malware that compromises all burning software and rootkits your new LiveCD and rootkits your current Windows system such that you won't be able to detect the rootkit on the LiveCD...

But "harder" just means, they won't do it until it's worth it -- it's an obvious vulnerability.

The second kind of security through obscurity is the fact that this technique is relatively obscure -- that is, not well known. If users never use LiveCDs a lot, this will probably work well, because someone fishing for account info will go for your neighbor's (who accesses his bank from IE6) rather than you.

But neither kind is actually secure.

Doesn't work in certain areas in the world

[euyis]

For example, Mainland China, where all banks use the super-secure ActiveX technology to build their own authentication systems...

Re:Free Software not Linux

[SanityInAnarchy]

Most distributions still include binary blobs in their corresponding source code that can bring the kinds of problems for which Microsoft Windows is advocated against in the article.

You won't find the word "proprietary", "open source", or "source code" in the article. The reason Windows is advocated against is simple: Malware is written to target Windows. Malware could as easily be written to target any operating system which is vulnerable.

Thankfully at this point, you can get machines that run a free bios, support wireless, and run 100% free software.

And 100% proprietary hardware, unless you've got schematics for all of it.

Never mind that you're connecting to a webserver running the bank's proprietary software...

Thankfully at this point, you can get machines that run a free bios, support wireless, and run 100% free software.

Which you've of course scrutinized every single line for security vulnerabilities... ...what's that? You haven't?

Why is it that you think free software is inherently more trustworthy than proprietary software, in that way? Or that the binary blobs in question are inherently compromising your security?

And, conversely, if you're a valuable enough target that you can afford to (and should) scrutinize every line, wouldn't you also have a budget to enroll in Microsoft's "Shared Source" program, and gain full access to the Windows source code, also?

No, you're right, there's nothing special about a "Linux LiveCD". But the magic word here isn't Linux, or even the implied "Free Software", but "LiveCD". From the point of view of the article, it could be a Windows PE disc, it's just that Linux CDs are free (as in beer), and Windows offers no real advantage in an environment which will only run a web browser.

I agree with many of the goals of software freedom, and I agree a solid open source process can yield more robust software than a closed one. But not every article with the word "Linux" is an appropriate place to bring it up. You sound kind of like this guy.

Simple truths

[fwarren]

Yes the title says it all.

We need to keep it simple people.

Facts:

1. Banks are keeping their costs down, they are not issuing hardware to all of their customers to generate one time keys.

2. Most people (more than 90%) run windows.

3. That the average user can not be sure that their computer running a Microsoft OS has NOT been compromised in some way.

4. A Linux LiveCD is able to solve the problem.

Put the CD in, reboot the computer, open Firefox, type in the URL for the bank and enter your user name and password. Simple and secure. Reboot and you are back to Windows. Nothing stored, nothing cached, and nothing saved.

When I say simple and secure. I am talking real world Joe six-pack security. If you have decided to bank online you have already given up worrying about DNS poisoning, compromised routers, man-in-the-middle attacks. If you don't want to spend the money for a Mac or a new PC just for banking, a Linux Live CD is a great choice. Not to mention you know it is secure, because you can't infect a live CD.

And banks do just that

[Sycraft-fu]

My bank (Bank of America) has optional two factor authentication. The way it works is you specify what it is used for. So login is an option (off by default when you get it), login on an unrecognized computer is an option (on by default when you get it), money transfer, adding a new bill pay recipient and so on. Now it asks you each time for the code when you do any of these things. So if you had everything on and logged in from a new computer you'd have to enter the code first to validate the new computer (along with answering a question). Then you'd have to enter a new code to actually do a login. You'd have to then enter a third code to add someone new to billpay. You choose when it asks (and for that matter if you want to use it in the first place).

So they already do as you suggest. Really, two factor security with banks is pretty good. It's not perfect, but no security is. However, it'll stop nearly all the attacks you can think of. You have to get MUCH more complex to get around it. Well, the harder you make a target, the less tempting that target is.

After all if someone has $5000 in savings and you can steal that with a 4 line Perl script, a thief probably find that worth it. However if to get the same $5000 you need a series of extremely complex custom programs that aren't even guaranteed to work and maybe increase your risk of exposure, well perhaps that $5000 isn't so worth it after all.

Compare it to money on the street. If there's a $100 bill laying on a bench with nobody around, maybe you just pocket it. Easy, risk free money. If that same $100 has a camera watching it, a strong guy by it, and a snarling dog on a chain near it, you probalby give it a miss. Could you take out the camera, guard, and the dog? Maybe, but it probalby really isn't worth the risk.

I'll tell you what...

[bdwoolman]

What in the holy hell do people who make costumes have to do with any of this?

If you are going to rob a bank anonymously you absolutely need a costumer. The costumer is the person who dresses up the bank robber in his archetypal stripped shirt and handkerchief mask. Costumers are typically blond with big... ideas.

Re:I'll tell you what...

[Rudeboy777]

If you are going to rob a bank anonymously you absolutely need a costumer. The costumer is the person who dresses up the bank robber in his archetypal stripped shirt and handkerchief mask.

Right, but is it the bank or the costumer responsible for the sack with the dollar sign on it?

That rather assumes everyone has a mobile phone

[Viol8]

And that they have it to hand when they're doing the transfer. I suppose you could say that anyone who's doing internet banking is likely to have one but even so, it seems a bit presumptuous.

Re:Devil's advocate: Deepfreeze?

[Rennt]

Yes, a hardened single-purpose Windows machine is almost as resilient as a Live CD. Almost. It is also infinitely harder to set up correctly and significantly less useful all those times you aren't banking. It is understandable why it is not the solution recommended for non-technical users or people who only want one computer.

IE

[bruthasj]

Beyond multi-factor authentication, there's another fundamental problem with many Bank websites. They only work in IE. It's difficult to convince non-power-users to drop a bank and go with another that works in Konqueror or even Firefox. This is especially a problem in a non-US country where every bank has the same problem.

Re:IE

[MollyB]

there's another fundamental problem with many Bank websites. They only work in IE.

As an Ubuntu user, my bank (FCU, actually) just sprung this "Windows/Mac only" policy lately. I've complained loudly to Member Services to no avail. They even said blankly that my "Lynux" system would no longer be able to access Online Banking because they were "beefing up security"!?!

I have CrossOver Office installed and it is simple to open IE8 and do my banking, but when I pointed out this flaw in their thinking, they had no comment.

Another point: I live in a rural area and have banked at this location for 15 years. I like all the tellers and ordinary staff. Changing banks would be a real hassle and there's no guarantee the new institution might not do the same thing...

Re:Devil's advocate: Deepfreeze?

[Rennt]

I'm confused, are you supporting or disagreeing with my post?

Re:Non-random bits on LiveCD can compromise securi

[QuantumV]

Not Linux. Randomness comes from the time (hardware, persistent), but also from the randomness of network traffic and other driver miscellanea such as HDD head seek times, mouse movements, keystrokes, CPU temperature data, electrical noise on the power supply (with the right hardware)...

If you start the LiveCD only to use online banking there isn't much time between the startup and the time you need randomness for a secret key. The question is if there is enough time to gather sufficient entropy from the environment.

Others have suggested to seed with the current time, but that is easy to guess for an attacker. Netscape's original SSL implementation was broken because the PRNG used only the current time (in microseconds) and the PID as a random seed ([1], [2]).

[1]: http://marc.info/?l=bugtraq&m=87602167418753&w=2
[2]: http://www.cs.berkeley.edu/~daw/papers/ddj-netscape.html

Say what you like about the Germans...

[vorlich]

But the banking system here, requires the use of single use numbers for each online banking transaction. Your bank provides you with a unique sheet of them and if you lose it, you have to request a new one. Nor are credit cards popular with German consumers. Sites such as Amazon.de allow payment by bank transfer (Uberweisung). You can manually complete the transactions slip and give to your bank or do the same thing with your online banking. Any issue and the transfer has to be reversed. There are an awful lot more banks too - one just around the corner from me and at least three within a few minutes walk with real people working there and very, very friendly managers - if you're liquid!

Re:terrible advice

[jhol13]

OK. I'll wait for actual implementation.

P.S. I have been waiting for the invasion of Linux viruses for over 15 years, how long you expect I need to wait for this?

FREQUENCY

[shis-ka-bob]

If you are trying to be safe, you have to realize that 'safe' is a probability, not a certainty. What is the frequency of this vulnerability relative to the frequency of compromised computers? If you want absolute safety,well you can't. If you decide to bank in person, you have to drive to the bank - risking your life by getting behind the wheel. If the average user has a choice between using his 'regular' browser that was downloading free porn and free photoshop via some torrent, or using a clean browser from a bootable CD, I'm willing to bet long odds that the frequency of attack will go way down with the live CD option. A frequently updated Live CD would seem to be a fairly practical solution for most users. I would also suggest that a bank supplied live cd that prevents surfing to other sites would be even better. The CD could have a jailed browser and a jailed 'something you have' key/value map that allows the bank to ask you for the value for their key. There may still be attacks, but the frequency with such a 2-factor authentication must be quite low, but not zero.

Let the banks supply a disk

[DeBaas]

Like I suggested in August: http://slashdot.org/comments.pl?sid=1347481&cid=29198657&art_pos=4

The banks should distribute a locked down version themselves. Then they can even build in extra authentication in the browser and minimise other programms with possible weaknesses