Slashdot Mirror
Can Ubuntu Save Online Banking?
CWmike writes with a pointer to this ComputerWorld mention of an interesting application of Live CDs, courtesy of Florida-based regional bank CNL: "Recognizing that most consumers don't want to buy a separate computer for online banking, CNL is seriously considering making available free Ubuntu bootable 'live CD' discs in its branches and by mail. The discs would boot up Linux, run Firefox and be configured to go directly to CNL's Web site. 'Everything you need to do will be sandboxed within that CD,' [CNL CIO Jay McLaughlin] says. That should protect customers from increasingly common drive-by downloads and other vectors for malicious code that may infect and lurk on PCs, waiting to steal the user account names, passwords and challenge questions normally required to access online banking." (But what if someone slips in a stack of doctored disks?)
(But what if someone slips in a stack of doctored disks?)
What do you mean, like a disk that would boot Microsoft Windows instead?
Tequila: It's not just for breakfast anymore!
What about infecting the BIOS?
Isn't the point of online banking that it is convenient? And easy? For me, booting from a Live CD may be a piece of cake, but for a lot of people, it's far from that.
Even if it is a great idea, 98% of the population won't latch on to something like this, and the 2% who might are probably already running linux
The majority of users I have contact with resent having to enter passwords/user-verification at all. With banks they do, often at least, appreciate the value of the process. But they still take every opportunity to minimise the process, so what're these users to do when they can't have Firefox (et al) save their username/passwords?
Personally, I'm thinking they'll go back to using Windows, which can't be reasonably prevented by the institution, without cutting off a large user-base. Still, a nice -and, to me, novel- idea.
Lots of Utah state government employees who work from home (for example, people who do data entry for Dept. of Workforce Services). It's worked pretty well, bypasses a lot of problems.
THL phish sticks
I don't think its a question of difficulty. It would be a total pain in the rear if I had to reboot every time I wanted to get on my bank's website. Or do I keep a dedicated bank terminal ready to got at any instant?
Actually, yes, you could have a "dedicated bank terminal". Take the old PC that is getting replaced, boot from the Linux cd-rom, use it for banking, and let the family screw up the new computer with trojans and malware while you enjoy relative peace of mind. I know a few families that have gone this route. They could care less about FOSS and its philosophies or politics, they just like the practicality of the solution. This is how FOSS can make inroads to the public, through practicality, not through ideological conversion.
In theory it is a fantastic idea to promote security and virtually prevent problems. In reality, here is what you face: 1. User inertia to do this because it removes some of the convenience of online banking. Maybe Joe and Jane Smith who would be using this would be less savvy than your average computer user and still find a way to bungle things up despite this being totally sandboxed. 2. The fact that this is openly downloadable - Criminal networks can now simply obtain CNL's distro and systematically look for a weakness. A weakness with Linux is generally in order of magnitudes harder to find than Windows. It might work if, you have a system where you must be a customer of the bank and the distro you download comes with a unique certificate tied to your identity. But the reality of online banking is that it is an inherrent security risk. But even then, it is not quite perfect.
Sure, but who's likely to sit down and download 100mb worth of patches each time they want to check their BofA account balance?
The point of the LiveCD is that there it is rather difficult for hackers to compromise (owing to the physical, unalterable nature of the disk image). It has nothing to do with obscurity--the point is that each time they boot a verified, trusted disk image and then go straight to the bank's website--without a keylogger in the motherboard there aren't really any useful attack vectors.
Yep, security could be enforced if we made people walk into a bank with two forms of photo-id before they could do anything....
Wait! Whats a sig?
You could use token authentication and just allow the disk to keep a cookie that logs them in with minimal interaction (either nothing or a short password like their pin).
Also, just thought you might like to know... Et al. is short for et alii and translates literally as, "with others." etc. is short for et cetera and translates roughly as, "with other objects". There is a people/things distinction. So if the other stuff is people, "et al." and if the other stuff is things, "etc.".
Honestly, I just read that entire thing. :\
Unless they plan on sending you a new Live CD every time a new Firefox or Linux kernel security bug is patched, many users would be vulnerable to attacks within a few months of this CD being released.
Er, no. If you've got a distro with no open ports, firewalled as well, that can only get to a single IP address on port 443, which doesn't let you connect unless the remote server's SSL cert is signed by the bank's CA which is the only one in your browser's CA list - where does the vulnerability come from?
Get your own free personal location tracker
If you are going to go to the expense of creating and distributing physical media, just implement two-factor authentication.
SECURITY NERD RAGE! RAUGH!
In my opinion, pressing a little button on your bank-branded, credit card-sized PIN generator (such as the ones I have from Bank of America and PayPal/eBay) you keep in your wallet next to your credit cards and ID is waaaay easier than trying to remember what bullshit answer I gave to yet another off the wall "security" question. It's clearly much more secure.
obviously no deficiencies vs. no obvious deficiencies
If you're distributing your own discs, you could just use DNSSEC and include the cert needed for verification on the disk itself. Similarly, making your own CA isn't really a good plan if you want to serve customers who don't have this disc, but the disc can have no CA certs installed on it and just have the verification data for your site.
Uhhh - wait a minute here. Ubuntu doesn't "just work"? The most problems I've had were getting video cards to work like they are supposed to. Damned ATI drops support for this card or that, then you have to jump through hoops to get your hardware acceleration.
But, if you're booting to a secure OS specifically for the purpose of doing online banking, what need is there for super graphics?
Next most common problem is the WIFI card. Whoever distributes the CD needs to ensure that 99.9% of all WIFI cards are detected and supported.
What's the next most common problem? None that I can think of, really. If your browser opens, and connects to the bank, you should be good to go. No dongles, no bluetooth, no state of the art multimedia, none of that nonsense - just do your banking, then boot back into your main operating system.
Not so difficult, is it?
Of course, I'm not going to go that route. I just installed Ubuntu and Debian on all of my machines, and I don't worry very much about security. Yes, of course I check on things, and watch the logs, run Wireshark now and again, avoid phishing attacks, avoid using Root privileges, etc - all the common "common sense" security measures.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Aside from "branded consumer experiences" and all that stuff that gets the marketing guys excited, the one reason to make the disks bank-specific is that it makes security a lot easier.
If all the disk has to do is go to https://mybank.com/ you can do all sorts of draconian but secure stuff: Disable loading any non-SSL page or element. Trust only your own cert/CA. Remove any option to approve an exception. Configure the firewall to block any and all traffic that isn't either a DNS(SEC, preferably) lookup for mybank.com, or communication between the host and mybank.com
If you have to coordinate between a bunch of banks, things get harder. Either you take on a big institutional verification task, enrolling reputable banks in your list of trusted sites and cert/CAs, and hopefully not having some front group sneak one in there for some XSS action, or you throw up your hands and just build a generic "browser liveCD".
The generic browser liveCD is still a good bit safer than Joe user's computer, since it needn't be a general purpose machine, or capable of running Limewire, or have every infection picked up in two years of browsing(since the max lifespan of a liveCD session will probably be a few hours); but it is still substantially less safe than a dedicated one. If there are any available exploits for the browser used, the user has a nonzero chance of picking one up while poking around and having it still resident if they bank after doing that, and before rebooting. There would also be the basic issue of cross site/cross tab stuff. Exploits of those sorts of flavors are discovered all the time. If you give up on the goal of having a general-purpose browser, you can neutralize most of them without even discovering them or patching the browser. If your browser has to be general purpose, you have to do the security the hard way.
My other Dutch bank ABN/AMRO uses some kind of calculator thingy that provides a transaction number based on a value you receive from the banks webpage.
The same ING bank also provides a very simple system where you have a sheet of paper with transaction numbers, and the webpage just asks you for your next TAN code.
What do all these have in common? Right, a separate transaction authorization outside the browser. How hard is that?
Among the several distinct ways to alter Knoppix, the one likely to be of broadest interest is remastering, during which you can substitute your own software for a portion of that on the standard Knoppix CD-ROM