Slashdot Mirror
Can Ubuntu Save Online Banking?
CWmike writes with a pointer to this ComputerWorld mention of an interesting application of Live CDs, courtesy of Florida-based regional bank CNL: "Recognizing that most consumers don't want to buy a separate computer for online banking, CNL is seriously considering making available free Ubuntu bootable 'live CD' discs in its branches and by mail. The discs would boot up Linux, run Firefox and be configured to go directly to CNL's Web site. 'Everything you need to do will be sandboxed within that CD,' [CNL CIO Jay McLaughlin] says. That should protect customers from increasingly common drive-by downloads and other vectors for malicious code that may infect and lurk on PCs, waiting to steal the user account names, passwords and challenge questions normally required to access online banking." (But what if someone slips in a stack of doctored disks?)
(But what if someone slips in a stack of doctored disks?)
What do you mean, like a disk that would boot Microsoft Windows instead?
Tequila: It's not just for breakfast anymore!
Isn't the point of online banking that it is convenient? And easy? For me, booting from a Live CD may be a piece of cake, but for a lot of people, it's far from that.
Even if it is a great idea, 98% of the population won't latch on to something like this, and the 2% who might are probably already running linux
The majority of users I have contact with resent having to enter passwords/user-verification at all. With banks they do, often at least, appreciate the value of the process. But they still take every opportunity to minimise the process, so what're these users to do when they can't have Firefox (et al) save their username/passwords?
Personally, I'm thinking they'll go back to using Windows, which can't be reasonably prevented by the institution, without cutting off a large user-base. Still, a nice -and, to me, novel- idea.
I always keep hearing that claim. I've never found one and actually never heard of one reported in the wild.
As for the article: Online Banking has worked perfectly fine the last years.... At least for me :-) It needs no saving...
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
They could ship you a free NetBook w/ CD.
Don't mod me funny, I'm serious. Like maybe a $100 little book running Linux, automatically set to keep itself up to date to eliminate hundreds of millions of dollars in cybercrime. The banks would own it, maybe even lease it to you for a $2 banking fee for having an online account with them. When you don't need it anymore or switch banks, you give it back to them and they would wipe the BIOS and system and reuse it.
In fact, they could probably even make the netbook cheaper by not including a hard drive. Just boot from USB or CD, maybe even a small USB traveldrive installed internally inside the case itself. The USB ports could be removed or completely disabled, no CDROM drive included, no HDD, etc. It becomes more or less a dumb terminal whose only purpose is to connect to the bank on boot. And, in addition, sandboxed to not allow any other applications to run besides the required startup items.
Just checked and it looks like Gateway sells a $49 netbook, found it on CNETs list of netbooks when I sorted by lowest price. And, that's *consumer* price, if the banks bought in bulk they'd even be cheaper than that. If they banks told them they didn't want USB ports (except the internal one), no harddrives, etc. then it would even be cheaper. I bet they could get them for $25 or so apiece in bulk for say 1000 units. That's not much cost to essentially eliminate the wholesale highway robbery of people's accounts that's been going on. The savings would be pretty enormous. Offset that with a small lease fee like I suggested above and its a win/win for everyone involved. Not to mention it would help Gateway out of its slump.
Gateway LT2016u (Verizon Wireless) Specs: Intel Atom N270 / 1.6 GHz, 1 GB, 160 GB, Microsoft Windows XP Home Edition, 10.1 in TFT active matrix, 3 lbs
Lots of Utah state government employees who work from home (for example, people who do data entry for Dept. of Workforce Services). It's worked pretty well, bypasses a lot of problems.
THL phish sticks
One of the major Canadian banks (RBC) was actually giving away netbooks (eeePC 700 I believe) a little while back (to those who switched to them). With that in mind this suggestion doesn't seem that crazy. In reality, you wouldn't even need a full netbook. A small screen, minimal keyboard, network card, and very small SD card would do. Some people might even be willing to pay $100 for them if it meant they could feel safe in their online banking.
In theory it is a fantastic idea to promote security and virtually prevent problems. In reality, here is what you face: 1. User inertia to do this because it removes some of the convenience of online banking. Maybe Joe and Jane Smith who would be using this would be less savvy than your average computer user and still find a way to bungle things up despite this being totally sandboxed. 2. The fact that this is openly downloadable - Criminal networks can now simply obtain CNL's distro and systematically look for a weakness. A weakness with Linux is generally in order of magnitudes harder to find than Windows. It might work if, you have a system where you must be a customer of the bank and the distro you download comes with a unique certificate tied to your identity. But the reality of online banking is that it is an inherrent security risk. But even then, it is not quite perfect.
I think so too, the grandparent has some issues with reading comprehension ;-)
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
The point of the LiveCD is that there it is rather difficult for hackers to compromise (owing to the physical, unalterable nature of the disk image). It has nothing to do with obscurity--the point is that each time they boot a verified, trusted disk image and then go straight to the bank's website--without a keylogger in the motherboard there aren't really any useful attack vectors.
You could use token authentication and just allow the disk to keep a cookie that logs them in with minimal interaction (either nothing or a short password like their pin).
Also, just thought you might like to know... Et al. is short for et alii and translates literally as, "with others." etc. is short for et cetera and translates roughly as, "with other objects". There is a people/things distinction. So if the other stuff is people, "et al." and if the other stuff is things, "etc.".
Unless they plan on sending you a new Live CD every time a new Firefox or Linux kernel security bug is patched, many users would be vulnerable to attacks within a few months of this CD being released.
Er, no. If you've got a distro with no open ports, firewalled as well, that can only get to a single IP address on port 443, which doesn't let you connect unless the remote server's SSL cert is signed by the bank's CA which is the only one in your browser's CA list - where does the vulnerability come from?
Get your own free personal location tracker
If you are going to go to the expense of creating and distributing physical media, just implement two-factor authentication.
SECURITY NERD RAGE! RAUGH!
In my opinion, pressing a little button on your bank-branded, credit card-sized PIN generator (such as the ones I have from Bank of America and PayPal/eBay) you keep in your wallet next to your credit cards and ID is waaaay easier than trying to remember what bullshit answer I gave to yet another off the wall "security" question. It's clearly much more secure.
obviously no deficiencies vs. no obvious deficiencies
My other Dutch bank ABN/AMRO uses some kind of calculator thingy that provides a transaction number based on a value you receive from the banks webpage.
The same ING bank also provides a very simple system where you have a sheet of paper with transaction numbers, and the webpage just asks you for your next TAN code.
What do all these have in common? Right, a separate transaction authorization outside the browser. How hard is that?