7

I will soon be moving to Mexico and living there for an extended period. During that time I will need to occasionally access my US-based bank's website. I'll always be connecting using my own laptop, which is guarded and clean from infection. I have no specific reason to worry about my net traffic in Mexico being intercepted but I still want to take every precaution I can.

My options for accessing my bank's website are:

VPN - Use a US-based VPN service to tunnel from Mexico net space to US net space. I'm not concerned about the VPN logging my traffic, I only need to be sure that they implement the protocol correctly. I'm looking at StrongVPN and PrivateTunnel, I'm open to suggestions for others. Once I get into US net space I feel like I'll be reasonably safe from interception, I'm counting on HTTPS to cover me from the VPN exit to the bank's servers.

SSH - Connect to a trusted computer here in the states and then browse from that. This might be the safest but I don't think I'll be able to have anytime-access to a computer here. Plus, if the computer or router goes down I'll have to rely on someone else to fix it, also a shaky possibility. Could I SSH into a VPS, or maybe use Tunnelr.com?

HTTPS - Rely on HTTPS only. I really don't want to do this. I think I understand how certificates work and about checking the certification chain and the warnings that browsers give when the cert appears to have changed. But I'd hate for HTTPS to be my only defense against interception.

Is there another option for connecting securely? What do you recommend?

Edit: I think I've answered my own question. I'm thinking I'll get a VPN, probably Tunnelr.com, that way all my traffic is protected. I know nothing about the networks I'll be connecting to when I'm in Mexico and I think a VPN is the best and simplest solution for my current needs.

Still, any feedback or comments are welcome. Thank you!

Improve this question
2
  • 2
    I'm interested in the fact you consider the US more trustworthy than Mexico, however I'm not a resident/citizen of either country. :)
    – lew
    May 7, 2012 at 0:01
  • Heh, I'm aware that US govt is most likely actively intercepting anything they can, but I don't think they want my bank login. By safest I mean that it's less likely that the connection to my bank will be under attack or susceptible to malicious spying from non-govt entities, such as the companies that carry my traffic.
    – M_M_
    May 8, 2012 at 6:40

4 Answers 4

Reset to default
9

The only reason I would recommend tunneling HTTPS over VPN or SSH is if you (1) don't trust your banks implementation of SSL/TLS (weak cipher suites) and the network(s) your traffic is traversing or (2) you want to hide the destination(s) your browsing to up until the VPN/SSH exit point.

Provided HTTPS is implemented properly, it should be just as secure as VPN or SSH.

I would say compromise of your PC is more likely than compromise of data in transit due to a weakness in the bank's security.

Improve this answer
5
  • Hiding my destination is another good reason to use VPN, I hadn't thought of that aspect. Any tips on how I can gauge the effectiveness of my bank's implementation?
    – M_M_
    May 6, 2012 at 19:36
  • ssllabs.com/ssltest/index.html can evaluate a site's SSL configuration from the perspective of cipher suites, bit length, etc.
    – lew
    May 6, 2012 at 23:59
  • There is no evidence his bank uses a weak cipher suite.
    – Ramhound
    May 7, 2012 at 16:53
  • No public evidence. That link from lew seems to be a good start at looking for some.
    – M_M_
    May 8, 2012 at 6:43
  • 1
    It's worth noting a number of VPN providers use or offer SSL anyway, so from a cryptographic perspective (depending on implementation/configuration) there should be no gains as you're simply tunnelling SSL over SSL.
    – lew
    May 9, 2012 at 0:23
2

The vulnerabilities of HTTPS are:

  1. you or your browser ignores HTTPS warnings (e.g., this key is not signed by a CA or is for another website,
  2. you go to the wrong site (e.g., you click a link to a site that has a properly signed certificate but is https://yourbank.malicioussite.com),
  3. you are subject to a DNS or routing attack (e.g., you try going to the right site), but get redirected to a malicious server AND the attacker has either (a) fraudulently obtained yourbank.com's private SSL key, (b) obtained any trusted CA's private signing key, which they use to sign fraudulent certificates, or (c) managed to install bad certificates in your web browser somehow.

In your described scenario, all the VPN/SSH tunnel really buys you a little bit of extra anonymity to what websites you are connecting to. With regular old https they'll be able to see you are talking to server's controlled by yourbank.com (but not the full URLs), when you are connecting, and how much (encrypted) traffic is going back and forth.

A DNS or routing attack is presumably easier outside of the US, but still if you are going to https sites; they have to get you to trust their fake certificates somehow -- not an easy task (unless they've compromised your computer). If they've compromised your computer; you are kind of screwed anyways. (E.g., they can get login details/keys to your remote ssh server and mess with your tunnel).

Improve this answer
1
  • I'm familiar with Chrome's certificate mismatch warnings, I'm not one to ignore them and I'm familiar with checking cert paths. I feel pretty good about avoiding this pitfall. I never use favorites or links to my bank's website, I always type it in. I use Google DNS but I will definitely record my bank's IP address, just in case. You're right, VPN only grants me anonymity from local network snooping, which is something I want. Plus, all my DNS traffic will be protected from local intercept.
    – M_M_
    May 6, 2012 at 19:49
1

As a slight aside, if you decide that you do want to use SSH, setting up a shell account on a server that e.g. isn't one that you have sitting in your house in the US, but is instead in a datacentre is really very cheap and easy; if you want to setup a VPS where you know that you have relatively strong control over the install (i.e. you have root on the box), you can get them fairly cheaply: have a scour through this site.

You can then tunnel all your data through this connection really easily!

Improve this answer
2
  • Yes, I've seen that site and I've seriously considered doing what you suggest. However, for a little bit more money I could get a VPN connection and not have to go through the VPS setup process. I've never used a VPS before and while I'm sure I could figure it out, I'm pressed for time and I don't want to take the chance that I'll do something wrong.
    – M_M_
    May 6, 2012 at 19:39
  • revsys.com/writings/quicktips/ssh-tunnel.html :-)
    – Savara
    May 6, 2012 at 19:51
1

It should be sufficient to stick to just SSL. I recommend you use Firefox plus HTTPS Everywhere; that will ensure you always use SSL on your bank's site, and will help prevent you from clicking through warnings.

I think the risk of client-side malware is a much higher risk than the risk that someone manages to intercept your traffic, despite your use of SSL. Therefore, I think it's not the best use of your time and energy and money to set up a VPN. Instead, if you're really worried and want to do something, I'd focus on preventing client-side malware from stealing your online banking credentials, such as booting from a LiveCD for your online banking.

But personally, I don't bother with even a LiveCD in my own personal banking. How come? Partly because I trust my system's security. But mostly because I called up my bank and asked them about this, and they told me that in the case of an unauthorized transaction on my online banking account, they'd eat the cost and reverse the unauthorized transactions. It turns out that my bank even puts this guarantee in writing in their terms and services. How awesome is that? Apparently, most other banks will do the same. The main hitch is that these protections apply only to personal banking accounts. They do not apply to business accounts. Therefore, if you are doing any banking for business out of a business account, you are high risk, and in that case I recommend using strong protections (boot from LiveCD, SSL, HTTPS Everywhere).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .