What technologies are recommended for E-banking? [closed]

Question

If a Linux user need use his bank account from Internet, then what technologies and procedures should use?

1. Is better to use the Guest Account (if exist) of the OS, or an Administrator Account?
2. What web browser is highly recommended?
3. Should the user clean the browser history or it isn't useful?
4. Some specific port should be closed? (I'm developing with PHP so I have the port 80 opened for Apache)
5. There are some plugins or configurations that must be enabled/disabled?
6. Any software or method that could help to improve the security?
7. The Tor browser + Vidalia is a good or a bad alternative?

Answer 1

1. When using a computer you always want to use the least privileged account. This means a non-administrator should be used for web browsing.
2. I would recommend Chrome because it allows plugins to be disabled at the browser level, and only enabled as they are needed and accepted by the user. Never-the-less as long as you use an updated mainstream browser you shouldn't have any issues.
3. Yes, you can do this if you want to be secure. There are also browser modes, such as incognito mode in Chrome, which shouldn't save any local information. If you start delving into forensics you can find that this isn't always true, but from what I've found Chrome does a better job than most at this. If you want to pull out all the stops, I recommend reviewing this browser security review.
4. General best practices say a computer should only listen on the minimum ports required. As a desktop this is an extremely small amount of ports and I'm not entirely sure what this question is asking in this context?
5. As mentioned before, you should disable all plugins and only enable as needed. In addition Chrome has an add-on called NotScripts which will additionally secure your machine.
6. There are a lot of different types of software that could help secure your machine. In a consumer context, you are probably okay with AV, a software firewall, and strong password management. However, in more complex environments you should consider HIDS, Anti-Virus, software firewalls, strong password management (password vaults, etc.), Data Loss Prevention agents, Patch auditing agents, etc.

Answer 2

To answer your specific questions

1. Never use the root account, always use a normal user account
2. An up to date, patched one
3. Generally considered a good idea, but good online banking applications should enforce no memorisation of passwords etc
4. This doesn't mean anything in this context - what do you mean by port and closed here?
5. Any plugin could increase the attack surface of your machine, but generally NoScript and similar tools are useful at reducing risk
6. Use antivirus; use a firewall; use sensible browsing practices