New answers tagged

1

I like to rely on the auto-fill feature of my password manager for this check. The rationale is that I will not be clever enough to match the site URL in the browser to the expected one, while a password manager will. So when I see that it has filled in the entry for the site - the site is genuine, otherwise I should start to worry. The password manager ...


0

Steve DM's answer (checking and bookmarking the page) is better from an absolute security standpoint, but another viable (and possibly more user friendly) option is to tell them to Google the bank every time instead of clicking on a link. This way, you rely on Google taking you to the right place rather than some shady link and your observational skills. ...


2

Essentially your question is one of authentication. In this case, it's users authenticating the bank website is actually the bank. I think you're right, and the user is going to have difficulty in authenticating the bank through the URL (many banks have multiple URLs for instance). You're also correct that users aren't terribly sophisticated about URLs, ...


25

I was going to suggest that ensuring that the login screen for the online banking system showed the name of the bank in green, in the address bar might work. But then I started wondering if any of the local banks I know about did that properly. It's less encouraging than I'd hoped. For these nine fairly large banks, 6 provide the name of the bank in the ...


35

Why security indicators fail vs. phishing There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers. You are correct that checking for URL correctness is error-prone, and ...


-2

Yes. Use an app that is definitely connecting to the site. Or. Check the https. Verify the url. Make sure the url is short enough to visually see tampering. Also, maybe some examples of homographic attacks.


1

A proxy is better for that. I think if you configure this proxy but skip the SSL cert configuration you should get your answer.


0

I can give you some insight regards one of the biggest banks in the world as I used to work for them for some years. I won't go into specifics or tell you which bank just in case I am breaching some kind of security! The bank has multiple data centres, for contingency purposes, in fact the data centres they use are designed to withstand a nuclear attack. ...


7

This isn't as common now, but quite some time ago a lot of websites were just HTML wrappers around classic terminal (IBM 3270 and the like) applications which were being scraped statefully, and this was especially prevalent in legacy industries where the whole idea of a separation between view and model is very, very new. It's possible that a lot of banking ...


25

There's a couple of things going on here: Bankings sites will use cache-control headers to forbid cacheing of the pages. So when you click back the browser has to reload the page from the server. Some parts of the site may have a strict flow of pages, e.g. you enter transaction details, enter your SMS code, view transaction confirmation. These require ...


53

A scenario such banks might want to protect you from could be this: you visit your banking website and do your banking stuff. after you are finished you log out and then navigate to some other website to look at cat pictures or whatever. you leave your computer with the cat picture website open. Because there is nothing incriminating on your screen, you ...


0

Strictly speaking, both are insecure compared to USB boot etc. However, every layer of security drops the probability of generic attacks succeeding. Using a VM with incoming network connections disabled should be immune to the vast majority of malware on the host. You could disconnect the USB keyboard from the host and attach it exclusively to the VM to ...


0

Setting up a Linux VM dedicated for Internet Banking is a good idea, but if the VM is used for other purposes have a browser dedicated for Internet Banking only where everything that is not required is turned off (i.e. scripts, flash, etc...). As mentioned by Jonathan a VPN is a good idea too.


4

If you want to do home banking on a public network I would always recommend using a VPN. This should protect you against MITM attacks and other funny things that can happen on a public network. There is nothing wrong with using a Windows tablet to connect to your bank. Be sure to install a decent antivirus/malware and install your Windows security updates. ...


1

If you have very sensitive data, you should keep it somewhere, where there's no direct internet access. In that case, Linux on a virtual machine will do the job(but still, it's not 100% safe in this case). If you need an internet access, I suggest installing plugins like HTTPS Everywhere and uBlock/uMatrix/NoScript in your web browser, to keep the ...


3

A virtual machine can't protect the guest OS from the host (without specialized hardware features to support it). You will not gain any security from running Linux in a VM if Windows gets infected, and if your VM gets infected then that's still the environment you intended to use for security sensitive things that's new insecure. Have you tried live USB ...


1

You're asking the wrong question. The question should never be "Are there any security risks to doing X". The answer to that question is always yes. No risk is zero. The question should be more "Are the risks of doing X worth the benefits, and is there any benefit to trying to further reduce my risks". The answers to the above (in my estimation) are a ...


2

As long as you called them, at a phone number on the card or from your bank statement, it sounds standard to me. The hazard would be if someone called you claiming to be a bank employee, or you got the phone number you called from some untrusted source, such as a piece of email or a random snail mail that appeared to be from the bank.


2

If you consider how credit cards are used there is no increased security risk associated with providing the bank employee with the card number and your name and address. For example if you use the card for mail order purchases you will provide the same detail, but also the CVV code and expiry date a greater level of risk...but this is how they are intended ...


1

This question is alot of speculation, though I will say no its not safe BUT there is a certain amount of trust we have with banks and the employees the only risk is telling the employee down the phone, all phone calls to banks are recorded and easy to prove who abused their position of responsibility. I would say your risk is extremely low but not zero ...



Top 50 recent answers are included