The advice in the video is not total nonsense, though it wouldn't be something I'd emphasize to my friends or family. However, the explanation in the video is potentially a bit confusing.
Browsers are specifically designed to try to prevent a page in one tab from attacking a page open in another tab (assuming they are from two different domains). The specific security mechanism is known as the same-origin policy. So, generally speaking, you can usually assume that a page open in one tab cannot attack another site open in another tab. However, there are two important exceptions:
If the browser has a vulnerability, then all bets are off. If the browser has an unpatched vulnerability, a malicious page in one page might be able to exploit the vulnerability, gain control of the browser, and then attack the other page.
Browser vendors do their best to avoid vulnerabilities like this, but sometimes it happens. If you are using a modern browser (the latest version of Chrome, Firefox, or IE), such vulnerabilities should be relatively rare. If you are using an older version, oh boy, you could be in trouble.
Shutting down your browser and starting it up with just the bank site loaded doesn't help defend against this sort of attack.
If the web site has a vulnerability, then it might be susceptible to this sort of attack. Suppose the banking site, bank.com
, has a particular kind of vulnerability known as a cross-site request forgery (CSRF) vulnerability. Then if you have a bank.com
page open in one tab and a page from evil.com
open in another tab, the page from evil.com
could attack your banking session by exploiting the CSRF vulnerability in the bank's site.
Hopefully, any reasonable online banking site should be designed to avoid CSRF vulnerabilities, so hopefully this should be rare for high-security sites. However, it does happen. (And it is much more common for low-grade sites.)
Shutting down your browser and starting it up with just your bank loaded does defend against this sort of attack.
So, if you take all of this into account -- odds are, you probably don't need to do this business about shutting down your browser and starting it up with just your bank site. I realize there are some circumstances where it could possibly help, but they are pretty limited.
If you asked me for advice about how to ensure online banking is safe, here's what I'd suggest. If you are a consumer:
Choose a bank that promises to make you whole, in the event of fraud or unauthorized transactions. In the US, most banks have this policy for consumer accounts.
Turn on automatic updates on your operating system. Make sure you keep your OS updated.
Choose a modern browser, and keep it updated (most browsers will automatically update themselves these days). If you want to be especially paranoid, Chrome has a good reputation for security.
Choose a hard-to-guess password.
On Windows, install an antivirus program (there are reasonable free A/V products).
And that's it. If you want to be extra-cautious, you could take some extra steps: install Secunia PSI and follow its recommendations; you could also boot into a Linux LiveCD for your online banking.
If you are a business, securing online banking is much harder, because banks usually won't reimburse you for fraud: if a bad guy steals all your money, too bad, you lose. You might want to ask yourself carefully whether you really need it. If you do, I suggest using a number of paranoid steps: boot into a LiveCD each time you need to do online banking; establish transaction limits with your bank; consider enabling two-factor authentication, like one that uses a RSA SecurID or your mobile phone to confirm transactions; consider buying a separate machine that you use only for online banking and nothing else (not email, not web browsing, nothing else).