What's the safest way to access my US-based bank's website from within Mexico? VPN vs SSH vs HTTPS?

Question

I will soon be moving to Mexico and living there for an extended period. During that time I will need to occasionally access my US-based bank's website. I'll always be connecting using my own laptop, which is guarded and clean from infection. I have no specific reason to worry about my net traffic in Mexico being intercepted but I still want to take every precaution I can.

My options for accessing my bank's website are:

VPN - Use a US-based VPN service to tunnel from Mexico net space to US net space. I'm not concerned about the VPN logging my traffic, I only need to be sure that they implement the protocol correctly. I'm looking at StrongVPN and PrivateTunnel, I'm open to suggestions for others. Once I get into US net space I feel like I'll be reasonably safe from interception, I'm counting on HTTPS to cover me from the VPN exit to the bank's servers.

SSH - Connect to a trusted computer here in the states and then browse from that. This might be the safest but I don't think I'll be able to have anytime-access to a computer here. Plus, if the computer or router goes down I'll have to rely on someone else to fix it, also a shaky possibility. Could I SSH into a VPS, or maybe use Tunnelr.com?

HTTPS - Rely on HTTPS only. I really don't want to do this. I think I understand how certificates work and about checking the certification chain and the warnings that browsers give when the cert appears to have changed. But I'd hate for HTTPS to be my only defense against interception.

Is there another option for connecting securely? What do you recommend?

Edit: I think I've answered my own question. I'm thinking I'll get a VPN, probably Tunnelr.com, that way all my traffic is protected. I know nothing about the networks I'll be connecting to when I'm in Mexico and I think a VPN is the best and simplest solution for my current needs.

Still, any feedback or comments are welcome. Thank you!

Answer 1

The only reason I would recommend tunneling HTTPS over VPN or SSH is if you (1) don't trust your banks implementation of SSL/TLS (weak cipher suites) and the network(s) your traffic is traversing or (2) you want to hide the destination(s) your browsing to up until the VPN/SSH exit point.

Provided HTTPS is implemented properly, it should be just as secure as VPN or SSH.

I would say compromise of your PC is more likely than compromise of data in transit due to a weakness in the bank's security.

Answer 2

The vulnerabilities of HTTPS are:

1. you or your browser ignores HTTPS warnings (e.g., this key is not signed by a CA or is for another website,
2. you go to the wrong site (e.g., you click a link to a site that has a properly signed certificate but is https://yourbank.malicioussite.com),
3. you are subject to a DNS or routing attack (e.g., you try going to the right site), but get redirected to a malicious server AND the attacker has either (a) fraudulently obtained yourbank.com's private SSL key, (b) obtained any trusted CA's private signing key, which they use to sign fraudulent certificates, or (c) managed to install bad certificates in your web browser somehow.

In your described scenario, all the VPN/SSH tunnel really buys you a little bit of extra anonymity to what websites you are connecting to. With regular old https they'll be able to see you are talking to server's controlled by yourbank.com (but not the full URLs), when you are connecting, and how much (encrypted) traffic is going back and forth.

A DNS or routing attack is presumably easier outside of the US, but still if you are going to https sites; they have to get you to trust their fake certificates somehow -- not an easy task (unless they've compromised your computer). If they've compromised your computer; you are kind of screwed anyways. (E.g., they can get login details/keys to your remote ssh server and mess with your tunnel).

Answer 3

As a slight aside, if you decide that you do want to use SSH, setting up a shell account on a server that e.g. isn't one that you have sitting in your house in the US, but is instead in a datacentre is really very cheap and easy; if you want to setup a VPS where you know that you have relatively strong control over the install (i.e. you have root on the box), you can get them fairly cheaply: have a scour through this site.

You can then tunnel all your data through this connection really easily!

Answer 4

It should be sufficient to stick to just SSL. I recommend you use Firefox plus HTTPS Everywhere; that will ensure you always use SSL on your bank's site, and will help prevent you from clicking through warnings.

I think the risk of client-side malware is a much higher risk than the risk that someone manages to intercept your traffic, despite your use of SSL. Therefore, I think it's not the best use of your time and energy and money to set up a VPN. Instead, if you're really worried and want to do something, I'd focus on preventing client-side malware from stealing your online banking credentials, such as booting from a LiveCD for your online banking.

But personally, I don't bother with even a LiveCD in my own personal banking. How come? Partly because I trust my system's security. But mostly because I called up my bank and asked them about this, and they told me that in the case of an unauthorized transaction on my online banking account, they'd eat the cost and reverse the unauthorized transactions. It turns out that my bank even puts this guarantee in writing in their terms and services. How awesome is that? Apparently, most other banks will do the same. The main hitch is that these protections apply only to personal banking accounts. They do not apply to business accounts. Therefore, if you are doing any banking for business out of a business account, you are high risk, and in that case I recommend using strong protections (boot from LiveCD, SSL, HTTPS Everywhere).