My bank uses a security system based on a card reader for online banking. The card is the same as used for ATMs and payment in shops. There are several known attacks on this system, for example as descibed here and here.
I do not have detailed information regarding the readers used by my bank. What I know is:
- They can be operated with or without USB cable.
- The readers are interchangeable, i.e., contain no personalized information associated with my account.
My question is, what I can do to minimize the risk of fraud. My thoughts so far are:
- Use Tor for any interaction with the bank website.
- Use a Linux installation in a VirtualBox (or other VM), used only for online banking. However, as far as I understand, this would not protect me from key-loggers on my host PC. It is also unclear to me how big the danger due to key-loggers is with a card reader, since the PIN is entered on the reader, not on the PC.
- When used with USB connection, a driver on the host PC needs to be used (available only for Windows, so this is actually not an option, also due to the implied decrease of security). On the other hand, as far as I understand the USB connection could be used to get increased security, by displaying transaction-specific information on the card reader, which the user has to confirm. But as I understand from the papers linked above, this is often not properly implemented, so I don't know if the un-connected mode would actually be more secure?
- The same cards are used for online banking and for ATM and payment terminals. Thus, it seems that losing the PIN and the information on the chip of the card (through skimming and/or being observed when entering the PIN) will automatically also give attackers access to online banking. Since both my wife and me have a card for the same account, does it make sense to (as far as possible) use one of the cards as the "online banking card" and the other one as an "ATM card"? Would that substantially decrease the risk, or am I overlooking something?
Could you clear up my understanding of the points I described, as well as provide further insight?