What is the safest technical setup for online banking ?

Sarahspangles

booneruk said:

I guess the OPs question "What is the safest technical setup" can be interpreted absolutely (hand installed Linux distros, dedicated uncontended internet connection, concrete bunkers etc) and also practically - "what is the safest practical technical setup".

My Dad isn't going to want to mess about with Linux installs, finding obscure drivers, messing with the command line to get his eth0 nic working and dealing with kernel updates. He can, however, go buy an Android 14 phone and have immediate trust in that, the app store and the bank app he downloads - plus it will be supported and updated painlessly for years.

Absolutely, for most people the main questions are ‘Do I know where my wallet and phone are?” and “Have I checked my statement recently?”

danco

I am concerned about having two phone numbers if I follow the interesting advice about keeping one at home. It's not only banks that send 2FA codes by text messages. For instance, my NHS login requires a code, as does the regular security check on my email account. Some sites will allow more than one phone number but many won't.

Also, there is a cost in having a second phone number (in addition to the cost of the phone itself). One should pay for security, but I wonder what's the best way to go. Especially as some checks require sending a YES/NO message to a short number, and it seems many cheap providers don't allow that.

Emily_Joy

Monanore said:

All very interesting again.

My conclusion so far - a mobile with banking app kept at home !!!

Better a tablet - larger screen. Mobile screens has negative effect on eyesight.

Emily_Joy

booneruk said:

My Dad isn't going to want to mess about with Linux installs, finding obscure drivers, messing with the command line to get his eth0 nic working and dealing with kernel updates. He can, however, go buy an Android 14 phone and have immediate trust in that, the app store and the bank app he downloads - plus it will be supported and updated painlessly for years.

Installing linux nowadays is completely painless and everything you named works just out of the box. My Dad hates mobile phones (he even keeps his switched off 90% of the time) but pretty comfortable with his linux desktop.

booneruk

Emily_Joy said:

booneruk said:

My Dad isn't going to want to mess about with Linux installs, finding obscure drivers, messing with the command line to get his eth0 nic working and dealing with kernel updates. He can, however, go buy an Android 14 phone and have immediate trust in that, the app store and the bank app he downloads - plus it will be supported and updated painlessly for years.

Installing linux nowadays is completely painless and everything you named works just out of the box. My Dad hates mobile phones (he even keeps his switched off 90% of the time) but pretty comfortable with his linux desktop.

I'll be setting up Linux on a mini PC I've bought (Black Friday hysteria) on Sunday, so I'll see.

However, I'm not as confident as you are with that statement. Here's plenty of Linux wifi driver issues from the last month: 

https://www.google.com/search?q=reddit+can't+find+driver+for+wifi+linux&sca_esv=31e82a7279b06800&sxsrf=ADLYWIK8FA9NrH0VBPmsztM4e-hWsWNRbA:1732881722654&source=lnt&tbs=qdr:m&sa=X&ved=2ahUKEwjIw5C8v4GKAxX9hv0HHfxWPFwQpwV6BAgHEAo&biw=2327&bih=1161&dpr=1.1

"just out of the box" ?! Having drilled into a few of those issues and suggested fixes it looks less than simple. My Dad would struggle indeed.

Get an Android 14 phone. It will work out of the box. It will be secure. It will be supported for years (and as many will know, it's Linux underneath!)

Ergates

GeoffTF said:

friolento said:

GeoffTF said:

born_again said:

GeoffTF said:

Monanore s

A mobile away from home is clearly more at risk than a dedicated PC securely locked away at home, particularly if it does not have security updates.

Why is it?
Excluding using public WiFi.

Your using a mobile signal which is exactly the same no matter where you are.

VPN. Who's to say that the supplier is not filtering info.

Your phone can be snatched. It is easily accessed if it unlocked, and given the right resources could be accessed if it is not. If you use the same device for receiving security codes, you do not have proper 2FA. Most phones do not get security updates for long. Mobile phones are less prone to malware than Windows, but are not immune. A highly secure PC that is only used for online banking should be malware proof. The only ways in will be the original OS download and updates. They should be free of nasties, but there is no absolute guarantee. I have already mentioned immutable Linux. Another approach is to install Linux in a micro SD card and boot from that card only when using online banking. A micro SD card can be easily hidden. That is likely to be more secure than storing your PC in a safe.

WiFi should not be an issue, because your communications with the bank are encrypted.

No wonder non-IT people think online banking is way to complicated and difficult.

We have been asked what is the safest technical set up, and I have offered an answer. Security and convenience do not go together. If you want the ultimate in security, it is not going to be convenient. It is a mistake to kid oneself otherwise. It is much more common for people to give their money to scammers than it is for their phones to be hacked or for them to be forced to give access to their banking apps at knife point. Nonetheless, that is not what we have been asked.

Any additional security offered by the additional efforts of jumping through all those hoops is entirely illusory because it doesn't address the weakest link in the chain - you. 

It's a significant amount of additional cost, effort and inconvenience that makes no measurable difference to the risk of your money being stolen.

It's fitting steel shutters to all your windows, so you can't open them any more and they don't let in as much light, then leaving the front door unlocked and wide open.

Moreover, the false sense of security it offers can actually lead to people becoming more vulnerable to the real threat.

Rob5342

Monanore said:

All very interesting again.

My conclusion so far - a mobile with banking app kept at home !!!

It depends what you want to guard against. If it's a mobile left at home then it will take a lot longer for you to notice fraudulent transactions, and if you are out shopping or away on holiday it makes budgeting a lot more difficult as you can't use the app to check the current balance. There's also the risk of someone breaking into your house and stealing your phone which you'd have to weigh up against the risk of someone getting hold of your phone while you are out. As others have mentioned then there is always the risk that someone could scam you into paying them.

I have my savings in an account that only allows withdrawals to my current account. My current account is with Monzo and I have it set up so i need a fingerprint to open the app, an independent pin to authorise a payment and so that payments over £300 can only be made when my phone is at my home address. Of course that setuo isnt foolproof but I think it strikes the right balance.

Everyone I know uses online banking, I know two people that lost money to scams but in both cases that was due to someone phoning up pretending to be from their bank. They were very convincing by the sound of it, doing it with multiple phone calls over a few days. These were people that were pretty clued up on the way estate agents etc lie. 

GeoffTF

booneruk said:
My Dad isn't going to want to mess about with Linux installs, finding obscure drivers, messing with the command line to get his eth0 nic working and dealing with kernel updates. He can, however, go buy an Android 14 phone and have immediate trust in that, the app store and the bank app he downloads - plus it will be supported and updated painlessly for years.

You do not have to nowadays. An immutable Linux distro will not let you change anything anyway. That is the whole point of it. Neither you nor any malware can change what it does "out of the box". The only real hurdle to using Linux is installing it in the first place, on a suitable machine.

sausage_time

A Chromebook would be another option for a banking portal.

PRAISETHESUN

GeoffTF said:

booneruk said:
My Dad isn't going to want to mess about with Linux installs, finding obscure drivers, messing with the command line to get his eth0 nic working and dealing with kernel updates. He can, however, go buy an Android 14 phone and have immediate trust in that, the app store and the bank app he downloads - plus it will be supported and updated painlessly for years.

You do not have to nowadays. An immutable Linux distro will not let you change anything anyway. That is the whole point of it. Neither you nor any malware can change what it does "out of the box". The only real hurdle to using Linux is installing it in the first place, on a suitable machine.

For your average person who has only ever used Windows/Apple/smartphones, telling them to "just install Linux" is going to sound quite intimidating and is likely to put them off. As others have said the weakest link in the chain is the human element, and throwing an unfamiliar operating system into the mix on top of that is only going to be a recipe for disaster. I do appreciate where you're coming from though, and it's a good suggestion for the right person, but not as a general recommendation for everyone.