[LUG] Safely online banking using Linux, was Re: Banking trojan targeting Linux

[Martijn Grooten <dcglug@xxxxxxxxxxxxxxxxxx>]

When I posted this link, I did not intend to make people worry about 
online banking. I merely thought it was interesting to some and relevant 
to all on this list: while the PC malware threat for Linux is still 
extremely small compared to Windows and Mac, it's not non-existent.

Here is some advice on how to use online banking (as a non-business 
customer*) with Linux (all of this applies to other OS's as well):

1. Make sure your bank offers two-factor authentication and requires it 
before you can make transactions. If not, complain, switch banks, or don't 
use their online banking.

2. Always use a bookmark to go to the bank's website, or manually enter 
the address in the URL bar. Never click links in emails, or on other 
websites to go to an online banking system.

3. Make sure the address bar shows you're using HTTPS. If it doesn't, or 
if you get a warning about an invalid certificate, don't continue. Call 
the bank instead.

4. Some some kind of anti-virus. (ClamAV can be installed via the 
repositories of most distros.) As mentioned before, I'm not sure how well 
Linux desktop AV protects against the few threats that we're discussing 
here, but if something does go wrong your bank is likely to refund you. 
Being able to tell them you've been running anti-virus will make this 
process a little easier.

Instead of 4, you can also run a live CD, or a secure snapshot in a VM, 
but make sure you still follow 1-3.

* It is my understanding banks are less reluctant to give your money 
back if you're a business customer. I don't know the details.

Martijn.

--
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq