Windows unsafe for online banking? Shopping?

More and more experts are beginning to think that the best safe way to shop online or do online banking is to replace Windows with Linux.

By sjvn  14 comments

People, who like Linux, like yours truly, often harp on the fact that Linux is more secure than Windows. And, so it is, but most people still stick with Windows since that's what they know and like so many bad habits it's hard to break. That's especially true when the benefit, improved security, isn't seen as giving an immediate benefit. In the last few weeks, though, experts who aren't Linux fans, have been noticing that these days there are so many dangers with shopping or banking online while using Windows that they're now recommending people use Linux instead.

The most prominent example of this is The Washington Post's security columnist, Brian Krebs. Krebs recently recommended that after interviewing "dozens of victim companies that lost anywhere from $10,000 to $500,000 dollars because of a single malware infection," he's now recommending that, "commercial online banking customers consider accessing their accounts solely from non-Windows systems."

As Krebs points out, he's not the only one. The Financial Services Information Sharing and Analysis Center, an online financial-sector security forum recommends business users, ""carry out all online banking activity from a standalone, hardened, and locked-down computer from which e-mail and Web browsing is not possible."

Why businesses in particular? Because, as Krebs explains in another story, Businesses and consumers do not enjoy the same legal protections when banking online as consumers. Consumers typically have up to 60 days from the receipt of a monthly statement to dispute any unauthorized charges. … Commercial banking customers have roughly two business days to spot and dispute unauthorized activity if they want to hold out any hope of recovery."

In short, businesses not only have more to lose, they have less time to detect thief.

Meanwhile, in Australia, New South Wales police are recommending that people avoid Windows for financial transactions. At a public hearing on cyber-crime Detective Inspector Bruce van der Graaf from the Computer Crime Investigation Unit is reported to have said, "If you are using the internet for a commercial transaction, use a Linux boot up disk - such as Ubuntu) or some of the other flavours. Puppy Linux is a nice small distribution that boots up fairly quickly. It gives you an operating system which is perfectly clean and operates only in the memory of the computer and is a perfectly safe way of doing internet banking."

By now some of you are saying that I don't make those kinds of mistakes with Windows. I keep my Windows system as clean as the first snow. And, maybe you can, but as security writer, Michael Horowitz, said, "In my opinion, while it is possible to secure a Windows computer, the process is too hard, too time-consuming and/or technically over the head of most people." Therefore, unless you're an expert who puts the time in to keep your PC safe, he recommends that you should "consider instead, Macs and Linux, my preference being Linux" for your online finances.

Get the point? It's not safe else there on the big nasty Internet for your Windows PC. Windows 7 is filled with improvements, but security isn't among them. As several of these people point out, it's not like you have to give up Windows. You can use live Linux CDs for when you need to go shopping on Amazon or the like, and then return to your comfortable, but not especially safe, Windows.

14 comments

    Anonymous 2 years ago
    No burning of the ISO to CD needed.https://shipit.ubuntu.com/Requesting an Ubuntu CDUbuntu is available free of charge and we can send you a CD of the latest version (9.10 (Karmic Koala)) with no extra cost, but the delivery may take up to ten weeks, so you should consider downloading the CD image if you have a fast Internet connection.
    Anonymous 2 years ago
    A small number of firms and people will take this advise, but the majority will not. Windows has been the storage device for trojans, viruses, and BSODs for years and people still upgrade, use, and become new Windows users everyday.
    Face it most computer users and many IT managers are clueless and primarily computer illiterate. They will continue to listen to the media blitz and the OEMs who bet the farm on Microsoft.
    Anonymous 2 years ago
    I fully agree that Windows is terrible in terms of safety and for things like banking it should be avoided at any costs.The more terrible thing is that all Chinese banks (including world's largest bank in many aspects) actually require their customers to use Windows in order to bank online. If you use Linux or Mac, it doesn't work on their sites. I communicated with them in that they at least shouldn't forbid Linux/Mac users. And the answer is that on Windows you install some required ActiveX pieces and it is perfectly safe on Windows and so they are not supporting Linux or Mac. I don't know how more to say to them.
    Anonymous 2 years ago
    I've been trying to get my father-in-law to do everything on Linux for a couple years now. He does taxes (lic. CPA) and needs his XP machine, but doesn't want to hear anything about Linux. My point is, I'm not sure if everyday users really care about security.... until it happens to them of course! Any suggestions on how to go about getting my father-in-law to use Linux as his main OS and ONLY go to XP for taxes? I've rattled my mind over this and when I've tried to show him, he get's angry and storms off. Great article by the way, I have emailed it to my in-laws!
    Anonymous 2 years ago
    The EU has enacted laws dictating how connections to banks can be made and under what conditions must be met to connect. Europeans are given a key fob (USB) that must be used along with a strong password to even try a connection to their banks. Without key fob you are SOL to try any connections. The fob provides a secure connection along with other information to enable the connection. In the good ole USA we will never get these types of protections because banking industry and the government consider the citizens are nothing more then dump sheep with no intelligence.Linux will never get on many desktops until they get some kind of standerization. Sure Linux many be more secure because of all its different distros but these same distros also make have a standard install for software a lot more difficult let alone a standard desktop. Linux has the same problem Unix has, to many damn versions with no standards and dont get me started about hardware drivers. Linux will not replace Windows until some standards are written and enforced. Unix never did drive the stake through the heard of mainframes and Linux has the same problem with Windows.Before you Linux fanboys go ballistic with me understand I use Linux, Windows, OSx and Solaris.
    Anonymous 2 years ago
    Sounds like a job for Wubi.Banks cannot reasonably expect users to install a GNU/Linux distro in order to use their services.What they can do is insist that users install a bank supplied application that will give them a secure environment to boot to for conducting their banking transactions.This application can use Wubi to install a small Bank customised GNU/Linux system.
    mburton325
    mburton325 2 years ago
    "People, who like Linux, like yours truly, often harp on the fact that Linux is more secure than Windows."Linux is not more secure it is not attack as often due to the low percentage of users both home and corporate that use it on the desk top. Do Not make statements that can't be backed up. As my Linux instructor points out at the beginning of the quarter. The Linux Kernal is open source there-fore anyone can search through it for attack vectors. IF Linux were to actually become a main stream desktop the attacks would increase and due to the open source nature would become the most vunerable OS on the market. You logic rather than fanboy dreams it works better and you don't look quite as ignorant with these columns.
    Anonymous 2 years ago
    I.e., to burn a bootable UBUNTU image that can't be hacked in any meaningful way... Granted, I'm also going to want access to a folder of links to my online accounts, and another folder of transaction documentation, but those can be secured (encoded, etc) comparatively easily (HERE would be a good place for additional 'editorial' info, assistance, suggestions, etc re Linux options).Whereas booting from a USB stick secures nothing (unless the several 'proper names' referenced in the comment above are talking about USB securing utilities of some type) AND provides an accessible niche for opportunistic exploits...
    Anonymous 2 years ago
    "carry out all online banking activity from a standalone, hardened, and locked-down computer from which e-mail and Web browsing is not possible."How can you do online banking from a computer where web-browsing is not possible? Surely I can't be doing online banking using ftp?
    Anonymous 2 years ago
    I think businesses should begin to consider Linux on the desktop as a viable option. Linux is already used by many businesses and government offices. Many businesses are reluctant to migrate, however they should make the attempt as it's mature enough to handle just about everything.http://members.apex-internet.com/sa/windowslinux
    Anonymous 2 years ago
    I thought this was a SECURITY column, not a Linux column.
    Anonymous 2 years ago
    "Experts" coming up with the same conclusion I came up with 15 years ago?
    Anonymous 2 years ago
    Puppy Linux has zilch security, other than low attack time of being a Live OS and no open ports so firewalls are useless, as the regular Puppy Linux only has the root user available.AntiX is a good choice, Tiny Core if you know what your doing.Mandriva LiveCD's.Ubuntu then PCLinuxOS and its lighter derivatives, but these only work with open drives off LiveCD so be aware.Then if you have the hardware a Sabayon LiveDVD is quite nice and easy.
    Anonymous 2 years ago
    Put a full (but smaller) Linux distribution on a USB key, then boot from it (I am currently using AntiX, based on Mepis). That way, it is easy to keep it up-to-date and more functional, with additional software of your choice.So, shutdown your computer, plug in the USB key, on bootup push the boot menu key (usually F12 on Dell machines), select boot from USB, and enjoy!--AA

      Add a comment

      Post a comment using one of these accounts
      Or join now
      At least 6 characters

      Note: Comment will appear soon after you have activated your account.
      Obscene/spam comments will be removed and accounts suspended.
      The information you submit is subject to our Privacy Policy and Terms of Service.

      ITworld LIVE

      SecurityWhite Papers & Webcasts

      White Paper

      A Proactive Approach to Server Security

      Learn why security-conscious organizations are taking a more proactive approach to server security. Download this Spire Research whitepaper to understand how you can eliminate the threat caused by today's more advanced threats and protect your organization's most valuable data.

      White Paper

      Protection Against Modern Cybersecurity Threats

      Download this case study to learn how this accounting and consulting giant uses Bit9's adaptive application whitelisting to offer employees flexibility without jeopardizing enterprise safety.

      White Paper

      Stop Hackers Before They Attack

      Hacktivism, Identify Theft, Financial Gain, Cyber War - regardless of motivation, stopping today's hackers requires a new proactive approach to protecting endpoints. Learn how this New England hospital, breached multiple times by targeted attacks, put an end to the malware with Bit9 Parity. Their IT team can now identify malware and secure PCs and workstations -protecting patient care and privacy.

      White Paper

      From the Frontline - Preventing APT

      Is your company's network secure? Are your endpoints and servers secured? Before you answer, read this case study on a US Military Command that discovered no matter how much you educate users, hackers can get through traditional defenses. This targeted attack blew through all layers of their security, except one: Bit9 Parity's advanced threat protection.

      White Paper

      Protecting Point of Sale Systems from Targeted Attack

      If you are responsible for protecting retail systems, download this case study to learn how this retailer eliminated the threat of malware on their POS systems using Bit9's award winning solutions.

      See more White Papers | Webcasts

      Ask a question

      Ask a Question