Question for users accessing financial sites from Linux/Macs

Questions on how we spend our money and our time - consumer goods and services, home and vehicle, leisure and recreational activities
Post Reply
investomajic
Posts: 140
Joined: Tue Aug 03, 2010 8:01 pm

Question for users accessing financial sites from Linux/Macs

Post by investomajic » Sat May 05, 2012 1:48 pm

So I just got my new laptop (Windows 7) and, being the paranoid type, setup a non-persistent hard disk virtual machine (data gets erased at each shutdown/restart) to access financial websites.
My virtual machine is running Linux (Ubuntu 12.04).

If you read the "Your responsibilities" section for securing your computer on the Vanguard site, it states:
"Make certain that any computer you use to access Vanguard.com has up-to-date security and anti-spyware, antivirus, and firewall software."

(Link here: https://personal.vanguard.com/us/help/S ... ontent.jsp)

I'm still fairly new to Linux. My understanding is most Linux/Mac users do not run Anti-Virus software. My question is, is this a concern to you if you have a Vanguard account? Have you obtained anti-virus software for your Linux/Mac? Which one(s)?

My Linux machine is hosted inside my Windows machine, which IS protected by anti-virus and a very strict software firewall so I should be OK, but this lead me to ask.

User avatar
Jake46
Posts: 748
Joined: Tue Feb 20, 2007 10:16 am
Location: Fort Collins, Colorado

Re: Question for users accessing financial sites from Linux/

Post by Jake46 » Sat May 05, 2012 1:58 pm

I use Virus Barrier on my Macs.

http://www.intego.com/virusbarrier

User avatar
tetractys
Posts: 4596
Joined: Sat Mar 17, 2007 3:30 pm
Location: Along the Salish Sea

Re: Question for users accessing financial sites from Linux/

Post by tetractys » Sat May 05, 2012 3:54 pm

I'm on Mac OS. I don't go to questionable sites or download questionable email. I do not have virus software for 3 reasons: For prudent users the protection is superfluous; virus software providers have a vested interest in virus proliferation and customer fear; the software itself is an intrusive virus to both the system and the user.

Virus software = endless headaches, computer problems, and yes, virus attacks. (I would not even visit a virus companies web site--no way underwear!) Have never had a virus or the ensuing system problems since ridding myself of virus software 10 years ago.

So unless your a user who visits porn sites, clicks ads, and opens spam, virus software is a negative. Enterprise systems do need it, I believe, because of the open nature of enterprise. Single users only have to be concerned with themselves. -- Tet

investomajic
Posts: 140
Joined: Tue Aug 03, 2010 8:01 pm

Re: Question for users accessing financial sites from Linux/

Post by investomajic » Sat May 05, 2012 4:15 pm

Jake46 wrote:I use Virus Barrier on my Macs.

http://www.intego.com/virusbarrier
Excellent thanks! This will come in handy when I receive my first Mac (a hand me down from a relative who is upgrading) in a few months)

investor1
Posts: 1040
Joined: Thu Mar 15, 2012 8:15 pm

Re: Question for users accessing financial sites from Linux/

Post by investor1 » Sat May 05, 2012 4:18 pm

I run Ubuntu.

Most viruses nowadays are written as Java or Adobe/Flash exploits. These are (for the most part) OS independent. Other than those, most of viruses are writen for Windows and don't run on Linux. Google "rootkits" if you want to read more about Linux viruses.

To protect yourself on Linux:
1. Disable scripts in your web browser or only allow trusted sites. Your browser should have settings which you can control. A quick google will tell you what you need to know. NoScript works well if you use Firefox.
2. Disbale Flash in your web browser or only allow trusted sites. Your browser should have settings which you can control. A quick google will tell you what you need to know. Flashblock works well if you use Firefox.
3. Keep Adobe Reader up to date. They send out security updates frequently. Another option is not to use Adobe Reader at all. Just use something else to view PDFs.
4. Enable your Firewall. Ubuntu ships with UFW (Uncomplicated Firewall). The setup is easy. Start here: https://wiki.ubuntu.com/UncomplicatedFirewall. Be sure to set it up so everything is blocked by default, then enable what you want.
5. Enable your router's firewall. Google the security settings for your firewall and beef up your security. Again, disable access by default and enable whatever you want to use.
6. Scan for rootkits every so often. Rootkit Remover works well. Don't install it on the Linux machine since any good rootkit will look for it and either get rid of it or reconfigure it so it won't be of much use. A Linux Live CD comes in handy here.
7. Encrypt your data. Ubuntu allows you to encrypt your home directory (which is where most people store their documents, etc.) easily. Take advantage of that.
8. Change your passwords at least a few times each year. Don't use the same password for everything.
9. Some sites allow you to see the IP addresses/login times which you account is used from. Check info from time to time. Some sites have a setting to email you if your account is accessed from an unknown IP.
10. If you are still worried, run an anti-virus program. AVG works well and is free.

See here: https://wiki.ubuntu.com/Security/Features for more info.

Your VM setup seems helpful from a security perspective (also, you're a nut!).

investomajic
Posts: 140
Joined: Tue Aug 03, 2010 8:01 pm

Re: Question for users accessing financial sites from Linux/

Post by investomajic » Sat May 05, 2012 4:19 pm

tetractys wrote:I'm on Mac OS. I don't go to questionable sites or download questionable email. I do not have virus software for 3 reasons: For prudent users the protection is superfluous; virus software providers have a vested interest in virus proliferation and customer fear; the software itself is an intrusive virus to both the system and the user.

Virus software = endless headaches, computer problems, and yes, virus attacks. (I would not even visit a virus companies web site--no way underwear!) Have never had a virus or the ensuing system problems since ridding myself of virus software 10 years ago.

So unless your a user who visits porn sites, clicks ads, and opens spam, virus software is a negative. Enterprise systems do need it, I believe, because of the open nature of enterprise. Single users only have to be concerned with themselves. -- Tet
I don't visit [the obvious] questionable sites either. But, in my opinion, every site is questionable. With every site you visit, you are completely dependent upon the fact that they themselves haven't been hacked ; not to mention the numerous XSS, browser and browser plug-in exploits found and abused over the years.

I agree that staying away from the obvious questionable sites and not viewing unsolicited email will prevent most of the issues, but it is far from complete protection.

More to the point, if your Vanguard account was ever hacked (low probability, I know), do you feel confident enough that Vanguard will fix your issue given that you haven't met their requirements?

investomajic
Posts: 140
Joined: Tue Aug 03, 2010 8:01 pm

Re: Question for users accessing financial sites from Linux/

Post by investomajic » Sat May 05, 2012 4:24 pm

investor1 wrote:I run Ubuntu.

Most viruses nowadays are written as Java or Adobe/Flash exploits. These are (for the most part) OS independent. Other than those, most of viruses are writen for Windows and don't run on Linux. Google "rootkits" if you want to read more about Linux viruses.

To protect yourself on Linux:
1. Disable scripts in your web browser or only allow trusted sites. Your browser should have settings which you can control. A quick google will tell you what you need to know. NoScript works well if you use Firefox.
2. Disbale Flash in your web browser or only allow trusted sites. Your browser should have settings which you can control. A quick google will tell you what you need to know. Flashblock works well if you use Firefox.
3. Keep Adobe Reader up to date. They send out security updates frequently. Another option is not to use Adobe Reader at all. Just use something else to view PDFs.
4. Enable your Firewall. Ubuntu ships with UFW (Uncomplicated Firewall). The setup is easy. Start here: https://wiki.ubuntu.com/UncomplicatedFirewall. Be sure to set it up so everything is blocked by default, then enable what you want.
5. Enable your router's firewall. Google the security settings for your firewall and beef up your security. Again, disable access by default and enable whatever you want to use.
6. Scan for rootkits every so often. Rootkit Remover works well. Don't install it on the Linux machine since any good rootkit will look for it and either get rid of it or reconfigure it so it won't be of much use. A Linux Live CD comes in handy here.
7. Encrypt your data. Ubuntu allows you to encrypt your home directory (which is where most people store their documents, etc.) easily. Take advantage of that.
8. Change your passwords at least a few times each year. Don't use the same password for everything.
9. Some sites allow you to see the IP addresses/login times which you account is used from. Check info from time to time. Some sites have a setting to email you if your account is accessed from an unknown IP.
10. If you are still worried, run an anti-virus program. AVG works well and is free.

See here: https://wiki.ubuntu.com/Security/Features for more info.
This is a really helpful list, thanks!
(also, you're a nut!).
LOL, I can't argue with that. I actually enjoy setting up virtual machine's anyways ... I have about 8 different ones for various things. I use them all the time (have for years).

b4nash
Posts: 121
Joined: Wed Apr 11, 2012 11:20 am

Re: Question for users accessing financial sites from Linux/

Post by b4nash » Sat May 05, 2012 5:03 pm

I'm on a Mac too. I use Flashblock on Safari and never installed Adobe Reader. Occasionally, I'll run a scan with Sophos Antivirus to make sure I'm clean (and not a carrier for Windows viruses).

http://www.sophos.com/en-us/products/fr ... ition.aspx

Mudpuppy
Posts: 5889
Joined: Sat Aug 27, 2011 2:26 am
Location: Sunny California

Re: Question for users accessing financial sites from Linux/

Post by Mudpuppy » Sat May 05, 2012 9:05 pm

If you practice logical separation by having a dedicated virtual machine for one task, the need for anti-virus software is minimal (unless that specific task is randomly browsing the web or opening every email that comes your way). So if your virtual machine is just used for financial sites and you have it set to non-persistent mode, there is very little risk and very little need for anti-virus software.

Vanguard's little spiel just means "if your login is compromised because you downloaded a virus or malware like Zeus, it's your responsibility, not ours. Prevent such by taking standard security precautions." Your approach may not be a common security precaution, but it is just as sound as layering on anti-virus and anti-malware software then hoping that the machine doesn't get blasted because you clicked on the wrong link or attachment (I'd even argue that a non-persistent virtual machine is a better security precaution than trusting software to protect you, but that's a topic for another thread).

User avatar
tetractys
Posts: 4596
Joined: Sat Mar 17, 2007 3:30 pm
Location: Along the Salish Sea

Re: Question for users accessing financial sites from Linux/

Post by tetractys » Sat May 05, 2012 9:57 pm

investomajic wrote:More to the point, if your Vanguard account was ever hacked (low probability, I know), do you feel confident enough that Vanguard will fix your issue given that you haven't met their requirements?
I have no reason to believe the text box saying, "Use antivirus software and keep it updated," is stipulating a requirement. Do you?

I would expect Vanguard to fix their own issues. It doesn't seem prudent to me to expect Vanguard to fix personal customer issues, whatever those might be. -- Tet

Tabulator
Posts: 265
Joined: Sat Mar 31, 2012 4:03 pm

Re: Question for users accessing financial sites from Linux/

Post by Tabulator » Sat May 05, 2012 10:07 pm

I thought I was doing enough by
  • running Ubuntu LTS and installing updates every week,
  • using the Chrome browser and relying on its security, and
  • having a different password for every site.
I don't even understand some of the techniques being mentioned in this thread but it sounds like I might not be doing nearly enough.

Warp3
Posts: 2
Joined: Sat May 05, 2012 10:44 pm

Re: Question for users accessing financial sites from Linux/

Post by Warp3 » Sat May 05, 2012 11:04 pm

Like the OP, I do virtually all my browsing in a Linux VM now (recently I've been using Lubuntu as my browsing OS since it has less overhead than the standard Ubuntu versions including Xubuntu). However, mine is a persistent install but that doesn't worry much very much really. Very few exploits out there can even infect a Linux install (yes there are some, but not very many). In fact without something like Wine installed (which isn't preloaded in any Linux distro I've seen yet), most of them can't even run since they are almost always based on Windows executables not Linux executables. Yes many use Java/Flash exploits and those exploits work on multiple platforms. However the exploit is often only used to download and launch the malware in the first place. Unless this malware is also written to be cross-platform (and almost none of it is) then the exploit accomplished nothing.

Honestly, if you are using a Linux VM *and* a non-persistent environment I can't see you having much chance of an issue, especially if you reboot the VM before visiting any important sites (e.g. financial sites).

One extra thing I have done lately (which was actually to minimize annoyance more so than for security, though it does improve security as well) is to enable the function in Opera to only load plug-ins on demand. Thus if you are on a page with a flash object, it won't even load the flash object unless you click on it (until that point, it simply appears as a big play icon). (The reason I actually did this is because too many news sites love to include auto-play videos in their articles and having several tabs open each trying to play a video can wreak havoc on even a fast machine.) I use Opera for the vast majority of my surfing though I've started using Chromium instead for financial sites lately (even though nearly all the financial sites I've used seem to work fine with Opera as well).

User avatar
GregLee
Posts: 1748
Joined: Wed Oct 27, 2010 3:54 pm
Location: Waimanalo, HI

Re: Question for users accessing financial sites from Linux/

Post by GregLee » Sun May 06, 2012 3:19 am

investomajic wrote:My Linux machine is hosted inside my Windows machine, which IS protected by anti-virus and a very strict software firewall so I should be OK, but this lead me to ask.
I don't see how the Windows system could protect you when you're running Linux inside Windows, but I also don't see why you'd need any protection. I've been running Linux since the early 90s without any security problem at home. I'm also using Ubuntu 12.04 now, but nakedly. (I did catch a little case of rootkit in Linux once at work, about 10 years ago.)
Greg, retired 8/10.

Bongleur
Posts: 2066
Joined: Fri Dec 03, 2010 10:36 am

Re: Question for users accessing financial sites from Linux/

Post by Bongleur » Sun May 06, 2012 4:08 am

Use Software Update frequently. Apple uses that to give you the latest security items.
Seeking Iso-Elasticity. | Tax Loss Harvesting is an Asset Class. | A well-planned presentation creates a sense of urgency. If the prospect fails to act now, he will risk a loss of some sort.

asdfvcx
Posts: 20
Joined: Sun Mar 18, 2007 6:15 pm

Re: Question for users accessing financial sites from Linux/

Post by asdfvcx » Sun May 06, 2012 6:43 am

The main problem I see with the OP's idea is that if the disk is non-persistent, you likely aren't getting security updates.

Say there was a problem with the SSL encryption in your browser that exposed your encrypted communication to an attack and the problem was fixed in a security update. By using the unpatched browser you could be opening yourself up to attack.


I fully admit the risk of this is extremely low. And if there ever was a problem with something as vital as SSL, there would probably be a lot of media attention paid to it.

So it's likely not much of a risk, but something to consider.

Surgiconomy
Posts: 1
Joined: Sun May 06, 2012 6:52 am

Re: Question for users accessing financial sites from Linux/

Post by Surgiconomy » Sun May 06, 2012 6:54 am

I don't worry about it at all. Don't do anything.

investomajic
Posts: 140
Joined: Tue Aug 03, 2010 8:01 pm

Re: Question for users accessing financial sites from Linux/

Post by investomajic » Sun May 06, 2012 9:38 am

tetractys wrote:
investomajic wrote:More to the point, if your Vanguard account was ever hacked (low probability, I know), do you feel confident enough that Vanguard will fix your issue given that you haven't met their requirements?
I have no reason to believe the text box saying, "Use antivirus software and keep it updated," is stipulating a requirement. Do you?

I would expect Vanguard to fix their own issues. It doesn't seem prudent to me to expect Vanguard to fix personal customer issues, whatever those might be. -- Tet
I think we are coming from two different perspectives here. If Vanguard's entire site was hacked and, as a result, multiple user accounts were accessed fraudulently, then yes, I do believe this is Vanguard's problem and I, also, would expect them to fix their own issues.

My perspective is different. If my system is hacked, my username/password are stolen, and I found fraudulent activity on my account, this is where I believe having anti-virus is a requirement, at least as indicated here (I'm sure something similar is included in something we all signed (or electronically agreed to) to access our accounts online):
https://personal.vanguard.com/us/help/S ... ontent.jsp
Our commitment regarding online security is simple. If assets are taken from your account in an unauthorized online transaction on Vanguard.com®—and you've followed the steps described in the Your responsibilities section below—we will reimburse the assets taken from your account in the unauthorized transaction.
At a minimum, in order for this protection to apply, you must take the following steps:
The anti-virus protection is one of the "steps".
Make certain that any computer you use to access Vanguard.com has up-to-date security and anti-spyware, antivirus, and firewall software.

investomajic
Posts: 140
Joined: Tue Aug 03, 2010 8:01 pm

Re: Question for users accessing financial sites from Linux/

Post by investomajic » Sun May 06, 2012 9:41 am

asdfvcx wrote:The main problem I see with the OP's idea is that if the disk is non-persistent, you likely aren't getting security updates.
Security updates are applied, but since my disk is "non-persistent" I have to go about it in a different way.
What I do is keep a "Base - Security Updates Only" VM (for each OS), make it a persistent disk VM, complete my security updates on it, then redistribute the virtual disk to all of my non-persistent VM's.

investomajic
Posts: 140
Joined: Tue Aug 03, 2010 8:01 pm

Re: Question for users accessing financial sites from Linux/

Post by investomajic » Sun May 06, 2012 9:53 am

GregLee wrote:
investomajic wrote:My Linux machine is hosted inside my Windows machine, which IS protected by anti-virus and a very strict software firewall so I should be OK, but this lead me to ask.
I don't see how the Windows system could protect you when you're running Linux inside Windows, but I also don't see why you'd need any protection. I've been running Linux since the early 90s without any security problem at home. I'm also using Ubuntu 12.04 now, but nakedly. (I did catch a little case of rootkit in Linux once at work, about 10 years ago.)
You are correct, my windows machine can't protect me. What I meant to convey was that I at least can show Vanguard that my physical computer (not virtual) has anti-virus and a strong firewall and therefore satisfies their requirement (even though my virtual doesn't).

User avatar
Epsilon Delta
Posts: 7430
Joined: Thu Apr 28, 2011 7:00 pm

Re: Question for users accessing financial sites from Linux/

Post by Epsilon Delta » Sun May 06, 2012 10:25 am

Mudpuppy wrote: So if your virtual machine is just used for financial sites and you have it set to non-persistent mode, there is very little risk and very little need for anti-virus software.
GregLee wrote:
investomajic wrote:My Linux machine is hosted inside my Windows machine, which IS protected by anti-virus and a very strict software firewall so I should be OK, but this lead me to ask.
I don't see how the Windows system could protect you when you're running Linux inside Windows, but I also don't see why you'd need any protection. I've been running Linux since the early 90s without any security problem at home. I'm also using Ubuntu 12.04 now, but nakedly. (I did catch a little case of rootkit in Linux once at work, about 10 years ago.)
Mudpuppy and GregLee are making a common mistake. A virtual machine protects the host from anything that happens in the VM, a VM is not protected from things that happen to the host. A VM trusts the host O/S just as the host trusts the hardware.

As an example, suppose there is a malicious key and screen logger in the host. Then the VM does not help because the virtual screen and key board for the VM are provided by the compromised host.

You should not use VM just for accessing high value sites. The best practice is to use a VM for everything, particularly for accessing questionable sites. Before you access a high value site you should shutdown any running VM, which eliminates any malware picked up in those browsing session. You then start a clean VM to access the high value site.

User avatar
tetractys
Posts: 4596
Joined: Sat Mar 17, 2007 3:30 pm
Location: Along the Salish Sea

Re: Question for users accessing financial sites from Linux/

Post by tetractys » Sun May 06, 2012 12:06 pm

investomajic wrote:
tetractys wrote:
investomajic wrote:More to the point, if your Vanguard account was ever hacked (low probability, I know), do you feel confident enough that Vanguard will fix your issue given that you haven't met their requirements?
I have no reason to believe the text box saying, "Use antivirus software and keep it updated," is stipulating a requirement. Do you?

I would expect Vanguard to fix their own issues. It doesn't seem prudent to me to expect Vanguard to fix personal customer issues, whatever those might be. -- Tet
I think we are coming from two different perspectives here. If Vanguard's entire site was hacked and, as a result, multiple user accounts were accessed fraudulently, then yes, I do believe this is Vanguard's problem and I, also, would expect them to fix their own issues.

My perspective is different. If my system is hacked, my username/password are stolen, and I found fraudulent activity on my account, this is where I believe having anti-virus is a requirement, at least as indicated here (I'm sure something similar is included in something we all signed (or electronically agreed to) to access our accounts online):
https://personal.vanguard.com/us/help/S ... ontent.jsp
Our commitment regarding online security is simple. If assets are taken from your account in an unauthorized online transaction on Vanguard.com®—and you've followed the steps described in the Your responsibilities section below—we will reimburse the assets taken from your account in the unauthorized transaction.
At a minimum, in order for this protection to apply, you must take the following steps:
The anti-virus protection is one of the "steps".
Make certain that any computer you use to access Vanguard.com has up-to-date security and anti-spyware, antivirus, and firewall software.
As far as software is concerned, keeping your system updated fulfills the so called requirements. Certainly users are not required to implement 3rd party software. In all it's verbosity, Vanguard is saying it is not responsible for any security breaches that originate with you or your computer. In other words depending on Vanguard's position, it may or may not take an interest in recovering a client's losses.

So it's understandable some users will take drastic security measures. But here's my point again; by taking extreme security measures, a user can end up making their system less secure. -- Tet

Mudpuppy
Posts: 5889
Joined: Sat Aug 27, 2011 2:26 am
Location: Sunny California

Re: Question for users accessing financial sites from Linux/

Post by Mudpuppy » Sun May 06, 2012 7:29 pm

asdfvcx wrote:The main problem I see with the OP's idea is that if the disk is non-persistent, you likely aren't getting security updates.
So you subscribe to a mailing list that issues alerts about major security updates for your distribution of choice. When a big update alert comes across the mailing list, you turn the virtual machine back to persistent mode, boot up in single user mode with network access, install the updates, shut down, re-enable non-persistent mode and off you go....

There's absolutely no need to have automatic updates to install security updates. The manual way has worked for IT professionals for decades (and has the advantage of giving the patch a little time to be vetted and verified by all the automatic update patch "beta testers" in the real world before you install it).

Mudpuppy
Posts: 5889
Joined: Sat Aug 27, 2011 2:26 am
Location: Sunny California

Re: Question for users accessing financial sites from Linux/

Post by Mudpuppy » Sun May 06, 2012 7:31 pm

Epsilon Delta wrote:
Mudpuppy wrote: So if your virtual machine is just used for financial sites and you have it set to non-persistent mode, there is very little risk and very little need for anti-virus software.
GregLee wrote:
investomajic wrote:My Linux machine is hosted inside my Windows machine, which IS protected by anti-virus and a very strict software firewall so I should be OK, but this lead me to ask.
I don't see how the Windows system could protect you when you're running Linux inside Windows, but I also don't see why you'd need any protection. I've been running Linux since the early 90s without any security problem at home. I'm also using Ubuntu 12.04 now, but nakedly. (I did catch a little case of rootkit in Linux once at work, about 10 years ago.)
Mudpuppy and GregLee are making a common mistake. A virtual machine protects the host from anything that happens in the VM, a VM is not protected from things that happen to the host. A VM trusts the host O/S just as the host trusts the hardware.

As an example, suppose there is a malicious key and screen logger in the host. Then the VM does not help because the virtual screen and key board for the VM are provided by the compromised host.

You should not use VM just for accessing high value sites. The best practice is to use a VM for everything, particularly for accessing questionable sites. Before you access a high value site you should shutdown any running VM, which eliminates any malware picked up in those browsing session. You then start a clean VM to access the high value site.
I already addressed this in previous posts. Since the OP was involved in those previous posts and was already told in those previous posts to secure his host OS, I felt no need to rehash this issue again. I was responding to the OP directly, not everyone else in the world.

Edit: And if by chance I am confusing the OP with another poster with whom this topic has been discussed recently (since I am horrible with names), then this poster should head Epsilon Delta's advice, which was the same advice I gave the person in the other thread on this topic last month: Make another virtual machine for all random website browsing/email reading and never do such tasks from the host OS.

User avatar
Epsilon Delta
Posts: 7430
Joined: Thu Apr 28, 2011 7:00 pm

Re: Question for users accessing financial sites from Linux/

Post by Epsilon Delta » Sun May 06, 2012 11:41 pm

Mudpuppy wrote: I already addressed this in previous posts. Since the OP was involved in those previous posts and was already told in those previous posts to secure his host OS, I felt no need to rehash this issue again. I was responding to the OP directly, not everyone else in the world.

Edit: And if by chance I am confusing the OP with another poster with whom this topic has been discussed recently (since I am horrible with names), then this poster should head Epsilon Delta's advice, which was the same advice I gave the person in the other thread on this topic last month: Make another virtual machine for all random website browsing/email reading and never do such tasks from the host OS.
Sorry, if I had remembered details of the previous thread I would have phrased that quite differently.

I've run into a number of people who have made the mistake of setting up a VM only for high value programs; I'm afraid its become a bit of a hobby horse.

Bongleur
Posts: 2066
Joined: Fri Dec 03, 2010 10:36 am

Re: Question for users accessing financial sites from Linux/

Post by Bongleur » Mon May 07, 2012 3:56 am

New thread for discussing insurance against losses:

http://www.bogleheads.org/forum/viewtop ... =2&t=95995

>Vanguard is saying it is not responsible for any security breaches that originate with you or your computer. In other words depending >on Vanguard's position, it may or may not take an interest in recovering a client's losses.

(From this thread:
viewtopic.php?f=11&t=95903&p=1383565#p1383565

This is a vitally important question. The situation is worse for Treasury Direct -- they come right out and tell you that they will never reimburse you for any losses due to cybercrime.

It seems to me that we should think about taking out insurance against thefts from financial accounts to the extent they don't get reimbursed by the institution.
Seeking Iso-Elasticity. | Tax Loss Harvesting is an Asset Class. | A well-planned presentation creates a sense of urgency. If the prospect fails to act now, he will risk a loss of some sort.

User avatar
nisiprius
Advisory Board
Posts: 36888
Joined: Thu Jul 26, 2007 9:33 am
Location: The terrestrial, globular, planetary hunk of matter, flattened at the poles, is my abode.--O. Henry

Re: Question for users accessing financial sites from Linux/

Post by nisiprius » Mon May 07, 2012 5:15 am

investomajic wrote:If you read the "Your responsibilities" section for securing your computer on the Vanguard site, it states:
"Make certain that any computer you use to access Vanguard.com has up-to-date security and anti-spyware, antivirus, and firewall software."... My understanding is most Linux/Mac users do not run Anti-Virus software. My question is, is this a concern to you if you have a Vanguard account? Have you obtained anti-virus software for your Linux/Mac?
1) Flashback is the first really serious virus epidemic I've heard about on the Mac. Apple has incorporated some kind of built-in protection in a recent update. I have installed that update. Generally, if Vanguard were to interrogate me under oath as to whether I've complied with my responsibilities, my answer would be to shrug and say "I'm up-to-date on all of Apple's security patches." And add, "tell me specifically what you think Mac best practices are--naming products you've certified as appropriate--and I'll comply."

2) I use ClamAV from time to time. The only thing it has ever found is malware in spam email attachments, and 90% of what it finds there it usually finds are suspicious phishing URLs.

3) Mac OS X is a version of UNIX--has UNIX 03 certification, Wikipedia says--and, like LINUX, has a small market share and has not yet started to attract much virus activity. Therefore, yes, I take a fairly casual approach to virus scanning, but I believe it is justified by the current threat level--although this is obviously changing.

4) My prediction is that the need for continuous virus protection will become evident on Mac OS X fairly soon--and that when it does, Apple will incorporate some kind of tool analogous to Microsoft Security Essentials. Smug, ostrich-like, I know. But justified by Apple's business model, which tends to align them more closely with the end-user than Microsoft's does. If Microsoft was eventually led to produce Security Essentials, Apple will eventually do something similar.
Annual income twenty pounds, annual expenditure nineteen nineteen and six, result happiness; Annual income twenty pounds, annual expenditure twenty pounds ought and six, result misery.

User avatar
Epsilon Delta
Posts: 7430
Joined: Thu Apr 28, 2011 7:00 pm

Re: Question for users accessing financial sites from Linux/

Post by Epsilon Delta » Mon May 07, 2012 10:51 am

nisiprius wrote: 4) My prediction is that the need for continuous virus protection will become evident on Mac OS X fairly soon--and that when it does, Apple will incorporate some kind of tool analogous to Microsoft Security Essentials. Smug, ostrich-like, I know. But justified by Apple's business model, which tends to align them more closely with the end-user than Microsoft's does. If Microsoft was eventually led to produce Security Essentials, Apple will eventually do something similar.
I'd expect Apple to just create a more secure operating system rather than having an add on like Microsoft Security Essentials. Security is an add on for Microsoft Windows because of the history of Windows and some (early) choices made by MS for reasons largely unrelated to security.

Apple has quite a different history and made different decisions. The only reason I can think of for Apple to make security a separate program is so that Apple users can tick the boxes on a checklist designed round the MS tradition.

KyleAAA
Posts: 6767
Joined: Wed Jul 01, 2009 5:35 pm
Contact:

Re: Question for users accessing financial sites from Linux/

Post by KyleAAA » Mon May 07, 2012 10:55 am

Linux and Mac users should absolutely use anti-virus protection. Being a prudent, informed and defensive user is not a complete defense. Most exploits these days are OS independent, anyway.

Besides, Vanguard specifically states you must use anti-virus and anti-spyware applications. Ignore the letter of the law at your own risk. Somehow, I don't think the "but I have a Mac!" excuse is going to fly if something happens.
Last edited by KyleAAA on Mon May 07, 2012 10:59 am, edited 1 time in total.

KyleAAA
Posts: 6767
Joined: Wed Jul 01, 2009 5:35 pm
Contact:

Re: Question for users accessing financial sites from Linux/

Post by KyleAAA » Mon May 07, 2012 10:58 am

Epsilon Delta wrote:
nisiprius wrote: 4) My prediction is that the need for continuous virus protection will become evident on Mac OS X fairly soon--and that when it does, Apple will incorporate some kind of tool analogous to Microsoft Security Essentials. Smug, ostrich-like, I know. But justified by Apple's business model, which tends to align them more closely with the end-user than Microsoft's does. If Microsoft was eventually led to produce Security Essentials, Apple will eventually do something similar.
I'd expect Apple to just create a more secure operating system rather than having an add on like Microsoft Security Essentials. Security is an add on for Microsoft Windows because of the history of Windows and some (early) choices made by MS for reasons largely unrelated to security.

Apple has quite a different history and made different decisions. The only reason I can think of for Apple to make security a separate program is so that Apple users can tick the boxes on a checklist designed round the MS tradition.
This seems quite unlikely. However, I suppose it's not outside the realm of possibility for Apple to insist on building anti-virus protection into the OS and blocking out competitors. The basic security stuff is already built into all major OSes.

investomajic
Posts: 140
Joined: Tue Aug 03, 2010 8:01 pm

Re: Question for users accessing financial sites from Linux/

Post by investomajic » Mon May 07, 2012 8:01 pm

Mudpuppy wrote:
Epsilon Delta wrote:
You should not use VM just for accessing high value sites. The best practice is to use a VM for everything, particularly for accessing questionable sites. Before you access a high value site you should shutdown any running VM, which eliminates any malware picked up in those browsing session. You then start a clean VM to access the high value site.
Edit: And if by chance I am confusing the OP with another poster with whom this topic has been discussed recently (since I am horrible with names), then this poster should head Epsilon Delta's advice, which was the same advice I gave the person in the other thread on this topic last month: Make another virtual machine for all random website browsing/email reading and never do such tasks from the host OS.
Thanks for the heads up. I use my host OS for software development with trusted software only (I have a dedicated VM for testing new software / beta's, etc.). I run a relatively low-RAM background VM for Internet browsing while developing; seems to work for me. But you are both correct ... this strategy isn't for everyone and you need to be very aware of what you are doing in your host OS otherwise it is all for not.

investomajic
Posts: 140
Joined: Tue Aug 03, 2010 8:01 pm

Re: Question for users accessing financial sites from Linux/

Post by investomajic » Mon May 07, 2012 8:03 pm

Bongleur wrote:New thread for discussing insurance against losses:

http://www.bogleheads.org/forum/viewtop ... =2&t=95995

>Vanguard is saying it is not responsible for any security breaches that originate with you or your computer. In other words depending >on Vanguard's position, it may or may not take an interest in recovering a client's losses.

(From this thread:
viewtopic.php?f=11&t=95903&p=1383565#p1383565

This is a vitally important question. The situation is worse for Treasury Direct -- they come right out and tell you that they will never reimburse you for any losses due to cybercrime.

It seems to me that we should think about taking out insurance against thefts from financial accounts to the extent they don't get reimbursed by the institution.
Thanks for pointing out this thread, I will read through it with great curiosity. I agree with you, this is a vitally important question.

User avatar
FabLab
Posts: 1127
Joined: Mon Oct 18, 2010 12:15 pm

Re: Question for users accessing financial sites from Linux/

Post by FabLab » Tue May 08, 2012 7:38 am

Jake46 wrote:I use Virus Barrier on my Macs.

http://www.intego.com/virusbarrier
As do I. It runs unobtrusively, and that's just the way I like it.
The fundamental things apply as time goes by -- Herman Hupfeld

Post Reply