Dedicated Financial Computer Master Thread

[munemaker]

Do you use a separate PC/Laptop/Tablet to do your online investing/banking etc? What do you use and why?

Nope. I have computers all over my house and lot in from any of them.

MUN

[delamer]

To login to and do transactions at our three portfolio custodians, I only use my laptop (with 2FA). I don’t access those through my phone or iPad.

I also limit non-financial use of the laptop. I do access our bank’s website on my phone & iPad.

[RickBoglehead]

Asked often. Nope.

[MedEngineer]

good computing hygiene

No separate device.

1) I practice good computing hygiene
2) I do NOT use a phone or any device on a mobile network.
3) I do not use social media apps on my phone.
4) I do NOT use a password manager I keep an offline password file with encryption.
5) I keep my phone contacts limited to family & friends as much as possible.
6) Until recently I only used a wired connection to my router.
7) I've considered a dedicated cell phone/number just for Two-factor authentication messages, but I'm too cheap to pay for another phone.

I'm not paranoid, just respectful of the abilities of bad actors. The old saying about raccoons and garbage cans helps a lot, if you make your trash cans harder to get into than your neighbors, then the critters go elsewhere where the pickings are easier.

[MtnTravel]

I don't install finance apps on my mobile device.

Many banks/institutions are using the mobile app for authentication. Bank of America and Chase both send push notifications to your phone when you call customer service to verify you.

And what about fraud alerts? Banks generally use the app to send you a notification and ask if X Transaction was yours.

It seems more of a hassle to not have apps on your phone.

[BH13]

1) I practice good computing hygiene
2) I do NOT use a phone or any device on a mobile network.
3) I do not use social media apps on my phone.
4) I do NOT use a password manager I keep an offline password file with encryption.
5) I keep my phone contacts limited to family & friends as much as possible.
6) Until recently I only used a wired connection to my router.
7) I've considered a dedicated cell phone/number just for Two-factor authentication messages, but I'm too cheap to pay for another phone.

And I do almost exactly the opposite of all of the above.

- I do use my phone / computer / iPad on any wifi network, even public ones!
- I do use many social network apps on my phone
- I do use a password manager on my phone - even Cloud sync'd & with MFA tokens
- I have all kinds of phone contacts from any interaction, again Cloud sync'd. Tho pruned regularly
- I've been using Wifi since it was released.

As a (retired) Network Security engineer, I can only advise to keep your device OS / Apps / Router up to date. There is very little need for security theater fearing bad actors. Definitely using MFA wherever possible preferring Passkeys, tokens, and App based 2-factor over any SMS 2-factor.

In fact, make sure your mobile account has a SIM lock on it to avoid SIM hijacking.

[tibbitts]

Do you use a separate PC/Laptop/Tablet to do your online investing/banking etc? What do you use and why?

Absolutely not; I use my laptop or phone or whatever on more or less any network that's available.

[gotoparks]

I don't use a separate computer. I just Windows 11 which is updated regularly, and Firefox browser for finance-related things. I also use Malwarebytes Premium. Lots of people on this forum frown at using paid antivirus because it costs money, but I don't.

[enad]

99% of the time I use my desktop. I use my smartphone when I am in the hospital and need to access it (which is rare). Most of what one needs can be accessed through a browser. If spreadsheets are involved I use on from a Virtual Machine running on my desktop which has no access to the internet. I've done it this way for over 30 years without any issues. In the end what I do or what anyone does really doesn't matter. It's what you need to do to make you sleep well at night.

[PersonalFinanceJam]

No, I use whatever personal machine I have at the time on pretty much whatever network I may be on at the time. I have the mobile apps installed on my phone and I've used them on public wifi. I use a password manager on all my devices that syncs to the cloud. This means I have unique complex passwords for each site that should be autofilled correctly if the site I'm visiting is valid and I use the highest form of 2FA available for the site.

[Cruise]

For those who suggest not using phone for financial transactions, why is that?

Thank you!

[MoneyIsTime]

Yes, I do use a separate PC for my financial logins/etc. I've heard enough horror stories of hacking/etc that I'm doing this. Granted, I've never had a problem, but figuring someone potentially messing with my nestegg is something I don't need. I have other security measures too, but this one is fairly easy as it's at my "financial desk" in my home office and fairly easy to do.

[exodusNH]

I don't install finance apps on my mobile device.

Many banks/institutions are using the mobile app for authentication. Bank of America and Chase both send push notifications to your phone when you call customer service to verify you.

And what about fraud alerts? Banks generally use the app to send you a notification and ask if X Transaction was yours.

It seems more of a hassle to not have apps on your phone.

They send email and SMS.

I have never been limited by not running an app.

[exodusNH]

For those who suggest not using phone for financial transactions, why is that?

Thank you?

Because the phone can be stolen, or you can be mugged and forced to log in to your accounts. By not having them on the device, that removes that possibility.

I also worry about phone vulnerabilities. All the carriers run software on your device with root access. A vulnerability there could allow an exploit.

I slightly fibbed when I say I don't have an app on my phone. I do have my hub bank's app so that I can do mobile deposits. But I don't store my username and password and so have to be home to get the credentials. I don't use that app for any other banking functions.

[exodusNH]

good computing hygiene

No separate device.

1) I practice good computing hygiene
2) I do NOT use a phone or any device on a mobile network.
3) I do not use social media apps on my phone.
4) I do NOT use a password manager I keep an offline password file with encryption.
5) I keep my phone contacts limited to family & friends as much as possible.
6) Until recently I only used a wired connection to my router.
7) I've considered a dedicated cell phone/number just for Two-factor authentication messages, but I'm too cheap to pay for another phone.

I'm not paranoid, just respectful of the abilities of bad actors. The old saying about raccoons and garbage cans helps a lot, if you make your trash cans harder to get into than your neighbors, then the critters go elsewhere where the pickings are easier.

While this isn't bad per se, it's not practically more secure. Theoretically, probably.

Unique passwords, unique usernames, 2FA, keeping devices up to date is really all it takes.

[HawkeyePierce]

For those who suggest not using phone for financial transactions, why is that?

Thank you?

Because the phone can be stolen, or you can be mugged and forced to log in to your accounts. By not having them on the device, that removes that possibility.

I also worry about phone vulnerabilities. All the carriers run software on your device with root access. A vulnerability there could allow an exploit.

I slightly fibbed when I say I don't have an app on my phone. I do have my hub bank's app so that I can do mobile deposits. But I don't store my username and password and so have to be home to get the credentials. I don't use that app for any other banking functions.

So use a passcode. Now the thief has stolen a brick.

If a mugger forces me to transfer money I'll deal with my bank's fraud department the next day rather than argue with someone (presumably) brandishing a weapon at me who may or may not believe that I don't have any financial apps on my phone.

I have not seen a single vulnerability of the type you're describing on a modern smartphone. Your carrier isn't running any software on an iPhone, especially now that physical SIM cards are going away.

I say this every time it comes up: you could stand in the middle of Times Square placing million-dollar transactions on your iPhone over a malicious wifi network and it would STILL be safe.

1) I practice good computing hygiene
2) I do NOT use a phone or any device on a mobile network.
3) I do not use social media apps on my phone.
4) I do NOT use a password manager I keep an offline password file with encryption.
5) I keep my phone contacts limited to family & friends as much as possible.
6) Until recently I only used a wired connection to my router.
7) I've considered a dedicated cell phone/number just for Two-factor authentication messages, but I'm too cheap to pay for another phone.

And I do almost exactly the opposite of all of the above.

- I do use my phone / computer / iPad on any wifi network, even public ones!
- I do use many social network apps on my phone
- I do use a password manager on my phone - even Cloud sync'd & with MFA tokens
- I have all kinds of phone contacts from any interaction, again Cloud sync'd. Tho pruned regularly
- I've been using Wifi since it was released.

As a (retired) Network Security engineer, I can only advise to keep your device OS / Apps / Router up to date. There is very little need for security theater fearing bad actors. Definitely using MFA wherever possible preferring Passkeys, tokens, and App based 2-factor over any SMS 2-factor.

In fact, make sure your mobile account has a SIM lock on it to avoid SIM hijacking.

I agree with all of this.

EVERYBODY should be using a password manager. Password reuse is probably the single biggest threat to the average joe, along with phishing. Password managers help you use a unique password for everything and 2FA helps avoid phishing (only passkeys and Yubikeys prevent it entirely).

[bikefish]

I do not use a separate device. Juice isn't worth the squeeze.

[feh]

I do not. Personally, i don't think it is necessary if one otherwise has good computing hygiene.

+1

[feh]

7) I've considered a dedicated cell phone/number just for Two-factor authentication messages, but I'm too cheap to pay for another phone.

Google voice. No charge.

[Mrbogleheads]

If I'm the only one using the device, why?

[MrNarwhal]

For those who suggest not using phone for financial transactions, why is that?

Thank you?

I buy cheap phones (low-end locked prepaid) and use them past the end of support for the operating system. I also don't install updates consistently on a phone.

[PersonalFinanceJam]

...
I buy cheap phones (low-end locked prepaid) and use them past the end of support for the operating system. I also don't install updates consistently on a phone.

This is a bad idea even without financial apps on a phone.

[michaeljc70]

No. That would be a huge inconvenience. Especially when traveling.

I think it is totally unnecessary for me....but I know people that click on things willy-nilly and get viruses and malware.

[Blues]

I have a separate login / user id on the same device which is only used for accessing financial accounts. It is not used for ordinary online usage.

[MrNarwhal]

...
I buy cheap phones (low-end locked prepaid) and use them past the end of support for the operating system. I also don't install updates consistently on a phone.

This is a bad idea even without financial apps on a phone.

Why?

[Capster1]

I only use my phone and imac on my home wifi network to access financial accounts.
I have a Lenova laptop for work and I’ve never accessed anything financially on it. So, I do limit how things are accessed and keep it to those two devices.

[MtnTravel]

Because the phone can be stolen, or you can be mugged and forced to log in to your accounts. By not having them on the device, that removes that possibility.

I also worry about phone vulnerabilities. All the carriers run software on your device with root access. A vulnerability there could allow an exploit.

I slightly fibbed when I say I don't have an app on my phone. I do have my hub bank's app so that I can do mobile deposits. But I don't store my username and password and so have to be home to get the credentials. I don't use that app for any other banking functions.

If a criminal forces me to log into my bank app, what could they do? If they make me link their account via ACH or send a wire to them, I can almost guarantee Chase is going to decline the transaction until I jump through a bunch of hoops (which they do even when it's my own account I'm trying to link ).

In terms of root access vulnerability, this seems far fetched. Maybe it's an issue with Androids, but Apple is known for locking down iOS to the point that law enforcement and government agencies have difficulties accessing locked iPhones, even with advanced hacking tools. So I doubt a common criminal is going to be able to get in and steal money from my account.

Security and convenience are always a balance, but I think financial apps are perfectly safe. Probably even safer than using a browser on a computer. If you practice good digital habits there shouldn't be an issue. Don't click unknown links or open emails from people you don't know, keep your devices updated, and run regular virus scans if you are on Windows.

[michaeljc70]

For those who suggest not using phone for financial transactions, why is that?

Thank you?

Because the phone can be stolen, or you can be mugged and forced to log in to your accounts. By not having them on the device, that removes that possibility.

I also worry about phone vulnerabilities. All the carriers run software on your device with root access. A vulnerability there could allow an exploit.

I slightly fibbed when I say I don't have an app on my phone. I do have my hub bank's app so that I can do mobile deposits. But I don't store my username and password and so have to be home to get the credentials. I don't use that app for any other banking functions.

Every financial account I have can be accessed via a browser if the app isn't installed on my phone.

[PersonalFinanceJam]

This is a bad idea even without financial apps on a phone.

Why?

A smart phone is basically just a small computer so it can still be hacked to run malware to do things like exfiltrate your contact list for additional malware targeting. Compromised phones are also increasingly being seen in use as part of botnets for cyber attacks. Honestly, unlocked used smart phones are pretty cheap from places like Swapppa and Back Market and would still have support life left in them. I just don't see an excuse for using an always on connected computer past its OS support time. Or, you could get a dumb phone.

[MrNarwhal]

Why?

A smart phone is basically just a small computer so it can still be hacked to run malware to do things like exfiltrate your contact list for additional malware targeting. Compromised phones are also increasingly being seen in use as part of botnets for cyber attacks. Honestly, unlocked used smart phones are pretty cheap from places like Swapppa and Back Market and would still have support life left in them. I just don't see an excuse for using an always on connected computer past its OS support time. Or, you could get a dumb phone.

Phone is generally powered off / rebooted daily, has background data disabled (to the extent possible on stock Android OS), and generally only used to access known apps and websites.

My previous post was exaggerated a bit but the point is that I view a smartphone as a convenience device for mostly non-critical (or secondary) use so I put minimal effort and expense into it. My personal laptop used for directly accessing important accounts is upgraded to the latest OS (OpenBSD) version.

[exodusNH]

7) I've considered a dedicated cell phone/number just for Two-factor authentication messages, but I'm too cheap to pay for another phone.

Google voice. No charge.

Many sites will refuse to send SMS to Google Voice numbers. Even more problematic is that it might work when you first sign up, but will break in the future because they switched their SMS gateway providers.

[exodusNH]

Because the phone can be stolen, or you can be mugged and forced to log in to your accounts. By not having them on the device, that removes that possibility.

I also worry about phone vulnerabilities. All the carriers run software on your device with root access. A vulnerability there could allow an exploit.

I slightly fibbed when I say I don't have an app on my phone. I do have my hub bank's app so that I can do mobile deposits. But I don't store my username and password and so have to be home to get the credentials. I don't use that app for any other banking functions.

Every financial account I have can be accessed via a browser if the app isn't installed on my phone.

Yeah, and that's what I do.

[PersonalFinanceJam]

...
Phone is generally powered off / rebooted daily, has background data disabled (to the extent possible on stock Android OS), and generally only used to access known apps and websites.

My previous post was exaggerated a bit but the point is that I view a smartphone as a convenience device for mostly non-critical (or secondary) use so I put minimal effort and expense into it. My personal laptop used for directly accessing important accounts is upgraded to the latest OS (OpenBSD) version.

Makes even less sense to me now. Primary machine runs an OS which tries to be secure by default and prioritizes security over most other things and phone is old out of date but you try to mitigate that. Seems like you could use the money saved by using a free operating system to update your phone a tick faster, but to each their own.

[exodusNH]

This is a bad idea even without financial apps on a phone.

Why?

Because there are often security vulnerabilities that can be triggered by seemingly innocuous activities, like simply receiving a text message with an image. (Technically a MMS.) Or a vulnerability when displaying an image that's been intentionally corrupted in a particular way. (Exploiting a bug in the image processing code.)

[LittleMaggieMae]

I don't install finance apps on my mobile device.

Many banks/institutions are using the mobile app for authentication. Bank of America and Chase both send push notifications to your phone when you call customer service to verify you.

And what about fraud alerts? Banks generally use the app to send you a notification and ask if X Transaction was yours.

It seems more of a hassle to not have apps on your phone.

They all send Texts to your cell phone. You don't need their apps on your phone to get the texts. I don't have any banking apps on my phone. I get texts from all 4 of the banks I bank with based on the notifications level I accepted/set when I access their website via my home PC.

Years ago, I got a fraud alert txt AND a phone call to my cell phone from a CC. I have also gotten a txt when there's been an issue with the card I was trying to use to make a purchase - basically asking me to confirm that it was really me making the purchase by entering a code or something - it was a long time ago and only happened once. I don't have the banks or the credit cards app on my phone.

[mrb09]

<snip>

And I do almost exactly the opposite of all of the above.

- I do use my phone / computer / iPad on any wifi network, even public ones!
- I do use many social network apps on my phone
- I do use a password manager on my phone - even Cloud sync'd & with MFA tokens
- I have all kinds of phone contacts from any interaction, again Cloud sync'd. Tho pruned regularly
- I've been using Wifi since it was released.

As a (retired) Network Security engineer, I can only advise to keep your device OS / Apps / Router up to date. There is very little need for security theater fearing bad actors. Definitely using MFA wherever possible preferring Passkeys, tokens, and App based 2-factor over any SMS 2-factor.

In fact, make sure your mobile account has a SIM lock on it to avoid SIM hijacking.

Not a network security engineer, but I needed to pass software security reviews, audits and certifications in my employed life. I do exactly what BH13 does.

[jebmke]

Because the phone can be stolen, or you can be mugged and forced to log in to your accounts. By not having them on the device, that removes that possibility.

I also worry about phone vulnerabilities. All the carriers run software on your device with root access. A vulnerability there could allow an exploit.

I slightly fibbed when I say I don't have an app on my phone. I do have my hub bank's app so that I can do mobile deposits. But I don't store my username and password and so have to be home to get the credentials. I don't use that app for any other banking functions.

Every financial account I have can be accessed via a browser if the app isn't installed on my phone.

The “mugger” theory is a red herring

[xb7]

I don't currently but think that I might move to do so. I envision a relatively cheap windows laptop that I turn on once a week or (much less frequently) to do actual transactions. The biggest time sink there would likely be making sure that windows and my security software were up-to-date each time I turned it on.

I understand the points of those who say that sufficient security 'hygiene' is all that's needed. For the most part I agree --- for right now. My concern is that increasingly good AI will make it a lot easier for fairly unsophisticated criminals to cast better nets to rob us, particularly with so very many data breaches at differing companies such that it seems likely that much or all of my classic 'ID theft' information is already out there somewhere.
It strikes me then that an inexpensive laptop that I tuck (hide??) away somewhere in my house might be worth having going forward.

I would have the only copy of my authenticator credentials on this machine, no phone or tablet or other PC access to my primary brokerage. And as others have suggested, no email done on this machine, no web surfing, game playing, social media, whatever, just the minimum number of apps installed to allow access to my brokerage account and only use the PC for that purpose only.
And per above, the first thing I would do every time I turned on this PC would be to check for windows updates and updates to my security software.

[HawkeyePierce]

I don't currently but think that I might move to do so. I envision a relatively cheap windows laptop that I turn on once a week or (much less frequently) to do actual transactions. The biggest time sink there would likely be making sure that windows and my security software were up-to-date each time I turned it on.

I understand the points of those who say that sufficient security 'hygiene' is all that's needed. For the most part I agree --- for right now. My concern is that increasingly good AI will make it a lot easier for fairly unsophisticated criminals to cast better nets to rob us, particularly with so very many data breaches at differing companies such that it seems likely that much or all of my classic 'ID theft' information is already out there somewhere.
It strikes me then that an inexpensive laptop that I tuck (hide??) away somewhere in my house might be worth having going forward.

I would have the only copy of my authenticator credentials on this machine, no phone or tablet or other PC access to my primary brokerage. And as others have suggested, no email done on this machine, no web surfing, game playing, social media, whatever, just the minimum number of apps installed to allow access to my brokerage account and only use the PC for that purpose only.
And per above, the first thing I would do every time I turned on this PC would be to check for windows updates and updates to my security software.

This is still security theater even in the face of AI. AI has nothing to do with the threats faced by the average person: credential stuffing and phishing. We already know how to protect against both threats with password managers and 2FA.

AI doesn’t move the needle one bit on this subject.

[beardsicles]

I "sandbox" a Chromebook as my dedicated financial computer and been doing this since November 2020. I purchased from Best Buy during Black Friday for only $79. It's a Lenovo - Chromebook 3 11.6" HD Laptop - Celeron N4020 - 4GB Memory - 64GB eMMC. Very peppy little computer that I keep next to my TV relaxing chair and I use it daily. I think it's a great idea that I got from Clark Howard. Key is to never, ever, not ever use for Surfing the web, Online shopping, E-mail access, Visiting Facebook, Twitter/X or any other social media platform. This is where the trouble starts. I have often thought about using a dedicated email for my financial accounts but have yet to implement that option.

Clark Howard has a great write up about the using a Financial Computer.

https://clark.com/personal-finance-cred ... rk-howard/

Clark Howard is a podcast host, not a security expert.

There is absolutely no reason for a consumer to worry inordinately about the security of a modern, up-to-date PC. If you're concerned, use Yubikeys as an additional layer of protection.

[PersonalFinanceJam]

...
They all send Texts to your cell phone. You don't need their apps on your phone to get the texts. I don't have any banking apps on my phone. I get texts from all 4 of the banks I bank with based on the notifications level I accepted/set when I access their website via my home PC.

Years ago, I got a fraud alert txt AND a phone call to my cell phone from a CC. I have also gotten a txt when there's been an issue with the card I was trying to use to make a purchase - basically asking me to confirm that it was really me making the purchase by entering a code or something - it was a long time ago and only happened once. I don't have the banks or the credit cards app on my phone.

Scammers now take advantage of this to send fishing texts/calls which look like your bank. App based notifications don't suffer from this.

[LikeNumbers]

RE: Do you use a separate device for finances?

REsponse: NO

I know the following seems like a lot of hassle. It did not take much time to setup.

It seems there are three issues here.
1) Cyber crooks somehow gain access to your private financial info.
I deal with this potential in a few ways 1) all such files are password protected and encrypted (really only a handful of files),
2) I don't put those files in the cloud, backup locally and store the disk in a physical safe.
3) First line of defense is our router.
4) All private digital access credentials are contained in password manager w/encryption and
only I know the master password.

2) Physical crooks break into our house
Resolution is the same as #1

3) Physical crook breaks into auto and steal my PC
I've actually had this happen. The PC required a long password to login, the disk was encrypted.
About a year later, local police arrested a guy during an auto break-in, they arrested him and later searched his
residence - they found a room full of stolen stuff - including my PC. When I got the PC back, it was covered in
finger prints, and the internal disk was gone. Apparently the encrypted disk worked as I never had any issues.

[MedEngineer]

Not a network security engineer, but I needed to pass software security reviews, audits and certifications in my employed life. I do exactly what BH13 does.

Not a security engineer either, but I was a telcom engineer and now a Medical device engineer and still employed doing risk management so I lean towards the least exposure necessary. I don't disagree with mrb09 & BH13, I'm sure they are fine if they take precautions. There are new attacks strategies happening all of the time, I've seen a demonstration how to get past 2FA by cloning a cell number, yes its a pretty advanced attack but it is possible if the target is worth the effort. Also to be honest, I hate using the tiny screen on a phone for anything, so security is another justification to not use my phone.

[LadyGeek]

I merged HighLonesome's thread into a similar discussion. The combined thread is now in the Personal Consumer Issues forum (devices).

(Thanks to the member who reported the post and provided a link to this thread.)

[michaeljc70]

Yes.

Who does this? I've never heard of it.

The people using a 1% SWR.

[mrb09]

Not a network security engineer, but I needed to pass software security reviews, audits and certifications in my employed life. I do exactly what BH13 does.

Not a security engineer either, but I was a telcom engineer and now a Medical device engineer and still employed doing risk management so I lean towards the least exposure necessary. I don't disagree with mrb09 & BH13, I'm sure they are fine if they take precautions. There are new attacks strategies happening all of the time, I've seen a demonstration how to get past 2FA by cloning a cell number, yes its a pretty advanced attack but it is possible if the target is worth the effort. Also to be honest, I hate using the tiny screen on a phone for anything, so security is another justification to not use my phone.

Absolutely agree with the mobile passcode lockdown, and also agree there are a number of other things unrelated to separate devices: strong unique passwords, 2FA for email to guard against password reset attempts, shutting off message preview for locked phone screens. And a protocol for changing passwords if a device is lost (including a stolen desktop), since a registered device may bypass 2FA. And of course keeping up on security updates.

[PersonalFinanceJam]

I called into BoA because I wanted to add a yubikey as an option for 2fa and needed a code only obtained by calling in. When I called in, the automated system asked me to authenticate myself using the mobile app. Far more secure than a SMS (if only they would change the security on their web site!). I don't know that it is required but I could see these scenarios in the future where it's much more difficult without apps on phones.