I've seen articles that recommend using a linux liveCD when doing banking or other financial tasks online especially in a windows OS environment.

What about linux users? Should we boot to a liveCD only for banking and other financial tasks online?

The articles suggest this because when you use livecd nothing will be logged on the system / hdd it will be on the live image which you will be umounted after your reboot in normal OS. So from security point of view yes it is very safe way of carrying out banking transactions but at the same time it is not so easy at times when you are traveling.

If you have a Windows machine then another way would be to keep your antivirus / internet security solution updated. Make sure that you don't surf the sites which are bogus. Same applies for Linux as well.

When visiting banking sites make sure to check their ssl certificate and if it is valid. Also check in the status bar if the connection says encrypted / secure. Banking sites use virtual keyboard which saves you from keylogger which can fetch keystroke information. Make sure that when you are using a bank site you don't have any other tab / window open of another website.

As long as you are following do's and dont's it should be fine. If you are still worried about security the yes livecd is the way.

No, articles suggest it because a Live CD can't be tainted like you would subvert an OS on disk. (It doesn't protect against hardware keyloggers or sniffing or any process picked up and activated before entering a banking site.)


I don't have an opinion about using Windows for banking I want to voice right now but with respect to Linux I'd call it the Ostrich strategy. If you run a well configured and maintained system, audit it regularly, don't share the system with others and use common sense then you shouldn't need to stoop to using a Live CD for banking.

Thanks unSpawn, I mean to be the same but didn't get the right words. As on live CD no modifications are possible (cannot be tainted as you said). Thanks once again.

@ Mikey555

if you're worried about key loggers you may want to install a virtual keyboard from the repos. But there is no guarantee it would be effective or not.

Since a lot of banks now use java for online transactions.
Your live cd better have java installed or a easy way to install java.

http://murga-linux.com/puppy/viewtopic.php?t=93968

You did pretty OK. I just wanted to emphasize things.


If you suspect a (hardware?) key logger you best avoid locations where one may be planted or if you control the machine: verify its hardware and software.


I disagree. Commonly internet users don't need Java (we're talking banking so games don't count) so if its available it will probably be set up the "convenient way" with browser plugins, executing JNLP etc, etc. That's asking for trouble. Also if you run from a Live CD then you can tweak Java configuration all you want but unless you make changes persistent (forcing you to carry an USB stick as well that can be forgotten) that won't work conveniently. So IMHO the best first thing would be to find out if the site actually mandates Java and then decide.

But like I said before: if you run a well configured and maintained system, audit it regularly, don't share the system with others and use common sense then you shouldn't need to stoop to using a Live CD for banking.