Suitable ARM SBC for secure browsing etc.

I'm considering using an ARM SBC for accessing financial websites and keeping financial records, separate from my everyday PC, as a security measure. I'm looking for a suitable board.

First here's some more background, but to be clear my question is really about finding a suitable SBC, not performance tuning the RPi 3 (though I'd be delighted to hear about the causes of my lower-than-wanted RPi3 performance if people want to discuss that).

I have an RPi 3, but I'm finding it's too slow for this with my setup. Both browsing and opening/saving largish text files are slow (I'm using LUKS block device encryption on the SD card, but I don't think that's at fault going on CPU usage from top), and there are not infrequent long pauses of 5 or 10 seconds without obvious explanation to me. Saving files often takes several seconds. Firefox startup takes maybe 30 seconds or more (I didn't actually time that). First browse takes maybe 15 seconds or more. Main memory and CPU don't seem to be the main culprits, but disk I/O seems to be rather slow compared to what I'm used to (I measure roughly 20 Mb/s read, 3.3 Mb/s write based on hdparm -t, and dd'ing from /dev/zero + a sync, respectively), and I suspect network bandwidth may also be a problem for web browsing. I'm going to try another SD card, and may switch from firefox to chromium, but still, I'm looking for a new SBC.

I've spent a long time hunting for suitable boards and haven't yet found anything that seems just right. Can anybody help?

Here are my criteria:

Very important, but achievability in doubt:

• Runs STOCK ubuntu or debian, or some RELATIVELY MAINSTREAM THIRD PARTY distribution (the simpler and lighter-weight the better), NOT tweaked and requiring maintenance by manufacturer (because of security updates and not wanting to be left without maintenance / new releases)
• As few as possible binary blobs

Important and presumably achievable

• No built-in eMMC (removable eMMC is fine: I had thought eMMC by definition means non-removable, but at least in the language used on some manufacturer's websites, that's not the case...)
• Decent IO bandwidth for networking -- at least noticeably better than RPi3
• At least 2GB RAM
• CPU comparable with RPi3 or faster (i.e. quad-core cortex A53 1.2Ghz or better)
• ARM, not x86 (I'm not happy about Intel ME and friends for security reasons)
• HDMI or displayport

Nice to have

• No wifi
• No bluetooth
• M.2 for SSD? seems unavailable without either Intel or eMMC...
• Micro USB powered (convenient)
• 4GB RAM

Non-requirements

• Video playback
• Audio
• Fancy graphics acceleration, I guess (if it helps with plain old financial websites it's good I guess, but probably not at the cost of introducing a need for a binary blob driver)

Thanks for your thoughts!

At first glance I thought the Odroid C2 sounded promising. I find this thread pretty discouraging about the state of the SBC market outside of RPi, though (the problems even compiling chromium, apprently instability of firefox, presumed non-functional stock ARM ubuntu images, given that everybody seems to be using the Odroid-tweaked image, etc.):

http://forum.odroid.com/viewtopic.php?f=136&t=18709

One of the things I was looking for on an ARM based firewall couldn't be used because of lack of cryptographic support.


What is wrong with a new celeron?

Originally Posted by jefro One of the things I was looking for on an ARM based firewall couldn't be used because of lack of cryptographic support. What is wrong with a new celeron?

I guess Celerons lack Intel ME / vPro? That's a possibility, thanks for the suggestion. On the other hand, it still involves giving money to Intel, and honestly ME makes me prefer not to!

Can you elaborate on the issue re lack of cryptographic support? Is this about hardware acceleration?

In general, many of the ARM SBCs are appealingly simple. For security, simpler = better, other things being equal. Of course they certainly aren't equal if one ends up running some distribution that doesn't receive prompt kernel security patches. I don't *think* RPi, at least, falls into that "internet of shit" category... but I'm eager to hear evidence that I'm wrong. Hopefully the recent ARM standardisation efforts will improve this situation where at least non-RPi hardware has this question mark hanging over them.

I don't know much about this, but my impression is that Intel "mini PCs" has less of a problem with "computers within computers" running mysterious code (like ME) and firmware that can't practically be wiped and reinstalled, than do SBCs, despite their being plenty of binary blobs in the ARM world at the moment. In contrast TrustZone, for example, actually seems like a potentially useful feature that's under users' control, again from my very limited knowledge of that.