What do I need to do Netbanking?

If your system is clean then (at least no keylogger) and make shortcut to inlog page then chances of compromise are small.I have to hear the first massive cases of browser hijacking,DNS poisoning or XSS scripting out there.
I have a sandbox configured that only browser executable can connect,it give me a better feeling but not all attacks can be prevented.Compromised hosts(bank) can become a bigger treat in the future.

 

Hi,


i wonder if i have Avira AntiVir Premium (paid) then still i need anti-spyware program running in real-time on my system?
For example SUPERAntiSpyware PRO (paid with real-time protection)

I'm asking because as far as i know Avira Premium has implemented anti-spyware & anti-malware & adware protection in module called WebGuard which scanning HTTP access.

 

I don't see the need for any of the above. A good Hardware Firewall yes but forget the rest. I wouldn't do any NetBanking or paying by Credit Card etc without a program like Roboform http://www.roboform.com/

 

Is Roboform are the same software as KeePass http://keepass.info/ ?

 

Since your security approach is not based on an AV and so on, I would state this another way - basically you need a viable and robust security solution for your machine, whatever specific path that is. It could employ an AV, but it may not. Basically, you really don't need additional measures if the overall security approach employed is sound.

Blue

 

Yeah, looks pretty much the same. But Keepass, which I use btw, is free.

 

Thnaks for that. The last time I looked Keepass was pretty basic and seems to be developing quite nicely. Will give it a try. Does it allow you to enter credit card details with one click of the mouse ?

 

Not sure about that, I have never tried that as my bank website uses a virtual keyboard, and I never use my credit card to make purchases over the internet.

Keepass has just released a new version, give it a go, it's free

 

Hmm i have been trying Roboform and KeePass and for me Roboform is better solution. Roboform is easy to use - unfortunatelly i can't say the same about KeePass.

Roboform is really great software, i found discount coupon 20% for version Pro Roboform: http://www.softwarediscountcodes.com/siber-roboformpro.html

 

Yeah but Keepass is free

 

They have different aims. Roboform is designed to store password and then enter it automatically.

Keepass is designed to generate and store passwords. The point is to have a different password for eash login but you will only have to remember 1 master password.

 

Keepass also has ability to enter it automatically into webpages.

 

My bank offer the same option, but imagine this situation when on your computer is keylogger which using ScreenLogger then virtual keyboard implemented on bank website could be not enough to provide optimal security level.

Yes, but in my opinion it isn't easy to properly set-up this features.

 

Can you please say that again? I didn't understand what you meant.

Did you say there are keyloggers that if installed on your PC will be able to know what you entered into the banks virtual keyboard? If so, how?

 

Extract from Screenlogger program

"Screen Logger is like a handy cam to your screen. It can record everything your computer monitor displays on the screen. The main feature of Screen Logger is to capture your screen and log it into log files for you to view at any time. This is very important feature if you need to keep backups for your work, do some troubleshooting on your computer, or even if you just want to know what happens to your computer while you're away. By capturing screens and log them into log files will give you a figure on what happens to your computer."

Presumably if a program like this ran on your machine and could phone home then your details would be known by others ?

 

I think it is possible. How? Look here: http://www.zemana.com/list/list.asp?ktgr_id=424

 

For those of you concerned about keyloggers, here is a simple technique you can use when entering a password: while typing the password, occasionally change the focus to a different field and type random characters, and then change the focus back to the password field. For more details, see the paper How To Login From an Internet Cafe Without Worrying About Keyloggers.

 

Well the password is in asterick ********* on the screen, so it would be useless to the person who installed the keylogger on your PC.

 

This would be defeated by ***** virtual keyboards.

And in addition, a person could always use Neo's SafeKeys.

http://www.aplin.com.au/?page_id=246

ADVANTAGES:

* You don’t use your keyboard (keyloggers cannot record the password)
* The utility changes width and height each time, as well as its placement on the screen (to fool mouse-loggers, buttons will always be in different positions each time you use the program)
* Nothing is stored in the clipboard (clipboard loggers cannot save the password).
* You can use upper-case letters and symbols (such as !@#${}) by pressing the CAP button - no matter how complex your password is, the utility can type it.

 

Or use Neo’s SafeKeys,

 

Yeah... i'm back to KeePass. Roboform is really great but i loving too much my Opera. Unfortunatelly RF don't works with Opera

So i will stay with KeePass, who else?

Is ScreenLogger could see where is your mouse coursor? or not? if not then virtual keyboard is really good solution. If yes then software like KeePass/Roboform will be better.

I started to enjoy autotype it is faster than virtualkeyboard and save my time.
On banking sites i using this with Banking Mode in my Online Armor i think it is perfect solution.

 

The password may be ***** but presumably the virtual keyboard has to be visable for you to enter the characters. Don't misunderstand me the probabilties are very, very low but no security measure is absolutely secure. My own view is that security risks tend to be over exagerated and that diminishing margin returns apply mean that basic protection is good enough.

 

The Virtual Keyboard changes all the time, so even if someone could see the action of mouse, it would need to be different next time as the virtual keyboard layout changes.

 

Does KeePass encrypt data when i'm using Auto-Type?
I mean, when i earlier define pass and username in KeePass database, and then i open ex. bank site where i will use key-combination CTRL+ALT+A to start Auto-TYpe which fill username and pass field - is it possible to catch this data by Keylogger?

I tested it on Zemana KeyLogger which found only that i'm using Virtual Keybord (but it is not true, only KeePass Auto-Type i was using)... so KeePass pass i think, maybe i'm wrong

 

Ok, I was wrong.

I repeat the Zemana KeyLogger Test with another configuration, below my conclusions

KeePass version 1.12 failed KeyLogger test (doesn't matter if i used Auto-Type option or copy username/password - in last example Zemana Clipboard-Logger catch all)
so... when you are enter on Banking Site and you fill all field with KeePass v.1.12 then everything can be catch by popular keyloggers!
It is not very optimistic thought, because i believe many people use KP.

I tested also RoboForm (free), and RF pass Zemana KeyLogger Test. It is good news but RF do not works with Opera. (I am using only Opera Browser)

I decide then, to test KeePass 2.05 Alpha and it was for me big surprise.
2.05 Alpha pass KeyLogger Test even if you using Auto-Type option which automaticly fill empty field on the sites. Btw new KP has "Two-Channel Auto-Type Obfuscation" http://keepass.info/help/v2/autotype_obfuscation.html
v2.05 perfect works for me with Opera, Fx, and another browsers or application.
New Alpha offers you easy convert from database from v1 to v2 (from .kdb to .kdbx). I testing this software and works very smooth and i don't feel that is Alpha version. Big possitive for KeePass from me!

I think this verssion of KeePass is really good and strong alternative for RoboForm or Virtual Keyboard - not only storage safe your passwords but secure you until logging on any site too.