I want to make my computer SUPER secure

S

slideways666

Limp Gawd
Joined
Apr 30, 2007
Messages
258
I have one computer in the house that i do all my banking and stock trades on.. IM wanting to make this computer uber secure-- yet still be able to access the internet.. What do you guys think the best way to do this is?
 
Last edited:
A proper firewall is the first thing that comes to mind, but isn't everything encrypted at the service level either way? Dont you have to use some kind of authentication token to login to those services along with your username and pw?
 
TPM module installed on the motherboard if able too. Then I would use the drives self encryption algorythm if using an SSD.

Or ...

TrueCrypt your hard drive if using a spinner.

A good, not consumer, not even prosumer, but enterprise firewall is a good start but in the end you cant truly be secure.

With the latest whistleblowing from ex-federal employees the NSA has effectively cracked all known forms of encryption along with installing backdoor software in almost every device on the planet even Cisco.Yes your cellphone regardless of make or model in the last 5 years has NSA software running in it's core code.
 
slideways666 said:
I have one computer in the house that i do all my banking and stock trades on.. IM wanting to make this computer uber secure-- yet still be able to access the internet.. What do you guys think the best way to do this is?
Click to expand...

Hardware firewall, plus OS level firewall, plus make that computer a Linux box. A Linux machine alone with IPTables running should be sufficient enough though.

Mint is fairly user friendly to a Linux newcomer.
 
Make a VM, preferably Linux (less targeted by spyware and crap) and use it strictly for that stuff. The issue these days is it's so easy to get a drive by because all browsers are insecure now even Firefox. It can get hijacked and have malicious sites execute malicious code locally just as easily as IE can now days. Kind of sad.

Cleaned out my parents' computer, it got hijacked and they use Firefox not IE. In fact, Firefox itself was hijacked. If you type a URL it would just go to some scam site.
 
Secure as in secure transmissions, secure as in no one can break in, secure as in someone stealing it and getting data from drive....

Hardware firewall (only open ports needed for those applications and DNS, etc), Linux VM, etc... About as secure as you can get without unplugging things.
 
I LOVE how this thread is going :D
So many smart bro's who understand where we are at. Sad as it may be :mad:
Nice to see such [H]ard input.
 
safe until you click a link on a site you though was safe....so many legit sites get comprimised these days.

Make sure you have AV and a paid subscription for something like malware bytes anti-malware

Firewalls are great to stop exploits on running services and such, but if you have nothing running or "serving" on a port there is nothing to exploit and thus no way to get into a system either way if you got no NAT rules going to a system.
 
MrGuvernment said:
safe until you click a link on a site you though was safe....so many legit sites get comprimised these days.

Make sure you have AV and a paid subscription for something like malware bytes anti-malware

Firewalls are great to stop exploits on running services and such, but if you have nothing running or "serving" on a port there is nothing to exploit and thus no way to get into a system either way if you got no NAT rules going to a system.
Click to expand...

Along the same lines, make sure you're keeping up on your OS and application patches as well. I use both Secunia PSI and the Qualys Browsercheck (advanced option) to help me keep my system current. It wouldn't hurt to read some hardening guides, like the CIS benchmark for your OS, etc.

http://benchmarks.cisecurity.org/downloads/show-single/?file=windows7.120
 
It'll take about 500lbs of concrete to convert it into a safe...

Your data will be very safe then.
 
Use a Linux Live CD, new PC on every boot and you can use just your current one.

Use it in a VM if you don't want to have to reboot your desktop.

No reason to go crazy, you really don't have anything of that much value to warrant spending extra. If you did, you would already know the answers to your questions.
 
tangoseal said:
With the latest whistleblowing from ex-federal employees the NSA has effectively cracked all known forms of encryption along with installing backdoor software in almost every device on the planet even Cisco.Yes your cellphone regardless of make or model in the last 5 years has NSA software running in it's core code.
Click to expand...

No they didn't. There were no breakthroughs in defeating cryptographic primitives reveled and no reason to believe that they have been compromised. There may be certain implementations that have been weakened on purpose or accident (crypto is hard) by some vendors, but that goes to the hardware trust issue you were talking about with the backdoors, which is a perfectly valid concern.
 
Use your Windows Phone browser. No known exploits, no malware. Connect from WPA Enterprise with AES encryption, use a strong passphrase 10 characters or longer. change the password every two weeks. The SSL encryption will take care of the rest.
Or just go to your bank/broker and deal with them in person.
 
devman said:
No they didn't. There were no breakthroughs in defeating cryptographic primitives reveled and no reason to believe that they have been compromised. There may be certain implementations that have been weakened on purpose or accident (crypto is hard) by some vendors, but that goes to the hardware trust issue you were talking about with the backdoors, which is a perfectly valid concern.
Click to expand...

I'm pretty sure there was, and that they even had the root certs to get by SSL encryption as well.
 
Brak710 said:
Use a Linux Live CD, new PC on every boot and you can use just your current one.
Click to expand...
This. Downside is that you may be using older (possibly outdated or insecure) web browsers out of the box. So update them prior to going to your financial websites.
 
Biznatch said:
I'm pretty sure there was, and that they even had the root certs to get by SSL encryption as well.
Click to expand...

I think the most common stance is we don't know for sure, as the NSA won't talk about it. We can be relatively sure the Story is mostly true, as the NSA complained again that civil rights = terrorism, but we don't know how the NSA has weakened cryptography.
I think the common consensus (because it is the simplest to achieve) is an end-run to the root certificates.
Breaking, or finding a master key for AES128 seems unlikely, especially with the stated budget and in light of the known operations (infiltration of businesses/organizations, attempts to weaken/change standards, etc). I am not a crypto specialist, but my understanding is there is no support for an exploitable weakness in AES128 encryption standard- this could possibly be cheaper than the known operations of NSA, depending on hardware requirements. Quantum Computing could certainly crack AES128, but not for the stated budget (IMO)- have you seen the cost of QuantumComputers???.

The other issue comes down to cost/benefit and risk/reward. I don't like the civil rights abuses of the NSA, but that is a discussion for a different forum. From a strict cost/benefit and risk/reward standpoint, nothing has changed for me. I feel I have little risk of losing financial security, as I'm at bigger risk of a hack or exploit by a third party. I'm not willing to spend more money to fix an issue that doesn't exist for me, so I won't implement any different security.

I will be communicating with my elected representatives, but I won't be changing my security practices.
 
Man you have no idea how easily the government will get inside of you.

My friend that was watched by the FBI/CIA for a while ordered some router/modem online. The FBI intercepted the order, and sent him a the same router/modem but with a firmware revision to silently let the FBI sit and observe.

If the feds aren't why you're going incognito then most standard security procedures should keep you in check.
 
You could use a bootable Linux disk but I saw an article recently that said you can still be compromised. But this is what Krebs recommend you do for online banking.
 
Thanks for the reply's guys.. Im not worried about the feds-- they can look all they want.. Im more just trying to keep wandering eyes out.. I only use this computer for banking and stuff like that.. I dont visit sites with it(other then sites i know are ok).. I was just looking for a way to add a level of security to the machine.. I know my router has a firewall built in-- and of course windows firewall is there.. But was hoping to add something to make it just that much more secure.. I like the idea of encrypting all the data.. I dont think the apps i use are available in lynx(i dont use windows apps-- right?).. I was hoping there was a hardware type box-- that i plugged the internet cable into-- then out of there into the computer and that box was a ubber firewall.. lol..
 
slideways666 said:
Thanks for the reply's guys.. Im not worried about the feds-- they can look all they want.. Im more just trying to keep wandering eyes out.. I only use this computer for banking and stuff like that.. I dont visit sites with it(other then sites i know are ok).. I was just looking for a way to add a level of security to the machine.. I know my router has a firewall built in-- and of course windows firewall is there.. But was hoping to add something to make it just that much more secure.. I like the idea of encrypting all the data.. I dont think the apps i use are available in lynx(i dont use windows apps-- right?).. I was hoping there was a hardware type box-- that i plugged the internet cable into-- then out of there into the computer and that box was a ubber firewall.. lol..
Click to expand...

Security starts with you. If you're only using the computer to visit those sites and those site alone, just make sure you:
1. Have Windows firewall enabled (done)
2. Be behind a router with a built-in firewall (done)
3. Put a password on your user profile
4. Have good antivirus installed and fully updated with the newest definitions
5. Make sure you are up to date on all of your browser/OS security updates

More important is to make sure all your passwords are unique for every site and strong. Also, make sure you don't give out your password to phishers. It is significantly more likely that you accidentally give out your password to your banking account than it is for your banking site to be infected by some super-secret APT/NSA 0-day drive-by trojan downloader.

Adding more steps like different distros and vms and bootable linux ISOs makes your banking process more complicated and means you're less likely to go through the hassle every time making you less secure overall.
 
Blackjack-- your right in that if i make it tooooo complicated i might get sloppy and accidentally do something stupid.. Someone should make a small tiny linux computer that acts as a buffer-- so my data would go from the internet into the linux(which from the sounds of things is very secure).. Then out of there and into my finance computer..

So right now I have
1. a new fresh computer that ive only used to go to the two or three banking and stock sites i need.
2. windows firewall-- on
3. router firewall-- on
4. Am going to go through and redo passwords to make sure they are a bit tougher
5.I have a good antivirus on there
6. All updates are up to date.. So good there..
 
@ mizaco

What was your friend 'into'?

I, like most others, am not a security/encryption god but as far as I can tell, for the feds to be spending time/money on watching him, they must have had a very good reason, or at least suspicion...

I have nothing to hide from anyone, that said, I don't want some smart-ass getting on my network for any reason.

My wife's cousin, who is renowned for having a heavily infected laptop.....every time I get it.... she comes round from time to time and asks if she can get on our wifi, I tell here no way and trying to explain why to her and the wife is hard going I can tell you.

All my wireless clients have names assigned and when I log into the unifi software I can see who is and isn't connected... the other day I logged in and there's a Mac address with no name..... I nearly had a heart failure!

I blocked it instantly and noted the Mac and went searching..... in the end, it turned out to be the wife's kindle that I hadn't assigned a name to.

I have no doubt that ALL 'traffic' is being given a passing glance as it goes by, but I don't really think it'll get any more than that unless it is flagged for some reason, if I went online researching explosives or guns (illegal in the UK) and then in another window started researching our prime minister, the queen or Mr Obama himself, I'm pretty sure my 'traffic' would get a little more than a cursory glance....

I would be interested to find out what he was under suspicion of and how he found out his new router had been modified.
 
Last edited:
Ehren8879 said:
Hardware firewall, plus OS level firewall, plus make that computer a Linux box. A Linux machine alone with IPTables running should be sufficient enough though.

Mint is fairly user friendly to a Linux newcomer.
Click to expand...

This is what I was going to suggest.
 
you can also use some add-ons in Firefox like no script and disable java. Also don't run in admin of course, and hardware firewall. Encrypting the drive is more for theft. Other things, don't use adobe, word or flash.
 
Get rid of Windows first off. Microsoft couldn't be trusted with a needle and thread much less their massive consumer base. Here are my general opinions on setting up an extra secure browsing experience. The paranoid need only apply :)

Linux box , either Live or installed. If its Live I recommend : https://tails.boum.org/about/index.en.html , relies on encryption , uses some pretty clever software in the backround and is great for anything you deem "mission" critical important. If its installed .. well that's largely up to your personal taste. I would the bigger ones that incorporate cloud options (do not trust the cloud with sensitive personal information) so any of the lesser distro's should be alright. Check around and see what you might be into , trying them out doesn't hurt.

Next you'll need a VPN. I HIGHLY recommend you use a VPN NOT based in the western world , somewhere in Asia right now seems like a safe bet. I use Torguard and they do not keep logs of their customers and so far have been easy to work with. AirVPN is also great , well run site that heavily encourages its consumers to take all steps to stealth their activities online. Its important to remember that even if you use a VPN server in a different country that the VPN's site of origin is still subject to that countries governmental activities. So if you use a VPN based in the US but use a server in the Netherlands , its still not fully trust worthy anymore. Assume anything in the states is compromised and that should keep you out of trouble.

If you wanna be super paranoid then use TOR. It's slow as fuck but almost everyone recommends it continuously. DO NOT use TOR for anything like P2P , mixing TOR + VPN equals a very decent setup as well but it won't be something you'll use 24/7 due to the speed impact.

Its going to take more than just a different OS and proxy type connection , you need to also be careful of what kind of software you trust. If you are using Chrome , kiss it good bye. Google is way under the sheets with the US Government , from just about all the way top to bottom so its not a trust worthy browser anymore plain and simple. Firefox is the best option because its so well supported with a huge community of open source and trust worthy developers who strive to prevent intrusive predators like governments , hackers and the like. Don't use Gmail either , Google actively scans every piece of email that comes in and happily admits it. After the recent events of Lavabit , an off shore email provider might be a good idea , just remember ..location.. location... location.

You need to get into the habit of making intelligent passwords and changing them frequently. You need shed all those lazy habits of surfing , you know the kind I'm talking about as we've all developed them under a security blanket that encryption was safe and sound across the net. But we know the truth now , every tech company is scrambling to close its backdoor access and do an about face on its internal policies regarding ass kissing the international intelligence community abroad (make no mistake the US is far from the only one doing this kind of intrusive behavior). Use thing's like Https Everywhere , Noscript and of course turn off any and all cookies/tracking options. Also consider your smartphone , there isn't much you can do to secure it even with a VPN client and TOR on it as both major mobile OS's are pretty well compromised constantly. I highly recommend doing ZERO sensitive activities on smartphones , use your smartphone for chatting about anything but sensitive topics and never for anything really private or about your money (savings or stock holdings).

In the end being overly paranoid will help but honestly with a $150 million dollar yearly budget to throw at breaking encryption (for the NSA at least) there just might be jack shit you can do about it. GPU's have changed the decryption game so massively over the last 6 years its not even comical and in fact about a week or so ago there was a piece of software updated to support GPU's to break passwords over 55 characters now so even small time criminals are getting more and more powerful (of course its generally software targeted to databases so it isn't likely to be applied to you directly). Its only going to get easier the types of bodies of power to break into various forms of security as time goes on.
 
Last edited:
What the fuck does he need a VPN and Tor for if he logs into his bank? Without any appreciation for the attack scenario you're throwing random buzzwords around. Good job.

If its Live I recommend : https://tails.boum.org/about/index.en.html , relies on encryption , uses some pretty clever software in the backround and is great for anything you deem "mission" critical important.
Click to expand...
Hilarious. Are you a marketing weasel?
 
TCM said:
What the fuck does he need a VPN and Tor for if he logs into his bank? Without any appreciation for the attack scenario you're throwing random buzzwords around. Good job.

Hilarious. Are you a marketing weasel?
Click to expand...

I mentioned that my recommendations where for the paranoid , guess you didn't read that or just felt the compulsive need to respond without the basic requirement of prior information.

Marketing weasel? For recommending a secured Linux Live distro based on personal experience? If you don't like my recommendations that's fine but cut out the insults while you are ahead , they don't fly around here.
 
Godmachine said:
Marketing weasel? For recommending a secured Linux Live distro based on personal experience?
Click to expand...

Fine. Explain 'relies on encryption, uses some pretty clever software in the backround and is great for anything you deem "mission" critical important.' cause it's just BS.

Relies on encryption. Uh yeah, HTTPS does that, too.

Pretty clever software in the background? What is that supposed to mean at all?

"Mission" critical important. Pleeaase, my BS detector just broke.

The thread is about making a computer secure for banking and trading. VPNs and Tor have no place whatsoever here. None. Zero.

Run NoScript+RequestPolicy in the browser, don't run plugins. Run from a LiveCD or snapshotted VM. Revert or turn off after every session. Done. If you're overly paranoid that you catch something in a single session and you want to contain it, run a firewall that blocks everything _outgoing_ except your bank and trading website.
 
ITT: Posts that us real security people laugh at.

Honestly, you do not have the assets or information worth spending the time stealing. You've got people in this thread offering plans to build Fort Knox to protect a few copper bars. It's too much, and quit worrying. All of this borders on irrational paranoia.

I don't see how you could get your Windows box infected if you only used the computer for banking. If the bank site is what gets hacked, you're screwed anyways. Your router and windows firewall keep out any incoming traffic, and I would assume you're not shuttling infecting things over on flash drives.

If you're THAT concerned about having your system get compromised, use the LiveCD method. If you're concerned about DNS hijacks, hardcode the IPs to the bank domains in your hosts file and disable DNS. You do not need a VPN or Tor. The only exception would be if you wanted to do mobile banking on public wifi hotspts, then I would say you need a VPN... But a VPN to your home internet (using your router) would be more than enough.

You're doing personal banking, not operating the worlds largest botnet's command and control.
 
There's only so much you can do before the effort is not worth the reward.

My opinion is:

Windows 7....UAC and IE protected mode on, running a limited account.

A decent internet security suite, make sure it is properly configured to be aggressive without being annoying.

Use Chrome as your browser of choice.

Install and use No script.

Disable JAVA in the browser

Run http://secunia.com/vulnerability_scanning/personal/ monthly and verify/weigh your security risks.

Use a modern router/firewall, make sure the security settings in the router are properly configure.

Connect to the router with a physical ethernet cable.

If you share your internet with anyone else or any other client type device place them or yourself in your own Vlan.

Be your own champion and educate yourself about the dangers of phishing and other vectors for trojans, worms and forms of malware.
 
TCM said:
Fine. Explain 'relies on encryption, uses some pretty clever software in the backround and is great for anything you deem "mission" critical important.' cause it's just BS.

Relies on encryption. Uh yeah, HTTPS does that, too.

Pretty clever software in the background? What is that supposed to mean at all?

"Mission" critical important. Pleeaase, my BS detector just broke.

The thread is about making a computer secure for banking and trading. VPNs and Tor have no place whatsoever here. None. Zero.

Run NoScript+RequestPolicy in the browser, don't run plugins. Run from a LiveCD or snapshotted VM. Revert or turn off after every session. Done. If you're overly paranoid that you catch something in a single session and you want to contain it, run a firewall that blocks everything _outgoing_ except your bank and trading website.
Click to expand...

Seriously do you have an axe to grind or something? I really don't feel like explaining something that you can Google to figure out. Stop trying to instigate flaming in this thread. That's really all there is left to say to you.

Now onto other responses.

Its obvious that I'm not alone with my heavy usage of a VPN , Tor is certainly a paranoid step but if you want an extra layer of security its a very reliable platform for anonymity.

Also what if he's out and is using public Wifi? While Noscript is great and all I personally wouldn't connect to any public Wifi without a VPN and if I wanted to be assured of my privacy I would also use Tor. He's probably a day trader and that's a bit more serious than if he was simply checking his account balance all day. Its obvious some of you have far more faith in a more basic setup than I do which is fine.

As everyone has mentioned good surfing habits are more important than anything. I would rather be paranoid then get hacked or compromised. I know that I personally tend to go for the extreme measures but with literally daily reports of how badly broken encryption is .. it doesn't seem like it would hurt to exercise a bit more caution.

OP you have to decide what's worth while for you. If you don't feel incredibly concerned then at least you have some know how of what to do if you decide to become more concerned.
 
Godmachine said:
Get rid of Windows first off. Microsoft couldn't be trusted with a needle and thread much less their massive consumer base. Here are my general opinions on setting up an extra secure browsing experience. The paranoid need only apply :)

Linux box , either Live or installed. If its Live I recommend : https://tails.boum.org/about/index.en.html , relies on encryption , uses some pretty clever software in the backround and is great for anything you deem "mission" critical important. If its installed .. well that's largely up to your personal taste. I would the bigger ones that incorporate cloud options (do not trust the cloud with sensitive personal information) so any of the lesser distro's should be alright. Check around and see what you might be into , trying them out doesn't hurt.

Next you'll need a VPN. I HIGHLY recommend you use a VPN NOT based in the western world , somewhere in Asia right now seems like a safe bet. I use Torguard and they do not keep logs of their customers and so far have been easy to work with. AirVPN is also great , well run site that heavily encourages its consumers to take all steps to stealth their activities online. Its important to remember that even if you use a VPN server in a different country that the VPN's site of origin is still subject to that countries governmental activities. So if you use a VPN based in the US but use a server in the Netherlands , its still not fully trust worthy anymore. Assume anything in the states is compromised and that should keep you out of trouble.

If you wanna be super paranoid then use TOR. It's slow as fuck but almost everyone recommends it continuously. DO NOT use TOR for anything like P2P , mixing TOR + VPN equals a very decent setup as well but it won't be something you'll use 24/7 due to the speed impact.

Its going to take more than just a different OS and proxy type connection , you need to also be careful of what kind of software you trust. If you are using Chrome , kiss it good bye. Google is way under the sheets with the US Government , from just about all the way top to bottom so its not a trust worthy browser anymore plain and simple. Firefox is the best option because its so well supported with a huge community of open source and trust worthy developers who strive to prevent intrusive predators like governments , hackers and the like. Don't use Gmail either , Google actively scans every piece of email that comes in and happily admits it. After the recent events of Lavabit , an off shore email provider might be a good idea , just remember ..location.. location... location.

You need to get into the habit of making intelligent passwords and changing them frequently. You need shed all those lazy habits of surfing , you know the kind I'm talking about as we've all developed them under a security blanket that encryption was safe and sound across the net. But we know the truth now , every tech company is scrambling to close its backdoor access and do an about face on its internal policies regarding ass kissing the international intelligence community abroad (make no mistake the US is far from the only one doing this kind of intrusive behavior). Use thing's like Https Everywhere , Noscript and of course turn off any and all cookies/tracking options. Also consider your smartphone , there isn't much you can do to secure it even with a VPN client and TOR on it as both major mobile OS's are pretty well compromised constantly. I highly recommend doing ZERO sensitive activities on smartphones , use your smartphone for chatting about anything but sensitive topics and never for anything really private or about your money (savings or stock holdings).

In the end being overly paranoid will help but honestly with a $150 million dollar yearly budget to throw at breaking encryption (for the NSA at least) there just might be jack shit you can do about it. GPU's have changed the decryption game so massively over the last 6 years its not even comical and in fact about a week or so ago there was a piece of software updated to support GPU's to break passwords over 55 characters now so even small time criminals are getting more and more powerful (of course its generally software targeted to databases so it isn't likely to be applied to you directly). Its only going to get easier the types of bodies of power to break into various forms of security as time goes on.
Click to expand...

I don't know why I feed the trolls but here goes. Windows is plenty secure, it has the same model as nix for a very long time. Talk to me about Linux malware sometime, and the problems I'm seeing with customers patching their windows boxes and then leaving their Linux boxes unpatched for years and surprised they got popped. The operating system on Windows isn't getting popped, it's Java which happens on unix as well.

Browsers: Firefox is the least secure browser out there, since they still don't use a proper sandbox, both IE and Chrome do. (Yes, you can download sandboxes to make it a proper browser, shouldn't have too)

Brak710 is right, if this computer is only used for banking, you're doing something better than the high 90's of computer users.

This posting is provided "AS IS" with no warranties, and confers no rights.
 
One thing I've been playing with lately is vlaning. Have all vlans controlled by the firewall and separate stuff. For example have the wireless on a separate vlan, make it only allow the things you need over wireless, block everything else. You can also have a "public" wireless, that has an easier password and that's what you get people to connect to, block everything but the internet. You can even go as far as blocking all ports but 80, 443 and maybe email related ports. Basically it's strictly web surfing.

If you have "risky" machines on your network like a torrent box, perhaps make another vlan for "risky" stuff, and that way if it gets compromised they can't access anything else. Only allow the stuff that's needed.

For the browser, maybe have a VM strictly for browsing. Have that VM on the "risky" network. Since it's dedicated to browsing it could also be setup to revert every time it reboots. You'd want a way to easily save your favorites though.
 
Ranma_Sao said:
Browsers: Firefox is the least secure browser out there, since they still don't use a proper sandbox, both IE and Chrome do. (Yes, you can download sandboxes to make it a proper browser, shouldn't have too)
Click to expand...

That's an interesting statement because at one point FF was evangelized as being more secure than IE, but I think you're actually right, even IE is more secure than FF now. It's really sad to see they let it slip so much. It would be interesting to do tests with each browser to see which one brings the most viruses to the machine without user intervention by simply googling for stuff like porn and warez. (ex: clicking yes on a browser generated popup)
 
You must log in or register to reply here.
Back
Top