Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am going to be traveling out of the country to a pretty questionable area and I would like to be able to access my online banking while I am away. If I were taking my own computer, this wouldn't be an issue, but that is not an option. All I will have access to is a "Internet Cafe", presumably with Windows computers. I am assuming that I will have no ability to install any software on the computer, but I am assuming I would probably be able to run software off of a USB drive.

I know that the main options (although feel free to suggest others) are SSH Tunneling and VPNs. Unfortunately, I do not have access to configuring my home router, thus making SSH and VPNs very difficult to set up.

So far I have found teamviewer, which has a VPN component, but it is unclear whether this allows all network traffic to be routed through the connection without admin rights.

Another option would be to install firefox on the USB drive and use proxyfoxy, but again, I run into the issue of not being able to configure the home router.

TLDR: I'm looking for a VPN or SSH Tunneling application that can run from a USB drive (no setup) that does not require dyndns on the backend.

EDIT: I am aware of the keylogging issues, but in reality I would probably use a virtual keyboard. I am more interested in creating a secure connection to avoid packet sniffing and such.

share|improve this question
so you are ok with keyboard / mouse sniffing but not ok with paket sniffing? :) from an insecure computer no secure connection is possible. eos. and no, a "virtual keyboard" does not help either. do you want to run a "virtual monitor" as well? maybe they take 25fps snapshots of what you see, including the "virtual keyboard". – akira Jul 29 '11 at 15:02

The problem I see is that you are not going to be able to install anything like VPN software on these Internet Cafe computers, and even if you did, they could have keyloggers installed, leaving you very exposed.

Frankly, I would in no way access my bank from any of them, and I would abandon your current plans.

As a note: At least with TeamViewer, you could run the Quick Support version, which does not require installation, but you still could fall prey to the keylogging aspect.

In other words, you can make the connection in the middle secure, but not both ends of the connection.

share|improve this answer
Every bit of information you send to your home computer goes through the local, possibly insecure, computer. EVERY bit of information you use to logon, even if remotely, could easily be intercepted. How does it get from you remotely to the home computer? Through the insecure computer. You simply cannot do that securely. – KCotreau Jul 28 '11 at 21:27
The chances are not high, but are real. Good luck. – KCotreau Jul 28 '11 at 21:50
If the bank login information is saved on the remote computer, how would that be intercepted by the insecure computer? - Because the insecure OS that you enter your credentials on is the electronic equivalent of somebody looking over your shoulder and writing down which keys you press. If what you are suggesting is true, then there would be no problems with malware in the "real world", which obviously isn't the case. If you really want to do this, then I suggest 1) that you create a seperate bank account that you will only access from insecure locations, and keep a minimum amount... – Joe Internet Jul 28 '11 at 22:14
...of money in it. Keep refilling this account from another method (PayPal, secure account) that you only access from a secure location that you trust. And 2) that you find a good security-focused live-cd/usb that you can boot a pc from, even in an internet cafe. I would go with a cd if possible, to prevent anything from writing to the medium. Ideally, the OS would run from RAM. This is about as secure as you'll get, and even this is not 100% foolproof. – Joe Internet Jul 28 '11 at 22:20
@grawity I am well aware that physical access to the computer gives complete control. I am not as concerned about the owner or employees recording the information as much as the computer simply being poorly managed (and thus probably running malware). – viking Jul 29 '11 at 0:41

Unless you use one time passwords (which are difficult to setup) or smartcard-like devices, everything you can do on that insecure computer can be recorded and replayed. E.g. they can record the user name you use to log-on to your remote machine and copy your certificate. Sometimes even by viewing the information displayed on your online banking page, they can use some social engineering-based tricks to access your account while you're away.

A better way is to bring a Linux Live CD with you and boot from that. Then connect via a secured link to a trusted computer.

If you don't control your home router, you can easily open a free server on Amazon EC2. You can either use that machine as a VPN server or use it as your trusted host directly.

share|improve this answer
+1 for Linux Live CD, although they still could have a hardware keylogger. I guess that's pretty unlikely though. – houbysoft Jul 29 '11 at 1:44

Idea #1 - Get a new home router that does allow you to configure SSH (they are pretty cheap)

Concern about that idea -- Many internet cafe's limit the ports that can be used for outgoing connections... You might be limited to port 80 traffic only which would make ANY sort of SSH very difficult to use.

Idea #2 - Setup OpenVPN (or another VPN tool) on your home computer and use your router to forward the VPN port to that machine... Takes more configuration than using a built-in proxy service on your router, but it's free ;)

Idea #3 - Team Viewer on a USB drive is probably the easiest/best option listed so far... Use that along with KeePass and you will probably be okay. Again though depedns on how locked down the computers are, and how locked down their internet connection is.

Idea #4 - If you can't get anything else... You could just call your bank :)

As for the keylogger issue, I'd use KeePass... You can use a portable version and if you use the hotkey assignment for typing passwords instead of the copy/paste you can set an option for Two-channel auto-type obfuscation

Good luck!

share|improve this answer
Regarding your comment -- "you might be limited to port 80 traffic" -- that's not really a problem for SSH; just run it on a different port. I do this often to bypass exactly this type of restriction and it works just fine. – houbysoft Jul 29 '11 at 1:43
This isn't that bad of an idea. – surfasb Jul 29 '11 at 3:24

If you are able to boot from USB or CD, the Lightweight Portable Security (LPS) Linux distribution by the US Department of Defense will provide a secure environment:

LPS-Public turns an untrusted system (such as a home computer) into a trusted network client. No trace of work activity (or malware) can be written to the local computer.

LPS is designed to run from read-only media and without any persistent storage. Any malware that might infect a computer can only run within that session.

A user can improve security by rebooting between sessions, or when about to undertake a sensitive transaction. For example, boot LPS immediately before performing any online banking transactions.

DistroWatch have a review here:

The idea seems to be that most publicly-used operating systems are easy to compromise and so it would be a good idea if people could use a computer without the risk of exposing their credentials and private data to malware, key loggers and such.

(Thanks to The Linux Action Show for mentioning this.)

share|improve this answer
Now that I think about it, I don't see how this could block hardware keyloggers. But, it's partly your bank's responsibility to make this attack awkward, e.g., by only asking for certain characters from your password or pin number, or by asking for them in a random order. – sblair Jul 28 '11 at 22:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .