Accessing the internet while travelling overseas

[MJ]

I am leaving for SEA in November and will be away for 6+ months. I am having 2nd thoughs about lugging my heavy 6+ lbs laptop. For those of you travelling overseas without a laptop, how do you securely access your financial online accounts? I am setting up scheduled monthly money transfers to my ATM withdrawal accounts and bill payments to minimize online transactions but, I feel nervous about checking the status of some of my accounts or buying/selling stocks/funds online. In researching this issue, I read too often about the strong possibility of user ids and passwords being stolen. I know one of the members uses internet cafes in Thailand to access his financial accounts and has not had a problem (so far). Has he just been very lucky? Someone suggested that internet cafes in a large hotel "might" be more secure.

Anyone care to comment.

 

[donheff]

Mozilla has a mini-browser that you can launch from a USB key, that will protect you from some stuff. But if someone planted a key-logger program on the PC you would still be out of luck.

If you will be using PCs that allow users to boot from the CD ROM you could bring a bootable Knoppix Linux disk. The bootable disk will launch a stripped down version of Linux complete with a Firefox Browser. I think Ubuntu also makes a desktop version of Linux that boots from a CD. The problem is most Internet cafes probably have the machines set not to permit a CD boot and password protect the BIOS so you can't reset it,

 

[dex]

This is a great question. Besides lugging the laptop you will need to take an aray of plug adaptors. I would not like to check my bank account info from an internet cafe either.

There are financial agrigators http://corporate.yodlee.com/ that allow you to view your info.

The mini browser is a good idea.

So what are the options?

 

[justin]

Try copy-pasting your user ID and password into the entry boxes. I think that should get around most key loggers which capture all key strokes from a keyboard.

You could also copy-paste part of your ID a little at a time, and copy-paste other stuff to a text file in between ID/password copy-pastes. If someone is capturing all text input from any sources, this might be enough to at least make reducing the raw text capture file to a useable set of ID/pw difficult enough that they would pursue other victims. (ie - you don't have to outrun the bear, you just have to outrun your friends).

 

[audreyh1]

I guess buying a smaller, lighter laptop just for this purpose is out of the question? That is what I would do.

No way I'd use public computers to access my financial records.

And besides, I have to have somewhere to download images from my digital camera.

Audrey

 

[yakers]

A few years ago, in remote places (ike the small islands off Fij) it was difficult to make internet connections, It took me 6 minutes to send an email once from Aitutaki and cost $6. But times have changed and now the best way I have found is to connect wirelessly. I prefer this to the hardware in internet cafes (try using a French keyboard in Tahiti, and what kind in Japan or China?). Find a big hotel, or anywhere with an open connection.
My computer is a 15" and my wifes is a 14", I would prefer a 12 or 13" for travel but I don't want to travel without a laptop. Its the internet connection, picture downloading, DVD watching and game playing as well as work, of course.

 

[shiny]

I agree with Audrey, I'd buy a new, smaller device. I saw a tiny computer - it was a Sony, but I'm not sure it is was a prototype or if it is out yet.

By SEA, did you mean Seattle?

 

[eridanus]

You can use the on-screen keyboard in Windows to protect against key-loggers.

All Programs->Accessories->Accessibility

 

[kcowan]

You can use the on-screen keyboard in Windows to protect against key-loggers.
All Programs->Accessories->Accessibility

On-screen Keyboards

Program-To-Program (Non-Web) Keyboards
It is sometimes said that a third-party on-screen keyboard program is a good way to combat keyloggers, as it only requires clicks of the mouse. However, this is not true, because a keyboard event message must be sent to the external target program to type text. Every software keylogger can log the text sent as typed characters from one program to another with an on-screen keyboard, and additionally, some programs also record or take snapshots of what is displayed on the screen. (Screenshot recorders are a concern whenever entire passwords are displayed; fast recorders are generally required to capture a sequence of virtual key presses.)

Web-Based Keyboards
Web-based on-screen keyboards (written in Javascript, etc.) may provide some degree of protection. At least some commercial keylogging programs do not record typing on a web-based virtual keyboard. (Screenshot recorders are a concern whenever entire passwords are displayed; fast recorders are generally required to capture a sequence of virtual key presses.)

According to Wikipedia

 

[LOL!]

I always just take my laptop. It is under 5 pounds (Dell Latitude D600). I have never used internet cafes. I use wireless at hotels or DSL line in the room. Occasionally I have to use dial-up, but I have an international calling card with toll-free numbers for every country.

I have ZoneAlarm, and Sophos anti-virus. I have never had a problem.

As a backup, I have a spouse who can check things from home, but has never had to do so up to now.

I also use my blackberry sometimes to do web browsing, but not bill-paying.

 

[eridanus]

According to Wikipedia

Bummer. I stand corrected.

 

[Nords]

MJ: Kramer has an excellent thread on Raddr's board to jump-start your creative spending. http://www.raddr-pages.com/forums/viewtopic.php?t=2228

Bummer. I stand corrected.

There's a cheaper way to get out of this situation.

Use whichever keyboard you want, but type your access data out of order. Type the middle three characters, reposition the cursor to the front and type the first three characters, go to the end and type the last three characters, and so on. Delete a character or two for variety and start over. The data stream will be confusing enough that it won't be worth the keylogger's time or effort...

By SEA, did you mean Seattle?

I didn't see the smiley face in your post, so I'm gonna go with "Southeast Asia"... he's spent a little quality time there already and is now optimizing the experience...

 

[shiny]

I didn't see the smiley face in your post, so I'm gonna go with "Southeast Asia"... he's spent a little quality time there already and is now optimizing the experience...

Thanks for the explanation - there wasn't a smiley cause I was serious. I thought maybe he was coming here to take a flight there since SEA is the airport code for SeaTac. (EVA and Thai both fly from here).

 

[donheff]

Use whichever keyboard you want, but type your access data out of order. Type the middle three characters, reposition the cursor to the front and type the first three characters, go to the end and type the last three characters, and so on. Delete a character or two for variety and start over. The data stream will be confusing enough that it won't be worth the keylogger's time or effort..

Combine this with Justin's copy/paste suggestion and you have probably covered yourself against keyloggers pretty well. Watch out that you are using SSL to cover the interception of the transmitted data stream and you should be good to go.

 

[MJ]

I'm off to a lunch appointment so I need to make this short.
This is my 1st long trip abroad and don't know how much i'll miss my laptop so I have also thought about getting a smaller one but they still aren't as small as the pocketPCs that were around 4 to 7 years ago. Besides, I am running out of time to get one.

SEA = Southeast Asia (Nords got it)
Regarding copy paste, I thought about that too but from what I read key loggers can capture a paste as well.
I have 2 USB flash drives and have many portable apps loaded, firefox, thunderbird, clamwin (AV) etc. but using them doesn't prevent virus/worm attacks or keyloggers.
coming from the host PC
I was looking for virtual KBs but have not found any so far that are known and secure

Thanks for all the comments. I'll keep searching.

Got to run.

 

[MJ]

Thanks for the link. Nords

 

[kramer]

Hi MJ,

Just a few quick comments (in addition to the raddr board thread):

* There is no way to safely access the internet on someone else's client (e.g., with the computers at an internet cafe). There are ways to make it safer using portable apps (your own apps on your memory key), visual keyboard input, run your own spyware/virus checker on the system, etc. But it is inherently insecure and the risk is no longer low. Cut and paste does not avoid this problem. One plausible solution is to bring your own linux drive/flash/CD and boot off that, but I doubt most cafe owners would let you do that and there could be configuration issues.

* IMO, it is pretty safe to use a wireless access point on your client (or to plug your firewalled client into a network). Especially if you have good reason to trust it (you are sure it is not random wayward network spoofing brokerage sites). Also, sites like Vanguard now display a custom image associated with your account, before you type in a password, to avoid the spoofing problem.

* Your client choices are probably a light laptop or a higher end PDA. You can get a decent laptop at something like two pounds now, but they are expensive and fragile. You can get a VGA (640x480) PDA (6 ounces) with Wi-Fi, bluetooth, etc., for about $350 now (X51V from Dell, partly because Dell is getting out of the PDA business). If you get a PDA, and you are not a guru yet, there is a learning curve to using it and you will need to purchase some accessories.

* If you go with a PDA, make sure that your brokerages/banks allow access that way and that everything works OK, since the browsers are not as full featured as a desktop. Sometimes they brokers disable that capability on purpose for some reason (I heard Vanguard did this), and you need to trick the site into thinking your browser is on a PC (IE and other browsers on Windows PPC edition allow this, apparently it is trivial).

* What I like about a PDA is that you can carry it with you. I have visited a couple of countries where carrying a laptop even a few blocks in public was simply not an option for security reasons, and I hate lugging stuff around. You can read books on a PDA at the coffee house, opportunistically surf the web wherever there is Wi-Fi (you only need guaranteed security for a few sites, otherwise it does not matter), you can add GPS, you can run Skype on a PDA, etc. You can view movies on it (although these require preformatting, I had figured to preformat my own movies at home and put them on my web site for access on the road although memory sticks are so cheap now . . .). Notice how there is a learning curve to most of these things . . .

* The new Sony Reader might allow you to get English language books over the internet easily overseas ( http://ebooks.connect.com ). Or you could just focus on regular e-books (this is different from Sony's proprietary format) to read on your PDA + laptop. There are lots of free e-books. The Sony Reader might be fragile and it is really just first draft technology.

Also, please feel free to inbox me with email address if you have more questions. It took me awhile to build up knowledge in this area and I am still learning. I may not be on-line a lot this weekend, though.

Kramer

 

[MJ]

Thanks Kramer. I just registered with Raddr so I could reply to your thread. Your reply here saved me the trouble time.
1st thanks for your research. I also looked into Dell's Axim but apparently it wasn't obvious to me that it had more capabilities than media and sound. It sounds like it could be what I am looking for but since I am leaving in 3 weeks, I don't know if I buy the unit and I can get it functioning as working pocketpc. For this trip, I may have to settle on making occasional phone calls to transact my business. I'll bring my USB flash drives loaded with portable apps just in case I make friends with expats with secure home PCs and internet access. Perhaps I'll also bring along a bootable CD on the chance that I can find an internet cafe that will let me use it. I made friends with a owner of one, last time I was in Chiang Mai where I'll spending most of my time, hope he is still in business. Those solutions won't weigh me down too much.

 

[donheff]

Great post Kramer. I have never bothered with a PDA but I do plan to start travelling more extensively. Can you tell me a little bit more about the movies. Do the PDA have USB slots for memory sticks or do they use proprietary? What do you have to do to the movies to view them on the PDA? Any recommendations on best PDAs? Best to get one that is also a phone or do they tend not to have regular wifi capabilities?

 

[Ed_The_Gypsy]

Vagabond,

Suggest you take a second memory stick with all the same stuff on it for back-up. I am here to tell you that they die. A CD would also be a good idea. All this doesn't take up much space.

Kramer,

Thanks for the details! I have long worried about the very same thing. Much obliged!

Ed

 

[Nords]

* The new Sony Reader might allow you to get English language books over the internet easily overseas ( http://ebooks.connect.com ). Or you could just focus on regular e-books (this is different from Sony's proprietary format) to read on your PDA + laptop. There are lots of free e-books. The Sony Reader might be fragile and it is really just first draft technology.

I was pretty excited by this impending release until Business Week's tech columnist gave it a "not yet ready for prime time" rating. It works, and it's a great way to get an English-language book in Bangkok if you have the bandwidth, but so are used/exchange bookstores.

 

[MJ]

Vagabond,

Suggest you take a second memory stick with all the same stuff on it for back-up. I am here to tell you that they die. A CD would also be a good idea. All this doesn't take up much space.

Ed

I do have 2, One is a 1G U3 smart drive and the other a 2G regular drive. The U3 will have the skype software and other portable apps coming from http://software.u3.com/softwarecentral.aspx?skip=1. and the other will be loaded from http://portableapps.com/

 

[free4now]

Use whichever keyboard you want, but type your access data out of order. Type the middle three characters, reposition the cursor to the front and type the first three characters, go to the end and type the last three characters, and so on. Delete a character or two for variety and start over. The data stream will be confusing enough that it won't be worth the keylogger's time or effort...

I used this method while I was on my Round the World trip (which included months in southeast asia), and never had any problems. You might want to also do this out of order typing when you are entering the URL of your financial instution, so that it won't come up in a text search of a keylog. It wouldn't be enough to protect your info against a determined attacker (like the FBI or homeland security for instance) but most criminals are criminals because they are lazy so it thwarts them. In addition I took the following precautions:

I changed my passwords just before and just after the trip.

For my really important accounts (e.g. bank and brokerage) I would change the passwords more frequently, every few times I logged in.


You will find that especially in Southeast Asia, it's difficult to find cybercafes or other places that will let you plug into their ethernet or wifi, so even for the portions of the trip when I brought a laptop I usually ended up using cybercafe terminals for most of my web access.

 

[Lancelot]

Hey MJ,

Heading over to Bangkok? How about some Tom Yom Kung and Som Tam at Ba Jazz's restaurant?

I'm not a techie, but I've used Internet cafe's in Thailand, Cambodia, the Philippines, China... and never had a problem. I use the "Nord's" method, trying to scramble the password with several false entries and backspaces. So far so good...

Keep in touch,

Lance

 

[wheel9]

Best option is to have a 4GB usb key, or a laptop size portable hard drive and run something like http://mojopac.com/portal/content/hellomojo.jsp;jsessionid=877E4502A3F76B4ACB63FAB60148E114 this on the key. It is a virtual machine that piggy backs onto the host machine. You install your own software on it. I have a 512MB key that has mozilla with all my bookmarks and logins, outlook express, and acrobat on it. I have my VPN info on it and I have used it to log in to the office when the host machine would not let me do so.

I can plug into any Windows machine and have my own environment. When the key is removed, there is no trace of my having been there. They have a demo that you can try. You can even load full versions of your favorite software, which would increase the size needed for the drive. There is a cost for the program, but for the convenience, it is well worth it.

For the more frugal types, http://www.moka5.com/ MOKA5 is a free download that allows you to load full linux environments with Open Source software. It is not as polished and requires more space and takes a little longer to load, but is is FREE for now.

I have started to travel with these and I have always found a PC or laptop to piggyback onto. Much lighter to carry also 8)