Any advice for using passwords and internet banking in internet cafes around the world. It's more the ones in SE Asia that I'm worried about - there's bound to be plenty of keyloggers and stuff on the computers in some cafes. I have heard of taking passwords in an encrypted text file on a USB stick and pasting them in to prevent keyloggers. When SSL / https is used on the client machine can information on the sites still be picked up by the cafe and transmitted information?

Heya jackvull, You kinda answered your own question in a way "there's bound to be plenty of keyloggers and stuff on the computers in some cafes" Because the machine is not your own there could be anything there. There's no way of being able to tell if the operating system has been tampered with, or if there is some kind of designer keylogger, screen capture program running. The browser could be doctored to show that you are visiting a secure site when you're not really. The possibilities of what risks you could be exposing your financial details to are numerous. I wouldn't personally do any internet banking at internet cafes anywhere in the world. Now using public wireless hotspots is a little different because you use your own pc and know what is on it, but even this can be risky. There is a free tool called roboform2go that can be installed on a USB flash drive that will encrypt passwords, use keyless logins and clean up after it is removed from the host machine. Although it is very good and I use it myself I have never used it to do internet banking. Read About RoboForm2Go here

Thanks. I have heard of a program called TrueCrypt to encrypt stuff on the USB stick - might use that to although it seems that you need the program to run it. I doubt internet cafes let you install stuff or have administrative rights to run it off the stick? If IE is encrypting (SSL/HTTPS) on the client then how could the cafe pick up the passwords without a screen capture program?

I'm gonna play the devils advocate here... Let's imagine that you are using a secure encrypted site, and all the details are encrypted when information is sent out to the WAN. All the information is sent out in packets or frames and the host pc has a packet analyser and a decrypter running as well. I guess they could save or copy the packets then run the decrypter to try and crack the information stored within...the minute they have the correct key all the information that is saved is suddenly available to them although you have long since left. Clearing the browser cache won't help because the info has been saved to a separate directory. This is only one scenario that I could think of but it is possible, and these methods are commonly used to analyse network traffic. If the need to do internet banking is vital there are measures to minimise the risk as much as you possibly can. 1) Use the internet at reputable places like libraries or well known hotel chains 2) Put mojopac onto a large capacity USB flash drive or external HDD and run a virtual machine inside their own operating system. 3) Encrypt the contents of your external device 4) Use RoboForm2Go to login so that you don't have to manually do it 5) Install and use a more secure browser in your mojopac than IE 6) Install Ccleaner in Mojopac so that you can always clear the cache files easily and thoroughly 7) Change your passwords often and use secure passwords that aren't easy to crack, and if they do get cracked it won't be in time 8) Review your banking details often to detect any intrusion as early as possible

I now have the following on my USB stick: Opera mini (browser) encrypted with TrueCrypt RoboForm2Go Is that enough? I presume that cafes allow you to run your own software from a USB stick?

I don't see how Mojopac and encryption can work together? TrueCrypt requires administrative access to run it and I doubt this is an option in internet cafes!?

Mojopac creates a virtual environment to operate within another operating system. It's kind of like carrying your own Operating System in your back pocket. You are the administrator when you are running Mojopac, but only within it. The dilemna is running it on a public terminal. I've used Roboform outside of the home but I have never tried Mojopac. The encryption would be applied only to your virtual environment not to the host machine so it will only be run within Mojopac. Any changes, documents that are saved will only be made on the external device that is being used to run Mojopac. Encrypting the data on the external device makes it safer in case it is ever lost or stolen. EDIT: You can add programs like anti-virus and firewall to your virtual operating system to protect your operating system within the hosts operating system too