Tab Based Banking protection
Could F-Secure's banking protection feature only apply to the browser tab and not the entire browser? Would a tab-specific implementation be weaker in terms of data security?
Comments
-
In general, current F-Secure's Banking Protection feature is system-wide now. I mean, not really 'entire browser'-only.
Although I think that in the past and before this, it was even much more powerful system-wide implementation (including general network / browsing protection features) than it is now, and kind of long time now; but I do not think that intention was to lower scope of it to 'browser' or 'concerned tabs'.
Thus I do not feel that applying only to browser tab is a good move - at least - if we do not talk about something completely different than it is now.
And it is likely a tab-specific implementation can be weaker in terms of data security. // Or, well, maybe a bit more tricky to implement or guarantee something stable.
Moreover, it is likely or often the case that there is little opportunity to provide any "extra" security if only one browser tab is used (the bank), for example. It is expected to be a safe experience; otherwise system-wide takes or browser-wide tweaks are important (since the risks will increase from there).
sorry for comment.
-
"In my view, this kind of implementation can offer several clear advantages. First, it allows protection to be targeted precisely at the moment when the user is interacting with a bank or another sensitive service. That makes the protection model more precise: stricter security measures can be activated in the right context without unnecessarily disrupting the rest of the browsing session or the normal use of the system.
Another important advantage is usability. Broader system-wide or browser-wide restrictions can sometimes cause problems with other network traffic, payment flows, redirects, or parallel activity. A tab-based implementation may reduce these compatibility issues and make banking sessions smoother for the user without requiring them to disable or work around the protection.
Third, a tab-specific model may be technically well justified in the modern browser environment. Today’s browsers already rely on isolation between different sites and processes, so applying banking protection specifically to the relevant tab can be an efficient and logical way to build additional protection on top of the browser’s existing security mechanisms.
This model also has the advantage that protection can be applied in a more controlled and focused way. Instead of restricting all surrounding activity equally, tighter monitoring, warnings, or traffic controls can be attached specifically to the high-risk session. That can improve the balance between security and usability.
I also see it as possible that a tab-based model may reduce false blocks and unnecessary alerts. When protection is targeted precisely at the banking or payment page, the user’s other normal activity is less likely to be treated as suspicious or problematic. This may increase trust in the feature, because the protection does not feel excessively heavy or intrusive.
For these reasons, I believe tab-based banking protection can offer significant benefits if it is implemented carefully and if it provides a clear, purpose-built layer of extra protection exactly when the user is engaged in sensitive activity. At its best, such a design can provide a strong combination of precise protection, better compatibility, and a smoother user experience."
-
// sidenote: I am talking (primarily) about the Windows platform. So, other platforms might likely benefit more from a different design approach.
Well, it depends on the vectors or risks that exist for the user during banking transactions or using bank website.
Most of current features and options within Banking Protection (such as: ""Disconnect command-line and scripting tools"" / ""Clear the clipboard after banking sessions""; and the rest of them) represent direct actions against rather "specific" vectors or threats. A tab-based approach won't do that.
Limiting some 'untrusted' network connections also applies for the 'tab' with Banking website. So, in essence, there are no significant changes with either approach; in terms of unexpected compatibility troubles. And, then, with current design - everything is expected to work smoothly, and generally it should be smooth as long as certain guidelines and best practices of doing any 'online banking' procedures and stuff are followed.
Regarding activation, Banking Protection is already 'tab-based' (since it is the common way to trigger banking protection session by opening a website with a "bank" rating in a browser tab via HTTPS; as opposed to what was previously possible due to unexpected ways of iframes, embedded images from banking-rated domains on non-banking resources and so on). Done by utilising F-Secure Browsing Protection browser addon / extension.
Because Banking Protection technology ('implementation') is not really documented in details - I am not sure how it works. But I suspect that by default, sites with a banking rating (those that initiate a banking protection session and have a corresponding note in the "rating/reputation" area) have some additional security features 'built in'; that is, only these tabs have something more than other tabs in the browser. Though entire browser and system has only generic ones without extra bits. But this is speculation only.
To use Banking Protection only for a certain tab: such as, banking website is opened. The rest of system and other tabs are not protected by anything extra now. Only extra steps are added to this certain browser's tab. What kind of threat or 'troubles' can be avoided and from which can the user be protected?
Especially when some of things really depend on browser (or website) itself? Such as site-isolation, sandboxing and so.
Or if I am not sure is it possible to apply some stuff to just one tab (without preventing system-wide or browser-wide).
For example, surely a tab-based approach can't block any "unauthorized" connections only for a tab? Because what's the difficulty with a malicious entity using connections from other channels?
To create a robust tab-based banking protection feature, the browser will likely be closer to some sort of "isolated" Secure Browser or dedicated Sandbox. Which is another popular way of doing it. And which I wasn't a particular fan of.
Tab-based things are likely more valued for protection against malicious websites for a device (even Windows Defender Application Guard is about that). But during a banking protection session, we are not protected from 'banking' website. And tab/browser itself is usually protected via own browser settings/options/configuration. F-Secure just adds a number of extra things to the system.
I liked (I had) some idea or implementation of the above mentioned things in some forms, which I think I once described on the community pages in one of the discussions. Something which probably close to or known now as RBI (Remote Browser Isolation).
-
"I understand your point, and I agree that some protections are inherently system-level. Still, I think there is a good case for making Banking Protection more tab-focused, at least where that is technically feasible.
Since the protection session is initiated by opening a recognised banking site in a specific browser tab, it would make sense for the browser-side protections to follow that same context as closely as possible. That could help reduce unnecessary side effects outside the actual banking session, while also making the overall behaviour clearer to the user.
Of course, this would not mean that every protection could be limited to one tab. Some controls would still need to remain broader by design. But for browser-related measures, a more targeted approach would seem consistent with how modern browsers already work, with things like site isolation, sandboxing, and process separation.
So in my view, the most sensible direction would be a hybrid one: keep the protections that truly need wider scope, but make the browser-facing part as precise and context-aware as possible."
