Is online banking more secure on iOS than a desktop computer?

Question

Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the likelihood of running malware on the device is much lower. And even if malware is running on the device, I assume it wouldn't have the same capabilities that desktop malware does, such as keylogging.

Furthermore, iOS Safari doesn't support plugins that would enable a man-in-the-browser attack. This means that drive-by malware installation through common vectors such as Java, Flash, and Adobe Reader should be impossible. It presents a user interface that clearly indicates whether or not a connection is secure, and that user interface cannot be overridden by the site being displayed.

Assumptions

• iPhone has not been jailbroken.
• The password is typed with the onscreen keyboard.

Extra credit

• Does use of a password manager (like 1Password) improve or reduce security?

Answer 1

If you are using an IOS mobile device, your device is subject to many attacks such as

• Juice jacking
• A web browser that doesn't show HTTPS status clearly (iPhone)
• A web browser that doesn't show the URL... enabling phishing (iPhone)
• Web browsers that don't support additional SSL/TLS validation software such as Convergence

If you must use a mobile device, I'd suggest using a dedicated application, as this post suggests. In addition, the application itself may also validate the HTTPS certificate key (preventing MITM attacks) or even better it may use mutual auth TLS

(The following is similar to @Rory's answer:)

The ideal solution, is to reformat your PC, and install a virtual OS for games, testing, etc. Then use the standard PC for all your banking needs. Since the VM can't access your PC (hopefully you configured it so) then you're safe from any phishing or other attack.*

* Exception

Answer 2

The Apple walled garden model and iOS security model are very good for protecting the host but web applications require more than host security.

The iOS-ification of Mac OS X has brought the option of allowing only signed and vetted apps from the Appstore and the mandatory use of sandboxing from March 2012 on.

Windows 8 is slowly following the same model by making the tablet version (Windows RT) only run code from the Windows Store by default. But the platform is still young and fragile.

Apple Appstore security:

• $99 joining fee.
• Checks your identity and uses crime enforcement.
• Content review and static analysis.
• Code is signed and cannot be modified.
• Cost to exploit is very high.
• Very few malware applications slip through.

Apple iOS security:

• It takes 6 months to write an exploit.
• App review is a risk for months of work on an exploit.
• iOS exploits are written by few groups.
• Apple patches fast.
• Code signing is employed, memory pages are signed at runtime and like DEP it protects against injecting code.
• iOS Seatbelt sandbox is very good.
• Charlie Miller injected new code at runtime by finding a vulnerability and got banned from the Appstore then the vulnerability was patched in 4 days.
• Few malicious use of vulnerabilities found.

Securing the host is not enough and you can't rely on Apple to help the user BE secure. A secure host pushes attackers to attack the next weakest spots such as communication and the user where Apple can only nudge the user into being secure. There are other issues for online commerce:

• Weak passwords or lacking account protections against reset and intercept.
• Security awareness for things such as fake SSL certificates or phishing websites.
• Vulnerabilities in commercial websites that require user interaction, such as XSS, CSRF and Clickjacking.

Answer 3

One of the aspects not touched on yet in other answers is that mobile security is still relatively young, and by comparison with mature operating systems it is more difficult to gain assurance over the security functionality implemented.

So currently it is simpler to be more secure on a desktop OS- the tools are well known, the attack types are well known, and implementing layers of security is much more straightforward to the end user.

I still wouldn't use an ios or Android app for online banking, but do use a VM on my desktop machine as I can control it and wipe it after use.

Answer 4

No

1. iOS itself is not necessarily more secure than jailbreaked version. However, consider that for jailbreak to be possible iOS must have at least one security exploit by nature.
2. Once installed, many security exploits are often corrected by jailbreak developers. However, you may be unable to review and/or understand the jailbreak itself, or any patches that promise to fix exploits. Therefore, it may not be possible to trust the jailbreak at all.
3. When typing your password on screen, each key is "magnified" or enlarged on touch by the native iOS keyboard. Someone, or something (like a security camera), may be watching over your shoulder to steal your password.
4. Proper security is not only just securing the client, but the entire communication chain and all devices associated with it. For example, if you are not communicating over HTTPS, the information could be stolen in transit. If your password is not store securely (such as a bad developer who saves passwords in plaintext), your password could also be leaked if a database is ever compromised.

About password selection itself: There are a number of discussions online, and available here at security.stackexchange.com. I've found (and I love) this: XKCD #936: Short complex password, or long dictionary passphrase?