Monzo’s Response to Cloudbleed

Re:Monzo’s Response to Cloudbleed by mseebach on Friday February 24, 2017 @09:00AM (#13723680)

Honest question, this is far from my area of expertise: I get why you would put Cloudflare on a public website -- but what is the benefit of wrapping the authenticated, dynamic parts of a website/service in Cloudflare? These are things you would want to never get cached, and, I suppose, you would want end-to-end TLS'd into your own network?

[ Parent | on HN ]

Re:Monzo’s Response to Cloudbleed by bkeroack on Friday February 24, 2017 @09:08AM (#13723740)

If you put all of your services behind a reverse-proxy CDN/WAF service like CloudFlare it greatly reduces your attack surface because the public has no access to your origin IPs.

[ Parent | on HN ]

Re:Monzo’s Response to Cloudbleed by harmkolk on Friday February 24, 2017 @09:08AM (#13723733)

Cloudflare is not just a caching/CDN service, they also provide DDOS protection: https://www.cloudflare.com/ddos/

[ Parent | on HN ]

Re:Monzo’s Response to Cloudbleed by otabdeveloper on Friday February 24, 2017 @11:00AM (#13724793)

Because the "HTTPS everywhere or you're a dinosaur and you don't deserve to live" hysteria forced everyone to put HTTPS even in places where it doesn't belong.

[ Parent | on HN ]

Re:Monzo’s Response to Cloudbleed by jon-wood on Friday February 24, 2017 @11:21AM (#13724981)

I'm pretty sure "in front of the API for people's bank account" is exactly the place HTTPS belongs.

[ Parent | on HN ]

Re:Monzo’s Response to Cloudbleed by scrollaway on Friday February 24, 2017 @12:35PM (#13725701)

> put HTTPS even in places where it doesn't belong

Like an online banking app?

[ Parent | on HN ]