News for hackers. Stuff that matters.

A comment on Monzo urges 480k customers to change their pin numbers. Parent comment

Re:Monzo urges 480k customers to change their pin numbers by keraf on Tuesday August 06, 2019 @07:47AM (#20624277)
One of my concerns about Monzo, that I have mentioned to them on Twitter some time ago, is the fact that they entirely rely on CloudFlare for customer facing services. Although I trust CloudFlare and understand how useful their services are, I am a bit uneasy that my banking information is transiting in clear through any third party.
[ Parent | on HN ]
Re:Monzo urges 480k customers to change their pin numbers by buro9 on Tuesday August 06, 2019 @08:55AM (#20624676) 

    dig internal-api.monzo.com
    
    ;; QUESTION SECTION:
    ;internal-api.monzo.com.  IN A
    
    ;; ANSWER SECTION:
    internal-api.monzo.com. 288 IN CNAME k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com.
    k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 34.254.57.66
    k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 52.212.7.167
    k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 34.255.246.8
Monzo the bank, runs from Amazon and not via Cloudflare.

    dig www.monzo.com
    
    ;; QUESTION SECTION:
    ;www.monzo.com.   IN A
    
    ;; ANSWER SECTION:
    www.monzo.com.  59 IN A 104.25.212.99
    www.monzo.com.  59 IN A 104.25.211.99
Monzo the marketing website for the bank, uses Cloudflare.

If you go through the DNS logs for the Monzo app, you'll see everything else goes direct... Google, Facebook, Status Page, AWS.

With the only exception being some image assets:

    dig monzo-prod-user-images.imgix.net
    
    ;; QUESTION SECTION:
    ;monzo-prod-user-images.imgix.net. IN A
    
    ;; ANSWER SECTION:
    monzo-prod-user-images.imgix.net. 2280 IN CNAME dualstack.com.imgix.map.fastly.net.
    dualstack.com.imgix.map.fastly.net. 4 IN A 151.101.18.208
[ Parent | on HN ]
Re:Monzo urges 480k customers to change their pin numbers by BillinghamJ on Tuesday August 06, 2019 @09:05AM (#20624759)
There are still plenty of customer-data-carrying things which do go over cloudflare - e.g. the internet banking, the public API, in-app webviews, etc
[ Parent | on HN ]
Re:Monzo urges 480k customers to change their pin numbers by keraf on Tuesday August 06, 2019 @09:35AM (#20624994)
The Monzo web interface uses the public API too.
[ Parent | on HN ]
Re:Monzo urges 480k customers to change their pin numbers by m11a on Tuesday August 06, 2019 @12:14PM (#20626542)
"through any third party"

I would argue that using a third party that specialises in security is better than remaking the wheel yourself.

Cloudflare invest a significant amount in the security of their platform and have a lot of talented engineers that focus solely on that. They have a lot more data to play around with and I would expect they can do a better job at security than Monzo alone, with their own infrastructure, with their own engineers. Note that Cloudflare is PCI compliant (https://support.cloudflare.com/hc/en-us/articles/202249734-C...)

Not sure I understand the hype of remaking the wheel, when specialist services exist that probably do the work better, more safely and cheaper.

[ Parent | on HN ]
Re:Monzo urges 480k customers to change their pin numbers by loriverkutya on Tuesday August 06, 2019 @08:02AM (#20624343)
In clear? Could you show me any example supporting this claim?
[ Parent | on HN ]
Re:Monzo urges 480k customers to change their pin numbers by ce4 on Tuesday August 06, 2019 @08:20AM (#20624449)
Cloudflare basically acts as a reverse proxy adding all kinds of features (mostly caching, origin protection against ddos, waf, etc). I'm pretty sure they're pci compliant
[ Parent | on HN ]
Re:Monzo urges 480k customers to change their pin numbers by jsty on Tuesday August 06, 2019 @10:32AM (#20625488)
They are. Relevant support page for those who are curious: https://support.cloudflare.com/hc/en-us/articles/202249734-C...
[ Parent | on HN ]
Re:Monzo urges 480k customers to change their pin numbers by idiocache on Tuesday August 06, 2019 @09:51AM (#20625143)
Many banks use a CDN, primarily for DDOS protection. This includes the actual online banking endpoints. E.g. Lloyds and Barclays (major UK banks) both use Akamai, as does American Express.
[ Parent | on HN ]