Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Monzo urges 480k customers to change their pin numbers

theguardian.com

Post reply on HN
Print view View original

41–50 of 66 posts

Re: Monzo urges 480k customers to change their pin numbers

#41

Post by dbbk »

_0o6v wrote: post #37
pidg wrote: post #20

As someone who is fully drunk on Monzo kool-aid, well done to them on (a) identifying the problem and (b) immediately telling customers what to do. Imagine how long this would have been an issue if it had happened at Barclays or TSB.

I find it bizarre how people aren't giving Monzo more of a hard time over this. This is a security blunder of the highest order. Saying sorry in a cutesy email after the fact doesn't in any way make up for it.

> This is a security blunder of the highest order.

No information was leaked... it's really kind of a non-issue. Monzo's approach is radical transparency. Any other bank probably would have never said anything.

Re: Monzo urges 480k customers to change their pin numbers

#42

Post by keraf »

BillinghamJ wrote: post #35
buro9 wrote: post #30

Earlier quoted context omitted.

dig internal-api.monzo.com ;; QUESTION SECTION: ;internal-api.monzo.com. IN A ;; ANSWER SECTION: internal-api.monzo.com. 288 IN CNAME k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 34.254.57.66 k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 52.212.7.167 k8s-worker-external-alb-prod-1306866561…

There are still plenty of customer-data-carrying things which do go over cloudflare - e.g. the internet banking, the public API, in-app webviews, etc

The Monzo web interface uses the public API too.

Re: Monzo urges 480k customers to change their pin numbers

#43

Post by jakub_g »

buro9 wrote: post #9

You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging. I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties. In the case of Monzo: https://reports.exodus-privacy.eu.org/en/r…

Uh. I checked my bank (Boursorama, France) and I got 17 trackers. WTF? How can you just add trackers left and right in a _banking_ app?

    AdColony
    Adincube
    AppLovin
    ATInternet
    Facebook Ads
    Google Ads
    Google CrashLytics
    Google DoubleClick
    Google Firebase Analytics
    Inmobi
    MAdvertise
    Millennial Media
    Ogury Presage
    Smart
    Tapjoy
    Twitter MoPub
    Unity3d Ads

Re: Monzo urges 480k customers to change their pin numbers

#44

Post by hangonhn »

mcny wrote: post #40
buro9 wrote: post #17

Earlier quoted context omitted.

Oh wow. That's worse than accidental logging. Engineers should know the GET params get logged fairly routinely and shouldn't be used for anything sensitive.

I thought with https, the ISP (or anyone in between) only sees the base url and not params?

AWS ELBs typically terminate the SSL connection for you. If you’re using AWS’ certificates management, you won’t have access to the private keys so you have to terminate at the ELBs.

Re: Monzo urges 480k customers to change their pin numbers

#45

Post by idiocache »

keraf wrote: post #23
buro9 wrote: post #9

You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging. I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties. In the case of Monzo: https://reports.exodus-privacy.eu.org/en/r…

One of my concerns about Monzo, that I have mentioned to them on Twitter some time ago, is the fact that they entirely rely on CloudFlare for customer facing services. Although I trust CloudFlare and understand how useful their services are, I am a bit uneasy that my banking information is transiting in clear through any third party.

Many banks use a CDN, primarily for DDOS protection. This includes the actual online banking endpoints. E.g. Lloyds and Barclays (major UK banks) both use Akamai, as does American Express.

Re: Monzo urges 480k customers to change their pin numbers

#46

Post by McDev »

buro9 wrote: post #9

You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging. I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties. In the case of Monzo: https://reports.exodus-privacy.eu.org/en/r…

>Is this like Sentry? Does it send a stack on a crash?

It's just like Sentry and does send back stack traces on a crash or any error the developer chooses to send back.

Crashlytics part of fabric.io, which was bought by Google and is actively being integrated into Google's Firebase.

Re: Monzo urges 480k customers to change their pin numbers

#47

Post by McDev »

throwawaylolx wrote: post #25
pidg wrote: post #20

As someone who is fully drunk on Monzo kool-aid, well done to them on (a) identifying the problem and (b) immediately telling customers what to do. Imagine how long this would have been an issue if it had happened at Barclays or TSB.

To use this news to belittle their competition about a hypothetical event seems like a dangerous form of kool-aid fanboyism.

>about a hypothetical event

Not entirely: https://www.bbc.co.uk/news/business-44121901

https://www.theguardian.com/business/2018/apr/28/warning-sig...

Re: Monzo urges 480k customers to change their pin numbers

#48

Post by pjc50 »

jakub_g wrote: post #43
buro9 wrote: post #9

You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging. I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties. In the case of Monzo: https://reports.exodus-privacy.eu.org/en/r…

Uh. I checked my bank (Boursorama, France) and I got 17 trackers. WTF? How can you just add trackers left and right in a _banking_ app? AdColony Adincube AppLovin ATInternet Facebook Ads Google Ads Google CrashLytics Google DoubleClick Google Firebase Analytics Inmobi MAdvertise Millennial Media Ogury Presage Smart Tapjoy Twitter MoPub Unity3d Ads

Report them to the French information commissioner, for GDPR violation.

Re: Monzo urges 480k customers to change their pin numbers

#49

Post by collyw »

dbbk wrote: post #41
_0o6v wrote: post #37

Earlier quoted context omitted.

I find it bizarre how people aren't giving Monzo more of a hard time over this. This is a security blunder of the highest order. Saying sorry in a cutesy email after the fact doesn't in any way make up for it.

> This is a security blunder of the highest order. No information was leaked... it's really kind of a non-issue. Monzo's approach is radical transparency. Any other bank probably would have never said anything.

> Monzo's approach is radical transparency.

How can you be sure of that?

Re: Monzo urges 480k customers to change their pin numbers

#50

Post by jsty »

ce4 wrote: post #26
loriverkutya wrote: post #24

Earlier quoted context omitted.

In clear? Could you show me any example supporting this claim?

Cloudflare basically acts as a reverse proxy adding all kinds of features (mostly caching, origin protection against ddos, waf, etc). I'm pretty sure they're pci compliant

They are. Relevant support page for those who are curious: https://support.cloudflare.com/hc/en-us/articles/202249734-C...
Post reply on HN