Monzo urges 480k customers to change their pin numbers • Hacker News Board

Re: Monzo urges 480k customers to change their pin numbers

#61

Post by dijital » Tue, Aug 06, 2019, 5:09 PM UTC

BillinghamJ wrote: post #12

buro9 wrote: post #9

You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging. I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties. In the case of Monzo: https://reports.exodus-privacy.eu.org/en/r…

It wasn't the app logging the PIN, was their AWS ELB setup. Two APIs were accepting the PIN as URL parameters on GET requests, since in terms of REST principles, the operations were to retrieve information. They were changed to non-GETs with the PIN sent in the body instead. The apps needed to be updated to switch to the new APIs.

Out of interest, where did you hear this from?

Re: Monzo urges 480k customers to change their pin numbers

#62

Post by disgruntledphd2 » Tue, Aug 06, 2019, 9:37 PM UTC

estel wrote: post #59

pjc50 wrote: post #48

Earlier quoted context omitted.

Report them to the French information commissioner, for GDPR violation.

Embedding a particular SDK doesn't necessarily mean that there's a GDPR violation?

That's true, but as n_trackers increases, so does the chance of of some kind of GDPR violation (assuming independence of violations amongst trackers)

Re: Monzo urges 480k customers to change their pin numbers

#63

Post by disgruntledphd2 » Tue, Aug 06, 2019, 9:38 PM UTC

Nextgrid wrote: post #16

buro9 wrote: post #9

You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging. I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties. In the case of Monzo: https://reports.exodus-privacy.eu.org/en/r…

The Google and Facebook stalking concerns me way more than any PIN leakage to be honest (and I'm wondering why they need both Google and Facebook Analytics?). The leaked PINs were "leaked" to employees (and even then there's no evidence they were misused) and I expect them to be able to do damage even without those PINs if they wanted to, so to me it's not that big of a deal. The risk here could be if you reused the…

Because they are optimising for both Google and Facebook ads. You may not like that answer, but it's true.

Re: Monzo urges 480k customers to change their pin numbers

#64

Post by peteretep » Tue, Aug 06, 2019, 10:14 PM UTC

Iolaum wrote: post #51

peteretep wrote: post #28

Earlier quoted context omitted.

Barclays have surprised me with how good their tech seems to be

Really? They can't join a Barclaycard with a checking account because the former was opened through the internet and not from the store (Their words.) Plus they don't allow installing the Barclay's mobile app if you are running Lineage OS and openGapps despite passing safetyNet. Last but not least the web log in process for Barclaycard is security theatre. Split into 2+ steps but all knowledge based, ie still only 1…

> Lineage OS and openGapps despite passing safetyNet

I don’t know what any of these words mean, and I’m relatively technical

The sign-in I use requires a password (something you know) and a OTP generated by an irretrievable key, eg, something I have.

Re: Monzo urges 480k customers to change their pin numbers

#65

Post by pidg » Wed, Aug 07, 2019, 12:17 AM UTC

peteretep wrote: post #64

Iolaum wrote: post #51

Earlier quoted context omitted.

Really? They can't join a Barclaycard with a checking account because the former was opened through the internet and not from the store (Their words.) Plus they don't allow installing the Barclay's mobile app if you are running Lineage OS and openGapps despite passing safetyNet. Last but not least the web log in process for Barclaycard is security theatre. Split into 2+ steps but all knowledge based, ie still only 1…

> Lineage OS and openGapps despite passing safetyNet I don’t know what any of these words mean, and I’m relatively technical The sign-in I use requires a password (something you know) and a OTP generated by an irretrievable key, eg, something I have.

I believe LineageOS used to be called Cyanogenmod, and it's a fully free/open source implementation of Android. openGapps is Google Apps (like Maps) that you can install without having the Play Store.

Using LineageOS lets you do many more awesome things with your device, but financial apps (and even some apps like bus ticket apps) often don't work on this setup because it's viewed as insecure.

Re: Monzo urges 480k customers to change their pin numbers

#66

Post by lol768 » Wed, Aug 07, 2019, 5:55 PM UTC

K0nserv wrote: post #54

lol768 wrote: post #32

Earlier quoted context omitted.

This is correct, I've seen the diff of the two Android versions.

Do you have a source for this you could share?

Monzo will post a technical write-up soon. But, in the meantime:

Before:

  .method public abstract pan(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Lio/reactivex/Single;
      .param p1    # Ljava/lang/String;
    .annotation runtime Lretrofit2/http/Query;
        value = "account_id"
    .end annotation
      .end param
      .param p2    # Ljava/lang/String;
    .annotation runtime Lretrofit2/http/Query;
        value = "card_id"
    .end annotation
      .end param
      .param p3    # Ljava/lang/String;
    .annotation runtime Lretrofit2/http/Query;
        value = "challenge_type"
    .end annotation
      .end param
      .param p4    # Ljava/lang/String;
    .annotation runtime Lretrofit2/http/Query;
        value = "challenge"
    .end annotation
      .end param
      .param p5    # Ljava/lang/String;
    .annotation runtime Lretrofit2/http/Query;
        value = "idempotency_key"
    .end annotation
      .end param
      .annotation system Ldalvik/annotation/Signature;
    value = {
        "(",
        "Ljava/lang/String;",
        "Ljava/lang/String;",
        "Ljava/lang/String;",
        "Ljava/lang/String;",
        "Ljava/lang/String;",
        ")",
        "Lio/reactivex/Single;"
    }
      .end annotation

      .annotation runtime Lretrofit2/http/GET;
    value = "card/pan"
      .end annotation
  .end method

After (v2.59.1 has the fix):

  .method public abstract pan(Lcom/monzo/card/data/api/RetrievePanRequest;)Lio/reactivex/Single;
    .param p1  # Lcom/monzo/card/data/api/RetrievePanRequest;
    .annotation runtime Lretrofit2/http/Body;
    .end annotation
    .end param
    .annotation system Ldalvik/annotation/Signature;
    value = {
      "(",
      "Lcom/monzo/card/data/api/RetrievePanRequest;",
      ")",
      "Lio/reactivex/Single;"
    }
    .end annotation

    .annotation runtime Lretrofit2/http/PUT;
    value = "card/retrieve-pan"
    .end annotation
  .end method