Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Monzo urges 480k customers to change their pin numbers

theguardian.com

Post reply on HN
Print view View original

11–20 of 66 posts

Re: Monzo urges 480k customers to change their pin numbers

#11

Post by newaccoutnas »

benjojo12 wrote: post #7
shawabawa3 wrote: post #2

Seems like credentials being stored in logs is something that happens at pretty much every tech company - see e.g. Facebook[1] and Google[2]. Perhaps client and serverside hashing should be standard - at least then the actual credentials wouldn't be leaked, and the salt could be rolled the next time the user inputted it [1] https://krebsonsecurity.com/2019/03/facebook-stored-hundreds... [2] https://www.theverge.com/2…

PIN's are 4 digits in the UK. Hashing them (even with a per user salt) would only produce 10k possible hashes. To have anything that was difficult to brute force would also just not practical on CPU constrained mobile devices.

PINS for the ATM are but my online banking has a number more

Re: Monzo urges 480k customers to change their pin numbers

#12

Post by BillinghamJ »

buro9 wrote: post #9

You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging. I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties. In the case of Monzo: https://reports.exodus-privacy.eu.org/en/r…

It wasn't the app logging the PIN, was their AWS ELB setup.

Two APIs were accepting the PIN as URL parameters on GET requests, since in terms of REST principles, the operations were to retrieve information.

They were changed to non-GETs with the PIN sent in the body instead. The apps needed to be updated to switch to the new APIs.

Re: Monzo urges 480k customers to change their pin numbers

#14

Post by tialaramex »

shawabawa3 wrote: post #2

Seems like credentials being stored in logs is something that happens at pretty much every tech company - see e.g. Facebook[1] and Google[2]. Perhaps client and serverside hashing should be standard - at least then the actual credentials wouldn't be leaked, and the salt could be rolled the next time the user inputted it [1] https://krebsonsecurity.com/2019/03/facebook-stored-hundreds... [2] https://www.theverge.com/2…

Rather than this workaround, don't use secrets this way at all. Do public key crypto. You don't need a PKI because you have an existing registration + authentication flow you can re-use to figure out which keys belong to which users.

This design is safe because your systems don't have any secrets to mistakenly log or otherwise lose. Make things we don't want to happen _impossible_ and they'll stop happening. Merely saying "Don't do that" doesn't make it stop happening.

Your site can literally post all the WebAuthn registration data for users on the front page, and it won't make it any easier for bad guys to sign in as those users, there aren't any secrets in there. That's a correct design.

Re: Monzo urges 480k customers to change their pin numbers

#16

Post by Nextgrid »

buro9 wrote: post #9

You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging. I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties. In the case of Monzo: https://reports.exodus-privacy.eu.org/en/r…

The Google and Facebook stalking concerns me way more than any PIN leakage to be honest (and I'm wondering why they need both Google and Facebook Analytics?).

The leaked PINs were "leaked" to employees (and even then there's no evidence they were misused) and I expect them to be able to do damage even without those PINs if they wanted to, so to me it's not that big of a deal. The risk here could be if you reused the PIN on other cards.

Re: Monzo urges 480k customers to change their pin numbers

#17

Post by buro9 »

BillinghamJ wrote: post #12
buro9 wrote: post #9

You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging. I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties. In the case of Monzo: https://reports.exodus-privacy.eu.org/en/r…

It wasn't the app logging the PIN, was their AWS ELB setup. Two APIs were accepting the PIN as URL parameters on GET requests, since in terms of REST principles, the operations were to retrieve information. They were changed to non-GETs with the PIN sent in the body instead. The apps needed to be updated to switch to the new APIs.

Oh wow.

That's worse than accidental logging.

Engineers should know the GET params get logged fairly routinely and shouldn't be used for anything sensitive.

Re: Monzo urges 480k customers to change their pin numbers

#18

Post by ggambetta »

wrboyce wrote: post #8
rys wrote: post #4

Earlier quoted context omitted.

The PIN you use to prove it's your card, when you use it in an ATM or in a chip and PIN reader.

I'm going to hazard a guess that @ggambetta is making a veiled reference to "RAS Syndrome". https://en.wikipedia.org/wiki/RAS_syndrome

Yep :) Didn't know it was called that.
Post reply on HN