Monzo urges 480k customers to change their pin numbers
theguardian.com
Monzo urges 480k customers to change their pin numbers
1–10 of 66 posts
Re: Monzo urges 480k customers to change their pin numbers
#2Seems like credentials being stored in logs is something that happens at pretty much every tech company - see e.g. Facebook[1] and Google[2]. Perhaps client and serverside hashing should be standard - at least then the actual credentials wouldn't be leaked, and the salt could be rolled the next time the user inputted it
[1] https://krebsonsecurity.com/2019/03/facebook-stored-hundreds...
[2] https://www.theverge.com/2019/5/21/18634842/google-passwords...
Re: Monzo urges 480k customers to change their pin numbers
#3Would that be my personal pin number, or some other pin number?
Re: Monzo urges 480k customers to change their pin numbers
#4Would that be my personal pin number, or some other pin number?
The PIN you use to prove it's your card, when you use it in an ATM or in a chip and PIN reader.
Re: Monzo urges 480k customers to change their pin numbers
#5Seems like credentials being stored in logs is something that happens at pretty much every tech company - see e.g. Facebook[1] and Google[2]. Perhaps client and serverside hashing should be standard - at least then the actual credentials wouldn't be leaked, and the salt could be rolled the next time the user inputted it [1] https://krebsonsecurity.com/2019/03/facebook-stored-hundreds... [2] https://www.theverge.com/2…
I assume they're all double-checking after it was reported by Facebook, and they're realising they've been doing the same thing for a long time too.
Re: Monzo urges 480k customers to change their pin numbers
#6Would that be my personal pin number, or some other pin number?
It's the one you use in the ATM Machine :)
Re: Monzo urges 480k customers to change their pin numbers
#7Seems like credentials being stored in logs is something that happens at pretty much every tech company - see e.g. Facebook[1] and Google[2]. Perhaps client and serverside hashing should be standard - at least then the actual credentials wouldn't be leaked, and the salt could be rolled the next time the user inputted it [1] https://krebsonsecurity.com/2019/03/facebook-stored-hundreds... [2] https://www.theverge.com/2…
PIN's are 4 digits in the UK. Hashing them (even with a per user salt) would only produce 10k possible hashes. To have anything that was difficult to brute force would also just not practical on CPU constrained mobile devices.
Re: Monzo urges 480k customers to change their pin numbers
#8Would that be my personal pin number, or some other pin number?
The PIN you use to prove it's your card, when you use it in an ATM or in a chip and PIN reader.
I'm going to hazard a guess that @ggambetta is making a veiled reference to "RAS Syndrome".
Re: Monzo urges 480k customers to change their pin numbers
#9You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging.
I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties.
In the case of Monzo: https://reports.exodus-privacy.eu.org/en/reports/88809/
+ Facebook Analytics
+ Facebook Login
+ Google Ads
+ Google CrashLytics
+ Google DoubleClick
+ Google Firebase Analytics
And according to NetGuard locally:
ws-eu.pusher.com
graph.facebook.com
e.crashlytics.com
app.adjust.com
graph.accountkit.com
I saw an app recently that gave me the option in the settings to opt out of crashlytics - more of that please!
I'd be much happier seeing nothing third party in apps that deal with sensitive information.
And I'd be happy to memorise a 2nd less important software PIN for app transaction authorisation that wasn't the same as the ATM and hardware PIN.
Re: Monzo urges 480k customers to change their pin numbers
#10Seems like credentials being stored in logs is something that happens at pretty much every tech company - see e.g. Facebook[1] and Google[2]. Perhaps client and serverside hashing should be standard - at least then the actual credentials wouldn't be leaked, and the salt could be rolled the next time the user inputted it [1] https://krebsonsecurity.com/2019/03/facebook-stored-hundreds... [2] https://www.theverge.com/2…
PIN's are 4 digits in the UK. Hashing them (even with a per user salt) would only produce 10k possible hashes. To have anything that was difficult to brute force would also just not practical on CPU constrained mobile devices.
When traditional banks do "1st, 2nd and 4th character" checks (i.e. via their apps), some go to pretty good lengths to protect these, even given the limited entropy.
These systems are typically backed by HSMs, and the HSM generates a high-entropy "challenge". The challenge is sent to the client, which combines the challenge with the characters the user entered. The resulting hash is sent back to the HSM, which can verify internally that the correct characters were selected, by computing the expected hash for the correct response (hopefully in constant-time).
It seems there is a bigger issue here -- Monzo used card PINs as a generic security credential in their app, and was storing them in a recoverable form (albeit only accessible to a very small number of staff). That's not standard practice elsewhere that I'm aware of - given use of the PIN is the "proof" you approved the transaction, it's usually used only in environments with dedicated PIN entry devices (ATM, card readers), rather than commodity devices (phones), unless those go through PCI-style verification and approval.