8 ms·
Monzo’s Response to Cloudbleed
- libeclipse 10y agoEven though they weren't affected much and no one would have called them out if they didn't do this, the fact that they did such a nice job of dissecting the situation and deploying the appropriate measures is really, really good. Love monzo. <3
- lumisota 10y agoWhile it should be applauded that they responded promptly, it needs to be remembered that this is a regulated, licensed bank that proxied sensitive customer information via a (now compromised) third-party. We should expect this kind of disclosure from such organisations, not be surprised by it.
- mintplant 10y agoMy thoughts exactly. As a bank, allowing Cloudflare to MITM their customers' financial data, presumably so they can save on bandwidth, seems inappropriate.
- obeattie 10y agoThe only reason to consider Cloudflare, for us, is DDOS mitigation.
- mintplant 10y agoIs it necessary to allow them to terminate/decrypt your TLS connections in order to provide DDOS mitigation? There are other providers besides Cloudflare in this space. Isn't the DDOS mitigation undermined by exposing the API used by your apps directly?
- user5994461 10y agoThe (almost) only other provider is Akamai and it's the exact same thing. Seriously, CloudFlare is doing nothing new and nothing fancy.
- mintplant 10y agoAre you claiming that Cloudflare and Akamai are the only providers of DDoS mitigation services? A simple web search will show otherwise.
- shawabawa3 10y agoDid you read the post? They don't use cloudflare to MITM customer data.
- grzm 10y agoPlease don't imply that someone hasn't read the article. From the guidelines: "Did you even read the article? It mentions that" can be shortened to "The article mentions that." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- mintplant 10y agoI did read it, but on a second look, I see I missed that "Monzo.com [the web portal] does not process any sensitive information". Thanks for pointing that out.
- lumisota 10y ago> "Our developer API does sit behind Cloudflare with all of its traffic proxied through their service." .. "Data sent to and from our developer API may contain the following information:" .. "Customers’ personally identifiable information"
- libeclipse 10y agoIn an ideal world, yes. But this is the world where we live, and what monzo did is rare enough to warrant surprise.
- mdekkers 10y agoexcellent response
- deleted 10y ago[deleted]
- brad0 10y agoGreat response from Monzo. I live in Scotland and it's amazing the difference companies like monzo have compared to regular banks (see the tesco bank fiasco)
- pidg 10y agoWithout meaning to sound rude, why does it make a difference where you live? I feel like I'm missing something.
- cesarb 10y agoThe place where someone lives changes the set of "regular banks" one's exposed to.
- pidg 10y agoAh. I live in Scotland too and wondered if Monzo had some connection (Tesco Bank is based here but operates UK-wide)
- OJFord 10y agoMonzo is also UK-wide, but only UK-wide. Anecdotally, it seems Scots are more likely to say Scot* vs UK than are Welsh/English to offer the equivalent. I certainly grew up (in England) with the feeling that one had to be careful to say 'UK' if one really meant UK, for fear of similar reprimand to that when using a gendered pronoun that may or may not be correct.
- deleted 10y ago[deleted]
- Sholmesy 10y agoI believe Monzo is only offered within the UK at the moment as well, so this is at least a little bit region-related.
- 10y ago
- mseebach 10y agoHonest question, this is far from my area of expertise: I get why you would put Cloudflare on a public website -- but what is the benefit of wrapping the authenticated, dynamic parts of a website/service in Cloudflare? These are things you would want to never get cached, and, I suppose, you would want end-to-end TLS'd into your own network?
- harmkolk 10y agoCloudflare is not just a caching/CDN service, they also provide DDOS protection: https://www.cloudflare.com/ddos/ https://www.cloudflare.com/ddos/
- bkeroack 10y agoIf you put all of your services behind a reverse-proxy CDN/WAF service like CloudFlare it greatly reduces your attack surface because the public has no access to your origin IPs.
- otabdeveloper 10y agoBecause the "HTTPS everywhere or you're a dinosaur and you don't deserve to live" hysteria forced everyone to put HTTPS even in places where it doesn't belong.
- jon-wood 10y agoI'm pretty sure "in front of the API for people's bank account" is exactly the place HTTPS belongs.
- scrollaway 10y ago> put HTTPS even in places where it doesn't belong Like an online banking app?
- _pmf_ 10y ago> A bug in an NGINX module used by Cloudflare’s edge proxies More precise: a bug in a proprietary closed source module for NGINX used in-house at Cloudflare.
- nailer 10y agoNot sure why the parent post is being downmodded: it's entirely accurate. From what Google wrote [1], the module is part of a CloudFlare ScrapeShield, which is a proprietary nginx module that does DOM manipulation to obfuscate pages to fight scrapers. Mismatched tags were causing arbitrary bits of memory to leak into responses. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 https://bugs.chromium.org/p/project-zero/issues/detail?id=11...
- NTripleOne 10y agobecause it's a snarky "DAE h8 closed sauce proprietary??????" comment.
- nailer 10y agoI thought it was more a "the article accidentally makes it sound like it's code written by nginx rather than CloudFlare" which is a legitimate point.
- deckiedan 10y agoGreat that they respond so clearly and quickly. One question - does anyone else feel that having NGINX as the only link in the summary kind of suggests that it's an nginx problem? I could imagine my previous boss reading the article, and 3 months later saying, "Wait what, we're using nginx??? Isn't that that shit that made cloudbleed happen?"
- zzzcpan 10y agoWhile they are not being precise in their response, you cannot consider nginx more secure. Nginx is still part of the problem, it had many CVEs too, even very similar memory disclosure vulnerabilities.
- Filligree 10y agoIt's written in C, which is part of the problem. I'd be very interested in a similarly-featured webserver (reverse proxy, mostly) which is written in a memory-safe language.
- atmosx 10y agoCaddy[1] is written in Go and has a nicer, simpler syntax. I'm sure NGINX has many more features though. [1] https://github.com/mholt/caddy https://github.com/mholt/caddy
- fortytw2 10y agoCaddy has less than half the performance of Nginx - not really a viable replacement at any sort of scale. https://hackernoon.com/caddy-a-modern-web-server-vs-nginx-e9e4abc443e#.wps7udz6x https://hackernoon.com/caddy-a-modern-web-server-vs-nginx-e9...
- Filligree 10y agoDepends on what you're doing. If it's fronting an expensive web-app, then the couple hundred CPU-microseconds needed to proxy a request isn't going to be noticeable... Caddy can serve 5,000 requests per second per core. I would flip your statement on its head, and say that a minority of people need anything close to that. The few companies that do, can probably afford to keep on top of CVEs for their frontends as well.
- anc84 10y agoIf I understood the issue correctly, then "Transaction information" and "Customers’ personally identifiable information" via the Developer's API were potentially affected.
- deleted 10y ago[deleted]
- rodionos 10y agoThe Monzo's response is much more re-assuring compared to Cloudflare's: > "We've seen absolutely no evidence that this has been exploited," he told Reuters by phone. > "It's very unlikely that someone has got this information." http://www.reuters.com/article/us-cyber-cloudflare-idUSKBN1630RT http://www.reuters.com/article/us-cyber-cloudflare-idUSKBN16...
- sverige 10y agoI agree. Cloudflare's public statements have not inspired confidence. When you get publicly called out by Google's security chief, you need to bring your A game in damage control.
- overcast 10y agoWhat the heck is Monzo? I read the About, is this another Paypal 20 years later?
- CheckHook 10y agoIt's a prepaid credit card with a great app that lets you do things like freezing your card quickly. They also offer good exchange rates with no fees. Personally I use it as a travel/buffer card as my main card has been copied in the past and I usually have sub £100 on my Monzo card.
- dbbk 10y agoIt's currently a prepaid card, but they are in the process of launching a current account. It's a new, digital-first bank.
- nsgi 10y agoIt's a prepaid debit card that gives you a pretty breakdown of your spending through an app.
- aembleton 10y agoIt's a prepaid credit card that immediately notifies your phone every time you make a transaction with the amount and location. It is particularly useful overseas. I was in Belgium at the weekend and all my € spend was immediately translated into £ so I could clearly see how much I was spending. I could also find the café that I went to for breakfast the previous day because it's location is right there in the Monzo app. The other useful feature is when I'm out drinking. If I loose the card, I can freeze the card from inside the app. Also it means that the next morning I can see how much I spent.
- aembleton 10y agoI should add, there is no ongoing charge for this and they use the MasterCard exchange rate which is a better rate than I can get anywhere else.