4 ms·

One of my concerns about Monzo, that I have mentioned to them on Twitter some time ago, is the fact that they entirely rely on CloudFlare for customer facing se

by keraf 7y ago

One of my concerns about Monzo, that I have mentioned to them on Twitter some time ago, is the fact that they entirely rely on CloudFlare for customer facing services. Although I trust CloudFlare and understand how useful their services are, I am a bit uneasy that my banking information is transiting in clear through any third party.

loriverkutya 7y ago
In clear? Could you show me any example supporting this claim?
- ce4 7y ago
  Cloudflare basically acts as a reverse proxy adding all kinds of features (mostly caching, origin protection against ddos, waf, etc). I'm pretty sure they're pci compliant
  - jsty 7y ago
    They are. Relevant support page for those who are curious: https://support.cloudflare.com/hc/en-us/articles/202249734-Cloudflare-and-PCI-Compliance https://support.cloudflare.com/hc/en-us/articles/202249734-C...
buro9 7y ago
dig internal-api.monzo.com ;; QUESTION SECTION: ;internal-api.monzo.com. IN A ;; ANSWER SECTION: internal-api.monzo.com. 288 IN CNAME k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 34.254.57.66 k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 52.212.7.167 k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 34.255.246.8 Monzo the bank, runs from Amazon and not via Cloudflare. dig www.monzo.com ;; QUESTION SECTION: ;www.monzo.com. IN A ;; ANSWER SECTION: www.monzo.com. 59 IN A 104.25.212.99 www.monzo.com. 59 IN A 104.25.211.99 Monzo the marketing website for the bank, uses Cloudflare. If you go through the DNS logs for the Monzo app, you'll see everything else goes direct... Google, Facebook, Status Page, AWS. With the only exception being some image assets: dig monzo-prod-user-images.imgix.net ;; QUESTION SECTION: ;monzo-prod-user-images.imgix.net. IN A ;; ANSWER SECTION: monzo-prod-user-images.imgix.net. 2280 IN CNAME dualstack.com.imgix.map.fastly.net. dualstack.com.imgix.map.fastly.net. 4 IN A 151.101.18.208
- BillinghamJ 7y ago
  There are still plenty of customer-data-carrying things which do go over cloudflare - e.g. the internet banking, the public API, in-app webviews, etc
  - keraf 7y ago
    The Monzo web interface uses the public API too.
idiocache 7y ago
Many banks use a CDN, primarily for DDOS protection. This includes the actual online banking endpoints. E.g. Lloyds and Barclays (major UK banks) both use Akamai, as does American Express.
m11a 7y ago
"through any third party" I would argue that using a third party that specialises in security is better than remaking the wheel yourself. Cloudflare invest a significant amount in the security of their platform and have a lot of talented engineers that focus solely on that. They have a lot more data to play around with and I would expect they can do a better job at security than Monzo alone, with their own infrastructure, with their own engineers. Note that Cloudflare is PCI compliant (https://support.cloudflare.com/hc/en-us/articles/202249734-Cloudflare-and-PCI-Compliance https://support.cloudflare.com/hc/en-us/articles/202249734-C...) Not sure I understand the hype of remaking the wheel, when specialist services exist that probably do the work better, more safely and cheaper.

by keraf 7y ago

loriverkutya 7y ago

In clear? Could you show me any example supporting this claim?

ce4 7y ago
Cloudflare basically acts as a reverse proxy adding all kinds of features (mostly caching, origin protection against ddos, waf, etc). I'm pretty sure they're pci compliant
- jsty 7y ago
  They are. Relevant support page for those who are curious: https://support.cloudflare.com/hc/en-us/articles/202249734-Cloudflare-and-PCI-Compliance https://support.cloudflare.com/hc/en-us/articles/202249734-C...

buro9 7y ago

dig internal-api.monzo.com ;; QUESTION SECTION: ;internal-api.monzo.com. IN A ;; ANSWER SECTION: internal-api.monzo.com. 288 IN CNAME k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 34.254.57.66 k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 52.212.7.167 k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 34.255.246.8 Monzo the bank, runs from Amazon and not via Cloudflare. dig www.monzo.com ;; QUESTION SECTION: ;www.monzo.com. IN A ;; ANSWER SECTION: www.monzo.com. 59 IN A 104.25.212.99 www.monzo.com. 59 IN A 104.25.211.99 Monzo the marketing website for the bank, uses Cloudflare. If you go through the DNS logs for the Monzo app, you'll see everything else goes direct... Google, Facebook, Status Page, AWS. With the only exception being some image assets: dig monzo-prod-user-images.imgix.net ;; QUESTION SECTION: ;monzo-prod-user-images.imgix.net. IN A ;; ANSWER SECTION: monzo-prod-user-images.imgix.net. 2280 IN CNAME dualstack.com.imgix.map.fastly.net. dualstack.com.imgix.map.fastly.net. 4 IN A 151.101.18.208

BillinghamJ 7y ago
There are still plenty of customer-data-carrying things which do go over cloudflare - e.g. the internet banking, the public API, in-app webviews, etc
- keraf 7y ago
  The Monzo web interface uses the public API too.

idiocache 7y ago

Many banks use a CDN, primarily for DDOS protection. This includes the actual online banking endpoints. E.g. Lloyds and Barclays (major UK banks) both use Akamai, as does American Express.

m11a 7y ago

"through any third party" I would argue that using a third party that specialises in security is better than remaking the wheel yourself. Cloudflare invest a significant amount in the security of their platform and have a lot of talented engineers that focus solely on that. They have a lot more data to play around with and I would expect they can do a better job at security than Monzo alone, with their own infrastructure, with their own engineers. Note that Cloudflare is PCI compliant (https://support.cloudflare.com/hc/en-us/articles/202249734-Cloudflare-and-PCI-Compliance https://support.cloudflare.com/hc/en-us/articles/202249734-C...) Not sure I understand the hype of remaking the wheel, when specialist services exist that probably do the work better, more safely and cheaper.