Even though they weren't affected much and no one would have called them out if they didn't do this, the fact that they did such a nice job of dissecting the situation and deploying the appropriate measures is really, really good.
While it should be applauded that they responded promptly, it needs to be remembered that this is a regulated, licensed bank that proxied sensitive customer information via a (now compromised) third-party. We should expect this kind of disclosure from such organisations, not be surprised by it.
My thoughts exactly. As a bank, allowing Cloudflare to MITM their customers' financial data, presumably so they can save on bandwidth, seems inappropriate.
Is it necessary to allow them to terminate/decrypt your TLS connections in order to provide DDOS mitigation? There are other providers besides Cloudflare in this space.
Isn't the DDOS mitigation undermined by exposing the API used by your apps directly?
I did read it, but on a second look, I see I missed that "Monzo.com [the web portal] does not process any sensitive information". Thanks for pointing that out.
> "Our developer API does sit behind Cloudflare with all of its traffic proxied through their service." .. "Data sent to and from our developer API may contain the following information:" .. "Customers’ personally identifiable information"
Great response from Monzo. I live in Scotland and it's amazing the difference companies like monzo have compared to regular banks (see the tesco bank fiasco)
Anecdotally, it seems Scots are more likely to say Scot* vs UK than are Welsh/English to offer the equivalent. I certainly grew up (in England) with the feeling that one had to be careful to say 'UK' if one really meant UK, for fear of similar reprimand to that when using a gendered pronoun that may or may not be correct.
I agree - Monzo is amazing and I view it as a object lesson in credit card UX - great app, great customer service. Looking forward to the full banking service.
Honest question, this is far from my area of expertise: I get why you would put Cloudflare on a public website -- but what is the benefit of wrapping the authenticated, dynamic parts of a website/service in Cloudflare? These are things you would want to never get cached, and, I suppose, you would want end-to-end TLS'd into your own network?
If you put all of your services behind a reverse-proxy CDN/WAF service like CloudFlare it greatly reduces your attack surface because the public has no access to your origin IPs.
Because the "HTTPS everywhere or you're a dinosaur and you don't deserve to live" hysteria forced everyone to put HTTPS even in places where it doesn't belong.
Not sure why the parent post is being downmodded: it's entirely accurate. From what Google wrote [1], the module is part of a CloudFlare ScrapeShield, which is a proprietary nginx module that does DOM manipulation to obfuscate pages to fight scrapers. Mismatched tags were causing arbitrary bits of memory to leak into responses.
One question - does anyone else feel that having NGINX as the only link in the summary kind of suggests that it's an nginx problem? I could imagine my previous boss reading the article, and 3 months later saying, "Wait what, we're using nginx??? Isn't that that shit that made cloudbleed happen?"
Hahahaha, you're spot-on actually, but that's why they're paying you, right? So you'll take 2 weeks worth of explanations on why NGINX has nothing to do with this!
BUT... The moment you passed your argument through a severe vulnerability related to NGINX (doesn't even have to be directly related, mind you!) will be disclosed and you're boss will jump-in screaming "I KNEW IT, NGINX IS BEHIND ALL THIS!" (he'll be spelling it correctly by then :-P )
I think you're right: including NGINX in the summary is a distraction, and highlighting it as a link makes the wrong implication. I'm a developer at Monzo, so I've tweaked the blog post to remove the reference. Thanks!
While they are not being precise in their response, you cannot consider nginx more secure. Nginx is still part of the problem, it had many CVEs too, even very similar memory disclosure vulnerabilities.
It's written in C, which is part of the problem. I'd be very interested in a similarly-featured webserver (reverse proxy, mostly) which is written in a memory-safe language.
Depends on what you're doing. If it's fronting an expensive web-app, then the couple hundred CPU-microseconds needed to proxy a request isn't going to be noticeable...
Caddy can serve 5,000 requests per second per core. I would flip your statement on its head, and say that a minority of people need anything close to that. The few companies that do, can probably afford to keep on top of CVEs for their frontends as well.
Well, as nice as that sounds on paper, there's a reason we use reverse-proxies in the first place. It's because it turns out that opening anything up to the web is a whole can of worms of exploits, malformed requests, differently complying useragents, tons of standard, nonstandard, and "crazy off the wall bullshit" headers, and a LOT more.
Greenfield writing a new safe reverse proxy that works within a magnitude of performance of something like nginx is a monumental effort. Not to mention the chicken-and-egg problem of how nobody will trust it until it has significant usage which it won't get until some people trust it.
If I understood the issue correctly, then "Transaction information" and "Customers’ personally identifiable information" via the Developer's API were potentially affected.
The Monzo's response is much more re-assuring compared to Cloudflare's:
> "We've seen absolutely no evidence that this has been exploited," he told Reuters by phone.
> "It's very unlikely that someone has got this information."
I agree. Cloudflare's public statements have not inspired confidence. When you get publicly called out by Google's security chief, you need to bring your A game in damage control.
It's a prepaid credit card that immediately notifies your phone every time you make a transaction with the amount and location.
It is particularly useful overseas. I was in Belgium at the weekend and all my € spend was immediately translated into £ so I could clearly see how much I was spending. I could also find the café that I went to for breakfast the previous day because it's location is right there in the Monzo app.
The other useful feature is when I'm out drinking. If I loose the card, I can freeze the card from inside the app. Also it means that the next morning I can see how much I spent.
Is Monzo only for those based in the United Kingdom?
If so, for those based in the states, you ought to check out Simple (https://www.simple.com) - it's great, it has a clean user interface, there are no fees, and the customer support team is top notch.
I assume it's the same thing (Simple and Monzo). Anyone know of any major differences between them?
I'm also a happy customer of Simple and also similarly curious about any major differences. In fact, it seems like Simple is better in every way at the moment: https://www.simple.com/features
Monzo is UK only at the moment. They don't do saving which it seems Simple does. They (for now) have focussed upon building their tech stack and a pre paid credit card.
> It's a prepaid credit card that immediately notifies your phone every time you make a transaction with the amount and location.
All of my regular financial accounts (bank, credit cards) can do this. There's typically a page in the account center with settings for sending SMS and email alerts when various types of transactions exceed a certain monetary threshold. I set them all to $0 and get notified of everything as it happens.
Yup and recently all of my credit cards (Amex, Capital One, Citi, Discover) have implemented push notifications for all transactions. No middleman in the way and I get cash back :)
Same here, all of mine do the same. If you add them Apple Pay, you even get notifications added to lock screens. Nice for monitoring usage(which I caught a stolen card number with recently).
The other comments don't mention this, but it's also a new UK bank. They're going through the official approval process right now to be able to offer current accounts, overdrafts and so on.
64 comments
[ 2.1 ms ] story [ 93.1 ms ] threadLove monzo. <3
Isn't the DDOS mitigation undermined by exposing the API used by your apps directly?
Seriously, CloudFlare is doing nothing new and nothing fancy.
They don't use cloudflare to MITM customer data.
"Did you even read the article? It mentions that" can be shortened to "The article mentions that."
https://news.ycombinator.com/newsguidelines.html
Anecdotally, it seems Scots are more likely to say Scot* vs UK than are Welsh/English to offer the equivalent. I certainly grew up (in England) with the feeling that one had to be careful to say 'UK' if one really meant UK, for fear of similar reprimand to that when using a gendered pronoun that may or may not be correct.
Like an online banking app?
More precise: a bug in a proprietary closed source module for NGINX used in-house at Cloudflare.
[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=11...
One question - does anyone else feel that having NGINX as the only link in the summary kind of suggests that it's an nginx problem? I could imagine my previous boss reading the article, and 3 months later saying, "Wait what, we're using nginx??? Isn't that that shit that made cloudbleed happen?"
This caught my eye as well. Not sure what to do about it other than link/read the cloudflare blog post/incident report. FUD, etc.
BUT... The moment you passed your argument through a severe vulnerability related to NGINX (doesn't even have to be directly related, mind you!) will be disclosed and you're boss will jump-in screaming "I KNEW IT, NGINX IS BEHIND ALL THIS!" (he'll be spelling it correctly by then :-P )
[1] https://github.com/mholt/caddy
Caddy can serve 5,000 requests per second per core. I would flip your statement on its head, and say that a minority of people need anything close to that. The few companies that do, can probably afford to keep on top of CVEs for their frontends as well.
Empty request benchmarks are indicative of nothing in the real world.
For any reasonable workload, even serving static sites of a few kilobytes they will be effectively the same.
Caddy's sane default settings (enforcing SSL, and with correct settings to get an A+ on SSL labs) make it the right choice for a lot of deployments
https://github.com/mholt/caddy/issues/1204#issuecomment-2781...
Greenfield writing a new safe reverse proxy that works within a magnitude of performance of something like nginx is a monumental effort. Not to mention the chicken-and-egg problem of how nobody will trust it until it has significant usage which it won't get until some people trust it.
They also offer good exchange rates with no fees.
Personally I use it as a travel/buffer card as my main card has been copied in the past and I usually have sub £100 on my Monzo card.
It is particularly useful overseas. I was in Belgium at the weekend and all my € spend was immediately translated into £ so I could clearly see how much I was spending. I could also find the café that I went to for breakfast the previous day because it's location is right there in the Monzo app.
The other useful feature is when I'm out drinking. If I loose the card, I can freeze the card from inside the app. Also it means that the next morning I can see how much I spent.
Damn I'm going to Europe at the weekend too, thought the 2% charge my bank does isn't so bad but I may have to finally get on the Monzo train.
If so, for those based in the states, you ought to check out Simple (https://www.simple.com) - it's great, it has a clean user interface, there are no fees, and the customer support team is top notch.
I assume it's the same thing (Simple and Monzo). Anyone know of any major differences between them?
The thing is, their big value add is the instant notifications. As far as I can tell from reading their blog, this took a lot of development effort: https://monzo.com/blog/2015/12/15/why-are-foreign-card-payme...
All of my regular financial accounts (bank, credit cards) can do this. There's typically a page in the account center with settings for sending SMS and email alerts when various types of transactions exceed a certain monetary threshold. I set them all to $0 and get notified of everything as it happens.
I think our banking system is a bit antiquated. Monzo have built a tech stack that is far more advanced than any of our incumbant banks.