Monzo’s Response to Cloudbleed | Hacker News Reader

Monzo’s Response to Cloudbleed

monzo.com

151 pointsobeattie59 comments

Even though they weren't affected much and no one would have called them out if they didn't do this, the fact that they did such a nice job of dissecting the situation and deploying the appropriate measures is really, really good.

Love monzo. <3

While it should be applauded that they responded promptly, it needs to be remembered that this is a regulated, licensed bank that proxied sensitive customer information via a (now compromised) third-party. We should expect this kind of disclosure from such organisations, not be surprised by it.

My thoughts exactly. As a bank, allowing Cloudflare to MITM their customers' financial data, presumably so they can save on bandwidth, seems inappropriate.

The only reason to consider Cloudflare, for us, is DDOS mitigation.

Is it necessary to allow them to terminate/decrypt your TLS connections in order to provide DDOS mitigation? There are other providers besides Cloudflare in this space.

Isn't the DDOS mitigation undermined by exposing the API used by your apps directly?

The (almost) only other provider is Akamai and it's the exact same thing.

Seriously, CloudFlare is doing nothing new and nothing fancy.

Are you claiming that Cloudflare and Akamai are the only providers of DDoS mitigation services? A simple web search will show otherwise.

Did you read the post?

They don't use cloudflare to MITM customer data.

Please don't imply that someone hasn't read the article. From the guidelines:

"Did you even read the article? It mentions that" can be shortened to "The article mentions that."

https://news.ycombinator.com/newsguidelines.html

I did read it, but on a second look, I see I missed that "Monzo.com [the web portal] does not process any sensitive information". Thanks for pointing that out.

> "Our developer API does sit behind Cloudflare with all of its traffic proxied through their service." .. "Data sent to and from our developer API may contain the following information:" .. "Customers’ personally identifiable information"

In an ideal world, yes. But this is the world where we live, and what monzo did is rare enough to warrant surprise.

Great that they respond so clearly and quickly.

One question - does anyone else feel that having NGINX as the only link in the summary kind of suggests that it's an nginx problem? I could imagine my previous boss reading the article, and 3 months later saying, "Wait what, we're using nginx??? Isn't that that shit that made cloudbleed happen?"

> nginx hacked

This caught my eye as well. Not sure what to do about it other than link/read the cloudflare blog post/incident report. FUD, etc.

Hahahaha, you're spot-on actually, but that's why they're paying you, right? So you'll take 2 weeks worth of explanations on why NGINX has nothing to do with this!

BUT... The moment you passed your argument through a severe vulnerability related to NGINX (doesn't even have to be directly related, mind you!) will be disclosed and you're boss will jump-in screaming "I KNEW IT, NGINX IS BEHIND ALL THIS!" (he'll be spelling it correctly by then :-P )

I think you're right: including NGINX in the summary is a distraction, and highlighting it as a link makes the wrong implication. I'm a developer at Monzo, so I've tweaked the blog post to remove the reference. Thanks!

While they are not being precise in their response, you cannot consider nginx more secure. Nginx is still part of the problem, it had many CVEs too, even very similar memory disclosure vulnerabilities.

It's written in C, which is part of the problem. I'd be very interested in a similarly-featured webserver (reverse proxy, mostly) which is written in a memory-safe language.

Caddy[1] is written in Go and has a nicer, simpler syntax. I'm sure NGINX has many more features though.

[1] https://github.com/mholt/caddy

Caddy has less than half the performance of Nginx - not really a viable replacement at any sort of scale. https://hackernoon.com/caddy-a-modern-web-server-vs-nginx-e9...

Depends on what you're doing. If it's fronting an expensive web-app, then the couple hundred CPU-microseconds needed to proxy a request isn't going to be noticeable...

Caddy can serve 5,000 requests per second per core. I would flip your statement on its head, and say that a minority of people need anything close to that. The few companies that do, can probably afford to keep on top of CVEs for their frontends as well.

That's misleading at best.

Empty request benchmarks are indicative of nothing in the real world.

For any reasonable workload, even serving static sites of a few kilobytes they will be effectively the same.

Caddy's sane default settings (enforcing SSL, and with correct settings to get an A+ on SSL labs) make it the right choice for a lot of deployments

Ironically as I was considering Caddy as an NGINX alternative I found about a security issue that is very reminiscent of what happened at cloudflare:

https://github.com/mholt/caddy/issues/1204#issuecomment-2781...

Well, as nice as that sounds on paper, there's a reason we use reverse-proxies in the first place. It's because it turns out that opening anything up to the web is a whole can of worms of exploits, malformed requests, differently complying useragents, tons of standard, nonstandard, and "crazy off the wall bullshit" headers, and a LOT more.

Greenfield writing a new safe reverse proxy that works within a magnitude of performance of something like nginx is a monumental effort. Not to mention the chicken-and-egg problem of how nobody will trust it until it has significant usage which it won't get until some people trust it.

Honest question, this is far from my area of expertise: I get why you would put Cloudflare on a public website -- but what is the benefit of wrapping the authenticated, dynamic parts of a website/service in Cloudflare? These are things you would want to never get cached, and, I suppose, you would want end-to-end TLS'd into your own network?

Cloudflare is not just a caching/CDN service, they also provide DDOS protection: https://www.cloudflare.com/ddos/

If you put all of your services behind a reverse-proxy CDN/WAF service like CloudFlare it greatly reduces your attack surface because the public has no access to your origin IPs.

Because the "HTTPS everywhere or you're a dinosaur and you don't deserve to live" hysteria forced everyone to put HTTPS even in places where it doesn't belong.

I'm pretty sure "in front of the API for people's bank account" is exactly the place HTTPS belongs.

> put HTTPS even in places where it doesn't belong

Like an online banking app?

The Monzo's response is much more re-assuring compared to Cloudflare's:

  > "We've seen absolutely no evidence that this has been exploited," he told Reuters by phone. 
  > "It's very unlikely that someone has got this information."

http://www.reuters.com/article/us-cyber-cloudflare-idUSKBN16...

I agree. Cloudflare's public statements have not inspired confidence. When you get publicly called out by Google's security chief, you need to bring your A game in damage control.

> A bug in an NGINX module used by Cloudflare’s edge proxies

More precise: a bug in a proprietary closed source module for NGINX used in-house at Cloudflare.

Not sure why the parent post is being downmodded: it's entirely accurate. From what Google wrote [1], the module is part of a CloudFlare ScrapeShield, which is a proprietary nginx module that does DOM manipulation to obfuscate pages to fight scrapers. Mismatched tags were causing arbitrary bits of memory to leak into responses.

[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=11...

What the heck is Monzo? I read the About, is this another Paypal 20 years later?

It's a prepaid credit card with a great app that lets you do things like freezing your card quickly.

They also offer good exchange rates with no fees.

Personally I use it as a travel/buffer card as my main card has been copied in the past and I usually have sub £100 on my Monzo card.

It's currently a prepaid card, but they are in the process of launching a current account. It's a new, digital-first bank.

It's a prepaid debit card that gives you a pretty breakdown of your spending through an app.

It's a prepaid credit card that immediately notifies your phone every time you make a transaction with the amount and location.

It is particularly useful overseas. I was in Belgium at the weekend and all my € spend was immediately translated into £ so I could clearly see how much I was spending. I could also find the café that I went to for breakfast the previous day because it's location is right there in the Monzo app.

The other useful feature is when I'm out drinking. If I loose the card, I can freeze the card from inside the app. Also it means that the next morning I can see how much I spent.

I should add, there is no ongoing charge for this and they use the MasterCard exchange rate which is a better rate than I can get anywhere else.

Ah really? No foreign currency fees?

Damn I'm going to Europe at the weekend too, thought the 2% charge my bank does isn't so bad but I may have to finally get on the Monzo train.

Yep, no foreign currency fees.

Is Monzo only for those based in the United Kingdom?

If so, for those based in the states, you ought to check out Simple (https://www.simple.com) - it's great, it has a clean user interface, there are no fees, and the customer support team is top notch.

I assume it's the same thing (Simple and Monzo). Anyone know of any major differences between them?

I'm also a happy customer of Simple and also similarly curious about any major differences. In fact, it seems like Simple is better in every way at the moment: https://www.simple.com/features

Monzo is UK only at the moment. They don't do saving which it seems Simple does. They (for now) have focussed upon building their tech stack and a pre paid credit card.

The thing is, their big value add is the instant notifications. As far as I can tell from reading their blog, this took a lot of development effort: https://monzo.com/blog/2015/12/15/why-are-foreign-card-payme...

> It's a prepaid credit card that immediately notifies your phone every time you make a transaction with the amount and location.

All of my regular financial accounts (bank, credit cards) can do this. There's typically a page in the account center with settings for sending SMS and email alerts when various types of transactions exceed a certain monetary threshold. I set them all to $0 and get notified of everything as it happens.

Yup and recently all of my credit cards (Amex, Capital One, Citi, Discover) have implemented push notifications for all transactions. No middleman in the way and I get cash back :)

Same here, all of mine do the same. If you add them Apple Pay, you even get notifications added to lock screens. Nice for monitoring usage(which I caught a stolen card number with recently).

That's really good to hear. Unfortunately that doesn't seem to be the case in the UK, at least for my accounts (Barclaycard and Halifax).

I think our banking system is a bit antiquated. Monzo have built a tech stack that is far more advanced than any of our incumbant banks.

The other comments don't mention this, but it's also a new UK bank. They're going through the official approval process right now to be able to offer current accounts, overdrafts and so on.

If I understood the issue correctly, then "Transaction information" and "Customers’ personally identifiable information" via the Developer's API were potentially affected.

Great response from Monzo. I live in Scotland and it's amazing the difference companies like monzo have compared to regular banks (see the tesco bank fiasco)

Without meaning to sound rude, why does it make a difference where you live? I feel like I'm missing something.

The place where someone lives changes the set of "regular banks" one's exposed to.

Ah. I live in Scotland too and wondered if Monzo had some connection (Tesco Bank is based here but operates UK-wide)

Monzo is also UK-wide, but only UK-wide.

Anecdotally, it seems Scots are more likely to say Scot* vs UK than are Welsh/English to offer the equivalent. I certainly grew up (in England) with the feeling that one had to be careful to say 'UK' if one really meant UK, for fear of similar reprimand to that when using a gendered pronoun that may or may not be correct.

I believe Monzo is only offered within the UK at the moment as well, so this is at least a little bit region-related.

excellent response

Reply on news.ycombinator.com