Hacker News Reader

Comment by libeclipse | Hacker News Reader

Even though they weren't affected much and no one would have called them out if they didn't do this, the fact that they did such a nice job of dissecting the situation and deploying the appropriate measures is really, really good.

Love monzo. <3

View on HN

While it should be applauded that they responded promptly, it needs to be remembered that this is a regulated, licensed bank that proxied sensitive customer information via a (now compromised) third-party. We should expect this kind of disclosure from such organisations, not be surprised by it.

My thoughts exactly. As a bank, allowing Cloudflare to MITM their customers' financial data, presumably so they can save on bandwidth, seems inappropriate.

The only reason to consider Cloudflare, for us, is DDOS mitigation.

Is it necessary to allow them to terminate/decrypt your TLS connections in order to provide DDOS mitigation? There are other providers besides Cloudflare in this space.

Isn't the DDOS mitigation undermined by exposing the API used by your apps directly?

The (almost) only other provider is Akamai and it's the exact same thing.

Seriously, CloudFlare is doing nothing new and nothing fancy.

Are you claiming that Cloudflare and Akamai are the only providers of DDoS mitigation services? A simple web search will show otherwise.

Did you read the post?

They don't use cloudflare to MITM customer data.

Please don't imply that someone hasn't read the article. From the guidelines:

"Did you even read the article? It mentions that" can be shortened to "The article mentions that."

https://news.ycombinator.com/newsguidelines.html

I did read it, but on a second look, I see I missed that "Monzo.com [the web portal] does not process any sensitive information". Thanks for pointing that out.

> "Our developer API does sit behind Cloudflare with all of its traffic proxied through their service." .. "Data sent to and from our developer API may contain the following information:" .. "Customers’ personally identifiable information"

In an ideal world, yes. But this is the world where we live, and what monzo did is rare enough to warrant surprise.

Reply on news.ycombinator.com