Hacker News Reader

Comment by mintplant | Hacker News Reader

My thoughts exactly. As a bank, allowing Cloudflare to MITM their customers' financial data, presumably so they can save on bandwidth, seems inappropriate.

View on HN

The only reason to consider Cloudflare, for us, is DDOS mitigation.

Is it necessary to allow them to terminate/decrypt your TLS connections in order to provide DDOS mitigation? There are other providers besides Cloudflare in this space.

Isn't the DDOS mitigation undermined by exposing the API used by your apps directly?

The (almost) only other provider is Akamai and it's the exact same thing.

Seriously, CloudFlare is doing nothing new and nothing fancy.

Are you claiming that Cloudflare and Akamai are the only providers of DDoS mitigation services? A simple web search will show otherwise.

Did you read the post?

They don't use cloudflare to MITM customer data.

Please don't imply that someone hasn't read the article. From the guidelines:

"Did you even read the article? It mentions that" can be shortened to "The article mentions that."

https://news.ycombinator.com/newsguidelines.html

I did read it, but on a second look, I see I missed that "Monzo.com [the web portal] does not process any sensitive information". Thanks for pointing that out.

> "Our developer API does sit behind Cloudflare with all of its traffic proxied through their service." .. "Data sent to and from our developer API may contain the following information:" .. "Customers’ personally identifiable information"

Reply on news.ycombinator.com