One of my concerns about Monzo, that I have mentioned to them on Twitter some time ago, is the fact that they entirely rely on CloudFlare for customer facing services. Although I trust CloudFlare and understand how useful their services are, I am a bit uneasy that my banking information is transiting in clear through any third party.
dig internal-api.monzo.com
;; QUESTION SECTION:
;internal-api.monzo.com. IN A
;; ANSWER SECTION:
internal-api.monzo.com. 288 IN CNAME k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com.
k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 34.254.57.66
k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 52.212.7.167
k8s-worker-external-alb-prod-1306866561.eu-west-1.elb.amazonaws.com. 8 IN A 34.255.246.8
Monzo the bank, runs from Amazon and not via Cloudflare.
dig www.monzo.com
;; QUESTION SECTION:
;www.monzo.com. IN A
;; ANSWER SECTION:
www.monzo.com. 59 IN A 104.25.212.99
www.monzo.com. 59 IN A 104.25.211.99
Monzo the marketing website for the bank, uses Cloudflare.
If you go through the DNS logs for the Monzo app, you'll see everything else goes direct... Google, Facebook, Status Page, AWS.
With the only exception being some image assets:
dig monzo-prod-user-images.imgix.net
;; QUESTION SECTION:
;monzo-prod-user-images.imgix.net. IN A
;; ANSWER SECTION:
monzo-prod-user-images.imgix.net. 2280 IN CNAME dualstack.com.imgix.map.fastly.net.
dualstack.com.imgix.map.fastly.net. 4 IN A 151.101.18.208
I would argue that using a third party that specialises in security is better than remaking the wheel yourself.
Cloudflare invest a significant amount in the security of their platform and have a lot of talented engineers that focus solely on that. They have a lot more data to play around with and I would expect they can do a better job at security than Monzo alone, with their own infrastructure, with their own engineers. Note that Cloudflare is PCI compliant (https://support.cloudflare.com/hc/en-us/articles/202249734-C...)
Not sure I understand the hype of remaking the wheel, when specialist services exist that probably do the work better, more safely and cheaper.
Cloudflare basically acts as a reverse proxy adding all kinds of features (mostly caching, origin protection against ddos, waf, etc). I'm pretty sure they're pci compliant
Many banks use a CDN, primarily for DDOS protection. This includes the actual online banking endpoints. E.g. Lloyds and Barclays (major UK banks) both use Akamai, as does American Express.
Comments
One of my concerns about Monzo, that I have mentioned to them on Twitter some time ago, is the fact that they entirely rely on CloudFlare for customer facing services. Although I trust CloudFlare and understand how useful their services are, I am a bit uneasy that my banking information is transiting in clear through any third party.
If you go through the DNS logs for the Monzo app, you'll see everything else goes direct... Google, Facebook, Status Page, AWS.
With the only exception being some image assets:
There are still plenty of customer-data-carrying things which do go over cloudflare - e.g. the internet banking, the public API, in-app webviews, etc
The Monzo web interface uses the public API too.
"through any third party"
I would argue that using a third party that specialises in security is better than remaking the wheel yourself.
Cloudflare invest a significant amount in the security of their platform and have a lot of talented engineers that focus solely on that. They have a lot more data to play around with and I would expect they can do a better job at security than Monzo alone, with their own infrastructure, with their own engineers. Note that Cloudflare is PCI compliant (https://support.cloudflare.com/hc/en-us/articles/202249734-C...)
Not sure I understand the hype of remaking the wheel, when specialist services exist that probably do the work better, more safely and cheaper.
In clear? Could you show me any example supporting this claim?
Cloudflare basically acts as a reverse proxy adding all kinds of features (mostly caching, origin protection against ddos, waf, etc). I'm pretty sure they're pci compliant
They are. Relevant support page for those who are curious: https://support.cloudflare.com/hc/en-us/articles/202249734-C...
Many banks use a CDN, primarily for DDOS protection. This includes the actual online banking endpoints. E.g. Lloyds and Barclays (major UK banks) both use Akamai, as does American Express.