Hacker News Reader

Comment by chespinoza | Hacker News Reader

This looks to me like an open invitation to be attacked, banks don't use to describe openly the technologies or methodologies they use for good reasons and Monzo has been quite open about these matters for a long time (Go use for instance), they're doing pretty good though and probably as traditional banks are using quite old technologies they seem to be into a far less vulnerable position than traditional banking.

View on HN

None of what is described here is revolutionary or some novel form of security when dealing with PKI and root certs. Not sure how it opens up attacks or becomes an invitation to be attacked.

>banks don't use to describe openly the technologies or methodologies they use for good reasons

I don't think it's "for good reasons". I think it's for "don't want to be found to still be using XP" reasons.

I agree that's a significant part of it (most banks don't actually do a very good job of security). The other part is that most banks' leadership are finance people, while Mongo's leadership is largely technical (and consequently are more open to discussing technology).

Not sure what bank you're referring to but most finiance companies I've delt with in the past (in the UK) have extremely good technical people.

most of the stuff is security using multple layers - which can be a pain to modify

Any technical debt is evaluated as a risk and signed off by the business

Having good people is necessary but not sufficient for good security. In many cases, management isn't even aiming for compliance much less actual security. This is based off of multiple close friends and family in the banking and bank auditing world in the US as well as my own experiences working on financial software (including the relevant regulatory and compliance bodies as well as the many banks who were our customers); can't speak to UK specifically.

From my past uk financial security experience - security personal can highlight and raise risks with any decision made by the business or other techies.

the higher the risk the more hoops you need to jump through for security sign off (to the point where they will not sign it off) and higher the risk, the higher up the food chain of managment that is needed to sign it off

obv if the execs are not bothered about security then anything can happen

but if something goes wrong a big finger will be pointing at that person who signed it off - which seems in it self a massive deterrent

Plot twist: their procedures are actually completely different, and this blog is part of a larger scheme to confuse potential attackers.

A lot of us InfoSec folks consider this very good practice to be 100% open about how security technologies are deployed. Ever heard about security by obscurity? It confers a false (dangerous!) sense of security, and prevents your security stack from being audited/reviewed even by casual comments, like it's literally happening right now on HN.

are you saying that it's best for companies to openly publish all their (network) security?

Publish procedures?

Yes. Generally speaking, an open and auditable system is more robust and secure than a closed and non-auditable system.

There are obviously limits (e.g. publishing what specific VLAN numbering scheme you use is obviously not helpful to anyone and just provides information that wasn't known).

But yes, it is best practice to publish and accept feedback on generalized procedures.

You should sign up for the MDSP dev-security-policy mailing list and see how the (open) conversations have continued to improve security for all.

fully audited absolutely yes, feedback come internally with many (100's) of technical/ network architects poking and proding

I fail to see any positives in openly publishing anything, unless you provide an extememly very detailed view - I see only negatives

This isn't an invitation to attack us beyond as part of our HackerOne program (please don't make my life more difficult) but to steal a line from someone else at Monzo: Kerckhoffs's principle probably has some cross-over relevancy to this stuff.

Can't really comment on why other banks don't talk about this so you'll have to draw your own conclusions on that :P

bragging about security is definitely increasing the likelihood that some random guy will say "oh yah, we'll see about that" in response to a marketing campaign centered around security.

If Some Random Guy can just happen to compromise the processes described here after reading a few hundred word blog post, they should probably just go after every browser root cert program which use almost identical procedures and have also described them openly.

Why go after Monzo when you can go after XYZ root cert trusted by every device out there?

because one initiated a marketing campaign about their security so as to get some attention and find a different vulnerability the company didn't know about.

Publicly describing your security procedures is common (and encouraged) practice in infosec. See CloudFare, Mozilla, Google, etc. who have all publicly described various security procedures (including key signing and key management).

If you could actually do anything based on the knowledge here, you would go after a browser root cert because your hack would be exponentially more effective.

I wouldn't do anything, but I also wouldn't do a security driven marketing campaign. If someone thinks their root cert is safe it doesn't mean there isn't some other way to get access to user credentials that could allow compromise through some other avenue.

edit since I can't reply down level further: Yes I would be very careful about security related marketing and really consider if its necessary at all.

>it doesn't mean there isn't some other way to get access to user credentials

You can always be hacked in some other way, so I guess we should never write anything about security ever?

>edit since I can't reply down level further: Yes I would be very careful about security related marketing and really consider if its necessary at all.

Interestingly, the security people at Google, Cloudfare, Microsoft, and just about every other major tech company (and security company, certificate authority, etc.) agree that openly talking about security best practices is.. well.. A best practice. And that keeping security practices secret (obscure, you could say) benefits no one.

Not sure why you have to shoe-horn marketing in every comment, literally anything a company posts is arguably considered marketing, what's your point?

I hope this post doesn't come across as a brag as it's not meant to be, being arrogant about security only ends one way after all...

I published this because I want to be open about how we do these things, because I think we safely can be and it shows that we care and don't just pay lip-service to security

If you'd like to show us up for our security though, please do peek at our HackerOne program. I'm a program admin on it and I'd love to read more interesting reports https://hackerone.com/monzo <3 (I know it doesn't have a paid bounty yet, I'm advocating for it)

it comes off as marketing based on security which is no different than bragging in my opinion. You have a program for dealing with security vulnerabilities - clearly this blog post was to tell people about how good your security is. It's marketing.

Reply on news.ycombinator.com