bragging about security is definitely increasing the likelihood that some random guy will say "oh yah, we'll see about that" in response to a marketing campaign centered around security.
Why go after Monzo when you can go after XYZ root cert trusted by every device out there?
If you could actually do anything based on the knowledge here, you would go after a browser root cert because your hack would be exponentially more effective.
edit since I can't reply down level further: Yes I would be very careful about security related marketing and really consider if its necessary at all.
You can always be hacked in some other way, so I guess we should never write anything about security ever?
>edit since I can't reply down level further: Yes I would be very careful about security related marketing and really consider if its necessary at all.
Interestingly, the security people at Google, Cloudfare, Microsoft, and just about every other major tech company (and security company, certificate authority, etc.) agree that openly talking about security best practices is.. well.. A best practice. And that keeping security practices secret (obscure, you could say) benefits no one.
Not sure why you have to shoe-horn marketing in every comment, literally anything a company posts is arguably considered marketing, what's your point?
I published this because I want to be open about how we do these things, because I think we safely can be and it shows that we care and don't just pay lip-service to security
If you'd like to show us up for our security though, please do peek at our HackerOne program. I'm a program admin on it and I'd love to read more interesting reports https://hackerone.com/monzo <3 (I know it doesn't have a paid bounty yet, I'm advocating for it)