Monzo urges 480k customers to change their pin numbers

You can read in the announcement the need to update the app, meaning it was the app that logged the PIN and this led to internal logging.<p>I love Monzo, but one thing that does concern me greatly are banking apps (or any apps that touch highly sensitive pieces of information) that include third party components or make any communication to third parties.<p>In the case of Monzo: <a href="https:&#x2F;&#x2F;reports.exodus-privacy.eu.org&#x2F;en&#x2F;reports&#x2F;88809&#x2F;" rel="nofollow">https:&#x2F;&#x2F;reports.exodus-privacy.eu.org&#x2F;en&#x2F;reports&#x2F;88809&#x2F;</a><p>+ Facebook Analytics<p>+ Facebook Login<p>+ Google Ads<p>+ Google CrashLytics<p>+ Google DoubleClick<p>+ Google Firebase Analytics<p>And according to NetGuard locally:<p><pre><code> ws-eu.pusher.com graph.facebook.com e.crashlytics.com app.adjust.com graph.accountkit.com </code></pre> Of those, aside from generally &quot;Why?&quot; I&#x27;m most concerned by crashlytics.com . Is this like Sentry? Does it send a stack on a crash? If I&#x27;m paying someone and entered my PIN and it crashes, did my PIN go to a third party?<p>I saw an app recently that gave me the option in the settings to opt out of crashlytics - more of that please!<p>I&#x27;d be much happier seeing nothing third party in apps that deal with sensitive information.<p>And I&#x27;d be happy to memorise a 2nd less important software PIN for app transaction authorisation that wasn&#x27;t the same as the ATM and hardware PIN.

Seems like credentials being stored in logs is something that happens at pretty much every tech company - see e.g. Facebook[1] and Google[2]. Perhaps client <i>and</i> serverside hashing should be standard - at least then the actual credentials wouldn&#x27;t be leaked, and the salt could be rolled the next time the user inputted it<p>[1] <a href="https:&#x2F;&#x2F;krebsonsecurity.com&#x2F;2019&#x2F;03&#x2F;facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years&#x2F;" rel="nofollow">https:&#x2F;&#x2F;krebsonsecurity.com&#x2F;2019&#x2F;03&#x2F;facebook-stored-hundreds...</a><p>[2] <a href="https:&#x2F;&#x2F;www.theverge.com&#x2F;2019&#x2F;5&#x2F;21&#x2F;18634842&#x2F;google-passwords-plain-text-g-suite-fourteen-years" rel="nofollow">https:&#x2F;&#x2F;www.theverge.com&#x2F;2019&#x2F;5&#x2F;21&#x2F;18634842&#x2F;google-passwords...</a>

As someone who is fully drunk on Monzo kool-aid, well done to them on (a) identifying the problem and (b) immediately telling customers what to do.<p>Imagine how long this would have been an issue if it had happened at Barclays or TSB.

I remember we worked for a well established (no startup) EU bank on a completely new mobile banking (which later won several awards) and I always kind of wondered why they didn&#x27;t want any 3rd party services like Google Analytics or Fabric. Well now I completely understand. Also, the PIN (which was a &quot;password&quot; to enter into the app) never left the app and the bank didn&#x27;t know the PIN. A SRP (Secure Remote Password) protocol was used so that the passwords never left the device and actually even the communication could be done over HTTP (instead of SSL) and the attack would not gain the passwords&#x2F;keys. I became a customer after working onsite for them and seeing the code and working with the devs at the bank :-).

Would that be my personal pin number, or some other pin number?