The Klarna effect?
Klarna users are being signed in to random accounts
11–20 of 517 posts
Re: Klarna users are being signed in to random accounts
#12Huh, from the headline I was thinking it was intentional! Nothing but marketing fluff in the newsfeed yet, still waiting on an article that's not walled in Swedish(?).
Re: Klarna users are being signed in to random accounts
#13Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts.
For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials to make transfers they could as well look at all my other account data. I really wonder how such a scheme can be legal and how banks can allow this, as they normally tell people to never give their credentials to anyone. The situation of course recently improved with the mandated 2FA for logins and transfers, but still there are so many attack vectors in this model that it boggles my mind how it can still exist.
Re: Klarna users are being signed in to random accounts
#14Lots of times when I’ve been buying things in e-shops I’ve been offered to pay using Klarna as a payment broker.
But doing so has always been more confusing for me compared to “regular” payments with a credit card anywhere else, and has on overall been a negative experience for me.
I really don’t understand why anyone would prefer to use them at all.
What am I missing? Can anyone help me understand?
Re: Klarna users are being signed in to random accounts
#15you have to wonder why they decided to stay up. Surely, if you have a leak this bad, you pull the plug until you can fix it.
Probably a push to prod of something of something that worked on the developers machine, Klarna is at the size where any fault like this would be seen by thousands within any reasonable reaction time.
Re: Klarna users are being signed in to random accounts
#16If you rely on your application layer to enforce data privacy instead of enforcing it in your storage layer its just a matter of time until you have an issue like this.
It says a lot about the security of their api and development culture that they are even struggling with something like this. This should be caught in the first architecture review session.
Re: Klarna users are being signed in to random accounts
#17I've had this happen, although not on a scale as this, when implementing caching and disregarding authentication as a parameter that varies the cache...
Happened to Valve too, Christmas 2015: https://arstechnica.com/gaming/2015/12/valve-explains-ddos-i...
Re: Klarna users are being signed in to random accounts
#18you have to wonder why they decided to stay up. Surely, if you have a leak this bad, you pull the plug until you can fix it.
According to the article they shut down all logins in the app. Unsure if this means you can still use it you are already signed in or not
Re: Klarna users are being signed in to random accounts
#19"The payment giant Klarna, which has 87 million customers globally, currently has major technical problems. Users of the company's app saw other customers' payments and personal information, before it was shut down completely. The supervisory authority Finansinspektionen, FI, has asked Klarna to explain what happened." A future, fascinating post-mortem I hope!
Happened to Steam in 2015. In their case it was a caching issue.
https://old.reddit.com/r/Steam/comments/3y7lxm/when_i_go_to_...
https://www.forbes.com/sites/insertcoin/2015/12/25/steam-is-...
Re: Klarna users are being signed in to random accounts
#20I suspect this might be request threading/confusion[0] issue similar to the one GitHub experienced a while back. This would explain why seemingly random user data is being returned.
0: https://github.blog/2021-03-18-how-we-found-and-fixed-a-rare...