Other discussion that is rapidly sinking from the front page:
Klarna users are being signed in to random accounts
101–110 of 517 posts
Re: Klarna users are being signed in to random accounts
#102I suspect this might be request threading/confusion[0] issue similar to the one GitHub experienced a while back. This would explain why seemingly random user data is being returned. 0: https://github.blog/2021-03-18-how-we-found-and-fixed-a-rare...
IIRC, Klarna is mostly written in Erlang, Scala and some parts in Clojure. If someone should be aware of thread-local storage and its implication it ought to be them.
Using trendy tech doesn't solve much by itself. Especially if you can't (or don't) compete with FAANG on compensation.
Re: Klarna users are being signed in to random accounts
#103Reminds me of what happened to Steam a few years ago https://www.youtube.com/watch?v=dkSslseq9Y8
This also happened to GitHub recently, although limited. https://github.blog/2021-03-18-how-we-found-and-fixed-a-rare...
Re: Klarna users are being signed in to random accounts
#104Earlier quoted context omitted.
There have been some weird legal cases in Sweden where businesses and scammers have been freed after having signed in using other people's "BankID" to change retirement savings around or send cash. Its the ID method I use for credits, pharmacies, health care, taxes, but was apparently not an ID so it's not id-hijacking. Klarna has man in the middled my bank account before and performed a purchase and I've boycotting…
In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs. The same NemID is also used to file your taxes, look at all your health info, get married, everything basically. Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you p…
[deleted]
Re: Klarna users are being signed in to random accounts
#105> Hear hear, I used Klarna (not by choice) It was by choice. You weren't born with an account. Not taking personal responsibility for the rise of the ubiquity of these terrible online services (WhatsApp users, I'm looking at you) is a huge part of the problem. Pretending that you didn't opt-in is a lie you've told yourself; you shouldn't propagate that lie to others in society.
It at least used to be very easy to accidentally sign up for Klarna, thinking you're just paying by card.
Re: Klarna users are being signed in to random accounts
#106My email includes a common Swedish first name so I regularly have people mistakenly use my email address for Klarna orders. What’s most annoying/troubling is that, at least last time I checked, they don’t verify an address before sending invoices, etc. so I end up with other people’s order info in my inbox. I finally started unsubscribing from notifications for orders that weren’t mine.
Is your email adress firstname@something.etc?
I've seen a lot of people not get their emails and wondering if they parse lastname.firstname@something.etc wrong
Re: Klarna users are being signed in to random accounts
#107Earlier quoted context omitted.
Yes and we'll be screaming "please shut off your computer" because of all of the excess heat and insane power bills.
Why not separate concerns? Crypto currencies work without Proof of Work today.
Yeah, so basically use something like Chia instead and create tons of e-waste?
Re: Klarna users are being signed in to random accounts
#108If you rely on your application layer to enforce data privacy instead of enforcing it in your storage layer its just a matter of time until you have an issue like this. It says a lot about the security of their api and development culture that they are even struggling with something like this. This should be caught in the first architecture review session.
How would any measures at storage layer prevent, for example, issues in caching?
And how can one enforce it on a storage layer? There must be something in the application that determines user identity, which either threading, flawed logic, bug or caching (most likely) can mess up. In which case storage layer gets this identity information from application layer.
Re: Klarna users are being signed in to random accounts
#109I find the default Twitter response by the Klarna social media account really annoying. The issue is not a system disturbance. The issue is clearly in the whole implementation of the system itself, code which was written by developers and where something really stupid has been implemented and where security was not taken into account at all because an issue like this could have been prevented at so many layers and ye…
Whole implementation? It's probably the edge cache catching a cookie on the way out, a toggle box somewhere.
Yes?
The session layer should confirm and only accept that the other SSL-endpoint is an authenticated app. The app should do this as well.
If a toggle box exists that can cause this, I'd wonder how much of else of the implementation is worth saving.
Re: Klarna users are being signed in to random accounts
#110Totally anecdotal, and probably unrelated, I interviewed for Klarna a few years ago.
Mid process, they sent me some sort of timed bizarre IQ test that the recruiter claims EVERYONE who works there has to take.
That's when I knew that kind of working culture wasn't for me.