Looks like a JWT oopsie
Klarna users are being signed in to random accounts
121–130 of 517 posts
Re: Klarna users are being signed in to random accounts
#122Earlier quoted context omitted.
In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs. The same NemID is also used to file your taxes, look at all your health info, get married, everything basically. Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you p…
However it also forces everybody to use two factor authentication. On a whole population level I'd bet that's overall a positive tradeoff. And I believe you can also use sms + password for online transactions.
2FA is already mandatory by the PSD2 directive of the EU. I use my debit card as the second factor to access my bank account here in Germany via ChipTAN
Re: Klarna users are being signed in to random accounts
#123Dupe https://news.ycombinator.com/item?id=27301311
[deleted]
Re: Klarna users are being signed in to random accounts
#124> Hear hear, I used Klarna (not by choice) It was by choice. You weren't born with an account. Not taking personal responsibility for the rise of the ubiquity of these terrible online services (WhatsApp users, I'm looking at you) is a huge part of the problem. Pretending that you didn't opt-in is a lie you've told yourself; you shouldn't propagate that lie to others in society.
Whatsapp was fantastic when it started. Right up until it was bought by facebook.
Sofortüberweisung needed your bank credentials from the start.
Re: Klarna users are being signed in to random accounts
#125Sometime in the future, people will stop belittling crypto currencies when they realize that the digitization concepts of traditional finance technology providers are inferior to those of crypto currencies and blockchains. Putting safety and security first for anything that handles money makes sense. The calls for "you don't need a blockchain, just use a database" will become less and less. Edit: Of course, Hacker Ne…
People can't use bitcoin without offloading transactions outside of the blockchain, which means entrusting an exchange, which could and probably has the same issues as Klarna.
Re: Klarna users are being signed in to random accounts
#126Sometime in the future, people will stop belittling crypto currencies when they realize that the digitization concepts of traditional finance technology providers are inferior to those of crypto currencies and blockchains. Putting safety and security first for anything that handles money makes sense. The calls for "you don't need a blockchain, just use a database" will become less and less. Edit: Of course, Hacker Ne…
Because crypto exchanges and smart contracts are such a shining beacon of bugfree code?
It's more about incentive alignment, and lack of free get out of jail cards -- people tend to assume you can just roll back fraudulent fiat transactions. Fuck up in crypto? Poof, the money is gone...
Compared to legacy finance, the exchanges are indeed bugfree. I would sooner trust Binance security team than people who think SMS is enough of a second factor. Never mind all the 'European unicorn' challenger 'banks'.
Re: Klarna users are being signed in to random accounts
#127> Hear hear, I used Klarna (not by choice) It was by choice. You weren't born with an account. Not taking personal responsibility for the rise of the ubiquity of these terrible online services (WhatsApp users, I'm looking at you) is a huge part of the problem. Pretending that you didn't opt-in is a lie you've told yourself; you shouldn't propagate that lie to others in society.
> You weren't born with an account.
A merchant I shopped at, and paid in full by card, opened an account for me and shared line item details with Klarna, apparently because they are using them as their payments processor in addition to an installment payment option.
I noticed this when I later did in fact "open" an (or rather, claim an existing) account with them.
Very disturbing, and the bad aftertaste has never fully gone away.
Re: Klarna users are being signed in to random accounts
#128Sometime in the future, people will stop belittling crypto currencies when they realize that the digitization concepts of traditional finance technology providers are inferior to those of crypto currencies and blockchains. Putting safety and security first for anything that handles money makes sense. The calls for "you don't need a blockchain, just use a database" will become less and less. Edit: Of course, Hacker Ne…
With Klarna, any fraud that results from this incident can and will be reversed thanks to both company and government regulations.
With crypto, anything but perfect opsec on the entire stack through which your money travels means potentially losing all your money irreversibly. I’ll take “just use a database” thanks.
Re: Klarna users are being signed in to random accounts
#129Lots of times when I’ve been buying things in e-shops I’ve been offered to pay using Klarna as a payment broker. But doing so has always been more confusing for me compared to “regular” payments with a credit card anywhere else, and has on overall been a negative experience for me. I really don’t understand why anyone would prefer to use them at all. What am I missing? Can anyone help me understand?
Not sure where you are located, but in Sweden, Klarna at the start (if I remember it correctly) only needed your 'personnummer'(social security number) to process payments. Now I think they manage to track your devices so I only have to enter my postal code, and then I just click purchase, and it's all done. They used to use really weird/dark patterns, to make you forget to pay and then pay huge fees to Klarna. Nowad…
And they don't notify you when it's available for payment, or when it's about to expire. So if you order something, and it for some reason takes a few weeks/months before they ship it and it becomes available for payment, you'll end up with a reminder fee with no warning.
Re: Klarna users are being signed in to random accounts
#130Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…
I have the same sketchy feeling about Sofortüberweisung/Klarna. If they want to make transactions on my behalf, why should I give them full access to my account? Most banks have a paragraph in their contracts/ToS forbidding sharing the account with third parties, but they are rarely enforcing it. Still, they could close the account due to contract/ToS violation.
Worse, you're on the hook if your account is drained.