Klarna users are being signed in to random accounts • Hacker News Board

Re: Klarna users are being signed in to random accounts

#171

Post by diveanon » Thu, May 27, 2021, 1:28 PM UTC

mewpmewp2 wrote: post #90

diveanon wrote: post #16

If you rely on your application layer to enforce data privacy instead of enforcing it in your storage layer its just a matter of time until you have an issue like this. It says a lot about the security of their api and development culture that they are even struggling with something like this. This should be caught in the first architecture review session.

Out of curiosity, how is that enforcement usually done? I have usually just used some SQL database like MySQL/Postgres, and having application determine how to fetch data, so application has access to everything. I can see how this could be insecure due to some bug in application code fetching with wrong WHERE etc, how would one go about enforcing it on sql/database layer? Would you have separate SQL credentials for…

So I think the best place to start is looking into row-level security in Postgres. Its a familiar place to start and gives a high return. Row level security can be used to implement the user / tasks use case you described.

Re: Klarna users are being signed in to random accounts

#172

Post by diveanon » Thu, May 27, 2021, 1:31 PM UTC

corroclaro wrote: post #50

diveanon wrote: post #16

If you rely on your application layer to enforce data privacy instead of enforcing it in your storage layer its just a matter of time until you have an issue like this. It says a lot about the security of their api and development culture that they are even struggling with something like this. This should be caught in the first architecture review session.

Cached data in middle layers can get even the safest of row-level secured databases. I agree in general that you need to enforce things at the storage layer.

You're right, and cache policy issues can be really hard to debug.

As a rule I don't cache personal information for this reason.

Out of curiosity do you have any knowledge on GDPR's stance on caching PI?

Re: Klarna users are being signed in to random accounts

#173

Post by ho_schi » Thu, May 27, 2021, 1:31 PM UTC

I had once contact with Klarna. It required me eight weeks to teach until they accepted the truth - I didn't owed them a cent. Just one of the usual startups around outsourcing, minimum wage and avoiding actual work.

Lesson 1: If someone want to sell you something and doesn't want make the bookkeeping itself, avoid them.

Lesson 2: In doubt? Cash only.

Re: Klarna users are being signed in to random accounts

#174

Post by lxgr » Thu, May 27, 2021, 1:41 PM UTC

Hamuko wrote: post #165

lxgr wrote: post #127

Earlier quoted context omitted.

> You weren't born with an account. A merchant I shopped at, and paid in full by card, opened an account for me and shared line item details with Klarna, apparently because they are using them as their payments processor in addition to an installment payment option. I noticed this when I later did in fact "open" an (or rather, claim an existing) account with them. Very disturbing, and the bad aftertaste has never ful…

Do they always open up an account when you pay by card? Because I've definitely paid online purchases with my credit card with Klarna as the processor, but I am not aware of having an account there.

You could try to find out by opening an account or alternatively with a GDPR request.

I just checked the chronology again: I performed the initial order months before opening the account, yet the line-level item details are there (and last time I checked, there was no way to delete these, for a payment years ago).

Oh, and I'm almost certain that somewhere within the fine print of paying at that store I consented to all of this, but this does not make it any less creepy from my point of view.

Re: Klarna users are being signed in to random accounts

#175

Post by gspr » Thu, May 27, 2021, 1:42 PM UTC

timdaub wrote: post #81

junon wrote: post #78

Earlier quoted context omitted.

Yes and we'll be screaming "please shut off your computer" because of all of the excess heat and insane power bills.

Why not separate concerns? Crypto currencies work without Proof of Work today.

> Why not separate concerns? Crypto currencies work without Proof of Work today.

You mean through proof of stake instead? Yay, now all the people who wanted to avoid having a competent central bank in a free democracy control the money supply get to have the people with the most money control the supply instead.

Jesus fucking christ, you cryptocurrency lunatics have lost it.

Re: Klarna users are being signed in to random accounts

#176

Post by Aldipower » Thu, May 27, 2021, 1:45 PM UTC

andix wrote: post #153

bellyfullofbac wrote: post #137

Earlier quoted context omitted.

Reminds me of a colleague implementing "emailRecipients" as a field in a singleton service. The first online order got an order confirmation mail, and when a second online order came s/he also got their confirmation mail (the field just grew and grew...).

One more reason not to make singletons.

I like the Whisky.

Re: Klarna users are being signed in to random accounts

#177

Post by elliekelly » Thu, May 27, 2021, 1:47 PM UTC

WildGlade wrote: post #161

ecmascript wrote: post #36

Time to GDPR my account on klarna then.

You can't—at least in Sweden—remove much from Klarna. Your marketing profile is tied in with their accounting system. The law requires them to store accounting data for at least 7 years, with no obligation to actually remove it once that time is up. Since the accounting laws supersede the GDPR: they can hoard data pretty effectively. The Swedish 'Data Protection Authority' tried to launch (yet another) investigation…

Whats Klarna’s argument for the data in a customer’s marketing profile being necessary for accounting purposes? You can’t just store data in your accounting system and wipe your hands of GDPR.

Re: Klarna users are being signed in to random accounts

#178

Post by prestigious » Thu, May 27, 2021, 1:47 PM UTC

fogihujy wrote: post #164

kesor wrote: post #156

Earlier quoted context omitted.

if they make it though alive ...

Let's hope not. They're deliberately trying to get people to take on debt rather than just do card payments, and even simple things like buying a book through a web site requires declining several offers for paying with credit. Unfortunately, they're huge, and I doubt the Swedish authorities will do more than give them a fine and a slap on the wrist.

Card payments are usually debt also?

Re: Klarna users are being signed in to random accounts

#179

Post by altacc » Thu, May 27, 2021, 1:47 PM UTC

ho_schi wrote: post #173

I had once contact with Klarna. It required me eight weeks to teach until they accepted the truth - I didn't owed them a cent. Just one of the usual startups around outsourcing, minimum wage and avoiding actual work. Lesson 1: If someone want to sell you something and doesn't want make the bookkeeping itself, avoid them. Lesson 2: In doubt? Cash only.

I can understand avoiding a company due to a bad experience but that sounds like a rather general and rather restrictive conclusion. Did you mean bookeeping specifically, or payment handler, as they are somewhat different things?

For small businesses using a payment processor removes a massive barrier to market entry. Many small business hire real world external accountants to do their bookkeeping, so "avoiding actual work", would you avoid them as well? I do some work with the accounting & invoicing teams in our corporation and there is a LOT to take into account that would cripple a startup with only a handful of employees.

Bigger companies use services like Klarna not because they can't (often they have other payment methods as well and do their own bookkeeping), it's because customers like to use them and failing to use something like Klarna means their customers will shop elsewhere.

Re: Klarna users are being signed in to random accounts

#180

Post by artemonster » Thu, May 27, 2021, 1:48 PM UTC

ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

tangential thought, but related: I am, in general, a proponent of nuclear energy as a green alternative to whatever the hell we are doing today. But when I see such stories that humans manage to fuck up simple payment processing apps, still make errors while maintaining bridges, still manage to do hugely negligent screw-ups (most likely corrupt) in *cable cars maintenance*, I immediately think that it is imminent, that something will go wrong with such complex thing as a nuclear reactor and the price there is much bigger.