Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

211–220 of 517 posts

Re: Klarna users are being signed in to random accounts

#211
post #204

Earlier quoted context omitted.

Yes, sadly a quite common part in too many recruitment processes here in Sweden.

Wow, first time i hear that. Aren't those IQ test horribly biased?

not only that, but they aren't a great predictor of actual job performance

Re: Klarna users are being signed in to random accounts

#213
post #196

Earlier quoted context omitted.

Let's hope not. They're deliberately trying to get people to take on debt rather than just do card payments, and even simple things like buying a book through a web site requires declining several offers for paying with credit. Unfortunately, they're huge, and I doubt the Swedish authorities will do more than give them a fine and a slap on the wrist.

>They're deliberately trying to get people to take on debt rather than just do card payments So what? It's 0% interest. It's incredibly helpful to have easy-access financing to split purchases across a few months. >even simple things like buying a book through a web site requires declining several offers for paying with credit. This sounds so specific it seems like you're taking a bad experience with one website and…

> It's incredibly helpful to have easy-access financing to split purchases across a few months.

I don't know, it seems like a failure at adulting to have to do that for small to medium sized purchases. If you need the feature, you probably should not have it available. Maybe this is my German attitude about money - basically, only take on debt for investments, a notable example being housing.

Re: Klarna users are being signed in to random accounts

#214

Time to GDPR my account on klarna then.

You can't—at least in Sweden—remove much from Klarna. Your marketing profile is tied in with their accounting system. The law requires them to store accounting data for at least 7 years, with no obligation to actually remove it once that time is up. Since the accounting laws supersede the GDPR: they can hoard data pretty effectively. The Swedish 'Data Protection Authority' tried to launch (yet another) investigation…

You can forbid Klarna sharing the accounting data with anyone. I doubt there is a legal sharing permission overriding GDPR for accounting data aside from tax authorities.

Re: Klarna users are being signed in to random accounts

#215

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

Have been using SÜ for years until I learned that they not just facilitate the transfer but abuse their role to dump bank transfer data worth several months. I don't use that service anymore.

That sounds pretty bad! I always thought the login flow was super sketchy, but wasn't aware of this part — has this been covered/analyzed somewhere or is it evident from their terms or something?

Re: Klarna users are being signed in to random accounts

#216
post #208

I am really really interested in knowing the root cause. I am really concerned by agile, and start-up hipster culture creeping into critical infrastructure companies. There are so many patterns(event driven, CQRS) in recent microservices architecture, which are gaining popularity and people have been using them without realizing the cons and the need for them.

>agile, and start-up hipster culture

What does that even mean?

Re: Klarna users are being signed in to random accounts

#217

I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.

I expect something exactly like this happened. I had a similar bug long time ago. Apache was somehow incorrectly caching the request and the session cookie in the request ended up in a cache. But it happened only about 1/10,000th of the time so it was impossible to figure out the root cause.

However, one common source for this kind of bugs is to ”cache any URL ending .pdf as a static file” and then you are in fact serving logged in PDFs like customer invoices that come with the session cookie.

I think CloudFlare used to come with a default rule to treat .pdf as a static content. The responses were cached when you hit their ”cache the good stuff” checkbox.

Re: Klarna users are being signed in to random accounts

#218
post #3

Reminds me of what happened to Steam a few years ago https://www.youtube.com/watch?v=dkSslseq9Y8

I remember when this happened to Apple with iTunes Connect (where developers submit apps for the App Store) back in the day:

https://techcrunch.com/2015/01/29/itunes-connect-issue-loggi...

Re: Klarna users are being signed in to random accounts

#220

Does Klarna still do the IQ test as part of their hiring process?

Oh boy this brought back memories for me. I thought that IQ test was screening test, pre-phone interview. But no, they had me redo it at the onsite interview too. The funny part was the onsite test had the exact same questions as pre-phone interview. edit: typo

Ha.

I remember doing it too. I was at work in a meeting and they have instructions saying something to the tune of finding a quiet place and all of that, but my thoughts were if they are serious about this, then solving these abstract problems is something I'll have to be able to do while under pressure or under the heat of conversation.

Long story short anyway, I'm not intelligent enough to work there I guess, so good thing they used that test to screen me out and make sure I knew. It does have a little bit of merit with the very quick no versus the long, drawn out no. I recently interviewed at a great company, 4 1-1 interviews, a presentation/demo I had to make to present to 7 other people, etc. and I think another interview after that and I'm just over it.

Post reply on HN