Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

221–230 of 517 posts

Re: Klarna users are being signed in to random accounts

#221

Post by axiosgunnar »

ladon86 wrote: post #195
ipsin wrote: post #185

What are the ways you can implement "log in as anyone accidentally"? I'm imagining it was a case of an SQL-based password check where "TRUE OR" got added to the WHERE clause, and the code takes the first result instead of expecting only 0 or 1 row. Are there other easy ways to do this?

1) Caching: a cache is used in front of the API for things like product listings, it uses a pattern match like /api/products/*, and caches routes which match. Someone accidentally configures it to cache /api/*, and thus login responses from /api/session return another recent user session, potentially including the cookie such that subsequent requests are authenticated as that user. 2) Mentioned elsewhere in this thre…

Why do users get multiple other users instead of one then, if it's a global variable? I assume because Klarna is running on many servers?

Re: Klarna users are being signed in to random accounts

#222

Post by tephra »

kukallan wrote: post #202
ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

Yes, sadly a quite common part in too many recruitment processes here in Sweden.

My first job at a consulting company out of uni I had to to an IQ test that could also indicate if I had rabies.

It had questions like "are you afraid of water", "have you showered in the last three weeks", "have you felt more aggressive lately"...

Re: Klarna users are being signed in to random accounts

#223

Post by onoira »

elliekelly wrote: post #177
WildGlade wrote: post #161

Earlier quoted context omitted.

You can't—at least in Sweden—remove much from Klarna. Your marketing profile is tied in with their accounting system. The law requires them to store accounting data for at least 7 years, with no obligation to actually remove it once that time is up. Since the accounting laws supersede the GDPR: they can hoard data pretty effectively. The Swedish 'Data Protection Authority' tried to launch (yet another) investigation…

Whats Klarna’s argument for the data in a customer’s marketing profile being necessary for accounting purposes? You can’t just store data in your accounting system and wipe your hands of GDPR.

That's what the investigation aimed to find out before it was cut short. Klarna's general reasoning has been (A) 'because', and (B) 'because it's all in the same system and we have no obligations or confidence in thinning it'.

Any request for data or information regarding their architecture is rejected on the grounds of 'trade secrets'.

Re: Klarna users are being signed in to random accounts

#224

Post by lwhi »

artemonster wrote: post #180
ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

tangential thought, but related: I am, in general, a proponent of nuclear energy as a green alternative to whatever the hell we are doing today. But when I see such stories that humans manage to fuck up simple payment processing apps, still make errors while maintaining bridges, still manage to do hugely negligent screw-ups (most likely corrupt) in *cable cars maintenance*, I immediately think that it is imminent, th…

Yes! We will always make huge mistakes.

.. so we need to accept the eventuality that the worst result will eventually occur.

Re: Klarna users are being signed in to random accounts

#225

Post by dminor »

mavster wrote: post #181

I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.

Years ago I added varnish in front of a website to cache image requests, not realizing that if the response included 'set-cookie' that was also cached.

We immediately started getting reports of random products appearing in our customers' shopping carts, as people's sessions got merged with random strangers.

Re: Klarna users are being signed in to random accounts

#226

Post by somedude895 »

tephra wrote: post #222
kukallan wrote: post #202

Earlier quoted context omitted.

Yes, sadly a quite common part in too many recruitment processes here in Sweden.

My first job at a consulting company out of uni I had to to an IQ test that could also indicate if I had rabies. It had questions like "are you afraid of water", "have you showered in the last three weeks", "have you felt more aggressive lately"...

I'm sorry what?

Re: Klarna users are being signed in to random accounts

#227

Post by hervature »

fogihujy wrote: post #192
prestigious wrote: post #178

Earlier quoted context omitted.

Card payments are usually debt also?

Debit cards is more common in quite a few places. My impression has always been that paying everything with a credit card is a U.S. thing. Here in Finland, It's not uncommon to have no debt apart from the mortage on one's home.

Mortgages are 70% of debt in the US. It is like saying I got perfect on a test except for the 70% I got wrong.

Re: Klarna users are being signed in to random accounts

#228

Post by onoira »

chopin wrote: post #214
WildGlade wrote: post #161

Earlier quoted context omitted.

You can't—at least in Sweden—remove much from Klarna. Your marketing profile is tied in with their accounting system. The law requires them to store accounting data for at least 7 years, with no obligation to actually remove it once that time is up. Since the accounting laws supersede the GDPR: they can hoard data pretty effectively. The Swedish 'Data Protection Authority' tried to launch (yet another) investigation…

You can forbid Klarna sharing the accounting data with anyone. I doubt there is a legal sharing permission overriding GDPR for accounting data aside from tax authorities.

That's correct, but the data still stays with Klarna. I interpreted the OP as wanting to remove the data Klarna stores, or remove the 'account' pages. Neither of these are completely possible.

Re: Klarna users are being signed in to random accounts

#229

Post by andix »

jaywalk wrote: post #167
andix wrote: post #153

Earlier quoted context omitted.

One more reason not to make singletons.

Singletons are fine and useful in many situations. You just have to understand what singletons entail, and design them correctly. If his singleton had a "SendEmail" function that accepted an Email object with To, From, Subject, Body, etc. fields, it wouldn't have been an issue.

I strongly disagree. Singletons are most of the time a code smell. They hide dependencies, make testing hard, and enforce tight coupling.

Singletons are easy to understand, as long as they contain of one simple class. But after a few iterations of development, they tend to "capture" a lot of dependencies, which practically become singletons too. A lot of mistakes happen. And most of the time, there was no good reason to create a singleton in the first place.

see also those posts: https://stackoverflow.com/a/138012/4249619 https://stackoverflow.com/a/142450/4249619

Re: Klarna users are being signed in to random accounts

#230

Post by rwoerz »

tephra wrote: post #222
kukallan wrote: post #202

Earlier quoted context omitted.

Yes, sadly a quite common part in too many recruitment processes here in Sweden.

My first job at a consulting company out of uni I had to to an IQ test that could also indicate if I had rabies. It had questions like "are you afraid of water", "have you showered in the last three weeks", "have you felt more aggressive lately"...

Considering these questions, have you honestly answered "yes" to the last one?
Post reply on HN