Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

241–250 of 517 posts

Re: Klarna users are being signed in to random accounts

#241

Post by sneak »

toxik wrote: post #118
sneak wrote: post #65

> Hear hear, I used Klarna (not by choice) It was by choice. You weren't born with an account. Not taking personal responsibility for the rise of the ubiquity of these terrible online services (WhatsApp users, I'm looking at you) is a huge part of the problem. Pretending that you didn't opt-in is a lie you've told yourself; you shouldn't propagate that lie to others in society.

I needed to buy things, because that is life, and the merchant only offered Klarna. You might want to reconsider your hostile rhetoric, it does not come across well.

It's not hostile, it's just the truth.

Re: Klarna users are being signed in to random accounts

#242

Post by AtNightWeCode »

mrweasel wrote: post #62

Klarna is a weird company. Last I interacted with them it was clear that they are completely designed to operate within Sweden, but have no idea of how to deal with the outside world. Maybe that have changed. I talked to Klarna maybe 10 years ago. One of the things I wanted to know was how they dealt with abuse in Sweden, given you just need the social security number of a person and then you can do purchase as that…

I believe the user id actually was the email address when they started out.

Re: Klarna users are being signed in to random accounts

#243

Post by switch007 »

kruxigt wrote: post #113
cpach wrote: post #111

Dupe https://news.ycombinator.com/item?id=27301311

Why did this one disappear from the front page so fast?

Who knows, many of the HN algorithms are secret and there is no moderation log a la https://lobste.rs/moderations

Re: Klarna users are being signed in to random accounts

#244

Post by AtNightWeCode »

generic_dev_47 wrote: post #23

I worked in a project over 10 years ago where something very similar happened! We had built and authentication service that, among other things, was used by a SyncML service that was used back in the day of feature phones to syncs contacts etc. You can imagine that getting someone else's contacts on your phone isn't exactly ideal. This was how we came to know about the problem, from customers getting other customers…

I would expect this to happen if an option in the line of "serve stale content if target server is unreachable" is enabled.

Re: Klarna users are being signed in to random accounts

#246

Post by iratewizard »

mavster wrote: post #181

I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.

To get around this, one could include the request IP address in the JWT and required a refresh token to be sent when the user's IP switches.

Re: Klarna users are being signed in to random accounts

#247

Post by kgnail »

altacc wrote: post #179
ho_schi wrote: post #173

I had once contact with Klarna. It required me eight weeks to teach until they accepted the truth - I didn't owed them a cent. Just one of the usual startups around outsourcing, minimum wage and avoiding actual work. Lesson 1: If someone want to sell you something and doesn't want make the bookkeeping itself, avoid them. Lesson 2: In doubt? Cash only.

I can understand avoiding a company due to a bad experience but that sounds like a rather general and rather restrictive conclusion. Did you mean bookeeping specifically, or payment handler, as they are somewhat different things? For small businesses using a payment processor removes a massive barrier to market entry. Many small business hire real world external accountants to do their bookkeeping, so "avoiding actua…

Using a real payment processor for credit cards is not a problem. Like it was around 2005, when most merchants had not settled on Klarna and similar.

Some merchants sell via Klarna to private customers and via invoice or pre-payment to a proper bank account to business customers.

Private customers are second class. No business would deal with this nonsense.

Re: Klarna users are being signed in to random accounts

#248

Post by admissionsguy »

altacc wrote: post #179
ho_schi wrote: post #173

I had once contact with Klarna. It required me eight weeks to teach until they accepted the truth - I didn't owed them a cent. Just one of the usual startups around outsourcing, minimum wage and avoiding actual work. Lesson 1: If someone want to sell you something and doesn't want make the bookkeeping itself, avoid them. Lesson 2: In doubt? Cash only.

I can understand avoiding a company due to a bad experience but that sounds like a rather general and rather restrictive conclusion. Did you mean bookeeping specifically, or payment handler, as they are somewhat different things? For small businesses using a payment processor removes a massive barrier to market entry. Many small business hire real world external accountants to do their bookkeeping, so "avoiding actua…

> it's because customers like to use them and failing to use something like Klarna means their customers will shop elsewhere.

Also, some customers do not have personnummer and find Klarna to be one of few payments methods that will reliably let them shop online.

Re: Klarna users are being signed in to random accounts

#249

Post by _nnv7 »

duxup wrote: post #216
_nnv7 wrote: post #208

I am really really interested in knowing the root cause. I am really concerned by agile, and start-up hipster culture creeping into critical infrastructure companies. There are so many patterns(event driven, CQRS) in recent microservices architecture, which are gaining popularity and people have been using them without realizing the cons and the need for them.

>agile, and start-up hipster culture What does that even mean?

Looks like people are really offended by this. Agile lately has been looked at this silver bullet for software engineering. I have worked both in Cisco and some good startups and in my humble opinion having fast paced development and high feature churn rate really is unsuitable for a bank and other infrastructure companies.

Also by hipster, I mean that the banks don't have luxury to experiment with latest trends and the cool tools. They have to stick with the old proven methods.

Re: Klarna users are being signed in to random accounts

#250

Post by dkersten »

onoira wrote: post #223
elliekelly wrote: post #177

Earlier quoted context omitted.

Whats Klarna’s argument for the data in a customer’s marketing profile being necessary for accounting purposes? You can’t just store data in your accounting system and wipe your hands of GDPR.

That's what the investigation aimed to find out before it was cut short. Klarna's general reasoning has been (A) 'because', and (B) 'because it's all in the same system and we have no obligations or confidence in thinning it'. Any request for data or information regarding their architecture is rejected on the grounds of 'trade secrets'.

Hmm, that's strange. I did some contract work for Klarna about a year ago and had to go through mandatory on-site training and a big chunk of that was with their legal team about data protection, GDPR, about storing the least amount possible etc. It sounded like they treat it very seriously, so this is surprising to me.

I do know there are various legal requirements to retain certain data for some time (PSD2 for example must be stored for 13 months, I believe), but outside of that, it sounded to me like they tried very hard not to store anything for longer than necessary or without user consent.

I mean, doesn't mean its true, just the impression I got from the training.

Post reply on HN