Klarna users are being signed in to random accounts • Hacker News Board

Re: Klarna users are being signed in to random accounts

#251

Post by klmadfejno » Thu, May 27, 2021, 3:06 PM UTC

viraptor wrote: post #205

artemonster wrote: post #180

Earlier quoted context omitted.

tangential thought, but related: I am, in general, a proponent of nuclear energy as a green alternative to whatever the hell we are doing today. But when I see such stories that humans manage to fuck up simple payment processing apps, still make errors while maintaining bridges, still manage to do hugely negligent screw-ups (most likely corrupt) in *cable cars maintenance*, I immediately think that it is imminent, th…

I kind of get the worry, but the requirements and processes seem to scale exponentially with reliability needs. Online companies may fuck up every day in new and creative ways and we barely get to hear about it. On the other hand we know of every nuclear failure so far with enough public details to discuss the whole time line, system design, steps each person followed, etc. and the death count is still minimal. Then…

We know every nuclear failure. We don't know every time a strong nuclear risk existed but by chance, didn't trigger. Nuclear power plants are probably much safer on average, but it only takes one corner cutting plant to cause a nuclear accident.

That said, I'm also pro-nuclear.

Re: Klarna users are being signed in to random accounts

#252

Post by secureleaf » Thu, May 27, 2021, 3:07 PM UTC

iratewizard wrote: post #246

mavster wrote: post #181

I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.

To get around this, one could include the request IP address in the JWT and required a refresh token to be sent when the user's IP switches.

This is not a safe method for protecting against this type of cache vulnerability. IP addresses are regularly shared by multiple users, especially when behind NAT (even mobile ISPs are doing carrier grade NAT these days).

Re: Klarna users are being signed in to random accounts

#253

Post by henvic » Thu, May 27, 2021, 3:07 PM UTC

As a software engineer, I hate when I add a check for something "that will never happen" but that if happens is awful, and people complain.

A classic example: you need to get a user from a session, check against a database, and continue if they're signed in.

Then I add a simple if databaseUser.Username != form.Username and people will say "if that happens we've something worse wrong". Geez, something might be wrong and such double checking might provide to be useful.

On a smaller scale, bits flip due to cosmic rays and so on. Of course, there must be a limit where we stop, but people are used to actively avoid doing such "silly assertions" even for important steps.

¯\_(ツ)_/¯

Re: Klarna users are being signed in to random accounts

#254

Post by yunohn » Thu, May 27, 2021, 3:08 PM UTC

ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

Yep, took it just a month ago. Quite dumb honestly, not sure what it indicates. It was a bunch of weird pattern matching and guessing? Seemed easy, but got a rejection a week later.

Re: Klarna users are being signed in to random accounts

#255

Post by 3np » Thu, May 27, 2021, 3:09 PM UTC

cra wrote: post #69

flemhans wrote: post #60

Earlier quoted context omitted.

In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs. The same NemID is also used to file your taxes, look at all your health info, get married, everything basically. Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you p…

Yeah, same way they have it in Sweden, it's called "BankID" and only a few banks are allowed to issue that

Major distinction being that BankID is privately owned and operated, as opposed to state-run.

Re: Klarna users are being signed in to random accounts

#256

Post by WaitWaitWha » Thu, May 27, 2021, 3:09 PM UTC

from this event... game idea:

create a social media site - allow postings, conversations, threads, etc.

Every quarter (or some other period), there is "reconning". You are placed into a complete stranger's account, and now you have to continue it for a week (or some other short period).

Whoever can maintain the quality of the account, in the direction as the original owner, wins a banana (or kumquat, something good but not expensive for anyone).

After reconning period, owner returns and judges. None-participation is default no-win.

Re: Klarna users are being signed in to random accounts

#257

Post by paxys » Thu, May 27, 2021, 3:09 PM UTC

Having at least authenticated sections of your site use HTTPS was standard well before 2011.

Re: Klarna users are being signed in to random accounts

#258

Post by claudex » Thu, May 27, 2021, 3:10 PM UTC

domano wrote: post #207

vishnugupta wrote: post #201

Earlier quoted context omitted.

Oh boy this brought back memories for me. I thought that IQ test was screening test, pre-phone interview. But no, they had me redo it at the onsite interview too. The funny part was the onsite test had the exact same questions as pre-phone interview. edit: typo

Maybe to check for cheaters

Asking the same question doesn't help a lot to find cheater with a memory.

Re: Klarna users are being signed in to random accounts

#259

Post by dkersten » Thu, May 27, 2021, 3:13 PM UTC

Here's their official statement:

https://www.klarna.com/uk/blog/written-statement-on-app-bug/

Although I dunno about "According to GDPR standards, only non-sensitive data was exposed." since in the twitter thread someone said:

This is definitely not a test environment. I was called by someone who was logged in to my account and saw all my personal data including bank details, Klarna card etc.

And while I'm told the bank details are obfuscated (I don't use Klarna, I dunno), I would consider the phone number to be a clear breach of my privacy under GDPR.

Although, the twitter account that said that has 0 followers, so maybe its not true. I dunno. I know someone who works for Klarna and he told me: "Full investigation will take time. There's a LOT of engineers working on this. Only confirmation I have currently is that the firstname was visible."

Going by the screenshots, first name and account balance. Doesn't seem that bad from a GDPR point of view. Still bad, of course, but not suuuper sensitive.

EDIT: Nevermind: https://twitter.com/esraefe/status/1397843949985931265

Re: Klarna users are being signed in to random accounts

#260

Post by _u » Thu, May 27, 2021, 3:14 PM UTC

I can remember something similar happening on Facebook back in 2013-2014 (when I was a kid). I went on this app called 'Video Chat Rounds' and when I left the app, I got signed in to a random Facebook account.