Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

291–300 of 517 posts

Re: Klarna users are being signed in to random accounts

#291

Post by tl »

paxys wrote: post #257

Having at least authenticated sections of your site use HTTPS was standard well before 2011.

Let's Encrypt started in 2014 to address HTTP overuse.

In 2011, I (in-house corp app dev) was still stuck with HTTP services (behind a firewall, accessible only via VPN).

In 2014, public facing mobile apps using HTTP was prevalent enough to prompt name and shame campaigns. [1] My fuzzy memory suggests some banks were still using HTTP.

[1] https://arstechnica.com/information-technology/2014/08/new-w...

Re: Klarna users are being signed in to random accounts

#292

Post by macintux »

_nnv7 wrote: post #273
duxup wrote: post #268

Earlier quoted context omitted.

I don't understand your perspective here. Debates about Agile have gone on for ages, that's not a 'lately' thing. I have no idea what 'hipster' has to do with banks and tools... or what you mean by 'old proven methods'.

Not looking for a debate myself :)

Making snarky comments about a common development methodology but not interested in debating the merits of the underlying complaint? I believe that’s called trolling.

Re: Klarna users are being signed in to random accounts

#293

Post by hbosch »

dvaun wrote: post #275
hundchenkatze wrote: post #245

Klarna has posted a statement here https://www.klarna.com/uk/blog/written-statement-on-app-bug/

In their statement they deny accessing bank details: > The bug led to random user data being exposed to the wrong user when accessing our user interfaces. It is important to note that the access to data has been entirely random and not showing any data containing card or bank details (obfuscated data was visible). This means that it has been impossible to access a specific user’s data. This is not the experience of t…

I believe it is the case, that when you see your stored payment method is is obfuscated such that it only reveals the last 4-5 digits. Same with bank details as far as I know.

However, showing the card issuer/bank + the final 4 or 5 digits of an account or card number is still extremely distressing. There are some services and vectors out there that can be engineered with just that information for sure.

Combine that with possibly exposed address, telephone number, and you are in very dangerous territory.

Re: Klarna users are being signed in to random accounts

#294

Post by philbert101 »

ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

It's not an IQ test. It's just pattern recognition which is about 5% of the tasks you do in a real IQ test.

When I joined Klarna in 2011, the test was so easy that I joked I could score full marks on it even if I was hungover with no sleep. There was one question on the test that actually had 2 correct answers depending on what logic you applied. This was actually a real issue when recruiting, because there was a hard cut-off to make it into the engineering department, and several times I had to ask "what was their answer on question 12?"

It caused quite a bit of commotion at HR to change the official test scoring to 2 correct answers for that question.

Now the test is like a million times harder and your score at the end is between 0-10 and you have no idea how many questions you actually answered correctly. I would be very interested to know the "true" answers of these new tests to understand what kind of crazy logic you need to apply to get every question right. I'm almost certain it would take me longer to understand the answer than the time you have to do the test.

Re: Klarna users are being signed in to random accounts

#295

Post by tremon »

philbert101 wrote: post #294
ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

It's not an IQ test. It's just pattern recognition which is about 5% of the tasks you do in a real IQ test. When I joined Klarna in 2011, the test was so easy that I joked I could score full marks on it even if I was hungover with no sleep. There was one question on the test that actually had 2 correct answers depending on what logic you applied. This was actually a real issue when recruiting, because there was a har…

It's not an IQ test. It's just pattern recognition which is about 5% of the tasks you do in a real IQ test.

So it is an IQ test, just not a comprehensive one?

Re: Klarna users are being signed in to random accounts

#296

Post by _nnv7 »

macintux wrote: post #292
_nnv7 wrote: post #273

Earlier quoted context omitted.

Not looking for a debate myself :)

Making snarky comments about a common development methodology but not interested in debating the merits of the underlying complaint? I believe that’s called trolling.

@macintux

I did reply and explained my perspective clearly. Anymore than that will just not be constructive. From here on it will be just difference in opinion and no one will again anything.

And if you think I am troll then not feeding a troll is the best thing to do right?

Re: Klarna users are being signed in to random accounts

#297

Post by stadium »

arthur_sav wrote: post #281
hundchenkatze wrote: post #245

Klarna has posted a statement here https://www.klarna.com/uk/blog/written-statement-on-app-bug/

> It’s concluded that a human error caused the bug I would not want to be that "human" atm

A good practice is that once a change passes code review and ships, the team owns it.

Human error doesn't mean blame the human, it's better to look at the overall processes and system to figure out how to prevent human error the next time around.

Re: Klarna users are being signed in to random accounts

#298

Post by rightbyte »

henvic wrote: post #253

As a software engineer, I hate when I add a check for something "that will never happen" but that if happens is awful, and people complain. A classic example: you need to get a user from a session, check against a database, and continue if they're signed in. Then I add a simple if databaseUser.Username != form.Username and people will say "if that happens we've something worse wrong". Geez, something might be wrong a…

I like defensive programming. Even though I think the state is unreachable, it feels nice to add a panic assert just in case.

Re: Klarna users are being signed in to random accounts

#299

Post by tarsinge »

pvillano wrote: post #211
domano wrote: post #204

Earlier quoted context omitted.

Wow, first time i hear that. Aren't those IQ test horribly biased?

not only that, but they aren't a great predictor of actual job performance

Given that these tests don't evaluate critical thinking and knowledge of statistics it's quite ironic but coherent for the company using these tests.

Re: Klarna users are being signed in to random accounts

#300

Post by Oddskar »

kukallan wrote: post #202
ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

Yes, sadly a quite common part in too many recruitment processes here in Sweden.

I would disagree. I’ve never heard of any company doing this, nor any former or current colleague that had to do one.
Post reply on HN