Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

311–320 of 517 posts

Re: Klarna users are being signed in to random accounts

#311

Post by sneak »

toxik wrote: post #288
sneak wrote: post #241

Earlier quoted context omitted.

It's not hostile, it's just the truth.

I'm afraid you don't decide what comes across as hostile. Things can be discussed in many ways, yours is one of assuming to hold all the answers in a conversation with a stranger you know very little about. I would reconsider this. You don't know what I was buying, for what reason, or if there was a realistic alternative. You just say "you weren't born with it", and "it's the truth". An unconvincing way to argue what…

If you find truthful and accurate statements of fact to be hostile, I don't know what to tell you, other than perhaps clarifying that I wasn't intending to be convincing or persuasive.

Those that care about the truth will be persuaded sufficiently by facts, and everyone outside of those that care about the truth I am not interested in spending any effort persuading.

Re: Klarna users are being signed in to random accounts

#312

Post by lmkg »

domano wrote: post #204
kukallan wrote: post #202

Earlier quoted context omitted.

Yes, sadly a quite common part in too many recruitment processes here in Sweden.

Wow, first time i hear that. Aren't those IQ test horribly biased?

In the United States, the Supreme Court has ruled that using IQ tests for employment screening can violate Title VII of the Civil Rights Act.

https://en.wikipedia.org/wiki/Griggs_v._Duke_Power_Co.

Re: Klarna users are being signed in to random accounts

#313

Post by 243423443 »

def_true_false wrote: post #126
detaro wrote: post #119

Earlier quoted context omitted.

Because crypto exchanges and smart contracts are such a shining beacon of bugfree code?

It's more about incentive alignment, and lack of free get out of jail cards -- people tend to assume you can just roll back fraudulent fiat transactions. Fuck up in crypto? Poof, the money is gone... Compared to legacy finance, the exchanges are indeed bugfree. I would sooner trust Binance security team than people who think SMS is enough of a second factor. Never mind all the 'European unicorn' challenger 'banks'.

"you can just roll back fraudulent fiat transactions. Fuck up in crypto? Poof, the money is gone..."

Do you know why Ethereum Classic exists?

Re: Klarna users are being signed in to random accounts

#314

Post by sorenjan »

arthur_sav wrote: post #281
hundchenkatze wrote: post #245

Klarna has posted a statement here https://www.klarna.com/uk/blog/written-statement-on-app-bug/

> It’s concluded that a human error caused the bug I would not want to be that "human" atm

Reminds me of this story after an expensive mistake:

> Boss - "Why do you think you are here, Jack?"

> JW - "I expect I am here so you can fire me"

> Boss - "I just spent a million dollars on your education - why would I fire you now?"

http://www.nickmilton.com/2016/03/jack-welch-on-learning-fro...

Re: Klarna users are being signed in to random accounts

#315

Post by shkkmo »

tl wrote: post #291
paxys wrote: post #257

Having at least authenticated sections of your site use HTTPS was standard well before 2011.

Let's Encrypt started in 2014 to address HTTP overuse. In 2011, I (in-house corp app dev) was still stuck with HTTP services (behind a firewall, accessible only via VPN). In 2014, public facing mobile apps using HTTP was prevalent enough to prompt name and shame campaigns. [1] My fuzzy memory suggests some banks were still using HTTP. [1] https://arstechnica.com/information-technology/2014/08/new-w...

I started doing professional web development in 2011. It was very clear at the time that not using HTTPS for any site with a login was an BAD practice that made your users less secure. There were clearly people and institution still using bad practices, but risks were clear to most web developers.

What was shifting at the time was developer views on using HTTPS for non-secure, unauthenticated portions of websites. This is where the "HTTPS Everywhere" plugin and other such movements came in.

Re: Klarna users are being signed in to random accounts

#316

Post by sublimefire »

speedgoose wrote: post #80
sublimefire wrote: post #39

Junior dev was facing a dilemma. Before pushing to production please finish this code and choose the id you want to use: "select * from users where id = ?" > user_id > profile_id > user_profile_id > profile_user_id > id > rand()

I don't think it's nice to make fun of beginners in our industry.

I was not trying to make a joke about the beginner devs. The list of choices a novice developer needs to make is reflective of our industry (why would there be so many choices). It is easy to make an error and bring the whole system down which in turn is the joke about "senior" people who instead of reducing complexity - increase it, and make it fragile.

Re: Klarna users are being signed in to random accounts

#317

Post by benlivengood »

tl wrote: post #291
paxys wrote: post #257

Having at least authenticated sections of your site use HTTPS was standard well before 2011.

Let's Encrypt started in 2014 to address HTTP overuse. In 2011, I (in-house corp app dev) was still stuck with HTTP services (behind a firewall, accessible only via VPN). In 2014, public facing mobile apps using HTTP was prevalent enough to prompt name and shame campaigns. [1] My fuzzy memory suggests some banks were still using HTTP. [1] https://arstechnica.com/information-technology/2014/08/new-w...

Bank of America back in 2005 (timestamp from the annoyed email I sent them) refused to load the front page over https. I think it even redirected https attempts back to http. The form submission was over https.

The solution was to enter garbage for the first login since the "re-enter your password" page was served over https. I think they fixed it before 2011, but don't have an exact record of when.

Re: Klarna users are being signed in to random accounts

#318

Post by YeBanKo »

henvic wrote: post #253

As a software engineer, I hate when I add a check for something "that will never happen" but that if happens is awful, and people complain. A classic example: you need to get a user from a session, check against a database, and continue if they're signed in. Then I add a simple if databaseUser.Username != form.Username and people will say "if that happens we've something worse wrong". Geez, something might be wrong a…

If it is due to cache, then extra check like you described probably would not help.

Re: Klarna users are being signed in to random accounts

#319

Post by NalNezumi »

kukallan wrote: post #202
ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

Yes, sadly a quite common part in too many recruitment processes here in Sweden.

I had to do it twice for different companies that used the same IQ-test platform.

And most of the time it's not even proper IQ-test but only Raven Matrice test + maybe quick math tests.

Funny thing was that I did very good (apparently according to the HR person) on one of them, but did horrible enough they didn't even call back on the second test.

grids my gear why this is still a common practice in Sweden. HR in Sweden seems to be about one or two decades behind rest of the world in their efficiency.

Re: Klarna users are being signed in to random accounts

#320

Post by remram »

iratewizard wrote: post #246
mavster wrote: post #181

I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.

To get around this, one could include the request IP address in the JWT and required a refresh token to be sent when the user's IP switches.

In this context, this would just prevent everybody from logging in. The JWT would correctly get rejected but people would still be getting the wrong token from the CDN over and over.
Post reply on HN