Earlier quoted context omitted.
That's not true. Cookies can have a 'secure' attribute which tells the browser to send them only over TLS
in 2011?
Yes
Klarna users are being signed in to random accounts
321–330 of 517 posts
Re: Klarna users are being signed in to random accounts
#322Re: Klarna users are being signed in to random accounts
#323Earlier quoted context omitted.
That only protects the user's password. The auth cookie will be sent in all subsequent requests in plain text. EDIT: that's how firesheep ( https://en.wikipedia.org/wiki/Firesheep ) hijacked sessions for e.g.
That's not true. Cookies can have a 'secure' attribute which tells the browser to send them only over TLS
A secure cookie would be of no use for a site whose only secure page is the login page, which is what the parent post I replied to was talking about.
Re: Klarna users are being signed in to random accounts
#324Does Klarna still do the IQ test as part of their hiring process?
They did that? Although, I guess Google does IQ tests too in effect? But it's called "solve this puzzle" and "here's a riddle".
I don't think they do those anymore. At least when I've interviewed there (2x) over the last couple of years I did not encounter any of those types of questions.
Re: Klarna users are being signed in to random accounts
#325I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.
I introduced a similar bug into one of my products in the past (Be honest, who hasn't?). But I'm surprised here because Klarna is a quite mature product and something like this shouldn't really happen at that stage.
Oh, it can definitely happen even in mature products. One I worked on had pretty much the same issue as Klarna (people seeing others' info) when someone updated a web client library we were using to a new version that subtly changed how it handled concurrency.
Re: Klarna users are being signed in to random accounts
#326Earlier quoted context omitted.
A recruiter contacted me aswell and I asked about their salary. They pay 50k euro for juniors in berlin with afaik no stock vesting. How they even manage to get qualified personnel is beyond me, I would expect much more for a fintech with over 3B evaluation
50k in euro's is pretty ok for European developers, no?
I am from munich so my opinion may be skewed, but it is at best very average, as in some no name devshop/consultancy would pay this much(and even they tend to pay more).
Nothing I would expext from a Unicorn, but maybe the market in Berlin is THAT different.
Re: Klarna users are being signed in to random accounts
#327Earlier quoted context omitted.
In their statement they deny accessing bank details: > The bug led to random user data being exposed to the wrong user when accessing our user interfaces. It is important to note that the access to data has been entirely random and not showing any data containing card or bank details (obfuscated data was visible). This means that it has been impossible to access a specific user’s data. This is not the experience of t…
I believe it is the case, that when you see your stored payment method is is obfuscated such that it only reveals the last 4-5 digits. Same with bank details as far as I know. However, showing the card issuer/bank + the final 4 or 5 digits of an account or card number is still extremely distressing. There are some services and vectors out there that can be engineered with just that information for sure. Combine that…
It might be accurate if you are internally discussing PCI compliance.
However, to the layperson, "bank details" definitely includes name of bank and last 4 digits of account number. It does come across as deceptive to use that terminology to respond to customer complaints.
Re: Klarna users are being signed in to random accounts
#328I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.
I doubt that Klarna, a bank, have OSI layer 7 proxies in the cloud, with TLS termination in their CDN solution, on AWS. I would assume this traffic is outside of that. But then again, I know they wasted 25M+ Euros on a garbage NodeJS platform. They also created an own cloud once. Yes, it is in the trash bin.
Re: Klarna users are being signed in to random accounts
#329Earlier quoted context omitted.
Let's Encrypt started in 2014 to address HTTP overuse. In 2011, I (in-house corp app dev) was still stuck with HTTP services (behind a firewall, accessible only via VPN). In 2014, public facing mobile apps using HTTP was prevalent enough to prompt name and shame campaigns. [1] My fuzzy memory suggests some banks were still using HTTP. [1] https://arstechnica.com/information-technology/2014/08/new-w...
I started doing professional web development in 2011. It was very clear at the time that not using HTTPS for any site with a login was an BAD practice that made your users less secure. There were clearly people and institution still using bad practices, but risks were clear to most web developers. What was shifting at the time was developer views on using HTTPS for non-secure, unauthenticated portions of websites. Th…
From what I remember there was a lot of pushback from infrastructure as we thought using https for the whole website would increase CPU load. Never verified if this was true... but I'm sure someone here should know.
Re: Klarna users are being signed in to random accounts
#330Earlier quoted context omitted.
Yes, sadly a quite common part in too many recruitment processes here in Sweden.
My first job at a consulting company out of uni I had to to an IQ test that could also indicate if I had rabies. It had questions like "are you afraid of water", "have you showered in the last three weeks", "have you felt more aggressive lately"...
I've had to take the MMPI [1] for an employer before. About 500 true/false questions to screen for mental health disorders. Some of the questions seem quite outlandish but taken as a whole make sense.
[1] https://en.wikipedia.org/wiki/Minnesota_Multiphasic_Personal...