Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

331–340 of 517 posts

Re: Klarna users are being signed in to random accounts

#331

Post by shkkmo »

pooper wrote: post #329
shkkmo wrote: post #315

Earlier quoted context omitted.

I started doing professional web development in 2011. It was very clear at the time that not using HTTPS for any site with a login was an BAD practice that made your users less secure. There were clearly people and institution still using bad practices, but risks were clear to most web developers. What was shifting at the time was developer views on using HTTPS for non-secure, unauthenticated portions of websites. Th…

From what I remember there was a lot of pushback from infrastructure as we thought using https for the whole website would increase CPU load. Never verified if this was true... but I'm sure someone here should know.

Re 2011

Push back on what? There was pushback against HTTPS for non-authenticated pages for various reasons.

That does not mean that HTTPS for authenticated pages was not considered a standard and necessary security measure.

Re: Klarna users are being signed in to random accounts

#332

Post by brabel »

kukallan wrote: post #202
ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

Yes, sadly a quite common part in too many recruitment processes here in Sweden.

I failed a job application because of the IQ test. It was administered in a second language for me, so I really didn't do well... the interviews had been completely smooth and I got on well with everyone I had talked with...

The thing is, I really needed that job... ended up going to another job that offered me a very low salary (I had no visa in the country , so was looking for a sponsor, which makes things a lot harder) and the company went bankrupt within a few months!

Anyway, I still got the visa, and then, with a few months to find another job with more peace of mind, I eventually got much nicer job, paying a lot more! But I still dread the though of doing an IQ test, despite my years of experience indicating I am more competent than average, at least.

Re: Klarna users are being signed in to random accounts

#333

Post by canada_dry »

ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

When I applied to work for a bank in Canada back in the 80's I had to write a Wolfe-Spence Programming Aptitude Test (was basically an IQ test).

The hiring company would send your answer sheet and work sheets off to the company to analyze and provide a score.

Anyone else remember those?

Re: Klarna users are being signed in to random accounts

#334

Post by hatchnyc »

hundchenkatze wrote: post #245

Klarna has posted a statement here https://www.klarna.com/uk/blog/written-statement-on-app-bug/

> affected up to 0.1%, approximately 90 000, of our users

Does this mean the bug affected .1% of accounts or that only .1% logged in during the 31 minute window when the bug was present?

Re: Klarna users are being signed in to random accounts

#335

Post by rightbyte »

mrweasel wrote: post #62

Klarna is a weird company. Last I interacted with them it was clear that they are completely designed to operate within Sweden, but have no idea of how to deal with the outside world. Maybe that have changed. I talked to Klarna maybe 10 years ago. One of the things I wanted to know was how they dealt with abuse in Sweden, given you just need the social security number of a person and then you can do purchase as that…

Isn't this how post order used to work? You just send a pre-printed form to the company and fill in the address and name? However, with computers automated scams are instant and could have a greater scale. I.e. instead of having some random person have a delivery pizza, you could order 1000 pizzas in 1000 towns.

Re: Klarna users are being signed in to random accounts

#336

Post by 74d-fe6-2c6 »

bschne wrote: post #215
74d-fe6-2c6 wrote: post #158

Earlier quoted context omitted.

Have been using SÜ for years until I learned that they not just facilitate the transfer but abuse their role to dump bank transfer data worth several months. I don't use that service anymore.

That sounds pretty bad! I always thought the login flow was super sketchy, but wasn't aware of this part — has this been covered/analyzed somewhere or is it evident from their terms or something?

I cannot answer this question satisfyingly. I read it somewhere and found tangential information by google search - but nothing very specific.

Re: Klarna users are being signed in to random accounts

#337

Post by timdaub »

akoncius wrote: post #114
timdaub wrote: post #91

Earlier quoted context omitted.

Get your vocabulary right. Klarna is having an authorization problem not an authentication one.

seems like you have issues with vocabulary - it clearly indicates that problems are with authentication, not authorization :D each time klarna identifies user as different user.

If I can see another user's balance as is shown in the tweet of the original poster, that to me is an authorization problem as its concerned with access. Why? Because as user A I should not be able to read information of users B to Z.

I don't think it's an authentication problem as there's no confirmed problem with proving an assertion as in e.g. (sha3("hello") === "0xabc") in the original post.

Re: Klarna users are being signed in to random accounts

#339

Post by the_duke »

paxys wrote: post #257

Having at least authenticated sections of your site use HTTPS was standard well before 2011.

Only for certain domains and in certain regions.

A lot of the web was still on http, including some banks.

Even Facebook was still primarliy http when Firesheep [1] came out in 2010.

[1] https://en.wikipedia.org/wiki/Firesheep

Re: Klarna users are being signed in to random accounts

#340

Post by timdaub »

gspr wrote: post #175
timdaub wrote: post #81

Earlier quoted context omitted.

Why not separate concerns? Crypto currencies work without Proof of Work today.

> Why not separate concerns? Crypto currencies work without Proof of Work today. You mean through proof of stake instead? Yay, now all the people who wanted to avoid having a competent central bank in a free democracy control the money supply get to have the people with the most money control the supply instead. Jesus fucking christ, you cryptocurrency lunatics have lost it.

Why not separate concerns? Crypto currencies work without central banking or democracies today.
Post reply on HN