Klarna users are being signed in to random accounts • Hacker News Board

Re: Klarna users are being signed in to random accounts

#351

Post by switch007 » Thu, May 27, 2021, 5:19 PM UTC

dang wrote: post #341

switch007 wrote: post #243

Earlier quoted context omitted.

Who knows, many of the HN algorithms are secret and there is no moderation log a la https://lobste.rs/moderations

True, but it's still always possible to get an answer to a question—you just have to ask. However, we might not see it unless you ask at hn@ycombinator.com.

I don't want to appear ungrateful - let me take this opportunity to thank you sincerely for all that you do. Your set up appears to work, and I'm probably in a minority with my demands.

We wouldn't have to ask if you had a public mod log (and banned sites list etc) and a public explanation of the algos that power HN.

Your comment reminds me of hotels - "X is available, just ask". A scheme clearly designed to reduce usage of X. I'm guessing the current audience is quite diverse, as most engineers would see through that kind of BS in about 0.2ms.

Re: Klarna users are being signed in to random accounts

#352

Post by timdaub » Thu, May 27, 2021, 5:22 PM UTC

gspr wrote: post #348

timdaub wrote: post #340

Earlier quoted context omitted.

Why not separate concerns? Crypto currencies work without central banking or democracies today.

They work poorly (if at all) as currencies: (1) They're way too volatile. (2) Even if they weren't, the popular cryptocurrencies today have fixed money supplies. A central bank cannot increase it to target moderate inflation.

Central banks use PID controllers to control stability [1]. Stable coin systems can use PID controller systems too [2]. Stable coins are as volatile as their fiat counterparts.

Crypto currencies are run by people as much as central banks are. People can have opinions and values. People forked of Ethereum into Ethereum Classic because they had an issue with the main chain's policy. ETC community is alive.

Building crypto currencies is all about optimizing for legitimacy [3]. We can build what we want, we just need to want it in the first place. No need to discount a whole field of computer science with a comment.

- 1: https://link.springer.com/article/10.1007/s11403-014-0127-3

- 2: https://github.com/reflexer-labs/whitepapers/blob/master/Eng...

- 3: https://vitalik.ca/general/2021/03/23/legitimacy.html

Re: Klarna users are being signed in to random accounts

#353

Post by klarnaenginner » Thu, May 27, 2021, 5:23 PM UTC

Is that a really surprise to you guys? Just look for the old klarna news, this is not the first time and won’t be the last time. There is no security on internet, just get used to it, if you use klarna.

Re: Klarna users are being signed in to random accounts

#354

Post by cerved » Thu, May 27, 2021, 5:29 PM UTC

sneak wrote: post #311

toxik wrote: post #288

Earlier quoted context omitted.

I'm afraid you don't decide what comes across as hostile. Things can be discussed in many ways, yours is one of assuming to hold all the answers in a conversation with a stranger you know very little about. I would reconsider this. You don't know what I was buying, for what reason, or if there was a realistic alternative. You just say "you weren't born with it", and "it's the truth". An unconvincing way to argue what…

If you find truthful and accurate statements of fact to be hostile, I don't know what to tell you, other than perhaps clarifying that I wasn't intending to be convincing or persuasive. Those that care about the truth will be persuaded sufficiently by facts, and everyone outside of those that care about the truth I am not interested in spending any effort persuading.

you're not coming across as terribly polite

Re: Klarna users are being signed in to random accounts

#355

Post by cerved » Thu, May 27, 2021, 5:35 PM UTC

mrweasel wrote: post #62

Klarna is a weird company. Last I interacted with them it was clear that they are completely designed to operate within Sweden, but have no idea of how to deal with the outside world. Maybe that have changed. I talked to Klarna maybe 10 years ago. One of the things I wanted to know was how they dealt with abuse in Sweden, given you just need the social security number of a person and then you can do purchase as that…

typiskt danskt att skicka massa knullsaker

Re: Klarna users are being signed in to random accounts

#356

Post by cerved » Thu, May 27, 2021, 5:39 PM UTC

jacquesm wrote: post #308

henvic wrote: post #253

As a software engineer, I hate when I add a check for something "that will never happen" but that if happens is awful, and people complain. A classic example: you need to get a user from a session, check against a database, and continue if they're signed in. Then I add a simple if databaseUser.Username != form.Username and people will say "if that happens we've something worse wrong". Geez, something might be wrong a…

This is very good practice as far as I'm concerned. Functions should treat their arguments as potentially hostile input.

maybe if it helps to fail fast and only public functions

Re: Klarna users are being signed in to random accounts

#357

Post by elamje » Thu, May 27, 2021, 5:43 PM UTC

mavster wrote: post #181

I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.

This reminds me -

A couple of years back, I was making https://lifeboxhq.com which involved users uploading quite a bit of content. I was happily testing security with some url resource enumeration and for some reason, I could non-deterministically access user uploads via url, even on accounts I didn't own. I spent several days looking at my Flask code, javascript, etc. to debug....

I knew it wasn't my code, but I was getting more and more frustrated, then I remembered I set up Cloudflare....

Remember to exclude certain routes from Cloudflare if you want to avoid arbitrary user content from being cached without authentication.

Re: Klarna users are being signed in to random accounts

#358

Post by piva00 » Thu, May 27, 2021, 5:47 PM UTC

AtNightWeCode wrote: post #328

mavster wrote: post #181

I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.

I doubt that Klarna, a bank, have OSI layer 7 proxies in the cloud, with TLS termination in their CDN solution, on AWS. I would assume this traffic is outside of that. But then again, I know they wasted 25M+ Euros on a garbage NodeJS platform. They also created an own cloud once. Yes, it is in the trash bin.

What makes you doubt that?

Re: Klarna users are being signed in to random accounts

#359

Post by disabled » Thu, May 27, 2021, 5:48 PM UTC

lxgr wrote: post #174

Hamuko wrote: post #165

Earlier quoted context omitted.

Do they always open up an account when you pay by card? Because I've definitely paid online purchases with my credit card with Klarna as the processor, but I am not aware of having an account there.

You could try to find out by opening an account or alternatively with a GDPR request. I just checked the chronology again: I performed the initial order months before opening the account, yet the line-level item details are there (and last time I checked, there was no way to delete these, for a payment years ago). Oh, and I'm almost certain that somewhere within the fine print of paying at that store I consented to a…

> You could try to find out by opening an account or alternatively with a GDPR request.

Klarna AB (a Swedish company) is obliged to follow GDPR worldwide. So, this does warrant a GDPR inquiry.

Re: Klarna users are being signed in to random accounts

#360

Post by piva00 » Thu, May 27, 2021, 5:55 PM UTC

philbert101 wrote: post #294

ericmay wrote: post #168

Does Klarna still do the IQ test as part of their hiring process?

It's not an IQ test. It's just pattern recognition which is about 5% of the tasks you do in a real IQ test. When I joined Klarna in 2011, the test was so easy that I joked I could score full marks on it even if I was hungover with no sleep. There was one question on the test that actually had 2 correct answers depending on what logic you applied. This was actually a real issue when recruiting, because there was a har…

That test was always stupid and fought hard by a lot of engineers that considered it so. It was still kept even after a lot of pushback. I left the interviewing team due to that, I couldn't be part of a process that considered that step not only required but as a hard cutoff for engineers.

I lost so many great candidates that would be great hires to my teams at Klarna to that stupid test.