Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

411–420 of 517 posts

Re: Klarna users are being signed in to random accounts

#411

Post by kruxigt »

dang wrote: post #346
kruxigt wrote: post #113

Earlier quoted context omitted.

Why did this one disappear from the front page so fast?

Do you mean https://news.ycombinator.com/item?id=27301311 ? A moderator buried it for reasons explained here: https://news.ycombinator.com/item?id=27305371 . Sorry for the delay, but these days you guys need to wait until I'm online to get explicit explanations, because I'm currently the only mod who's posting publicly.

Thanks! Yeah, too bad we didn't get an explanation. Just removing a post with lots of interesting discussions in it from the front page is not my preferred respons. Should be some better way.

Re: Klarna users are being signed in to random accounts

#412

Post by mekkkkkk »

AtNightWeCode wrote: post #328
mavster wrote: post #181

I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.

I doubt that Klarna, a bank, have OSI layer 7 proxies in the cloud, with TLS termination in their CDN solution, on AWS. I would assume this traffic is outside of that. But then again, I know they wasted 25M+ Euros on a garbage NodeJS platform. They also created an own cloud once. Yes, it is in the trash bin.

I'd actually bet against you on that one. They are still stuck with one foot in the startup mindset.

Re: Klarna users are being signed in to random accounts

#413

Post by toxik »

dang wrote: post #398
sneak wrote: post #65

> Hear hear, I used Klarna (not by choice) It was by choice. You weren't born with an account. Not taking personal responsibility for the rise of the ubiquity of these terrible online services (WhatsApp users, I'm looking at you) is a huge part of the problem. Pretending that you didn't opt-in is a lie you've told yourself; you shouldn't propagate that lie to others in society.

We detached this subthread from https://news.ycombinator.com/item?id=27301463 .

Does that mean it can’t be found on the original thread anymore?

Re: Klarna users are being signed in to random accounts

#414

Post by gpvos »

Flow wrote: post #35

Klarna wants to be Facebook of payment. When I buy and pay with Klarna, they get the list of items and on Klarna's app and homepage I see pictures of whatever it is I bought. I'm not sure what to think about this. My first thought is "Is this really legal?".

Way to make me run away from them fast.

Re: Klarna users are being signed in to random accounts

#416

Post by tl »

kaszanka wrote: post #397
tl wrote: post #291

Earlier quoted context omitted.

Let's Encrypt started in 2014 to address HTTP overuse. In 2011, I (in-house corp app dev) was still stuck with HTTP services (behind a firewall, accessible only via VPN). In 2014, public facing mobile apps using HTTP was prevalent enough to prompt name and shame campaigns. [1] My fuzzy memory suggests some banks were still using HTTP. [1] https://arstechnica.com/information-technology/2014/08/new-w...

If the pages are only accessible via a VPN, what does HTTPS really get you?

Not needing a VPN. rimshot

In all seriousness, better security. You are leaking whatever payload is sent right after VPN drops. An early version of the application had a defect because it did not check response payloads on an endpoint (the code handled errors, but 200 OK was all it needed on success). This is not what you want when the 200 OK is followed by the HTML of a hotel's wi-fi access page.

Re: Klarna users are being signed in to random accounts

#417

Post by thomasikzelf »

rbmks wrote: post #68
ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

I cancel every online order if I find out that it is handled by PayPal, Klarna, Mollie or other data collecting entities. The situation in Europe is so bad that you are sometimes tricked into a prepaid order only to find out that the invoice comes from one of those. The appropriate penalty is immediate cancellation and multiple GDPR requests.

I looked through the terms of use and the privacy policy for Mollie and I don't think they are selling data. Do you have different information then I have?

Re: Klarna users are being signed in to random accounts

#418

Post by mekkkkkk »

henvic wrote: post #253

As a software engineer, I hate when I add a check for something "that will never happen" but that if happens is awful, and people complain. A classic example: you need to get a user from a session, check against a database, and continue if they're signed in. Then I add a simple if databaseUser.Username != form.Username and people will say "if that happens we've something worse wrong". Geez, something might be wrong a…

I agree, and I've also been called out for doing "stupid" defensive assertions. It's almost certainly not a code-level issue this time though. This whole thing reeks of infrastructure/caching issues.

Re: Klarna users are being signed in to random accounts

#419

Post by timdaub »

gspr wrote: post #392
timdaub wrote: post #352

Earlier quoted context omitted.

Central banks use PID controllers to control stability [1]. Stable coin systems can use PID controller systems too [2]. Stable coins are as volatile as their fiat counterparts. Crypto currencies are run by people as much as central banks are. People can have opinions and values. People forked of Ethereum into Ethereum Classic because they had an issue with the main chain's policy. ETC community is alive. Building cry…

Sure. We can probably build a sane cryptocurrency. I'm talking about the ones that people are sinking tens of bn into and hyping the hell out of today .

Fair enough, I'm against the on-going hype in the space.

Re: Klarna users are being signed in to random accounts

#420

Post by ptx »

LinAGKar wrote: post #129
queuep wrote: post #25

Earlier quoted context omitted.

Not sure where you are located, but in Sweden, Klarna at the start (if I remember it correctly) only needed your 'personnummer'(social security number) to process payments. Now I think they manage to track your devices so I only have to enter my postal code, and then I just click purchase, and it's all done. They used to use really weird/dark patterns, to make you forget to pay and then pay huge fees to Klarna. Nowad…

And they don't notify you when it's available for payment, or when it's about to expire. So if you order something, and it for some reason takes a few weeks/months before they ship it and it becomes available for payment, you'll end up with a reminder fee with no warning.

Hm? I always get an e-mail when the invoice is ready and another e-mail when the payment has been received.
Post reply on HN