Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

431–440 of 517 posts

Re: Klarna users are being signed in to random accounts

#431

Post by tkiolp4 »

adflux wrote: post #303
the_monocle wrote: post #157

Earlier quoted context omitted.

A recruiter contacted me aswell and I asked about their salary. They pay 50k euro for juniors in berlin with afaik no stock vesting. How they even manage to get qualified personnel is beyond me, I would expect much more for a fintech with over 3B evaluation

50k in euro's is pretty ok for European developers, no?

In all Western and Northern Europe (except UK and Switzerland), 50K for a junior position sounds about right. It’s around 25K in Southern Europe, and probably less in Eastern Europe.

Re: Klarna users are being signed in to random accounts

#432

Post by skeeter2020 »

dkersten wrote: post #259

Here's their official statement: https://www.klarna.com/uk/blog/written-statement-on-app-bug/ Although I dunno about "According to GDPR standards, only non-sensitive data was exposed." since in the twitter thread someone said: This is definitely not a test environment. I was called by someone who was logged in to my account and saw all my personal data including bank details, Klarna card etc. And while I'm told the b…

And this is both maddening AND make the problem worse (from the CEO):

"We are truly sorry for any inconvenience..."

Re: Klarna users are being signed in to random accounts

#433

Post by flemhans »

aenin wrote: post #84
flemhans wrote: post #60

Earlier quoted context omitted.

In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs. The same NemID is also used to file your taxes, look at all your health info, get married, everything basically. Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you p…

However it also forces everybody to use two factor authentication. On a whole population level I'd bet that's overall a positive tradeoff. And I believe you can also use sms + password for online transactions.

SMS + password works for some Mastercards still but not Visa.

I don't think it's good that users are taught to accept their primary citizen 2FA on any random website and app where the URL doesn't even show.

Re: Klarna users are being signed in to random accounts

#434

Post by neuronic »

anticristi wrote: post #426
neuronic wrote: post #369

Earlier quoted context omitted.

Of course, Sweden's largest export are lessons about morality. Interesting for a country that slowly eradicates their indigenous people btw. https://en.wikipedia.org/wiki/S%C3%A1mi_people#Discriminatio... https://en.wikipedia.org/wiki/Swedification#Swedification_of...

> Of course, Sweden's largest export are lessons about morality Not sure why you were downvoted. I think your comment is rather fair. :) Although, let's give them some credit, they do have a pretty successful mixture of socialism and capitalism. > Interesting for a country that slowly eradicates their indigenous people btw. I think that sad story is over. They significantly ramped up protection for indigenous people.

Yes, Sweden deserves quite some credit. It doesn't have a clear track record on human rights though, as it is trying to suggest on the geopolitical platform.

The conflict is imo not over, it is still going on. If it wasn't then Sweden couldn't produce 90% of all iron in Europe because the mine happens to be on Sami land.

Re: Klarna users are being signed in to random accounts

#435

Post by timdaub »

gspr wrote: post #349
macintux wrote: post #283

Earlier quoted context omitted.

I don’t necessarily disagree with the sentiment, but HN guidelines demand more constructive disagreements.

I'm sorry about my second paragraph. I'm getting a bit antsy from losing an otherwise intelligent friend to this nonsense.

If you mean me, I've been lost since 2014 to this stuff: Check my CV on my blog: https://timdaub.github.io

Re: Klarna users are being signed in to random accounts

#436

Post by dang »

toxik wrote: post #413
dang wrote: post #398

Earlier quoted context omitted.

We detached this subthread from https://news.ycombinator.com/item?id=27301463 .

Does that mean it can’t be found on the original thread anymore?

No, it just means that it floats to the top rather than being a child of its original parent. If you're not seeing it, that's probably because the thread is paginated and you need to click "More" at the bottom of the page.

I wrote recently about the different reasons why we do this, if anyone's interested: https://news.ycombinator.com/item?id=27132402.

Re: Klarna users are being signed in to random accounts

#437

Post by rojondo »

sneak wrote: post #401
rojondo wrote: post #382

Earlier quoted context omitted.

Does that mean you do not care about the truth, as you seem unpersuaded by the fact your missives are found to be hostile?

opinions != facts

Ahh but it is a fact that the opinion is widely, perhaps universally, held. I hope this truth will persuade you to be more collegial and respectful to your fellow community members going forward.

Cheers

Re: Klarna users are being signed in to random accounts

#438

Post by generic_dev_47 »

AtNightWeCode wrote: post #244
generic_dev_47 wrote: post #23

I worked in a project over 10 years ago where something very similar happened! We had built and authentication service that, among other things, was used by a SyncML service that was used back in the day of feature phones to syncs contacts etc. You can imagine that getting someone else's contacts on your phone isn't exactly ideal. This was how we came to know about the problem, from customers getting other customers…

I would expect this to happen if an option in the line of "serve stale content if target server is unreachable" is enabled.

Yes, you are right!

Re: Klarna users are being signed in to random accounts

#439

Post by OJFord »

I think this would make quite an interesting exercise for whatever it is one works on oneself; that is, what's the minimum, most innocuous patch that causes this behaviour?

I bet it's not as much as people railing against it would like to think.

I'm partly thinking of this because I fixed a (way less critical) bug today that boiled down to a (x - y) * z = 0 query that should've just been (x - y) = 0. But it was hidden by the whole expression being named, and that then seeming correct, it not being obvious that `z` could be 0 (or was involved at all) and as a result unwanted results would be included where x != y.

Probably the most obvious one is different IDs - have two fk columns that sound a bit similar and it's easy to come a cropper, getting 'random' records that correspond to a given ID but that's for the wrong table...

Re: Klarna users are being signed in to random accounts

#440

Post by kenniskrag »

OJFord wrote: post #439

I think this would make quite an interesting exercise for whatever it is one works on oneself; that is, what's the minimum, most innocuous patch that causes this behaviour? I bet it's not as much as people railing against it would like to think. I'm partly thinking of this because I fixed a (way less critical) bug today that boiled down to a (x - y) * z = 0 query that should've just been (x - y) = 0. But it was hidde…

> getting 'random' records that correspond to a given ID but that's for the wrong table...

That's why I use GUID instead of integers. If you get a result, it was the right column.

Post reply on HN