Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

451–460 of 517 posts

Re: Klarna users are being signed in to random accounts

#451

Post by avereveard »

vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

Good to hear, I failed an interview with them at the sixth step or so because I make a point not to remember easily googleable trivia, bet their engineers are traversing rb trees on paper off memory like crazy right now trying to find a solution

Re: Klarna users are being signed in to random accounts

#452

Post by weird-eye-issue »

willeh wrote: post #271
weird-eye-issue wrote: post #234

Earlier quoted context omitted.

Depends on the job actually. (I know this will be unpopular but in my experience hiring for certain roles it is correlated)

This is exactly why these IQ-test companies make so much money. It gives out yeses and no:s confirmation bias does the rest. Quickly why they don't work: You create a huge chain correlational assumptions. First that visual-spatial tasks of this kind predict performance on visual tasks. 2. That performance on visual tasks predict general intelligence (whatever that is). 3. That this notion of general intelligence (whi…

I use it to filter out candidates when hiring assistants from the Philippines. I get so many applicants that I don't have time to talk to all of them. Have you been on the hiring end? You get hundreds of applications within a couple days when you have a good position and are paying well enough.

There is a strong correlation between IQ and professional achievement whether you want to believe it or not.

Re: Klarna users are being signed in to random accounts

#453

Post by horstmeyer »

tgsovlerkhgsel wrote: post #384
ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

Sofortüberweisung specifically got caught looking at 30 days of transaction data. > how banks can allow this A court decided that blocking this "business model" would be anticompetitive.

Do you have sources on them looking at transaction data please? That is clearly not necessary for processing the payment.

Edit: Found an article in German - https://www.sueddeutsche.de/geld/zahlung-per-sofortueberweis...

They claim they need to do this to make sure there is sufficient money in the account, even with transactions that might not be reflected in the balance, and they also check for other "Sofortüberweisungen" to detect fraud. Makes sense in a way but still quite shady. If there wasn't enough money in my account, or other transfers pending would my bank even allow their transfer?

Re: Klarna users are being signed in to random accounts

#454

Post by horstmeyer »

bschne wrote: post #215
74d-fe6-2c6 wrote: post #158

Earlier quoted context omitted.

Have been using SÜ for years until I learned that they not just facilitate the transfer but abuse their role to dump bank transfer data worth several months. I don't use that service anymore.

That sounds pretty bad! I always thought the login flow was super sketchy, but wasn't aware of this part — has this been covered/analyzed somewhere or is it evident from their terms or something?

Here is an article in German : https://www.sueddeutsche.de/geld/zahlung-per-sofortueberweis...

Re: Klarna users are being signed in to random accounts

#455

Post by sneak »

dpatterson2008 wrote: post #448
vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

This reminds me of this BBC article I came across: https://www.bbc.co.uk/news/business-55829879 > To use Klarna's pay later service, which defers payments for up to 30 days, shoppers only have to provide a name, email, date of birth, mobile number and billing address. It’s mind blowing that’s all the information you need to process a payment via Klarna.

The benefits of reduced friction in high-trust societies are incredible sometimes. The failure modes are predictable.

Re: Klarna users are being signed in to random accounts

#456

Post by sneak »

vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

The actual victim of the fraud is the creditor who was defrauded by the criminal; they are just leveraging the unfair legal system to push the liability onto someone who was not party to the fraud in any way (the person whose name was used in the fraud by the criminal against Klarna).

This is the lie of "identity theft". It's not identity theft, it's money/goods fraud, from a bank that didn't do proper authentication.

Re: Klarna users are being signed in to random accounts

#457

Post by [deleted] »

lupire wrote: post #445
shaan7 wrote: post #267

Ha, one time I was debugging an issue that only happened to a particular user. Lazy as I was, I hardcoded his auth token in the code "just to test". Having found the bug quickly, I was excited and did not realize I checked-in the auth token too. Bypassed reviews, pushed to prod and then reports started coming in "Hey, users are saying they are all logged in to this random guy's account". Lessons learned the hard way…

Did you compensate the victim of your personal and corporate negligence?

[deleted]

Re: Klarna users are being signed in to random accounts

#458

Post by tapland »

2rsf wrote: post #199
vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

In Sweden you can ask them to require Mobilt BankID confirmation to every buy, their competitors (like qliro) don't have that yet so Klarna are only half bastards. But they did get a lot of criticism from the Swedish government about the same things you have presented.

Yeah. Klarna has BankID but it doesn't make them half bastards as they log in to users banks as the user, where they can see all account balances and purchases.

That makes them double bastard.

Re: Klarna users are being signed in to random accounts

#459

Post by tapland »

sneak wrote: post #456
vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

The actual victim of the fraud is the creditor who was defrauded by the criminal; they are just leveraging the unfair legal system to push the liability onto someone who was not party to the fraud in any way (the person whose name was used in the fraud by the criminal against Klarna). This is the lie of "identity theft". It's not identity theft, it's money/goods fraud, from a bank that didn't do proper authentication…

And guess who's their own bank?

Klarna \o/

Re: Klarna users are being signed in to random accounts

#460

Post by pylon »

vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

This is one of the reasons I wish governments in the world implement proper digital authentication instead of relying on static identifiers like name, address, or SSN.
Post reply on HN