Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

461–470 of 517 posts

Re: Klarna users are being signed in to random accounts

#461

Post by passerby1 »

lupire wrote: post #445
shaan7 wrote: post #267

Ha, one time I was debugging an issue that only happened to a particular user. Lazy as I was, I hardcoded his auth token in the code "just to test". Having found the bug quickly, I was excited and did not realize I checked-in the auth token too. Bypassed reviews, pushed to prod and then reports started coming in "Hey, users are saying they are all logged in to this random guy's account". Lessons learned the hard way…

Did you compensate the victim of your personal and corporate negligence?

Just out of curiosity. Is it a bad question for some reason or why is it downvoted?

Re: Klarna users are being signed in to random accounts

#462

Post by AdamJacobMuller »

sly010 wrote: post #442
vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

I am not sure this makes sense. Shouldn't Klarna provide proof of the transaction to the court? Won't the court look at it and throw it out as baseless? If Klarna were actually on the hook for their own money, it wold only have to happen a few times before they realize it's not worth it. edit: definitely not a finnish lawyer

> If Klarna were actually on the hook for their own money

Aren't they?

> it wold only have to happen a few times before they realize it's not worth it

That's an assumption. Someone did some A/B testing and said this payment flow results in X% increased sales, resulting in Y% more revenue for Klarna, it results in Z% more fraud. I don't even object to this per-se.

If Y is greater than Z, they will do it.

If they are especially awful they will consider that of the Z% of fraud it will result in A% still being paid for and B% being recovered in debt collection. That is awful.

Re: Klarna users are being signed in to random accounts

#463

Post by rjzzleep »

pylon wrote: post #460
vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

This is one of the reasons I wish governments in the world implement proper digital authentication instead of relying on static identifiers like name, address, or SSN.

The Baltic states have had proper digital authentication for years. Priv/pub key pair on the Xth iteration digital identity card that is checked against your passport physically. The problem isn't that governments don't have proper digital authentication. It's that most countries want to reinvent it every time. The German version is a clusterfuck that they then had to force into existence by mandating it by law and yet normal citizen services can't be done with it.

Re: Klarna users are being signed in to random accounts

#464

Post by PebblesRox »

sorenjan wrote: post #314
arthur_sav wrote: post #281

Earlier quoted context omitted.

> It’s concluded that a human error caused the bug I would not want to be that "human" atm

Reminds me of this story after an expensive mistake: > Boss - "Why do you think you are here, Jack?" > JW - "I expect I am here so you can fire me" > Boss - "I just spent a million dollars on your education - why would I fire you now?" http://www.nickmilton.com/2016/03/jack-welch-on-learning-fro...

Yesterday's Money Stuff has a good discussion in this vein:

"A somewhat tongue-in-cheek but surprisingly useful maxim of high finance is that it is good for your career if you lose a billion dollars. I mean, if you lose a billion dollars for your employer you will probably be fired, though that depends on who your employer is and how much money you started with and what you did to lose it. But lots of other employers will be excited to hire you, once they learn that you lost a billion dollars for someone else."

https://www.bloomberg.com/opinion/articles/2021-05-26/exxon-...

Re: Klarna users are being signed in to random accounts

#466

Post by greycol »

passerby1 wrote: post #461
lupire wrote: post #445

Earlier quoted context omitted.

Did you compensate the victim of your personal and corporate negligence?

Just out of curiosity. Is it a bad question for some reason or why is it downvoted?

I didn't downvote it but the tone does seem quite adversarial to me.

You could ask "what was the fallout?", "Did the client get compensated?", or "did you make procedural changes afterwards?" without being as confrontational.

Less people will post about their mistakes if they know they're going to be lambasted for them. We can learn from these mistakes if they're shared or they can be a timely reminder of stakes if we're slipping into complacency. So we probably don't want to discourage such posts (especially since it's rarer for people to want to talk about failures that successes).

Re: Klarna users are being signed in to random accounts

#467

Post by scbrg »

hervature wrote: post #227
fogihujy wrote: post #192

Earlier quoted context omitted.

Debit cards is more common in quite a few places. My impression has always been that paying everything with a credit card is a U.S. thing. Here in Finland, It's not uncommon to have no debt apart from the mortage on one's home.

Mortgages are 70% of debt in the US. It is like saying I got perfect on a test except for the 70% I got wrong.

That's interesting. Mortgages are 100% of my debt, and the debt of most everyone I know. Which I guess was the point GP tried to make.

Re: Klarna users are being signed in to random accounts

#468

Post by Scoundreller »

tedd4u wrote: post #232

At a large site I used to work for circa 2011, before everyone had gone fully HTTPS, we received similar panicked reports from users: "I'm logged in as someone else!" Turns out an ISP in the Philippines decided to just ignore `cache-control` and `vary` headers and forcibly started caching logged-in responses along with auth cookies. Bad times. Made it clear to me why the whole web would have to go HTTPS.

Reminds me of a primitive web filter at work that blocked me from something. So I look at the URL, add an “s” to http and voila. I think they MITM everything now.

Re: Klarna users are being signed in to random accounts

#469

Post by wreath »

pvillano wrote: post #211
domano wrote: post #204

Earlier quoted context omitted.

Wow, first time i hear that. Aren't those IQ test horribly biased?

not only that, but they aren't a great predictor of actual job performance

They are a great predictor of actual job environment though (the test, not its results)

Re: Klarna users are being signed in to random accounts

#470

Post by zaphirplane »

mrweasel wrote: post #62

Klarna is a weird company. Last I interacted with them it was clear that they are completely designed to operate within Sweden, but have no idea of how to deal with the outside world. Maybe that have changed. I talked to Klarna maybe 10 years ago. One of the things I wanted to know was how they dealt with abuse in Sweden, given you just need the social security number of a person and then you can do purchase as that…

Sometime people pretend that it doesn’t make sense. Had a real-estate say offers have to be a signed contract I say it needs a expiry period so people don’t come back in a month and demand the contract is followed. He kept doubling down on “I don’t understand the problem”
Post reply on HN