Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

471–480 of 517 posts

Re: Klarna users are being signed in to random accounts

#471

Post by grishka »

pylon wrote: post #460
vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

This is one of the reasons I wish governments in the world implement proper digital authentication instead of relying on static identifiers like name, address, or SSN.

I'm somewhat happy that my country is so much behind on all this digital stuff. You usually have to physically present your ID to do something serious, or at least provide a picture of it. We do also have an official "government services" website, and it implements a proper oauth flow that many other government sites use and uses SSN + password for login.

Re: Klarna users are being signed in to random accounts

#472

Post by mnpl »

macintux wrote: post #292
_nnv7 wrote: post #273

Earlier quoted context omitted.

Not looking for a debate myself :)

Making snarky comments about a common development methodology but not interested in debating the merits of the underlying complaint? I believe that’s called trolling.

The complaint has been explained:

Agile inevitably leads to shoddy, churn-oriented programming and only serves bullshit consultants and code slingers.

Re: Klarna users are being signed in to random accounts

#473

Post by def_true_false »

243423443 wrote: post #313
def_true_false wrote: post #126

Earlier quoted context omitted.

It's more about incentive alignment, and lack of free get out of jail cards -- people tend to assume you can just roll back fraudulent fiat transactions. Fuck up in crypto? Poof, the money is gone... Compared to legacy finance, the exchanges are indeed bugfree. I would sooner trust Binance security team than people who think SMS is enough of a second factor. Never mind all the 'European unicorn' challenger 'banks'.

"you can just roll back fraudulent fiat transactions. Fuck up in crypto? Poof, the money is gone..." Do you know why Ethereum Classic exists?

I'm well aware of ETC. It's not going to happen again on Ethereum, with any level of certainty, anyway. So crypto exchanges and similar won't be able to count on that.

Re: Klarna users are being signed in to random accounts

#474

Post by AtNightWeCode »

jordanbeiber wrote: post #424
AtNightWeCode wrote: post #328

Earlier quoted context omitted.

I doubt that Klarna, a bank, have OSI layer 7 proxies in the cloud, with TLS termination in their CDN solution, on AWS. I would assume this traffic is outside of that. But then again, I know they wasted 25M+ Euros on a garbage NodeJS platform. They also created an own cloud once. Yes, it is in the trash bin.

They didn’t “create” their own cloud - they wanted to host their own hardware using an api layer to provision resources. That stuff was not built in-house. Manhandled in-house though...

Sebastian used the word cloud when I met him.

Re: Klarna users are being signed in to random accounts

#475

Post by def_true_false »

croon wrote: post #125
timdaub wrote: post #72

Sometime in the future, people will stop belittling crypto currencies when they realize that the digitization concepts of traditional finance technology providers are inferior to those of crypto currencies and blockchains. Putting safety and security first for anything that handles money makes sense. The calls for "you don't need a blockchain, just use a database" will become less and less. Edit: Of course, Hacker Ne…

People can't use bitcoin without offloading transactions outside of the blockchain, which means entrusting an exchange, which could and probably has the same issues as Klarna.

I've used Binance, and as far as I can tell, their stuff works as well as Stripe or better. They are an order of magnitude bigger than Coinbase.

Whether they are likely to have a competent security team with sufficient budget is an exercise left to the reader.

My interactions with Klarna have so far failed to inspire similar confidence.

Re: Klarna users are being signed in to random accounts

#476

Post by ChuckNorris89 »

rjzzleep wrote: post #463
pylon wrote: post #460

Earlier quoted context omitted.

This is one of the reasons I wish governments in the world implement proper digital authentication instead of relying on static identifiers like name, address, or SSN.

The Baltic states have had proper digital authentication for years. Priv/pub key pair on the Xth iteration digital identity card that is checked against your passport physically. The problem isn't that governments don't have proper digital authentication. It's that most countries want to reinvent it every time. The German version is a clusterfuck that they then had to force into existence by mandating it by law and y…

>The German version is a clusterfuck ...

These gigantic government IT projects are also a good way to funnel taxpayer money to the right pockets, that's why they're always behind schedule and over budget (just like all government physical infrastructure projects) and if you look closely it's always the same 2-3 companies getting all the contracts.

Re: Klarna users are being signed in to random accounts

#477

Post by fogihujy »

gruez wrote: post #209
fogihujy wrote: post #200

Earlier quoted context omitted.

> So what? It's 0% interest. Debt is slavery and so on. Let's not get too hung up on the fact that I dislike it. > Most e-commerce sites I've used in the past year offer Klarna or some similar service and all of them have been implemented as just another option in a set of radio buttons. Radio buttons is fine. It's the defaults and "are you sure you don't want to pay with credit?" questions I'm bugged out about. I do…

>Debt is slavery and so on. No it's not, and statements like that trivializes the mistreatment that actual slaves went through.

You missed the point. It was a deliberate simplification (hence a simplification of a biblical quote and the addition of "and so on") intended to steer the focus away from my personal opinion about debt, and towards the second point, i.e. dark patterns in order to get people to pay with credit rather than with a debit card.

Re: Klarna users are being signed in to random accounts

#478

Post by 2rsf »

OldGoodNewBad wrote: post #430
anticristi wrote: post #426

Earlier quoted context omitted.

> Of course, Sweden's largest export are lessons about morality Not sure why you were downvoted. I think your comment is rather fair. :) Although, let's give them some credit, they do have a pretty successful mixture of socialism and capitalism. > Interesting for a country that slowly eradicates their indigenous people btw. I think that sad story is over. They significantly ramped up protection for indigenous people.

> they do have a pretty successful mixture of socialism and capitalism Used to, they’re broke now.

we are?

Re: Klarna users are being signed in to random accounts

#479

Post by 2rsf »

tapland wrote: post #458
2rsf wrote: post #199

Earlier quoted context omitted.

In Sweden you can ask them to require Mobilt BankID confirmation to every buy, their competitors (like qliro) don't have that yet so Klarna are only half bastards. But they did get a lot of criticism from the Swedish government about the same things you have presented.

Yeah. Klarna has BankID but it doesn't make them half bastards as they log in to users banks as the user, where they can see all account balances and purchases. That makes them double bastard.

they do what? how is that even possible? even if I never coupled my account to them?

Re: Klarna users are being signed in to random accounts

#480

Post by OJFord »

kenniskrag wrote: post #440
OJFord wrote: post #439

I think this would make quite an interesting exercise for whatever it is one works on oneself; that is, what's the minimum, most innocuous patch that causes this behaviour? I bet it's not as much as people railing against it would like to think. I'm partly thinking of this because I fixed a (way less critical) bug today that boiled down to a (x - y) * z = 0 query that should've just been (x - y) = 0. But it was hidde…

> getting 'random' records that correspond to a given ID but that's for the wrong table... That's why I use GUID instead of integers. If you get a result, it was the right column.

Good point, we do for new things, but of course when I hit it it was with an old table and was a problem.. sod's law. (Though arguably it's just harder to notice the effects of it happening with a GUID and it could have too.)
Post reply on HN