Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

481–490 of 517 posts

Re: Klarna users are being signed in to random accounts

#481

Post by croon »

timdaub wrote: post #347
croon wrote: post #125

Earlier quoted context omitted.

People can't use bitcoin without offloading transactions outside of the blockchain, which means entrusting an exchange, which could and probably has the same issues as Klarna.

I'm not sure what you mean. Can you elaborate on that?

10 transactions/sec means you are trading somewhere off-chain, meaning you entrust someone else with verification on your transaction until all those transactions are cleared on-chain. Meaning you are just trusting a bank (or non-bank) anyways, but with bitcoin buzzwords on top.

Re: Klarna users are being signed in to random accounts

#482

Post by randomswede »

rightbyte wrote: post #335
mrweasel wrote: post #62

Klarna is a weird company. Last I interacted with them it was clear that they are completely designed to operate within Sweden, but have no idea of how to deal with the outside world. Maybe that have changed. I talked to Klarna maybe 10 years ago. One of the things I wanted to know was how they dealt with abuse in Sweden, given you just need the social security number of a person and then you can do purchase as that…

Isn't this how post order used to work? You just send a pre-printed form to the company and fill in the address and name? However, with computers automated scams are instant and could have a greater scale. I.e. instead of having some random person have a delivery pizza, you could order 1000 pizzas in 1000 towns.

I suspect that depends on where in the world.

In Sweden, the classic "order by post" required paying at the post office as you picked your parcel up, with only the pick-up slip (with the total to pay) being delivered to the address.

I have seen a few Swedish companies who didn't use the Swedish postal order system, instead opting to send a package with a giro slip and an "pay within X days" inside.

My understanding is that the post office took a small cut of the postal order payment, as a fee for guaranteeing payment. And the companies instead sending a giro slip had enough compliance with paying that it netted more money.

Re: Klarna users are being signed in to random accounts

#483

Post by rorykoehler »

ChuckNorris89 wrote: post #476
rjzzleep wrote: post #463

Earlier quoted context omitted.

The Baltic states have had proper digital authentication for years. Priv/pub key pair on the Xth iteration digital identity card that is checked against your passport physically. The problem isn't that governments don't have proper digital authentication. It's that most countries want to reinvent it every time. The German version is a clusterfuck that they then had to force into existence by mandating it by law and y…

>The German version is a clusterfuck ... These gigantic government IT projects are also a good way to funnel taxpayer money to the right pockets, that's why they're always behind schedule and over budget (just like all government physical infrastructure projects) and if you look closely it's always the same 2-3 companies getting all the contracts.

In Singapore they have world class public IT infrastructure and they do it all in house.

Re: Klarna users are being signed in to random accounts

#484

Post by boruto »

sorenjan wrote: post #314
arthur_sav wrote: post #281

Earlier quoted context omitted.

> It’s concluded that a human error caused the bug I would not want to be that "human" atm

Reminds me of this story after an expensive mistake: > Boss - "Why do you think you are here, Jack?" > JW - "I expect I am here so you can fire me" > Boss - "I just spent a million dollars on your education - why would I fire you now?" http://www.nickmilton.com/2016/03/jack-welch-on-learning-fro...

That is definitely not the case in EU software industry. I have seen technical leads get fired for a bug which caused 200k EUR loss. With team setups and documentation no one is irreplaceable.

Re: Klarna users are being signed in to random accounts

#485

Post by anaganisk »

auggierose wrote: post #367
akamia wrote: post #310

Earlier quoted context omitted.

I worked with a team that owned a service that resizes images. An engineer was assigned a task to add support for auto rotating images. His solution involved saving the image to a file and then using a library to handle the rotation. He used a hardcoded value for the file name. In a local environment where requests are sparse this looked fine to him and other engineers on the team missed it in code reviews. It wasn't…

"An engineer was assigned" Nope. That definitely wasn't an engineer.

Elitism alert!

Re: Klarna users are being signed in to random accounts

#486

Post by rorykoehler »

arthur_sav wrote: post #281
hundchenkatze wrote: post #245

Klarna has posted a statement here https://www.klarna.com/uk/blog/written-statement-on-app-bug/

> It’s concluded that a human error caused the bug I would not want to be that "human" atm

Almost certainly isn't a single human unless their governance model is atrocious

Re: Klarna users are being signed in to random accounts

#487

Post by Hikikomori »

AtNightWeCode wrote: post #474
jordanbeiber wrote: post #424

Earlier quoted context omitted.

They didn’t “create” their own cloud - they wanted to host their own hardware using an api layer to provision resources. That stuff was not built in-house. Manhandled in-house though...

Sebastian used the word cloud when I met him.

There was a Klarna cloud yes. At the time it was unclear if finance/banks could utilise public cloud services (regulatory requirements), so it made sense in that way, but creating your own cloud is something few orgs are capable of.

Re: Klarna users are being signed in to random accounts

#488

Post by ALittleLight »

PebblesRox wrote: post #464
sorenjan wrote: post #314

Earlier quoted context omitted.

Reminds me of this story after an expensive mistake: > Boss - "Why do you think you are here, Jack?" > JW - "I expect I am here so you can fire me" > Boss - "I just spent a million dollars on your education - why would I fire you now?" http://www.nickmilton.com/2016/03/jack-welch-on-learning-fro...

Yesterday's Money Stuff has a good discussion in this vein: "A somewhat tongue-in-cheek but surprisingly useful maxim of high finance is that it is good for your career if you lose a billion dollars. I mean, if you lose a billion dollars for your employer you will probably be fired, though that depends on who your employer is and how much money you started with and what you did to lose it. But lots of other employers…

There is a Dilbert comic about this.

https://dilbert.com/strip/1995-12-23

Re: Klarna users are being signed in to random accounts

#489

Post by useerup »

bagacrap wrote: post #263
useerup wrote: post #149

Earlier quoted context omitted.

I've seen something like this happen because of a race issue during login. Basically the developer(s) had refactored something and were not aware that a global variable was being captured by a closure used for auth. This meant that whenever two users signed in at the exact same time, there was a non-negligible chance that they swapped accounts during the flow. It was actually not that easy to spot in the code. Someti…

use of a global variable seems pretty stupid in fact, and easy to spot

> and easy to spot

Not always. Like if you initialize middleware by using a "lambda" (closure), and you from within that closure creates a new closure.

It means that you need to be aware of the context the outer closure is used in. If it is only instantiated once during initialization, it's free variables are in essence "hidden" global variables. Not easy to spot.

Re: Klarna users are being signed in to random accounts

#490

Post by piva00 »

AtNightWeCode wrote: post #474
jordanbeiber wrote: post #424

Earlier quoted context omitted.

They didn’t “create” their own cloud - they wanted to host their own hardware using an api layer to provision resources. That stuff was not built in-house. Manhandled in-house though...

Sebastian used the word cloud when I met him.

Klarna Cloud was a deployment of Cloudstack or Openstack (my memory fails me now) for internal usage, when there was still a lot of discussions around cloud lock-in, it was not an in-house built cloud platform.
Post reply on HN