Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

491–500 of 517 posts

Re: Klarna users are being signed in to random accounts

#491

Post by vesinisa »

sly010 wrote: post #442
vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

I am not sure this makes sense. Shouldn't Klarna provide proof of the transaction to the court? Won't the court look at it and throw it out as baseless? If Klarna were actually on the hook for their own money, it wold only have to happen a few times before they realize it's not worth it. edit: definitely not a finnish lawyer

Problem is the invoice itself is real. You have to contest it actively to the debt collector and give at least some evidence as to why the debt is invalid. If you do not actively contest the collection, it will soon end up in court. This is a very routine case for a district judge where they will give a default judgement in favor of the plaintiff.

The problem is that the law in Finland is written so that even if the collection is baseless the supposed debtor needs to actively manage it or end up in legal jeopardy. Which is rather unfair if you are a victim of identity theft.

Re: Klarna users are being signed in to random accounts

#492

Post by AtNightWeCode »

Hikikomori wrote: post #487
AtNightWeCode wrote: post #474

Earlier quoted context omitted.

Sebastian used the word cloud when I met him.

There was a Klarna cloud yes. At the time it was unclear if finance/banks could utilise public cloud services (regulatory requirements), so it made sense in that way, but creating your own cloud is something few orgs are capable of.

It is not that uncommon among finance tech companies in Sweden to have some in house cloud. They often already have the knowledge to run servers with virtualization, logging, backups, redundancy and so on. Adding a service layer to that by using Kubernetes for instance is doable.

Re: Klarna users are being signed in to random accounts

#493

Post by AtNightWeCode »

piva00 wrote: post #490
AtNightWeCode wrote: post #474

Earlier quoted context omitted.

Sebastian used the word cloud when I met him.

Klarna Cloud was a deployment of Cloudstack or Openstack (my memory fails me now) for internal usage, when there was still a lot of discussions around cloud lock-in, it was not an in-house built cloud platform.

I did not think they actually wrote the code. But I think the ambition was higher. Pretty much every CTO in this country have hubris and think their services will be sold to third parties.

Re: Klarna users are being signed in to random accounts

#494

Post by 1cvmask »

neuronic wrote: post #369
2rsf wrote: post #203

Earlier quoted context omitted.

> "Why would anyone do that?" That's such a typical Swedish answer... but they do allow (but not as default!) to block orders and request digital confirmation

Of course, Sweden's largest export are lessons about morality. Interesting for a country that slowly eradicates their indigenous people btw. https://en.wikipedia.org/wiki/S%C3%A1mi_people#Discriminatio... https://en.wikipedia.org/wiki/Swedification#Swedification_of...

They also have no problems sending people to be tortured.

“Also, the United Nations Committee against Torture condemned Sweden for having violated the principle of non refoulement provided in Article 3 of the Convention against Torture.”

https://www.cairn.info/revue-internationale-de-droit-penal-2...

Re: Klarna users are being signed in to random accounts

#495

Post by vesinisa »

pylon wrote: post #460
vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

This is one of the reasons I wish governments in the world implement proper digital authentication instead of relying on static identifiers like name, address, or SSN.

Finland offers a state of the art digital authentication system. It's just that Klarna doesn't want to use it because it adds an auhtentication step to their checkout process. It's just easier for them to take the random internet user's word for who they are (!!).

I am not sure how this is even legal under the PSD2 in EU. It might not be. But Klarna does not seem to care, and I really hope someone will take them to court over this.

Re: Klarna users are being signed in to random accounts

#496

Post by vesinisa »

2rsf wrote: post #199
vesinisa wrote: post #94

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address. Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order ite…

In Sweden you can ask them to require Mobilt BankID confirmation to every buy, their competitors (like qliro) don't have that yet so Klarna are only half bastards. But they did get a lot of criticism from the Swedish government about the same things you have presented.

Wait, so you have to explicitly ask Klarna to not sell stuff under your payment info to random internet strangers? That's not too good either - I think ordering without BankID should be opt-in rather than opt-out.

Re: Klarna users are being signed in to random accounts

#497

Post by mlonkibjuyhv »

tapland wrote: post #458
2rsf wrote: post #199

Earlier quoted context omitted.

In Sweden you can ask them to require Mobilt BankID confirmation to every buy, their competitors (like qliro) don't have that yet so Klarna are only half bastards. But they did get a lot of criticism from the Swedish government about the same things you have presented.

Yeah. Klarna has BankID but it doesn't make them half bastards as they log in to users banks as the user, where they can see all account balances and purchases. That makes them double bastard.

They what now? That has to be illegal.

Re: Klarna users are being signed in to random accounts

#498

Post by p2detar »

We still haven’t got our money back for a purchase paid via Klarna. Apparently they wired the money to another bank account but under my partner’s name.

After 3 support calls and several emails, we just gave up. Fortunately it was just €12.

This was so frustrating that we now avoid paying with Klarna whenever possible.

Re: Klarna users are being signed in to random accounts

#499

Post by OldGoodNewBad »

2rsf wrote: post #478
OldGoodNewBad wrote: post #430

Earlier quoted context omitted.

> they do have a pretty successful mixture of socialism and capitalism Used to, they’re broke now.

we are?

Yes, please examine your nation’s cash situation in 2010 and compare to today. You’re broke, Sven.

Re: Klarna users are being signed in to random accounts

#500

Post by 2rsf »

simon1573 wrote: post #443
2rsf wrote: post #199

Earlier quoted context omitted.

In Sweden you can ask them to require Mobilt BankID confirmation to every buy, their competitors (like qliro) don't have that yet so Klarna are only half bastards. But they did get a lot of criticism from the Swedish government about the same things you have presented.

Qliro has that too, which I know since somebody bought shoes with my SSN. I don't know if it's a general feature or if you have to contact them, but the functionality is implemented at least.

I contacted them and they said no, but they have other "smart" ways to prevent fraud
Post reply on HN