Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

51–60 of 517 posts

Re: Klarna users are being signed in to random accounts

#51

Post by tapland »

corroclaro wrote: post #32
ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

Klarna is actually its own bank these days so that doesn't really happen anymore. I think however many other payment providers operate this way still which is ridiculous. Then again, PSD2 API roll-out has been very ???

It's happened wayyy into them being their own bank (at least until 2019 when I started boycotting them)

They signed into users bank accounts, in other banks, to set up transfers (which also gives you all account statements).

Re: Klarna users are being signed in to random accounts

#52

Post by corroclaro »

tapland wrote: post #51
corroclaro wrote: post #32

Earlier quoted context omitted.

Klarna is actually its own bank these days so that doesn't really happen anymore. I think however many other payment providers operate this way still which is ridiculous. Then again, PSD2 API roll-out has been very ???

It's happened wayyy into them being their own bank (at least until 2019 when I started boycotting them) They signed into users bank accounts, in other banks, to set up transfers (which also gives you all account statements).

Did not know! Guess being scummy doesn't stop because you get a license.

Re: Klarna users are being signed in to random accounts

#53

Post by jstummbillig »

ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

What could a competitively convenient way to do this better look like?

Re: Klarna users are being signed in to random accounts

#54

Post by spurgu »

ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

Yeah I once had to make a ~20k transfer with Klarna and was shocked to see that they essentially hijacked my credentials. I only went through with it because there is additional 2FA (on my bank) so they wouldn't have been able to repeat it. But still a super shady practice. I was sweating for days until I got a confirmation that the transfer went through successfully. 1/5 experience.

Re: Klarna users are being signed in to random accounts

#55

Post by K0nserv »

corroclaro wrote: post #44
K0nserv wrote: post #20

I suspect this might be request threading/confusion[0] issue similar to the one GitHub experienced a while back. This would explain why seemingly random user data is being returned. 0: https://github.blog/2021-03-18-how-we-found-and-fixed-a-rare...

IIRC, Klarna is mostly written in Erlang, Scala and some parts in Clojure. If someone should be aware of thread-local storage and its implication it ought to be them.

I was under the impression that they had switched to Java more in recent years

Re: Klarna users are being signed in to random accounts

#56

Post by corroclaro »

AtNightWeCode wrote: post #48

Will be interesting to see what the problem is here. From what I have seen in real life my top guesses are. Some dependency on static variables in code. Reversed proxy with incorrect cache rules that ignores headers or some parameter.

How do you envision the static variables thing? I've seen the cache thing myself in real life but not the other.

Re: Klarna users are being signed in to random accounts

#57

Post by jablan »

diveanon wrote: post #16

If you rely on your application layer to enforce data privacy instead of enforcing it in your storage layer its just a matter of time until you have an issue like this. It says a lot about the security of their api and development culture that they are even struggling with something like this. This should be caught in the first architecture review session.

How would any measures at storage layer prevent, for example, issues in caching?

Re: Klarna users are being signed in to random accounts

#59

Post by rrrhys »

dustinmoris wrote: post #4

I find the default Twitter response by the Klarna social media account really annoying. The issue is not a system disturbance. The issue is clearly in the whole implementation of the system itself, code which was written by developers and where something really stupid has been implemented and where security was not taken into account at all because an issue like this could have been prevented at so many layers and ye…

Whole implementation? It's probably the edge cache catching a cookie on the way out, a toggle box somewhere.

Re: Klarna users are being signed in to random accounts

#60

Post by flemhans »

tapland wrote: post #29
ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

There have been some weird legal cases in Sweden where businesses and scammers have been freed after having signed in using other people's "BankID" to change retirement savings around or send cash. Its the ID method I use for credits, pharmacies, health care, taxes, but was apparently not an ID so it's not id-hijacking. Klarna has man in the middled my bank account before and performed a purchase and I've boycotting…

In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs.

The same NemID is also used to file your taxes, look at all your health info, get married, everything basically.

Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you pay on.

Post reply on HN