Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

61–70 of 517 posts

Re: Klarna users are being signed in to random accounts

#61

Post by adflux »

corroclaro wrote: post #56
AtNightWeCode wrote: post #48

Will be interesting to see what the problem is here. From what I have seen in real life my top guesses are. Some dependency on static variables in code. Reversed proxy with incorrect cache rules that ignores headers or some parameter.

How do you envision the static variables thing? I've seen the cache thing myself in real life but not the other.

Store user in static variable during processing data, then forget to clear the variable when you are done, so for the next request it still has access to the old data?

Re: Klarna users are being signed in to random accounts

#62

Post by mrweasel »

Klarna is a weird company. Last I interacted with them it was clear that they are completely designed to operate within Sweden, but have no idea of how to deal with the outside world. Maybe that have changed.

I talked to Klarna maybe 10 years ago. One of the things I wanted to know was how they dealt with abuse in Sweden, given you just need the social security number of a person and then you can do purchase as that person, and Swedish SSNs are not secret.

The friendly Klarna rep. had no idea what I meant, as you could only get stuff delivered to the address associated with the SSN. Based on how that would be abused in Denmark we suggested ordering a box of random sex toys to any random person in Sweden. The only answer I got was "Why would anyone do that?"

It took less than six month for Klarna to start asking us to block addresses, because they had no way to prevent abuse.

Re: Klarna users are being signed in to random accounts

#63

Post by tapland »

danpalmer wrote: post #47
ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

Can you explain more about the credentials and online banking? I've used (and integrated with) Klarna in the UK and from what I've seen it's only really a payment method with merchants who you pay back by card later.

In Sweden most people have an electronic way to identify themselves to their bank (BankID) and it is used by many services to verify your identity.

It's extremely useful for any ID verification, but Klarna asks you to verify your identity towards them but when you open the app they have instead sent a request to identify with your bank, using your credentials.

Re: Klarna users are being signed in to random accounts

#64

Post by ThePhysicist »

jstummbillig wrote: post #53
ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

What could a competitively convenient way to do this better look like?

I think PSD2 is supposed to solve these problems with a less insane approach, but the rollout seems to be quit sluggish.

Re: Klarna users are being signed in to random accounts

#65

Post by sneak »

> Hear hear, I used Klarna (not by choice)

It was by choice. You weren't born with an account.

Not taking personal responsibility for the rise of the ubiquity of these terrible online services (WhatsApp users, I'm looking at you) is a huge part of the problem. Pretending that you didn't opt-in is a lie you've told yourself; you shouldn't propagate that lie to others in society.

Re: Klarna users are being signed in to random accounts

#66

Post by purjolok »

josteink wrote: post #14

Lots of times when I’ve been buying things in e-shops I’ve been offered to pay using Klarna as a payment broker. But doing so has always been more confusing for me compared to “regular” payments with a credit card anywhere else, and has on overall been a negative experience for me. I really don’t understand why anyone would prefer to use them at all. What am I missing? Can anyone help me understand?

With Klarna you just need to type some information most people know by heart (10 digit ID number, f.ex.) before the order is confirmed. This is convenient if one wants to buy something quickly from a mobile phone. The address will oftenalso be prefilled. A credit card number is much more cumbersome to type on a small device, and the address needs to be typed in separately.

Some banks used to require people to log into their banks to temporarily unlock their card for internet shopping, or, nowadays, one also needs to authenticate the purchase with the bank. That adds extra friction.

With Klarna one does not need to pay until 14 days after the goods are shipped. Credit cards are even better, but most people tend to just have a debit card. With Klarna they don't need to worry about spending too much money from the account and having some other payment bounce later on.

I personally stopped using them after I fell for one of their dark patterns and bought something on credit, which incurred an extra fee. Legally I was entitled to cancel the credit purchase, pay the full amount and avoid the fee; but I was still annoyed.

Re: Klarna users are being signed in to random accounts

#67

Post by def_true_false »

josteink wrote: post #14

Lots of times when I’ve been buying things in e-shops I’ve been offered to pay using Klarna as a payment broker. But doing so has always been more confusing for me compared to “regular” payments with a credit card anywhere else, and has on overall been a negative experience for me. I really don’t understand why anyone would prefer to use them at all. What am I missing? Can anyone help me understand?

Same experience here. I assume it works better in Sweden, but I have no idea why someone with customers outside Sweden would want to use this.

One e-shop I use regularly switched to Klarna and the whole checkout experience got much worse. Simple forms replaced by broken interactive ones, etc. It's still not better than the old UX, even after multiple iterations. I'm more reluctant to enter CC info than before, for what that's worth.

Re: Klarna users are being signed in to random accounts

#68

Post by rbmks »

ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

I cancel every online order if I find out that it is handled by PayPal, Klarna, Mollie or other data collecting entities.

The situation in Europe is so bad that you are sometimes tricked into a prepaid order only to find out that the invoice comes from one of those.

The appropriate penalty is immediate cancellation and multiple GDPR requests.

Re: Klarna users are being signed in to random accounts

#69

Post by cra »

flemhans wrote: post #60
tapland wrote: post #29

Earlier quoted context omitted.

There have been some weird legal cases in Sweden where businesses and scammers have been freed after having signed in using other people's "BankID" to change retirement savings around or send cash. Its the ID method I use for credits, pharmacies, health care, taxes, but was apparently not an ID so it's not id-hijacking. Klarna has man in the middled my bank account before and performed a purchase and I've boycotting…

In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs. The same NemID is also used to file your taxes, look at all your health info, get married, everything basically. Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you p…

Yeah, same way they have it in Sweden, it's called "BankID" and only a few banks are allowed to issue that
Post reply on HN