Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

71–80 of 517 posts

Re: Klarna users are being signed in to random accounts

#71

Post by jan_Inkepa »

josteink wrote: post #14

Lots of times when I’ve been buying things in e-shops I’ve been offered to pay using Klarna as a payment broker. But doing so has always been more confusing for me compared to “regular” payments with a credit card anywhere else, and has on overall been a negative experience for me. I really don’t understand why anyone would prefer to use them at all. What am I missing? Can anyone help me understand?

They were also doing short-term loans [ https://www.bbc.com/news/business-56343942 ], which were for a while being pushed quite heavily in some internet community things I'm a part of.

Also, I figure they must be paying a lot of money to be the default payment provider on so many services.

For me, asking for my bank login details is...ridiculous - it'll be interesting to see if it is still following the same tactics in a few years.

Re: Klarna users are being signed in to random accounts

#72

Post by timdaub »

Sometime in the future, people will stop belittling crypto currencies when they realize that the digitization concepts of traditional finance technology providers are inferior to those of crypto currencies and blockchains. Putting safety and security first for anything that handles money makes sense.

The calls for "you don't need a blockchain, just use a database" will become less and less.

Edit: Of course, Hacker News hates this comment.

Re: Klarna users are being signed in to random accounts

#73

Post by dstergiou »

josteink wrote: post #14

Lots of times when I’ve been buying things in e-shops I’ve been offered to pay using Klarna as a payment broker. But doing so has always been more confusing for me compared to “regular” payments with a credit card anywhere else, and has on overall been a negative experience for me. I really don’t understand why anyone would prefer to use them at all. What am I missing? Can anyone help me understand?

You can get an invoice that you will pay later. Thus, you don't need to look for your credit card at the time of the purchase.

You can choose to pay at a later date

You can choose to split the payment into installments

Re: Klarna users are being signed in to random accounts

#74

Post by jagger27 »

jstummbillig wrote: post #53
ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

What could a competitively convenient way to do this better look like?

https://plaid.com/ does it well.

Re: Klarna users are being signed in to random accounts

#75

Post by [deleted] »

toxik wrote: post #27
K0nserv wrote: post #20

I suspect this might be request threading/confusion[0] issue similar to the one GitHub experienced a while back. This would explain why seemingly random user data is being returned. 0: https://github.blog/2021-03-18-how-we-found-and-fixed-a-rare...

We can only speculate, but what baffles me is that it happens for something so private, and for a company that is so rich. Do they not audit their code? Do they not risk assess these things? "Ah, storing user credentials in thread local storage, that sounds sane and bug-proof" said no auditor, ever.

[deleted]

Re: Klarna users are being signed in to random accounts

#76

Post by sneak »

There was that time that Dropbox let you log in to any account with any password, too.

I've never run a line of Dropbox code on any machine I own since that day. Even if you have no tests whatsoever on your app, you should have some basic smoke tests on your auth system.

Re: Klarna users are being signed in to random accounts

#77

Post by rbmks »

sneak wrote: post #65

> Hear hear, I used Klarna (not by choice) It was by choice. You weren't born with an account. Not taking personal responsibility for the rise of the ubiquity of these terrible online services (WhatsApp users, I'm looking at you) is a huge part of the problem. Pretending that you didn't opt-in is a lie you've told yourself; you shouldn't propagate that lie to others in society.

In principle I agree, but you can be tricked into using Klarna. However, in Europe you should be able to cancel the order without reasons.

Re: Klarna users are being signed in to random accounts

#78

Post by junon »

timdaub wrote: post #72

Sometime in the future, people will stop belittling crypto currencies when they realize that the digitization concepts of traditional finance technology providers are inferior to those of crypto currencies and blockchains. Putting safety and security first for anything that handles money makes sense. The calls for "you don't need a blockchain, just use a database" will become less and less. Edit: Of course, Hacker Ne…

Yes and we'll be screaming "please shut off your computer" because of all of the excess heat and insane power bills.

Re: Klarna users are being signed in to random accounts

#79

Post by andersco »

My email includes a common Swedish first name so I regularly have people mistakenly use my email address for Klarna orders. What’s most annoying/troubling is that, at least last time I checked, they don’t verify an address before sending invoices, etc. so I end up with other people’s order info in my inbox. I finally started unsubscribing from notifications for orders that weren’t mine.

Re: Klarna users are being signed in to random accounts

#80

Post by speedgoose »

sublimefire wrote: post #39

Junior dev was facing a dilemma. Before pushing to production please finish this code and choose the id you want to use: "select * from users where id = ?" > user_id > profile_id > user_profile_id > profile_user_id > id > rand()

I don't think it's nice to make fun of beginners in our industry.
Post reply on HN