Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

81–90 of 517 posts

Re: Klarna users are being signed in to random accounts

#81

Post by timdaub »

junon wrote: post #78
timdaub wrote: post #72

Sometime in the future, people will stop belittling crypto currencies when they realize that the digitization concepts of traditional finance technology providers are inferior to those of crypto currencies and blockchains. Putting safety and security first for anything that handles money makes sense. The calls for "you don't need a blockchain, just use a database" will become less and less. Edit: Of course, Hacker Ne…

Yes and we'll be screaming "please shut off your computer" because of all of the excess heat and insane power bills.

Why not separate concerns? Crypto currencies work without Proof of Work today.

Re: Klarna users are being signed in to random accounts

#82

Post by matsemann »

generic_dev_47 wrote: post #23

I worked in a project over 10 years ago where something very similar happened! We had built and authentication service that, among other things, was used by a SyncML service that was used back in the day of feature phones to syncs contacts etc. You can imagine that getting someone else's contacts on your phone isn't exactly ideal. This was how we came to know about the problem, from customers getting other customers…

Something similar happened a few years ago in Norway, when the yearly tax returns were released. Everyone of course logs in at the same time. It goes down, and the cache serves someone else's data instead.

Re: Klarna users are being signed in to random accounts

#83

Post by Freak_NL »

whizzter wrote: post #41
josteink wrote: post #14

Lots of times when I’ve been buying things in e-shops I’ve been offered to pay using Klarna as a payment broker. But doing so has always been more confusing for me compared to “regular” payments with a credit card anywhere else, and has on overall been a negative experience for me. I really don’t understand why anyone would prefer to use them at all. What am I missing? Can anyone help me understand?

They incentivize e-tailers by offering higher conversion rates(later) as well as taking the hit for fraudulent payments (often with regular CC billing an e-tailer can be liable for repayments) in exchange for a slightly higher percentage. Once someone comes to their checkout they hide or at least make the direct payment options well hidden so that by default people buy by taking credit with them. This credit often co…

Klarna is really shady. It encourages a 'buy now, pay later' mentality, which may be convenient right there and then, but it creates an unhealthy style of shopping:

https://www.theguardian.com/money/2018/nov/17/klarna-buy-now...

It's Payday Loans 2.0.

It's really disturbing to see Klarna as a payment option in many Dutch online shops. These always already have iDEAL (which the vast majority of customers use), a convenient way of doing an electronic bank transfer; and most shops support credit cards too.

Re: Klarna users are being signed in to random accounts

#84

Post by aenin »

flemhans wrote: post #60
tapland wrote: post #29

Earlier quoted context omitted.

There have been some weird legal cases in Sweden where businesses and scammers have been freed after having signed in using other people's "BankID" to change retirement savings around or send cash. Its the ID method I use for credits, pharmacies, health care, taxes, but was apparently not an ID so it's not id-hijacking. Klarna has man in the middled my bank account before and performed a purchase and I've boycotting…

In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs. The same NemID is also used to file your taxes, look at all your health info, get married, everything basically. Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you p…

However it also forces everybody to use two factor authentication. On a whole population level I'd bet that's overall a positive tradeoff.

And I believe you can also use sms + password for online transactions.

Re: Klarna users are being signed in to random accounts

#85

Post by AtNightWeCode »

corroclaro wrote: post #56
AtNightWeCode wrote: post #48

Will be interesting to see what the problem is here. From what I have seen in real life my top guesses are. Some dependency on static variables in code. Reversed proxy with incorrect cache rules that ignores headers or some parameter.

How do you envision the static variables thing? I've seen the cache thing myself in real life but not the other.

In C# for instance. If you mark a field static it is the same for all instances of a class (if you don't mark the code as thread static). So if you have static User field that changes on logon it will change for everyone. I have seen this but typically more complicated versions of it.

Re: Klarna users are being signed in to random accounts

#87

Post by jiofih »

queuep wrote: post #25
josteink wrote: post #14

Lots of times when I’ve been buying things in e-shops I’ve been offered to pay using Klarna as a payment broker. But doing so has always been more confusing for me compared to “regular” payments with a credit card anywhere else, and has on overall been a negative experience for me. I really don’t understand why anyone would prefer to use them at all. What am I missing? Can anyone help me understand?

Not sure where you are located, but in Sweden, Klarna at the start (if I remember it correctly) only needed your 'personnummer'(social security number) to process payments. Now I think they manage to track your devices so I only have to enter my postal code, and then I just click purchase, and it's all done. They used to use really weird/dark patterns, to make you forget to pay and then pay huge fees to Klarna. Nowad…

iDeal is smooth enough. Hoping this dystopian future does not come to the rest of the EU.

Re: Klarna users are being signed in to random accounts

#88

Post by tapland »

cra wrote: post #69
flemhans wrote: post #60

Earlier quoted context omitted.

In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs. The same NemID is also used to file your taxes, look at all your health info, get married, everything basically. Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you p…

Yeah, same way they have it in Sweden, it's called "BankID" and only a few banks are allowed to issue that

I've worked on BankID implementation and it was super smooth, good tools for testing and well documented.

We didn't need to scam anyone though, just have them verify that they were a Swedish resident (had a valid Swedish SSN and we're the ones ordering) :D

Re: Klarna users are being signed in to random accounts

#89

Post by rad_gruchalski »

timdaub wrote: post #72

Sometime in the future, people will stop belittling crypto currencies when they realize that the digitization concepts of traditional finance technology providers are inferior to those of crypto currencies and blockchains. Putting safety and security first for anything that handles money makes sense. The calls for "you don't need a blockchain, just use a database" will become less and less. Edit: Of course, Hacker Ne…

Because it’s totally unrelated to the problem Klarna is facing. What does authentication / authorisation have to do with financial system...

Re: Klarna users are being signed in to random accounts

#90

Post by mewpmewp2 »

diveanon wrote: post #16

If you rely on your application layer to enforce data privacy instead of enforcing it in your storage layer its just a matter of time until you have an issue like this. It says a lot about the security of their api and development culture that they are even struggling with something like this. This should be caught in the first architecture review session.

Out of curiosity, how is that enforcement usually done? I have usually just used some SQL database like MySQL/Postgres, and having application determine how to fetch data, so application has access to everything. I can see how this could be insecure due to some bug in application code fetching with wrong WHERE etc, how would one go about enforcing it on sql/database layer?

Would you have separate SQL credentials for each user, and configure SQL for each credential to have access to certain WHERE queries, or?

To simplify a use-case let's say I have "users" table and "tasks" table, where there's user_id in "tasks". Would I have separate sql credentials where they are configured in sql layer to have access to only rows where user_id corresponds to this certain credential? But even then how are credentials mapped to userId, as bug in application could easily cause retrieving false credentials?

Other way I can think of is to just have completely separate databases for each user, but let's in this case assume we must often do work with a mix of different users data.

Post reply on HN