Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

91–100 of 517 posts

Re: Klarna users are being signed in to random accounts

#91

Post by timdaub »

rad_gruchalski wrote: post #89
timdaub wrote: post #72

Sometime in the future, people will stop belittling crypto currencies when they realize that the digitization concepts of traditional finance technology providers are inferior to those of crypto currencies and blockchains. Putting safety and security first for anything that handles money makes sense. The calls for "you don't need a blockchain, just use a database" will become less and less. Edit: Of course, Hacker Ne…

Because it’s totally unrelated to the problem Klarna is facing. What does authentication / authorisation have to do with financial system...

Get your vocabulary right. Klarna is having an authorization problem not an authentication one.

Re: Klarna users are being signed in to random accounts

#92

Post by bierjunge »

ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

I have the same sketchy feeling about Sofortüberweisung/Klarna. If they want to make transactions on my behalf, why should I give them full access to my account?

Most banks have a paragraph in their contracts/ToS forbidding sharing the account with third parties, but they are rarely enforcing it. Still, they could close the account due to contract/ToS violation.

Re: Klarna users are being signed in to random accounts

#93

Post by def_true_false »

jan_Inkepa wrote: post #71
josteink wrote: post #14

Lots of times when I’ve been buying things in e-shops I’ve been offered to pay using Klarna as a payment broker. But doing so has always been more confusing for me compared to “regular” payments with a credit card anywhere else, and has on overall been a negative experience for me. I really don’t understand why anyone would prefer to use them at all. What am I missing? Can anyone help me understand?

They were also doing short-term loans [ https://www.bbc.com/news/business-56343942 ], which were for a while being pushed quite heavily in some internet community things I'm a part of. Also, I figure they must be paying a lot of money to be the default payment provider on so many services. For me, asking for my bank login details is...ridiculous - it'll be interesting to see if it is still following the same tactics…

> asking for my bank login details is...ridiculous

Is there more information on this? Are they doing the same thing Plaid does in the US? That is, literally asking for user credentials to internet banking instead of using the banks' proper APIs?

Re: Klarna users are being signed in to random accounts

#94

Post by vesinisa »

Klarna is no stranger to criminally lax attitude towards data privacy and security. In Finland, they implemented a checkout flow based only on your SSN (personal ID number). By simply entering someone else's SSN (which is not hard to guess/pry) you can reveal anyone's official home address.

Further, they enable a "pay later by invoice" checkout flow, again by just knowing someone's SSN. Scammers use this to order items from web stores to automated pick-up lockers with someone's else's SSN for payment info. The victim usually only becomes aware about this activity when they start getting debt collection notices for unpaid invoices from multiple stores for thousands and thousands of euros. The debt collection process in Finland is famously unfair and harsh towards the supposed "debtor" (here: victim of fraud).

Unless the "debtor" (victim) actively opposes each and every individual collection, the cases will eventually end up in court with summary judgement. This will ruin the victim's credit rating, which has devastating results for just about all aspects of life. People are known to have collapsed under the burden of all this and ended up taking their own life.

Klarna's response to all this is that they want convenient checkout experience and some fraud is unavoidable. Although there are excellent technical means available to strongly identify users in Finland, they add a minor layer of inconvenience compared to just typing in your SSN. This is OK for Klarna since they give exactly zero fucks about security as long as they can make a little buck from it.

Re: Klarna users are being signed in to random accounts

#95

Post by e_proxus »

Translation:

Major technical breakdown at Klarna when customers saw other people's data - The Swedish Financial Supervisory Authority (FI) has contacted the company

Payment giant Klarna, which has 87 million customers globally, is currently experiencing major technical problems. Users of the company's app saw other customers' payments and personal data, before it was shut down completely. The supervisory authority Finansinspektionen, FI, has asked Klarna to explain what happened.

In its app, Klarna has major technical problems. It means that users were logged into other customers' accounts and thereby see sensitive data such as their payment and purchase history and postal address. Users were also able to see part of the bank details linked to Klarna, but not the full account number.

One of Di's journalists accessed an account belonging to "Elisabeth". When the app was reloaded, another customer's login became visible.

When customers logged in with their own bank ID, they accessed other people's accounts. Each time they refreshed the page on the app, they brought up the details of a new, seemingly random user. It is unclear whether customers have been able to shop with other people's money.

Klarna had a total of 87 million consumers worldwide at the end of 2020, but it's unclear how many of those have an account on the company's app. The technical breakdown also extends beyond Sweden's borders, with outraged reactions pouring in on Twitter from Klarna users in various countries.

Klarna has now closed the app, citing a service outage. The company's press officer Niklas Gillström will return to Di after a while with a written comment.

"We are currently experiencing disruptions in our systems caused by technical problems. We are doing our utmost to restore the system and our services to full capacity and apologize for any inconvenience this may cause our customers. We have currently blocked all logins to the app until we are sure the problem has been fully resolved."

Di continues to seek the company for follow-up questions on whether the technical problems are due to an internal breakdown or external influence, how seriously the company views the sharing of personal data between users and whether customers may now have accidentally traded with other people's money. Klarna has asked for a response.

The Swedish Financial Supervisory Authority, FI, which among other things is the supervisory authority for banks, states that it has been informed of the situation.

"We have contacted Klarna and asked them for an explanation of what has happened," says Karin Lundberg, head of the business area Banking, to Di.

At the moment, FI has no further comments, she adds.

Di also seeks the Privacy Protection Authority, IMY, formerly known as the Data Inspectorate, for comment.

IMY has the right to fine companies up to 4 percent of their global annual turnover for serious violations. In addition, Klarna could face civil litigation, not least in the US where it has 15 million users.

(Translated with www.DeepL.com/Translator)

Re: Klarna users are being signed in to random accounts

#96

Post by tialaramex »

jstummbillig wrote: post #53
ThePhysicist wrote: post #13

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials…

What could a competitively convenient way to do this better look like?

You can generically solve the problem of Alice giving David access to Bob's service on her behalf without giving Alice's credentials for Bob's service to David using stuff like OAuth2, this is already how lots of things work today.

In OAuth2 David only ends up with some token showing Alice authorised David to use this service on her behalf. Bob can tell David and Alice apart, and choose to restrict what David can do appropriately.

If Bob is particularly tired of this nonsense, and his customers like Alice keep giving David their credentials and then are surprised that doing so means Bob can't tell Alice and David apart, WebAuthn reifies it so that most users in Alice's position can now see where the problem is. When David tells Alice he needs her Yubikey to access Bob's service, it should occur to Alice that giving the Yubikey to David isn't a good idea because then she won't have it any more. Good.

Re: Klarna users are being signed in to random accounts

#97

Post by Aeolun »

sneak wrote: post #65

> Hear hear, I used Klarna (not by choice) It was by choice. You weren't born with an account. Not taking personal responsibility for the rise of the ubiquity of these terrible online services (WhatsApp users, I'm looking at you) is a huge part of the problem. Pretending that you didn't opt-in is a lie you've told yourself; you shouldn't propagate that lie to others in society.

Whatsapp was fantastic when it started. Right up until it was bought by facebook.

Re: Klarna users are being signed in to random accounts

#98

Post by rightbyte »

queuep wrote: post #25
josteink wrote: post #14

Lots of times when I’ve been buying things in e-shops I’ve been offered to pay using Klarna as a payment broker. But doing so has always been more confusing for me compared to “regular” payments with a credit card anywhere else, and has on overall been a negative experience for me. I really don’t understand why anyone would prefer to use them at all. What am I missing? Can anyone help me understand?

Not sure where you are located, but in Sweden, Klarna at the start (if I remember it correctly) only needed your 'personnummer'(social security number) to process payments. Now I think they manage to track your devices so I only have to enter my postal code, and then I just click purchase, and it's all done. They used to use really weird/dark patterns, to make you forget to pay and then pay huge fees to Klarna. Nowad…

Ye Klarna was really scammy early. Making their living on reminder fees.

Re: Klarna users are being signed in to random accounts

#100

Post by dustinmoris »

rrrhys wrote: post #59
dustinmoris wrote: post #4

I find the default Twitter response by the Klarna social media account really annoying. The issue is not a system disturbance. The issue is clearly in the whole implementation of the system itself, code which was written by developers and where something really stupid has been implemented and where security was not taken into account at all because an issue like this could have been prevented at so many layers and ye…

Whole implementation? It's probably the edge cache catching a cookie on the way out, a toggle box somewhere.

With all respect, I don't disagree with your assumption about a silly cache somewhere, but that is sort of my point, if such a severe privacy and security vulnerability can be introduced by a single toggle box somewhere then the architecture of their platform is hugely lacking IMHO. This is not a cat photo sharing platform but a fin-tech business and there should be more layers to security than a single toggle box.
Post reply on HN