Klarna users are being signed in to random accounts

Re:Klarna users are being signed in to random accounts by K0nserv on Thursday May 27, 2021 @07:01AM (#27301456)

I suspect this might be request threading/confusion[0] issue similar to the one GitHub experienced a while back. This would explain why seemingly random user data is being returned.

0: https://github.blog/2021-03-18-how-we-found-and-fixed-a-rare...

[ Parent | on HN ]

Re:Klarna users are being signed in to random accounts by toxik on Thursday May 27, 2021 @07:04AM (#27301479)

We can only speculate, but what baffles me is that it happens for something so private, and for a company that is so rich. Do they not audit their code? Do they not risk assess these things? "Ah, storing user credentials in thread local storage, that sounds sane and bug-proof" said no auditor, ever.

[ Parent | on HN ]

Re:Klarna users are being signed in to random accounts by corroclaro on Thursday May 27, 2021 @07:12AM (#27301557)

IIRC, Klarna is mostly written in Erlang, Scala and some parts in Clojure.

If someone should be aware of thread-local storage and its implication it ought to be them.

[ Parent | on HN ]

Re:Klarna users are being signed in to random accounts by K0nserv on Thursday May 27, 2021 @07:16AM (#27301582)

I was under the impression that they had switched to Java more in recent years

[ Parent | on HN ]

Re:Klarna users are being signed in to random accounts by def_true_false on Thursday May 27, 2021 @07:41AM (#27301808)

Using trendy tech doesn't solve much by itself. Especially if you can't (or don't) compete with FAANG on compensation.

[ Parent | on HN ]

Re:Klarna users are being signed in to random accounts by sidebits on Thursday May 27, 2021 @10:01AM (#27303224)

This has changed many years ago.

[ Parent | on HN ]