News for hackers. Stuff that matters.

A comment on Klarna users are being signed in to random accounts. Parent comment

Re:Klarna users are being signed in to random accounts by flemhans on Thursday May 27, 2021 @07:18AM (#27301598)
In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs.

The same NemID is also used to file your taxes, look at all your health info, get married, everything basically.

Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you pay on.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by aenin on Thursday May 27, 2021 @07:29AM (#27301702)
However it also forces everybody to use two factor authentication. On a whole population level I'd bet that's overall a positive tradeoff.

And I believe you can also use sms + password for online transactions.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by legulere on Thursday May 27, 2021 @08:06AM (#27302013)
2FA is already mandatory by the PSD2 directive of the EU. I use my debit card as the second factor to access my bank account here in Germany via ChipTAN
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by flemhans on Thursday May 27, 2021 @05:50PM (#27309007)
SMS + password works for some Mastercards still but not Visa.

I don't think it's good that users are taught to accept their primary citizen 2FA on any random website and app where the URL doesn't even show.

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by cra on Thursday May 27, 2021 @07:23AM (#27301650)
Yeah, same way they have it in Sweden, it's called "BankID" and only a few banks are allowed to issue that
[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by tapland on Thursday May 27, 2021 @07:32AM (#27301727)
I've worked on BankID implementation and it was super smooth, good tools for testing and well documented.

We didn't need to scam anyone though, just have them verify that they were a Swedish resident (had a valid Swedish SSN and we're the ones ordering) :D

[ Parent | on HN ]
Re:Klarna users are being signed in to random accounts by 3np on Thursday May 27, 2021 @11:09AM (#27304028)
Major distinction being that BankID is privately owned and operated, as opposed to state-run.
[ Parent | on HN ]