5 ms·

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could

Their German counterpart, Sofortüberweisung, didn't properly blacklist test credentials given out by banks e.g. to developers in the beginning, so people could simply use those and pay for goods and services with fake accounts. For me there are so many red flags with all these services, as they basically "steal" your credentials to log into your online banking. And while they claim that they only use the credentials to make transfers they could as well look at all my other account data. I really wonder how such a scheme can be legal and how banks can allow this, as they normally tell people to never give their credentials to anyone. The situation of course recently improved with the mandated 2FA for logins and transfers, but still there are so many attack vectors in this model that it boggles my mind how it can still exist.

toxik 5y ago
Hear hear, I used Klarna (not by choice) and it surprised me they would feign being me in interactions with my bank. Exactly the type of behavior techies are trying to teach the older generations to NOT fall for. With this, we know that Klarna's software quality is papier-mâché level. I am happy I refused to let Klarna have my account authorization.
tapland 5y ago
There have been some weird legal cases in Sweden where businesses and scammers have been freed after having signed in using other people's "BankID" to change retirement savings around or send cash. Its the ID method I use for credits, pharmacies, health care, taxes, but was apparently not an ID so it's not id-hijacking. Klarna has man in the middled my bank account before and performed a purchase and I've boycotting any company having them as the only payment option since. OH, now I also remember Klarna adding credit in my name since they only needed my tax registered adress. I lived in a dorm so someone just used our public information to take out credits to order sneakers and could break into the crappy entry mailbox.
- flemhans 5y ago
  In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs. The same NemID is also used to file your taxes, look at all your health info, get married, everything basically. Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you pay on.
  - cra 5y ago
    Yeah, same way they have it in Sweden, it's called "BankID" and only a few banks are allowed to issue that
    - tapland 5y ago
      I've worked on BankID implementation and it was super smooth, good tools for testing and well documented. We didn't need to scam anyone though, just have them verify that they were a Swedish resident (had a valid Swedish SSN and we're the ones ordering) :D
    - 3np 5y ago
      Major distinction being that BankID is privately owned and operated, as opposed to state-run.
  - aenin 5y ago
    However it also forces everybody to use two factor authentication. On a whole population level I'd bet that's overall a positive tradeoff. And I believe you can also use sms + password for online transactions.
    - legulere 5y ago
      2FA is already mandatory by the PSD2 directive of the EU. I use my debit card as the second factor to access my bank account here in Germany via ChipTAN
    - flemhans 5y ago
- ekvilibrist 5y ago
  > There have been some weird legal cases in Sweden where businesses and scammers have been freed after having signed in using other people's "BankID" to change retirement savings around or send cash. As far as I know most, if not all, of these scams have been perpetrated against the elderly. All operations (authentication, signing) can be initiated remotely with just a personal ID number, so the typical scam meant calling up someone and claiming that "an authentication must be performed", and simultanously initiating a bank login session. If you can keep the victim on the phone and using the BankID app when you tell them, you could basically login and empty their bank accounts. This has been largely fixed using QR codes to initiate login requests for major internet banks (which means you have to be in front of the same screen now) and other clever workarounds. But it has also always been a fact that there will be a description saying what you are signing, in the app, so being careful you could easily avoid being scammed. I think its largely a great asset (BankID) but its never gonna be 100% tamper-proof without being seriously neutered.
corroclaro 5y ago
Klarna is actually its own bank these days so that doesn't really happen anymore. I think however many other payment providers operate this way still which is ridiculous. Then again, PSD2 API roll-out has been very ???
- tapland 5y ago
  It's happened wayyy into them being their own bank (at least until 2019 when I started boycotting them) They signed into users bank accounts, in other banks, to set up transfers (which also gives you all account statements).
  - corroclaro 5y ago
    Did not know! Guess being scummy doesn't stop because you get a license.
- lxgr 5y ago
  Is that true for all European banks though? I think they all need to have an API available at this point, but is Klarna using that in every instance (instead of their legacy creepy MITM scheme) already?
danpalmer 5y ago
Can you explain more about the credentials and online banking? I've used (and integrated with) Klarna in the UK and from what I've seen it's only really a payment method with merchants who you pay back by card later.
- tapland 5y ago
  In Sweden most people have an electronic way to identify themselves to their bank (BankID) and it is used by many services to verify your identity. It's extremely useful for any ID verification, but Klarna asks you to verify your identity towards them but when you open the app they have instead sent a request to identify with your bank, using your credentials.
- lxgr 5y ago
  Klarna provides many different financial services. They provide "pay by bank account" (which involves the mentioned MITMing of users' online banking accounts, unless Klarna is integrated with your bank via OAuth/PSD2, which is still not ubiquitous), but also installment payments/factoring and others.
jstummbillig 5y ago
What could a competitively convenient way to do this better look like?
- ThePhysicist 5y ago
  I think PSD2 is supposed to solve these problems with a less insane approach, but the rollout seems to be quit sluggish.
  - mping 5y ago
    Surprisingly, there are already integrations in my home country; I took a look at tink [1] some time ago (no affiliation whatsoever) and they look legit. I'm sure there are more SaaS like them. [1] https://docs.tink.com/market-capabilities/aggregation https://docs.tink.com/market-capabilities/aggregation
- jagger27 5y ago
  https://plaid.com/ https://plaid.com/ does it well.
  - lxgr 5y ago
    Don't they effectively do the exact same thing? As far as I know, they use screenscraping for most US banks rather than something OAuth-based.
    - jagger27 5y ago
      I think it depends on the bank. It's really up to the banks to provide a proper API.
- tialaramex 5y ago
  You can generically solve the problem of Alice giving David access to Bob's service on her behalf without giving Alice's credentials for Bob's service to David using stuff like OAuth2, this is already how lots of things work today. In OAuth2 David only ends up with some token showing Alice authorised David to use this service on her behalf. Bob can tell David and Alice apart, and choose to restrict what David can do appropriately. If Bob is particularly tired of this nonsense, and his customers like Alice keep giving David their credentials and then are surprised that doing so means Bob can't tell Alice and David apart, WebAuthn reifies it so that most users in Alice's position can now see where the problem is. When David tells Alice he needs her Yubikey to access Bob's service, it should occur to Alice that giving the Yubikey to David isn't a good idea because then she won't have it any more. Good.
spurgu 5y ago
Yeah I once had to make a ~20k transfer with Klarna and was shocked to see that they essentially hijacked my credentials. I only went through with it because there is additional 2FA (on my bank) so they wouldn't have been able to repeat it. But still a super shady practice. I was sweating for days until I got a confirmation that the transfer went through successfully. 1/5 experience.
rbmks 5y ago
I cancel every online order if I find out that it is handled by PayPal, Klarna, Mollie or other data collecting entities. The situation in Europe is so bad that you are sometimes tricked into a prepaid order only to find out that the invoice comes from one of those. The appropriate penalty is immediate cancellation and multiple GDPR requests.
- thomasikzelf 5y ago
  I looked through the terms of use and the privacy policy for Mollie and I don't think they are selling data. Do you have different information then I have?
bierjunge 5y ago
I have the same sketchy feeling about Sofortüberweisung/Klarna. If they want to make transactions on my behalf, why should I give them full access to my account? Most banks have a paragraph in their contracts/ToS forbidding sharing the account with third parties, but they are rarely enforcing it. Still, they could close the account due to contract/ToS violation.
- chopin 5y ago
  Worse, you're on the hook if your account is drained.
gpvos 5y ago
I understand that Sofort was allowed to continue despite using the user's bank credentials because disallowing them would be anticompetitive.[0] I have no idea how that could justify such an insecure practice, but there you have it. [0] https://knowledge.fintecsystems.com/en/blog/the-history-of-open-banking https://knowledge.fintecsystems.com/en/blog/the-history-of-o... , under "Legal Action by Giropay"
74d-fe6-2c6 5y ago
Have been using SÜ for years until I learned that they not just facilitate the transfer but abuse their role to dump bank transfer data worth several months. I don't use that service anymore.
- bschne 5y ago
  That sounds pretty bad! I always thought the login flow was super sketchy, but wasn't aware of this part — has this been covered/analyzed somewhere or is it evident from their terms or something?
  - 74d-fe6-2c6 5y ago
    I cannot answer this question satisfyingly. I read it somewhere and found tangential information by google search - but nothing very specific.
  - horstmeyer 5y ago
    Here is an article in German : https://www.sueddeutsche.de/geld/zahlung-per-sofortueberweisung-ein-klick-und-weg-sind-die-daten-1.1103403 https://www.sueddeutsche.de/geld/zahlung-per-sofortueberweis...
tgsovlerkhgsel 5y ago
Sofortüberweisung specifically got caught looking at 30 days of transaction data. > how banks can allow this A court decided that blocking this "business model" would be anticompetitive.
- horstmeyer 5y ago
  Do you have sources on them looking at transaction data please? That is clearly not necessary for processing the payment. Edit: Found an article in German - https://www.sueddeutsche.de/geld/zahlung-per-sofortueberweisung-ein-klick-und-weg-sind-die-daten-1.1103403 https://www.sueddeutsche.de/geld/zahlung-per-sofortueberweis... They claim they need to do this to make sure there is sufficient money in the account, even with transactions that might not be reflected in the balance, and they also check for other "Sofortüberweisungen" to detect fraud. Makes sense in a way but still quite shady. If there wasn't enough money in my account, or other transfers pending would my bank even allow their transfer?

toxik 5y ago

Hear hear, I used Klarna (not by choice) and it surprised me they would feign being me in interactions with my bank. Exactly the type of behavior techies are trying to teach the older generations to NOT fall for. With this, we know that Klarna's software quality is papier-mâché level. I am happy I refused to let Klarna have my account authorization.

tapland 5y ago

There have been some weird legal cases in Sweden where businesses and scammers have been freed after having signed in using other people's "BankID" to change retirement savings around or send cash. Its the ID method I use for credits, pharmacies, health care, taxes, but was apparently not an ID so it's not id-hijacking. Klarna has man in the middled my bank account before and performed a purchase and I've boycotting any company having them as the only payment option since. OH, now I also remember Klarna adding credit in my name since they only needed my tax registered adress. I lived in a dorm so someone just used our public information to take out credits to order sneakers and could break into the crappy entry mailbox.

flemhans 5y ago
In Denmark, you're forced to use the state-run "NemID" for credit card payments, making for some weird situations where you authenticate with NemID inside iframes on shady URLs. The same NemID is also used to file your taxes, look at all your health info, get married, everything basically. Credit card payments are much lower security level, and they're basically forcing sharing credentials amongst all the sites you pay on.
- cra 5y ago
  Yeah, same way they have it in Sweden, it's called "BankID" and only a few banks are allowed to issue that
  - tapland 5y ago
    I've worked on BankID implementation and it was super smooth, good tools for testing and well documented. We didn't need to scam anyone though, just have them verify that they were a Swedish resident (had a valid Swedish SSN and we're the ones ordering) :D
  - 3np 5y ago
    Major distinction being that BankID is privately owned and operated, as opposed to state-run.
- aenin 5y ago
  However it also forces everybody to use two factor authentication. On a whole population level I'd bet that's overall a positive tradeoff. And I believe you can also use sms + password for online transactions.
  - legulere 5y ago
    2FA is already mandatory by the PSD2 directive of the EU. I use my debit card as the second factor to access my bank account here in Germany via ChipTAN
  - flemhans 5y ago
ekvilibrist 5y ago
> There have been some weird legal cases in Sweden where businesses and scammers have been freed after having signed in using other people's "BankID" to change retirement savings around or send cash. As far as I know most, if not all, of these scams have been perpetrated against the elderly. All operations (authentication, signing) can be initiated remotely with just a personal ID number, so the typical scam meant calling up someone and claiming that "an authentication must be performed", and simultanously initiating a bank login session. If you can keep the victim on the phone and using the BankID app when you tell them, you could basically login and empty their bank accounts. This has been largely fixed using QR codes to initiate login requests for major internet banks (which means you have to be in front of the same screen now) and other clever workarounds. But it has also always been a fact that there will be a description saying what you are signing, in the app, so being careful you could easily avoid being scammed. I think its largely a great asset (BankID) but its never gonna be 100% tamper-proof without being seriously neutered.

corroclaro 5y ago

Klarna is actually its own bank these days so that doesn't really happen anymore. I think however many other payment providers operate this way still which is ridiculous. Then again, PSD2 API roll-out has been very ???

tapland 5y ago
It's happened wayyy into them being their own bank (at least until 2019 when I started boycotting them) They signed into users bank accounts, in other banks, to set up transfers (which also gives you all account statements).
- corroclaro 5y ago
  Did not know! Guess being scummy doesn't stop because you get a license.
lxgr 5y ago
Is that true for all European banks though? I think they all need to have an API available at this point, but is Klarna using that in every instance (instead of their legacy creepy MITM scheme) already?

danpalmer 5y ago

Can you explain more about the credentials and online banking? I've used (and integrated with) Klarna in the UK and from what I've seen it's only really a payment method with merchants who you pay back by card later.

tapland 5y ago
In Sweden most people have an electronic way to identify themselves to their bank (BankID) and it is used by many services to verify your identity. It's extremely useful for any ID verification, but Klarna asks you to verify your identity towards them but when you open the app they have instead sent a request to identify with your bank, using your credentials.
lxgr 5y ago
Klarna provides many different financial services. They provide "pay by bank account" (which involves the mentioned MITMing of users' online banking accounts, unless Klarna is integrated with your bank via OAuth/PSD2, which is still not ubiquitous), but also installment payments/factoring and others.

jstummbillig 5y ago

What could a competitively convenient way to do this better look like?

ThePhysicist 5y ago
I think PSD2 is supposed to solve these problems with a less insane approach, but the rollout seems to be quit sluggish.
- mping 5y ago
  Surprisingly, there are already integrations in my home country; I took a look at tink [1] some time ago (no affiliation whatsoever) and they look legit. I'm sure there are more SaaS like them. [1] https://docs.tink.com/market-capabilities/aggregation https://docs.tink.com/market-capabilities/aggregation
jagger27 5y ago
https://plaid.com/ https://plaid.com/ does it well.
- lxgr 5y ago
  Don't they effectively do the exact same thing? As far as I know, they use screenscraping for most US banks rather than something OAuth-based.
  - jagger27 5y ago
    I think it depends on the bank. It's really up to the banks to provide a proper API.
tialaramex 5y ago
You can generically solve the problem of Alice giving David access to Bob's service on her behalf without giving Alice's credentials for Bob's service to David using stuff like OAuth2, this is already how lots of things work today. In OAuth2 David only ends up with some token showing Alice authorised David to use this service on her behalf. Bob can tell David and Alice apart, and choose to restrict what David can do appropriately. If Bob is particularly tired of this nonsense, and his customers like Alice keep giving David their credentials and then are surprised that doing so means Bob can't tell Alice and David apart, WebAuthn reifies it so that most users in Alice's position can now see where the problem is. When David tells Alice he needs her Yubikey to access Bob's service, it should occur to Alice that giving the Yubikey to David isn't a good idea because then she won't have it any more. Good.

spurgu 5y ago

Yeah I once had to make a ~20k transfer with Klarna and was shocked to see that they essentially hijacked my credentials. I only went through with it because there is additional 2FA (on my bank) so they wouldn't have been able to repeat it. But still a super shady practice. I was sweating for days until I got a confirmation that the transfer went through successfully. 1/5 experience.

rbmks 5y ago

I cancel every online order if I find out that it is handled by PayPal, Klarna, Mollie or other data collecting entities. The situation in Europe is so bad that you are sometimes tricked into a prepaid order only to find out that the invoice comes from one of those. The appropriate penalty is immediate cancellation and multiple GDPR requests.

thomasikzelf 5y ago
I looked through the terms of use and the privacy policy for Mollie and I don't think they are selling data. Do you have different information then I have?

bierjunge 5y ago

I have the same sketchy feeling about Sofortüberweisung/Klarna. If they want to make transactions on my behalf, why should I give them full access to my account? Most banks have a paragraph in their contracts/ToS forbidding sharing the account with third parties, but they are rarely enforcing it. Still, they could close the account due to contract/ToS violation.

chopin 5y ago
Worse, you're on the hook if your account is drained.

gpvos 5y ago

I understand that Sofort was allowed to continue despite using the user's bank credentials because disallowing them would be anticompetitive.[0] I have no idea how that could justify such an insecure practice, but there you have it. [0] https://knowledge.fintecsystems.com/en/blog/the-history-of-open-banking https://knowledge.fintecsystems.com/en/blog/the-history-of-o... , under "Legal Action by Giropay"

74d-fe6-2c6 5y ago

Have been using SÜ for years until I learned that they not just facilitate the transfer but abuse their role to dump bank transfer data worth several months. I don't use that service anymore.

bschne 5y ago
That sounds pretty bad! I always thought the login flow was super sketchy, but wasn't aware of this part — has this been covered/analyzed somewhere or is it evident from their terms or something?
- 74d-fe6-2c6 5y ago
  I cannot answer this question satisfyingly. I read it somewhere and found tangential information by google search - but nothing very specific.
- horstmeyer 5y ago
  Here is an article in German : https://www.sueddeutsche.de/geld/zahlung-per-sofortueberweisung-ein-klick-und-weg-sind-die-daten-1.1103403 https://www.sueddeutsche.de/geld/zahlung-per-sofortueberweis...

tgsovlerkhgsel 5y ago

Sofortüberweisung specifically got caught looking at 30 days of transaction data. > how banks can allow this A court decided that blocking this "business model" would be anticompetitive.

horstmeyer 5y ago
Do you have sources on them looking at transaction data please? That is clearly not necessary for processing the payment. Edit: Found an article in German - https://www.sueddeutsche.de/geld/zahlung-per-sofortueberweisung-ein-klick-und-weg-sind-die-daten-1.1103403 https://www.sueddeutsche.de/geld/zahlung-per-sofortueberweis... They claim they need to do this to make sure there is sufficient money in the account, even with transactions that might not be reflected in the balance, and they also check for other "Sofortüberweisungen" to detect fraud. Makes sense in a way but still quite shady. If there wasn't enough money in my account, or other transfers pending would my bank even allow their transfer?