Sony: All personal data stolen from PSN • Hacker News Board

Re: Sony: All personal data stolen from PSN

#51

Post by r00fus » Tue, Apr 26, 2011, 8:46 PM UTC

blhack wrote: post #47

Wow this sounds really really bad. As much as I dislike sony's actions in the Geohot case, and as much as "this is what you get for failing at security", I feel pretty bad for them right now (and even worse for all of their customers) >To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit reports. >We have…

I fail to see why Sony should be pitied, unless the details of the attack are laid out, and Sony shows that it was following good security practice.

I see neither disclosure happening any time soon.

Re: Sony: All personal data stolen from PSN

#52

Post by dman » Tue, Apr 26, 2011, 8:46 PM UTC

nathanb wrote: post #43

city41 wrote: post #36

Earlier quoted context omitted.

People want to play God of War, Little Big Planet and Gran Turismo. I think Sony could do just about anything and stay in business. As sad as that is, it's probably true.

I know, right? Reading through the comments on that post, the "you should have told us this last week" comments are just about balanced out by the "why are you wasting time with this instead of getting the PSN back online" comments.

Different folks seem to value privacy very differently.

Re: Sony: All personal data stolen from PSN

#53

Post by rm445 » Tue, Apr 26, 2011, 8:47 PM UTC

norova wrote: post #8

FTA: we believe that an unauthorized person has obtained the following information that you provided: ...PlayStation Network/Qriocity password and login... I'm curious if this means they store everyone's password in plain-text, or if by "password" they really mean a hash of some sort.

Good question. When you reset your PSN password, they send you a link, rather than your password in plaintext, which at least hints they were doing the right thing. But who knows.

Re: Sony: All personal data stolen from PSN

#54

Post by [deleted] » Tue, Apr 26, 2011, 8:47 PM UTC

[deleted]

Re: Sony: All personal data stolen from PSN

#55

Post by ansy » Tue, Apr 26, 2011, 8:47 PM UTC

lotusleaf1987 wrote: post #10

Thanks for waiting a week to tell me my credit card info has been stolen Sony. I am not a big fan of MSFT usually, but the next time I am buying a console I'm not buying a PS4.

The article says there is no evidence credit card information was accessed.

Re: Sony: All personal data stolen from PSN

#56

Post by marshray » Tue, Apr 26, 2011, 8:47 PM UTC

jzila wrote: post #40

norova wrote: post #8

FTA: we believe that an unauthorized person has obtained the following information that you provided: ...PlayStation Network/Qriocity password and login... I'm curious if this means they store everyone's password in plain-text, or if by "password" they really mean a hash of some sort.

This would be such an incredibly stupid security failure. Passwords should always be salted and hashed. Credit card info should always be HSM-protected so that it is irretrievable except through a hardware API. What was Sony thinking!?

Credit card info should always be HSM-protected so that it is irretrievable except through a hardware API.

How could you suggest such a thing?! That would have cost Sony thousands of dollars extra!

Re: Sony: All personal data stolen from PSN

#57

Post by unexpected » Tue, Apr 26, 2011, 8:48 PM UTC

This is unreal. What bothers me the most, is that when this happened to me one time before, that particular company paid for a year of credit monitoring services.

In this case, Sony is too cheap to do even that, pointing you towards where you could download your credit report online. Ridiculous.

Re: Sony: All personal data stolen from PSN

#58

Post by GrandMasterBirt » Tue, Apr 26, 2011, 8:48 PM UTC

nathanb wrote: post #43

city41 wrote: post #36

Earlier quoted context omitted.

People want to play God of War, Little Big Planet and Gran Turismo. I think Sony could do just about anything and stay in business. As sad as that is, it's probably true.

I know, right? Reading through the comments on that post, the "you should have told us this last week" comments are just about balanced out by the "why are you wasting time with this instead of getting the PSN back online" comments.

The problem is audience:

Kids don't give a shit. Privacy is crap, they got their penis pictures on facebook. They want their fucking video games.

People playing games all day don't give a shit. They want their fucking games, stfu privacy and get moar kof33 and fucking get this shit online.

People with money to lose care. They care that their information is stolen because that could lead to their money being stolen.

People who know the value of information care. Thats few people though, since facebook exists.

In the end of the day people are willing to talk shit, when it comes to action that is a different story. How many people were so against EA's rootkits, but how many actually boycotted? Same with Apple? And now its same with Sony. Nobody will do anything. Nobody will boycott, the company will just shrug this off as an "opse".

Re: Sony: All personal data stolen from PSN

#59

Post by alexknight » Tue, Apr 26, 2011, 8:49 PM UTC

While I don't know the details of how this happened, it's a sure fire bet that they were not doing something right when it came to securing their infrastructure. How many times have we heard of big name companies running un-patched operating systems and SQL databases or even weak passwords? From the consumer end, this really sucks. Especially if their personal data was compromised.

Re: Sony: All personal data stolen from PSN

#60

Post by aeontech » Tue, Apr 26, 2011, 8:49 PM UTC

Does anyone else find it odd that they "strongly recommend that you log on and change your password" instead of just force-resetting everyone's password and sending them an email with an activation link? Out of 60M subscribers, I'm certain that a large proportion will never see this message.