101–110 of 292 posts
Giant Bomb is reporting that passwords are supposedly secure (of course, "no way" is clearly false), so I'm guessing there's at least a decent salted hash: http://www.giantbomb.com/news/good-news-psn-back-maybe-withi...
Earlier quoted context omitted.
It really looks like the PSN architecture assumed that the clients were trustworthy. If so, that's an epic Security 101 fail.
And they used the same servers for development as for production. Isn't that non-PCI-compliant?
This is unreal. What bothers me the most, is that when this happened to me one time before, that particular company paid for a year of credit monitoring services. In this case, Sony is too cheap to do even that, pointing you towards where you could download your credit report online. Ridiculous.
Earlier quoted context omitted.
"I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death." Banks, colleges, hospitals, and credit card processors do this all the time, and it doesn't cost them anywhere near a billion dollars despite the fact that they have vastly more personal information. Sure they usually only have a few hundred thousand records and not a few million…
I would argue the cost of the RRoD was a heck of a lot more than $1B because of all the lost sales. People didn't want to invest in hardware that was going to break 5 times over. The direct damage from this won't be $1B (still tens of millions at least). But what about the impact of the lost sales and customers from the loss in credibility and trust? That is what could be huge. It was relatively "easy" for Microsoft…
Agreed. Microsoft only wrote down the $1B as an expected total cost of fixing broken Xboxes. Who knows how much money they lost?
FTA: we believe that an unauthorized person has obtained the following information that you provided: ...PlayStation Network/Qriocity password and login... I'm curious if this means they store everyone's password in plain-text, or if by "password" they really mean a hash of some sort.
This would be such an incredibly stupid security failure. Passwords should always be salted and hashed. Credit card info should always be HSM-protected so that it is irretrievable except through a hardware API. What was Sony thinking!?
I can't even begin to fathom the magnitude of this considering how many people likely use the same login credentials for all of their sites. The problem you run into is that communicating both the nature of the breach and convincing people to respond accordingly is incredibly hard. This will continue to happen across many sites. I think after enough of these breaches, though, people will start to think about the prot…
This is a good time to purchase a password-vault app - AND USE IT!
Earlier quoted context omitted.
Ordinarily I'd just say reformat it and install Linux, but....
Linux installation is easy piece of cake to HN audience, but nightmare to normal people.
Earlier quoted context omitted.
I know, right? Reading through the comments on that post, the "you should have told us this last week" comments are just about balanced out by the "why are you wasting time with this instead of getting the PSN back online" comments.
Different folks seem to value privacy very differently.
This is a much much bigger deal than the Gawker security breach. Sony had substantially more information on its users than Gawker could ever hope to dream of. Specifically information on real names, addresses, and potentially credit cards. This is a big F'N deal and I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death. I don't think t…
"I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death." Banks, colleges, hospitals, and credit card processors do this all the time, and it doesn't cost them anywhere near a billion dollars despite the fact that they have vastly more personal information. Sure they usually only have a few hundred thousand records and not a few million…