Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sony: All personal data stolen from PSN

blog.us.playstation.com

Post reply on HN
Print view View original

161–170 of 292 posts

Re: Sony: All personal data stolen from PSN

#161

Post by nkassis »

dman wrote: post #42
cooldeal wrote: post #37

Earlier quoted context omitted.

>You can diss your competitor for poor security practices only if you have some confidence in your own. Nope, companies usually don't leave any chance to point to the competition's faults and laugh, even if they themselves are worse in that regard.

It does carry a risk though - if you make securing a major online service sound too easy by ridiculing your competitor then down the line when you get breached its more damaging imo. eg I dont remember any Car companies in recent history pointing to Service recalls of their competitors in their advertisements, ditto for Airlines and crashes.

Airline crashes would be such a bad PR idea I mean, that's just bad taste.

Re: Sony: All personal data stolen from PSN

#162

Post by ghostDancer »

teamonkey wrote: post #143
mkinsella wrote: post #110

Earlier quoted context omitted.

60 million users isn't "a few million"

I'm not sure where that number comes from, they've sold less than 50 million PS3s to date.

You can have more than one PSN account in a home i think (not a ps3 owner), one for each family member, i suppose there is where you can find the gap between the numbers.

Re: Sony: All personal data stolen from PSN

#163

Post by amackera »

aeontech wrote: post #60

Does anyone else find it odd that they "strongly recommend that you log on and change your password" instead of just force-resetting everyone's password and sending them an email with an activation link? Out of 60M subscribers, I'm certain that a large proportion will never see this message.

Methinks that 99% of PSN users can't remember their own passwords.

Re: Sony: All personal data stolen from PSN

#164

Post by holdenk »

uxp wrote: post #138
marshray wrote: post #111

Earlier quoted context omitted.

It may be that the attackers pwned the servers and skimmed the numbers (including CVV) as they were HTTP POSTed in plain text.

That wouldn't work over SSL, as there is no plain text in the HTTP Verb. And I recall a "paper" coming up some months ago that was mentioning the protocols the PS3 goes through, which does confirm that the data is transmitted over SSL.[0] [0] http://arstechnica.com/gaming/news/2011/02/report-psn-hacked...

If the attacker "0wned" the servers the fact there was encryption between you and the server doesn't really help a whole lot, they can just insert them selves in the stack post encryption (or even use the private key to decrypt the encrypted traffic if they wanted to minimize the number of points they touched).

Re: Sony: All personal data stolen from PSN

#165

Post by cookiecaper »

jimktrains2 wrote: post #72
ak217 wrote: post #48

Earlier quoted context omitted.

How do you use stored credit card info if the cc# is not stored? Unlike passwords, the encryption for the cc#s has to be reversible. That's part of the reason why they introduced CVCs, right?

You could at least have them encrypted on disk with a key only stored in memory, i.e.: when the system is turned on. Alternatively a dedicated crypo device where you feed it cipher text and it gives you plain text would also help as the attack wouldn't be able to get the key (even if they have the physical box (for good crypto devices)) While only marginally better depending on the type of attack and permissions gain…

And what if that server needs to be rebooted some day? What if there's a hardware failure and it has to be powered off?

Something as big as PSN has multiple servers reading the same DB and must be able to tolerate failures without forcing everyone to re-enter their CC #. The keys must be stored persistently somewhere.

Re: Sony: All personal data stolen from PSN

#166

Post by pero »

moondowner wrote: post #96

Notice how they never apologize? The closest thing to apology, but it's not an apology, is: > "We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience." Sony apologizes only to Chuck Norris.

That is very standard legal. If they did so, the impending class action would already be over.

I wouldn't be surprised if that blog post cost them well into 6 figures for legal fees. And that it took the full week to draft and approve--it is probably the reason this announcement took so long to emerge.

Re: Sony: All personal data stolen from PSN

#167

Post by cookiecaper »

seiji wrote: post #101
estel wrote: post #76

Giant Bomb is reporting that passwords are supposedly secure (of course, "no way" is clearly false), so I'm guessing there's at least a decent salted hash: http://www.giantbomb.com/news/good-news-psn-back-maybe-withi...

Salt is bad for you: http://news.ycombinator.com/item?id=1209254

Salted hashes are better than unsalted hashes.

Re: Sony: All personal data stolen from PSN

#168

Post by wmf »

mortenjorck wrote: post #150
cryptoz wrote: post #11

I wonder how many times a company can install trojans on your computer, destroy your OS's security, secretly watch all your actions, then proceed to not properly protect your data when you voluntarily give it to them...before going out of business. Sony's size and momentum must be pretty crazy. Or maybe it's our society. I just can't imagine a small record store in the 1960s, after being caught spying through the bed…

Don't read this as a defense of the company, but there hasn't really been a single, monolithic Sony for decades. Sony Music Entertainment, perpetrators of 2005's rootkit debacle, is pretty far removed from Sony Computer Entertainment, the division responsible for Playstation. Sony Electronics, makers of TVs, home theater systems, and Walkmans, is another silo, as is Sony Pictures. Of course, every act of incompetence…

There have been rumors that Sony Music/Pictures has "oh no, piracy!" veto power over the rest of Sony, though. Either that or every division of Sony happens to be really DRM-happy.

Re: Sony: All personal data stolen from PSN

#169

Post by c2 »

redfloatplane wrote: post #19

There were sixty million[0] PSN accounts. This is impressive, and amounts to (judging by a quick search) the largest-scale ID (and possibly credit-card) theft ever [Not so, see child comment]. Not even factoring in credit card details, the usernames, emails, addresses, ages, passwords, mother's maiden names, favourite pets, of sixty million people is worth a hell of a lot. I have to wonder how much data that is, in t…

TJ Maxx data theft involved 45 million confirmed credit card/debit card numbers stolen, which I believe was more serious then this:

http://www.msnbc.msn.com/id/17853440/

Fact is people put most of that other information on Facebook anyway, so for 500 million people, you can quite easily find someone's age, birthday, pets, and much more just from their FB account.

Re: Sony: All personal data stolen from PSN

#170

Post by tzs »

cookiecaper wrote: post #165
jimktrains2 wrote: post #72

Earlier quoted context omitted.

You could at least have them encrypted on disk with a key only stored in memory, i.e.: when the system is turned on. Alternatively a dedicated crypo device where you feed it cipher text and it gives you plain text would also help as the attack wouldn't be able to get the key (even if they have the physical box (for good crypto devices)) While only marginally better depending on the type of attack and permissions gain…

And what if that server needs to be rebooted some day? What if there's a hardware failure and it has to be powered off? Something as big as PSN has multiple servers reading the same DB and must be able to tolerate failures without forcing everyone to re-enter their CC #. The keys must be stored persistently somewhere.

What we do where I work is take the newly generated key whenever we key or rekey the system, split it into multiple pieces using Shamir's secret sharing algorithm, and those pieces are distributed to several people.

Whenever the server needs to be started, two of those people must enter their key shares. That enables the server to reconstruct the key, which is then stored in memory.

Post reply on HN