Sony: All personal data stolen from PSN • Hacker News Board

Re: Sony: All personal data stolen from PSN

#211

Post by daeken » Wed, Apr 27, 2011, 1:46 AM UTC

ansy wrote: post #185

wewyor wrote: post #81

Earlier quoted context omitted.

It also says it might have been, which is much more worrying to me than the lack of evidence; because before this sony had no evidence that their network was compromised. This whole thing seems like a great example of incompetence.

This compromise happened DAYS ago. Google was hacked by China in mid-December 2009 they didn't publicly announce what happened until January 12, 2010. What started to look like a harmless intrusion turned into compromised gmail accounts turned into a highly sophisticated attack on Chinese dissidents turned into a full scale assault on their infrastructure. People were still figuring out the extent of that attack a co…

Being a security guy, I agree that no amount of planning and intelligence will keep out a significantly determined attacker. However, this doesn't give you carte blanche to not think about security. All the evidence presented around this shows that they simply didn't make it difficult at all; as soon as the console fell, so did their system. They seem to have violated every rule in security. That is simply unacceptable.

It's one thing to be attacked by determined people and fail eventually -- given enough time, everyone does -- but it's a completely different matter to give the keys to the castle to anyone with a rooted PS3.

Re: Sony: All personal data stolen from PSN

#212

Post by quanticle » Wed, Apr 27, 2011, 2:07 AM UTC

ovi256 wrote: post #189

GrandMasterBirt wrote: post #58

Earlier quoted context omitted.

The problem is audience: Kids don't give a shit. Privacy is crap, they got their penis pictures on facebook. They want their fucking video games. People playing games all day don't give a shit. They want their fucking games, stfu privacy and get moar kof33 and fucking get this shit online. People with money to lose care. They care that their information is stolen because that could lead to their money being stolen. P…

Oh noes, some people value different things than me how dare they. Let's be all elitist and imply "kids" don't know the value of information , whatever that may be. More like they know the information PSN had on them didn't matter (some nickname and email). And yeah, they want they games online, that's why they paid for a PS3 and multiplayer videogames after all. And Sony promised online multiplay. That's a badly mad…

Even if PSN didn't collect any financial information a breach of usernames and passwords is a big deal. As the Gawker hack has shown us, people tend to use the same usernames and passwords across many different websites. You can argue that this is the user's fault, but it doesn't matter. They'll still blame you when their bank account gets hacked.

In this case, though, there are indications that financial data was disclosed. PSN (just like Steam and XBox Live) collects financial data to allow for online game purchases. Disclosure of that information is quite a serious matter. Yeah, the "kids" playing might not care about their PSN account, but the parents who enter credit card information to buy their kids games sure will.

A poorly made argument does not automatically render the conclusion false.

Re: Sony: All personal data stolen from PSN

#213

Post by rorrr » Wed, Apr 27, 2011, 2:12 AM UTC

michaelchisari wrote: post #71

So how do we sign up for the class action lawsuit?

You can do it right here. All you need is what, 30 people to get the class action status.

Re: Sony: All personal data stolen from PSN

#214

Post by quanticle » Wed, Apr 27, 2011, 2:14 AM UTC

Alex3917 wrote: post #34

OmarIsmail wrote: post #2

This is a much much bigger deal than the Gawker security breach. Sony had substantially more information on its users than Gawker could ever hope to dream of. Specifically information on real names, addresses, and potentially credit cards. This is a big F'N deal and I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death. I don't think t…

"I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death." Banks, colleges, hospitals, and credit card processors do this all the time, and it doesn't cost them anywhere near a billion dollars despite the fact that they have vastly more personal information. Sure they usually only have a few hundred thousand records and not a few million…

Agreed. Look at the T.J. Maxx breach, in which approximately 94 million credit card numbers were stolen. Despite media claims of billions of dollars in damages, and multiple class action lawsuits, T.J. Maxx didn't pay any huge settlements or face any special penalties.

If T.J. Maxx can get away with it, Sony can too.

Re: Sony: All personal data stolen from PSN

#215

Post by alecco » Wed, Apr 27, 2011, 2:16 AM UTC

yuhong wrote: post #188

wmf wrote: post #114

Earlier quoted context omitted.

I think corporate ass-covering is pretty pan-cultural. See RSA's recent "we're answering every question other than the one that everyone is asking" PR about the SecurID thing.

I know, there was a previous article on the cover-up culture that once made it to the top at HN.

For the lazy

http://news.ycombinator.com/item?id=2088469

Re: Sony: All personal data stolen from PSN

#216

Post by sukuriant » Wed, Apr 27, 2011, 2:22 AM UTC

jcromartie wrote: post #204

falcolas wrote: post #159

Earlier quoted context omitted.

Much of ecommerce would go down the drain, if they got rid of remote storage of your details. No recurring billing, no "One-Click", no address books, etc...

I can imagine a couple of good one-click solutions involving public keys.

Expound upon this, remembering the common audience that want things fast and easy and from anywhere (iPhone, Android, mac, windows, some computer at the library), I'd be curious to know it.

Re: Sony: All personal data stolen from PSN

#217

Post by Nelson69 » Wed, Apr 27, 2011, 2:29 AM UTC

gergles wrote: post #210

TheCondor wrote: post #183

Earlier quoted context omitted.

Do what you will, I'm not going to defend Sony exactly but you'd be stunned to know how much this kind of thing happens and goes unreported. Stunned. Sony deserves a pile of credit for manning up and saying what they've said. Unfortunately they're also admitting that they have no idea how bad it really is. A remarkable number of companies wouldn't disclose this much. A remarkable number of them will interpret and spi…

It took them a week to release a non-statement, which they only issued after Congresspeople started complaining about why the service was down for so long. This is not a victory for transparency.

What do you want them to do? What's reasonable? How long do you think it took them to figure out the extent? (They still don't fully know it!) There are absolutely business concerns that warrant acting with some measured prudence.

The parent is true, there are a lot more attacks than you hear about. Sony only loses here, they lie and under play it they look bad, they over play the concerns and they look bad, they tell the world too soon they look bad, they take their time and they look bad. It's just all around shitty. What's the reasonable way for them to report this or should they just lie like a lot of other companies?

Re: Sony: All personal data stolen from PSN

#218

Post by sukuriant » Wed, Apr 27, 2011, 2:29 AM UTC

gergles wrote: post #210

TheCondor wrote: post #183

Earlier quoted context omitted.

Do what you will, I'm not going to defend Sony exactly but you'd be stunned to know how much this kind of thing happens and goes unreported. Stunned. Sony deserves a pile of credit for manning up and saying what they've said. Unfortunately they're also admitting that they have no idea how bad it really is. A remarkable number of companies wouldn't disclose this much. A remarkable number of them will interpret and spi…

It took them a week to release a non-statement, which they only issued after Congresspeople started complaining about why the service was down for so long. This is not a victory for transparency.

Would you rather they still told the truth and said "unexpected server maintenance"?

It could be said that that's what they're doing.

They're saying more than they have to.

Re: Sony: All personal data stolen from PSN

#219

Post by [deleted] » Wed, Apr 27, 2011, 2:40 AM UTC

[deleted]

Re: Sony: All personal data stolen from PSN

#220

Post by watchandwait » Wed, Apr 27, 2011, 2:51 AM UTC

wmf wrote: post #168

mortenjorck wrote: post #150

Earlier quoted context omitted.

Don't read this as a defense of the company, but there hasn't really been a single, monolithic Sony for decades. Sony Music Entertainment, perpetrators of 2005's rootkit debacle, is pretty far removed from Sony Computer Entertainment, the division responsible for Playstation. Sony Electronics, makers of TVs, home theater systems, and Walkmans, is another silo, as is Sony Pictures. Of course, every act of incompetence…

There have been rumors that Sony Music/Pictures has "oh no, piracy!" veto power over the rest of Sony, though. Either that or every division of Sony happens to be really DRM-happy.

Sony Music's meddling is the reason Sony failed to make a successful Mp3 player, all the more remarkable because Sony created the individual portable music market and dominated it with the Walkman.