141–150 of 292 posts
Seriously? Even Sony is keeping passwords in plaintext? There wasn't a single competent person involved in the design of PSN who might have mentioned that was a terrible idea?
They say passwords were stolen. This must mean they are not properly hashing passwords with salts stored outside of the database. How many times does this have to happen before people realize that passwords are never to be stored in plaintext? The only exception is a client-side program that needs to log you in and in an ideal world that would be handled by a Kerberos-like ticket system.
It could also mean that the attacker was in a position to observe the plaintext supplied by the user after it was decrypted (from SSL) but before it was authenticated (with a password hash algorithm).
Or it could be that they're just not being too particular about the details, on the side of being overly conservative.
Earlier quoted context omitted.
"I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death." Banks, colleges, hospitals, and credit card processors do this all the time, and it doesn't cost them anywhere near a billion dollars despite the fact that they have vastly more personal information. Sure they usually only have a few hundred thousand records and not a few million…
60 million users isn't "a few million"
Earlier quoted context omitted.
Frankly I'm more concerned with their words about changing credit cards if you've made a purchase through PSN. This seems to be an admission that they were storing CC#'s in plain text.
It may be that the attackers pwned the servers and skimmed the numbers (including CVV) as they were HTTP POSTed in plain text.
Why on earth would you ever do that?
This is a much much bigger deal than the Gawker security breach. Sony had substantially more information on its users than Gawker could ever hope to dream of. Specifically information on real names, addresses, and potentially credit cards. This is a big F'N deal and I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death. I don't think t…
Microsoft had millions of pieces of defective hardware out there which they were warranting free replacement on for several years. Unless Sony's going to replace all the PS3's in the wild, the direct costs for dealing with this PR nightmare shouldn't come close to what Microsoft set aside.
Earlier quoted context omitted.
I would argue the cost of the RRoD was a heck of a lot more than $1B because of all the lost sales. People didn't want to invest in hardware that was going to break 5 times over. The direct damage from this won't be $1B (still tens of millions at least). But what about the impact of the lost sales and customers from the loss in credibility and trust? That is what could be huge. It was relatively "easy" for Microsoft…
I would argue the cost of the RRoD was a heck of a lot more than $1B because of all the lost sales. People didn't want to invest in hardware that was going to break 5 times over. Agreed. Microsoft only wrote down the $1B as an expected total cost of fixing broken Xboxes. Who knows how much money they lost?
First, most of the time when we're talking about business and we talk about costs we're clearly talking about accounting costs. This applies to startups, too. When you're talking about accounting costs, you don't get to include economic costs (e.g., opportunity cost.)
Second, isn't trying to include these extra "costs" due to lost sales the same thing that the music industry is doing? That is, claiming that they lost trillions of dollars due to file sharing from, you got it, "lost sales." [1]
I don't think there's any real way to measure these costs, so let's stop trying.
[1] http://www.p2pon.com/2011/03/25/greed-hits-climax-music-indu...
I wonder how many times a company can install trojans on your computer, destroy your OS's security, secretly watch all your actions, then proceed to not properly protect your data when you voluntarily give it to them...before going out of business. Sony's size and momentum must be pretty crazy. Or maybe it's our society. I just can't imagine a small record store in the 1960s, after being caught spying through the bed…
Of course, every act of incompetence under the Sony name tarnishes that name, and in the marketplace, that's ultimately all that matters.