Slashdot Mirror


77 Million Accounts Stolen From Playstation Network

Runaway1956 was one of many users to continue to update us about the intrusion we've been following this week. "Sony is warning its millions of PlayStation Network users to watch out for identity-theft scams after hackers breached its security and plundered the user names, passwords, addresses, birth dates, and other information used to register accounts. Sony's stunning admission came six days after the PlayStation Network was taken down following what the company described as an 'external intrusion'. The stolen information may also include payment-card data, purchase history, billing addresses, and security answers used to change passwords, Sony said on Tuesday. The company plans to keep the hacked system offline for the time being, and to restore services gradually. The advisory also applies to users of Sony's related Qriocity network."

645 comments

  1. It only... by zppln · · Score: 2

    steals everything.

    1. Re:It only... by Bobfrankly1 · · Score: 0

      makes you wish you had an Xbox.

    2. Re:It only... by JMJimmy · · Score: 1

      Except I do... and I love it!

      Stupid PS3 sits on the shelf and only gets used to play videos and the odd exclusive (Heavenly Sword - Ninja Theory is awesome)

  2. passwords? by jaymz666 · · Score: 5, Insightful

    Seriously? They were storing passwords in a way that could be unencrypted?

    1. Re:passwords? by Moryath · · Score: 1, Interesting

      Not only that:

      - If you wanted to play any of the games online, you had to have a PSN account. Which meant you had to provide a credit card whether you were ever going to buy anything or not.

      - Certain companies liked to tie PSN accounts to their forum accounts.

      End result: massive security headache for every user who's ever touched PSN for any reason.

      Extra fun: waiting while their entire network is down, to play basically online-only (or "so much online component that the single-player is a fucking joke") games. You know, like Call of Duty: Crap Ops.

      To paraphrase Obi-Wan, It was as if millions of voices suddenly cried out... and then were suddenly made to change their passwords.

    2. Re:passwords? by somersault · · Score: 1

      Sad face :/ I guess I should cancel my credit card too.

      --
      which is totally what she said
    3. Re:passwords? by lorenlal · · Score: 0

      Netflix users on PS3 are SOL too.

    4. Re:passwords? by jewelises · · Score: 1

      This seems like an amateur mistake. Who are these companies hiring lately?

      At the very least, hash and salt. If the hashes might be stolen then hash it thousands of times (see PBKDF2).

    5. Re:passwords? by tripleevenfall · · Score: 1

      I think it's horrendous that they force you to provide credit card info.

      I wonder if, when this comes back online, if I could go in and hash my credit card info and I could still use online functions?

    6. Re:passwords? by Anonymous Coward · · Score: 1

      You do not have to provide your credit card information unless you are going to buy something. To simply sign on and play online or peruse the store does not require a credit card on file.

    7. Re:passwords? by h4rr4r · · Score: 2

      I never did provide a CC, when did they ask for that. Mind you I have a PSN account used only for netflix.

    8. Re:passwords? by 0123456 · · Score: 5, Insightful

      This seems like an amateur mistake. Who are these companies hiring lately?

      The lowest bidder?

    9. Re:passwords? by fuzzyfuzzyfungus · · Score: 5, Funny

      My DARE officer told me that hash is illegal, and my health teacher says that salt causes high blood pressure...

    10. Re:passwords? by marcansoft · · Score: 4, Interesting

      This seems like an amateur mistake.

      About as amateur as using a static constant instead of a random number when signing firmware and games, which is exactly what they did (and which pretty much cost them their entire system security).

    11. Re:passwords? by Anonymous Coward · · Score: 2, Informative

      Get your fucking facts straight.
      1. You do not need a CC to get a PSN account. You only need one to buy something, and even then you could buy PSN credits at the store, and buy things on PSN without ever providing a valid credit card number.
      2. The game companies that allow you to tie your forum account to your PSN account are irrelevant. None of them require you to give them your PSN password.

      This situation sucks, and Sony fucked up big time, but this bullshit FUD everyone is spewing is not helping.

    12. Re:passwords? by Kuukai · · Score: 5, Informative

      - If you wanted to play any of the games online, you had to have a PSN account. Which meant you had to provide a credit card whether you were ever going to buy anything or not.

      Wrong. This is not true at all. You can play games without ever providing a credit card. On the other hand, they do require your name, birthdate, and mailing address.

      --
      Sendou Wave Kick!!
    13. Re:passwords? by Anonymous Coward · · Score: 0

      i would've modded you funny if you stopped at "hash is illegal".

    14. Re:passwords? by adam.dorsey · · Score: 2

      No, if you keep hammering on Netflix it lets you in eventually. It just bitches at you.

      --
      You are still innocent until proven guilty. What's changed is what they do to innocent people. - notnAP, #26891325
    15. Re:passwords? by Anonymous Coward · · Score: 0

      And I gave them a made-up name, fake address, and I don't even remember what birthdate I put in. I also never tied a credit card to the account. One password change and I'm good to go.

    16. Re:passwords? by teeloo · · Score: 2

      Well actually if you're on Netflix US, you can still log on and watch as normal on the PS3. Netflix Canada does not work though. I have both accounts, so this is from personal experience.

    17. Re:passwords? by xavierpayne · · Score: 3, Informative

      This is not true. The Netflix app does ask you to log in to the PSN but after 3 failed attempts it lets you into the netflix app anyway and I thus far I haven't encountered any problems streaming even with the PSN itself down.

    18. Re:passwords? by outsider007 · · Score: 2

      Is that because you don't understand what salt means in that context or because you realized that AC's can't mod posts?

      --
      If you mod me down the terrorists will have won
    19. Re:passwords? by schnell · · Score: 4, Insightful

      As a previously happy PS3 user, I'm infuriated at their shoddy handling of this whole thing. The delay in notifying customers was inexcusable, and I still don't understand how passwords could have been compromised... I refuse to believe that even Sony would have stored them in plaintext. The only thing that makes sense to me is that they were stored in hashes but Sony is concerned that the hashed passwords are subject to brute force attacks. I spent a good chunk of last night changing all my online passwords that were the same as the one used in my PS3 account, and that meant dozens of accounts. (Thank goodness none of them were bank-related.) I guess that I should have moved to a system of unique passwords for each site before, and this finally forced me to do it.

      I am struggling to find a bright spot anywhere in this, but if I were to find one it would be that Sony must understand how badly they have pooched this situation. I would expect some serious mea culpas and free crap out of them (like free PlayStation Plus for a year or something) out of this. I don't know whether I actually want that, but it should be interesting to watch them grovel for my online trust and/or business back.

      --
      "95% of all Slashdot .sig quotes are incorrect or completely fabricated." -Benjamin Franklin
    20. Re:passwords? by Anonymous Coward · · Score: 0

      Aw, snap!

      (Not the same AC.)

    21. Re:passwords? by somersault · · Score: 2

      He was talking out of his ass. You only need to provide card info to buy stuff from the store or get a PSN Plus account. Standard accounts are free.

      --
      which is totally what she said
    22. Re:passwords? by gstoddart · · Score: 5, Insightful

      Wrong. This is not true at all. You can play games without ever providing a credit card. On the other hand, they do require your name, birthdate, and mailing address.

      And people wonder why so many on-line accounts are set up with completely bogus information.

      Why should I be providing all of this information to play *(&^%*&^ video games? This is precisely why I don't give most companies this information -- because I don't trust them with it. Not to keep it safe, not to use it as they say, and not to provide it to someone else.

      --
      Lost at C:>. Found at C.
    23. Re:passwords? by Anonymous Coward · · Score: 0

      Um.. I do not believe that is correct. I did not have to provide a creditcard to create or use the PSN network. It was only after you make a purchase in their online store that a creditcard is asked for. I did notice though that that creditcard number appeared to be saved for future purchases whether I wanted it to or not. No 'opt in' choice to do so, it just does it... I tried finding a way to opt out of such a thing and couldn't find that either.

    24. Re:passwords? by Anonymous Coward · · Score: 0

      I refuse to believe that even Sony would have stored them in plaintext. The only thing that makes sense to me is that they were stored in hashes but Sony is concerned that the hashed passwords are subject to brute force attacks.

      Yes, it's very much like Sony to miss an opportunity to say "Hey folks, this isn't as bad as it seems, the passwords are actually... erm... kind of encrypted". The very fact that they're even admitting to password loss shows how bad the situation is, considering their usual MO is to bury such information - if they're telling people this it must mean there's a reasonable chance accounts elsewhere will be compromised. Seriously, it's people continually giving them a free pass and the benefit of the doubt every time they screw up that lets them get away with this kind of crap time after time. Sony are either evil or grossly incompetent - they've had zero of my money (bar whatever license fee they might still get on DVD technology) since the middle of the last decade, why anyone would still be throwing money at them boggles the mind.

    25. Re:passwords? by Anonymous Coward · · Score: 0

      Are you joking. Easy. All you need is John the Ripper, Rainbow tables and a little bit of time.

    26. Re:passwords? by teeloo · · Score: 1

      Not only that:

      - If you wanted to play any of the games online, you had to have a PSN account. Which meant you had to provide a credit card whether you were ever going to buy anything or not.

      NOT TRUE. You can create PS3 accounts without having to provide any cc info. I have done so many times for the GT5 birthday/gift car cheat.

    27. Re:passwords? by Anonymous Coward · · Score: 0

      I didn't have to provide any CC info when I created my PSN account.

    28. Re:passwords? by delinear · · Score: 1

      Maybe he's already modded in the thread and therefore has to post AC so as to not invalidate his previous mods.

    29. Re:passwords? by bioster · · Score: 1
      The article is speculating about that.

      Even if they were properly encrypted though, it's not beyond imagining that attackers could use rainbow tables or simply run brute force matching looking for relatively common passwords.

      Even if they enforced "strong" passwords, some people will still have chosen relatively easy to guess passwords (eg. MyDumbPass123), and once you figure out how they hashed the password database it wouldn't be hard to come up with a few million of these passwords. Then a brute force attack would pick up a few of the low hanging fruits. Sure, it might take a few weeks of processing time, but it's conceivable. That alone is enough to make a company recommend everyone change all their passwords.

      Of course, the security questions are probably a bigger hazard.

    30. Re:passwords? by outsider007 · · Score: 1

      run along, kiddies, the grown ups are trying to have a conversation here.

      --
      If you mod me down the terrorists will have won
    31. Re:passwords? by Anonymous Coward · · Score: 1

      I am in Canada. I use the most recent Netflix app and FW 3.60. I have my PS3 configured to not automatically connect to the PSN network.

      When I start Netflix, I get the black screen that says I need to connect to PSN, I click OK, it fails, then Netflix happily starts.

    32. Re:passwords? by linear+a · · Score: 2

      We're all DOOMED!

    33. Re:passwords? by tripleevenfall · · Score: 1

      same behavior in the US.

    34. Re:passwords? by Desler · · Score: 1

      Yet, I've used Netflix every day since the down time.

    35. Re:passwords? by Kuukai · · Score: 1

      I don't think anyone actually wonders that :P But in their defense "think of the children" groups would be all over Sony if they didn't at least try to do that or something similar.

      --
      Sendou Wave Kick!!
    36. Re:passwords? by Anonymous Coward · · Score: 0

      "brevity is the soul of wit."

      ACs can mod posts.

    37. Re:passwords? by Jibekn · · Score: 2

      Im in Canada, my netflix on my PS3 works fine, and has worked fine all through this outtage.

    38. Re:passwords? by nick13245 · · Score: 1

      If they don't store them plaintext, they still have to store a hash (MD5, SHA2, etc...). If they know the hash algorithm (which I'm sure they do if they got DB access), they could easily run a brute force attack on the hashes that will crack any weak passwords (which I'm sure many are). Even password hashes on Linux systems can be cracked if the passwords are weak and the attacker has time. See http://www.openwall.com/john/.

    39. Re:passwords? by Spazmania · · Score: 4, Insightful

      Not only did I use a unique email address and password for my PSN account (not used for anything else), I gave intentionally dishonest answers to the secondary security question (and wrote them down), an intentionally dishonest DOB and the only purchases I made were made with a debit card I got as a gift.

      I feel like a genius.

      --
      Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
    40. Re:passwords? by amicusNYCL · · Score: 0

      I refuse to believe that even Sony would have stored them in plaintext.

      What do you mean "even Sony"? This is the same company that decided a rootkit on their audio CDs was a great way to stop piracy. Exactly how much do you really think Sony cares about you or your information? All they want is your money, and you gave it to them. You didn't learn the first time, so now you get to pay for it this time.

      Go ahead, ask me why I never bought a Playstation, or any other Sony device after the rootkit fiasco. Go ahead, ask. I'll tell you. (hint: it's about trust)

      I would expect some serious mea culpas and free crap out of them

      Why the hell would you expect that from Sony? Again, there's historical data here. Go back and look at how they "rectified" the rootkit issue. You should expect the same level of "customer service" (in the George Carlin sense). That's right, you're the customer, and Sony is "servicing" you. I hope it was good for you.

      In the settlement filing, Sony states that it will immediately recall all XCP CDs and replace them with non-content-protected CDs. It has also agreed to offer incentives to U.S. customers to "ensure that XCP CDs are promptly removed from the market." Sony first released details about its CD recall scheme in late November.

      Customers who exchange their XCP CD can either download three albums from a list of over 200 titles, or claim a cash payment of $7.50 and a free download of one album. To claim this compensation, customers must return their XCP CDs to Sony or provide the company with a receipt showing they returned or exchanged the CD at a retailer after Nov. 14.

      Sony is not recalling MediaMax CDs, but has agreed to compensate buyers of these albums by allowing them to download one free album, as well as offering them MP3 versions of the music on the MediaMax album.

      But don't worry, the next time they come out with something shiny I'm sure you'll have forgotten all about this. They're counting on it.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    41. Re:passwords? by mug+funky · · Score: 1

      AC bashing = pompous douchebag behaviour.

      unless it's me doing it.

    42. Re:passwords? by arth1 · · Score: 1

      What I wonder is if I checked "Do not store credit card information", they STILL stored credit card information.

      I know at least one company that did that, and even stored the CCV2 number which is supposed to NEVER be stored.

      And this is Sony, after all. Their greed is only eclipsed by their incompetence.

    43. Re:passwords? by Mongoose+Disciple · · Score: 1

      I so don't know why this was modded funny.

      At one point it seemed like Sony had a pretty good idea to better compete with the (at the time, less expensive and better established) XBox: offer free online play. You bought a more expensive console, but hey, you get the online stuff for free and you're making up the money there.

      Except now it seems like they made that work, financially, by hiring cheap developers who didn't have the most basic idea of what they were doing.

    44. Re:passwords? by Narishma · · Score: 2

      You don't need to provide credit card info to create a PSN account or play online. You don't even need it to buy stuff on the PSN, you can instead use pre-paid cards.

      --
      Mada mada dane.
    45. Re:passwords? by Narishma · · Score: 1

      You don't even need it to buy stuff if you use PSN pre-paid cards.

      --
      Mada mada dane.
    46. Re:passwords? by Luckyo · · Score: 1

      Funny mod my ass. That is as insightful and informative as slashdot will ever be.

    47. Re:passwords? by Anonymous Coward · · Score: 0

      I'm not sure you are representative of the tens of millions of accounts they have. It's a fairly big problem, your individual situation aside.

    48. Re:passwords? by Tetsujin · · Score: 4, Informative

      As a previously happy PS3 user, I'm infuriated at their shoddy handling of this whole thing. The delay in notifying customers was inexcusable, and I still don't understand how passwords could have been compromised... I refuse to believe that even Sony would have stored them in plaintext.

      Even if you one-way cipher the passwords, getting access to the password database gives the attacker the ability to attack the database offline via brute-force attacks. (Attempting to brute-force without access to the database system would mean you'd have to do it via the login system - which wouldn't work so well if the login system is built to guard against brute force attacks, for instance by limiting the frequency of login attempts to a single account.) So if somebody gets the password database it's safest to assume they've got the passwords in it.

      --
      Bow-ties are cool.
    49. Re:passwords? by nschubach · · Score: 4, Informative

      Cancel? Just call up Visa and they give you a new card and number. No need to kill the account.

      --
      Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
    50. Re:passwords? by ginbot462 · · Score: 2

      >> My DARE officer told me that hash is illegal [by fuzzyfuzzyfungus (1223518)]

      I'm guessing he wasn't that influential on you.

      --
      Atlas Shrugged : Thematic Story :: Battlefield Earth : Organized Religion
    51. Re:passwords? by Eunuchswear · · Score: 1

      What, you don't have a sockpuppet for that?

      --
      Watch this Heartland Institute video
    52. Re:passwords? by outsider007 · · Score: 1

      Ooh, I'm sorry to step on your toes. But maybe if you keep your mouth closed nobody will notice that you were born retarded.

      --
      If you mod me down the terrorists will have won
    53. Re:passwords? by ultraexactzz · · Score: 1

      2. The game companies that allow you to tie your forum account to your PSN account are irrelevant. None of them require you to give them your PSN password.

      True - except that many of those 77 million people likely used the same password here as they did for those forums or for other sites. And that's where the real headache will be - and one of the best arguments in recent memory for proper password discipline.

      --
      Never underestimate the potential of Human stupidity. -Heinlein
    54. Re:passwords? by schnell · · Score: 2

      What do you mean "even Sony"? This is the same company that decided a rootkit on their audio CDs was a great way to stop piracy.

      Putting rootkits on CDs is evil. Storing passwords in plaintext is stupid. Being evil doesn't make you stupid.

      Exactly how much do you really think Sony cares about you or your information?

      They care exactly to the extent that they can be subject to an expensive class-action lawsuit or government fines over the exposure. So, again, Sony's consumer-unfriendly attitude does not indicate that they would take reckless chances with protecting information that they face potential liability claims over. I don't get why their history with rootkits has anything to do with the fact that I seriously doubt they stored passwords in plaintext.

      Go ahead, ask me why I never bought a Playstation, or any other Sony device

      Is it OK if I don't?

      --
      "95% of all Slashdot .sig quotes are incorrect or completely fabricated." -Benjamin Franklin
    55. Re:passwords? by RollingThunder · · Score: 1

      Lucky for you; I'm in Canada and my Netflix on PS3 will not work. It constantly errors out and tells me that it needs to sign in to PSN before it will stream.

    56. Re:passwords? by bluefoxlucid · · Score: 1

      Wii seems to let you buy points with a credit card, but it doesn't store that data at all. I need to re-enter everything, every time. I guess Nintendo just doesn't care who gets on, as long as it's with a Wii. And thus they have sidestepped being the target of millions of hackers looking to get huge databases of name/address/credit card/birth date/etc etc etc... unfortunately, the market for Wii Friend Codes is much larger.

    57. Re:passwords? by fuzzyfuzzyfungus · · Score: 4, Funny

      Are you implying that wasting time on slashdot is abnormal behavior for a fungus? The haploid glomeromycetes that fused to form my zygospore were always hassling me about it: "Are you going to sit there reproducing asexually in front of the computer like some pathetic diploid man-child all your life? Why don't you grow a fruiting body, and make something of yourself?"

    58. Re:passwords? by LavouraArcaica · · Score: 2

      Storing passwords in plaintext is only stupid? Do you really believe that?

    59. Re:passwords? by amicusNYCL · · Score: 1

      Putting rootkits on CDs is evil. Storing passwords in plaintext is stupid. Being evil doesn't make you stupid.

      "Never ascribe to malice what can be explained by stupidity." Putting rootkits on CDs is also stupid. Being evil doesn't make you stupid, and vice versa, but the results of each look pretty similar. But it's interesting to me that you seem to imply that you are happy to do business with an evil company, but not a stupid one.

      So, again, Sony's consumer-unfriendly attitude does not indicate that they would take reckless chances with protecting information that they face potential liability claims over.

      Obviously their risk management department isn't doing its job if they decided to store usernames, passwords, and payment card information in a way that is not secure. They didn't expect the breach, and they didn't take measures to protect the data because they didn't think the breach would happen (obviously, because of a complete lack of information from Sony, this is speculation). In other words, they didn't consider it reckless. This goes back to them being stupid.

      I don't get why their history with rootkits has anything to do with the fact that I seriously doubt they stored passwords in plaintext.

      They're stoooooopiiiiiiid. But the passwords don't need to be plaintext. They very well may have been encrypted. But encryption doesn't matter when someone also steals the encryption algorithm and keys. From the little information we have, it sounds like Sony doesn't even know how this happened or what the extent was. What I do know is that Sony has never claimed that their systems are PCI compliant, even when asked, so they very well may be storing things in plaintext.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    60. Re:passwords? by AmaranthineNight · · Score: 1

      Only for some people. I was using Netflix by just being persistent a couple of days ago, but yesterday it wouldn't let me through at all no matter how many times I tried to get in. It let me into the app, but whenever I started trying to watch a video it would try to force me to log into PSN. After that failed, the Netflix app produced an error and halted the streaming.

    61. Re:passwords? by AJH16 · · Score: 2

      It really isn't though. If hashed, great, they have a hash of my password. There are many many possible combinations that could map to my password. There are existing attacks to quickly find A value that will match to the hash, but not actually the original password. (At least not unless I missed some breakthrough in the last 2 years or your password is weak to dictionary attacks.) For example, my password 123 hashes to abc. The attacker obtains abc and determines that 098 also hashes to abc. However since site B uses a different seed in their hash, 123 hashes to def for them and 098 hashes to xde so no match is found and the login is safe. The hash issues I'm aware of are only an issue when the compromise is unknown and done by a man in the middle. (ie, I intercept your traffic and your password was hashed at the client side and sent clear. In this case I could generate my own hash to match yours. It is also an issue in situations like a signature on a download where I can modify the file but still have it match the signature.)

      Someone can correct me if I'm wrong, but I'm not aware of any technique to get an actual true password out of a one way hash.

      --
      AJ Henderson
    62. Re:passwords? by ashidosan · · Score: 1

      Which meant you had to provide a credit card whether you were ever going to buy anything or not.

      Where did you get this information from? I have a PSN account, and have never entered my credit card into my PS3 (nor used it for PSN purchases).

    63. Re:passwords? by Anonymous Coward · · Score: 0

      You can play games without ever providing a credit card. On the other hand, they do require your name, birthdate, and mailing address.

      And that's why Sony (and the hackers) now know that my name is Abdul AlHazred, i live in Silent hill on Elm street 13 an i was born 1.1.1900 (or 2999 depend how Sony or PSN will interpret it today)

      ps: Don't touch my book!

    64. Re:passwords? by Anonymous Coward · · Score: 0

      I do. Stupidity can be complicated, and even have roots in not-necessarily-stupidity, even if stupidity is the outcome.

      Failing to address stupidity that is known to pose risks to innocent people.. is that evil? No, even that is complicated.

      I wish I could say more... infer what you will.

    65. Re:passwords? by Anonymous Coward · · Score: 0

      You have to wait until Netflix loads up the previews screen. Then cancel the PSN signin and it will let you use Netflix. If you cancel the PSN signin before Netflix finishes loading, it will just warn you and pop up again.

    66. Re:passwords? by LordLimecat · · Score: 1

      Theres something delicious to all of this, their getting utterly pwned after laughing at Anon's efforts as feeble. I am not generally one given to schadenfraude, and I certainly hope that nothing serious like identity theft results from all this (probably an empty hope), but Sony really did provoke this.

    67. Re:passwords? by GNious · · Score: 1

      If you wanted to play any of the games online, you had to have a PSN account. Which meant you had to provide a credit card whether you were ever going to buy anything or not.

      Citation needed

    68. Re:passwords? by smelch · · Score: 3, Funny

      Like my wife. That's a lie, she never lets me in :-(.

      --
      If I can just reach out with my words and touch a butthole, just one, it will all be worth it.
    69. Re:passwords? by smelch · · Score: 1

      one of the best arguments in recent memory for proper password discipline

      Why, because somebody might impersonate you on IGN? That's pretty weak. Maybe if this was related to your banking information it'd be a problem but somehow I don't think Chase would want you to link your PSN account to your savings account.

      --
      If I can just reach out with my words and touch a butthole, just one, it will all be worth it.
    70. Re:passwords? by AK+Marc · · Score: 2

      If they got the entire system, they may know the hashing algorithm. As such, there may be some attack that allows them to two-way the one-way hash. Further, if the hashing were "perfect" (as in max entropy) then there would be limited, if any, collisions for passwords shorter than the hash length. So if the hash were larger than all the passwords, then they'd never be sure that they got the right password, but the chance of it increases greatly.

      Without more information, it's safest to say that your plaintext password (along with email address) has been compromised. Anything they could ever find related to your email address (not just email, but any social networking site linked to that email, any bank or broker account that uses the email for a login, etc.) will have your email and PSN password known.

    71. Re:passwords? by tmarthal · · Score: 1

      The article is speculating. What you start to hear is that they were storing their password answers as plain text, Sony has never said that their passwords were stored as plain text. Meaning, that the answers they would use to recuperate their forgotten passwords (e.g. "What is your mother's maiden name?") were what was compromised.

      Now, combined with the rest of the personal information, I think that the password answers to their security questions may lead to more identity theft than actual passwords.

    72. Re:passwords? by Anonymous Coward · · Score: 0

      Some users can streams others can't. I've tried a gain last night and gave up after 50 attempts.

    73. Re:passwords? by introcept · · Score: 1

      You're now guilty of wire fraud, unauthorised system access and several thousand ToS and EULA violations. Don't ever get noticed by Sony, they own you for life and aren't shy in the courtroom

    74. Re:passwords? by SpanglerIsAGod · · Score: 1

      It really isn't though. If hashed, great, they have a hash of my password. There are many many possible combinations that could map to my password

      If they used a bad enough hashing algorithm to make this statement true it still doesn't matter. They system doesn't know your password, only the hash. That means any password that creates the same hash will let the person log in.

      --
      War doesn't show who is right - just who is left.
    75. Re:passwords? by AJH16 · · Score: 1

      Except in a breach like this, they change the salt for the algorithm, invalidating all existing hashes. The only real possible problem with a breach like this and passwords is that the passwords would be usable on non-breached sites. Good hashing practice and non-dictionary passwords is pretty strong mitigation even with existing hash vulnerabilities.

      --
      AJ Henderson
    76. Re:passwords? by AJH16 · · Score: 1

      It is safest to assume everything is plaintext, yes, but it is also not accurate to say that hashing makes no difference. Proper hashing combined with proper password selection is still pretty secure at least outside a directed attack at you personally.

      --
      AJ Henderson
    77. Re:passwords? by Dare+nMc · · Score: 1

      But encryption doesn't matter when someone also steals the encryption algorithm and keys.

      I am assuming people think Sony should have hashed the passwords. The only reason to store a actual representation of your password (encrypted or not), is if you want to be able to have people recover their same password. Most services make you create a new one, thus no need to store the old one, just a hash of the old one.

      IE If I give you the password hash file, algorithm, and keys (all but the hash are open sourced) from my linux passwd file, you cant find out my exact password from it. given enough time and CPU you can technically narrow it down to a few hundred passwords, but no 1:1 hash->password method exists, only password->hash. When entering the password, the hash is calculated and compared, not the actual password. This is more secure, because a administrator would have access to the hash file, but having a copy of that does him no good, if he looses his admin rights, since they can't login to the network with a hash. Storing plain text password would require changing all admins passwords to re-secure a network after any breach in trust.

    78. Re:passwords? by game+kid · · Score: 2

      You should've told them to make like yeast and bud out.

      --
      You can hold down the "B" button for continuous firing.
    79. Re:passwords? by bioster · · Score: 1
      Agreed. It's easy enough to change your password if you care, but you can't change your mother's maiden name and a lot of sites with the question/answer interrogations use the same questions.

      I can remember calling up a bank on the phone, looking to reset my password. They were very helpful... maybe too helpful. We walked through almost the entire list of "security" questions before we found one I could remember what I had put down for an answer. If someone knew my mother's maiden name, and that had happened to be on the list, I can pretty much guarantee they'd have been able to reset my password and gain access to my bank account.

      Other than the obvious answer of having sites allow you to put in custom questions (and them allowing it isn't really under your control), the only thing that occurs to me would be to provide fake answers. But heck, there are tons of those questions and remembering fake answers to them all would be terrible.

    80. Re:passwords? by EdIII · · Score: 1

      Your same logic is the reason why Facebook is overvalued by, like, a billion times.

      Anytime somebody tells me they have a user base of a half-billion and I personally know people with 35 accounts just to game Mafia Wars, I start thinking the truth is a little different.

      The number of times I have given even 5% relevant information to a website or forum to gain access to service? ZERO

      I have a couple hundred email aliases since I run my own email server. I keep all the welcome messages in one box and a naming convention that allows me to keep track of them.

      For EXACTLY this reason. Sony finally got their asses handed to them and the only people I feel sorry for are the customers.

    81. Re:passwords? by Anonymous Coward · · Score: 0

      Please tell me a manner in which passwords can be stored in a way that they could not be unencrypted. Whether by brute force, luck or an understanding of the underlying algorithm, all encryption can and will eventually be broken.

    82. Re:passwords? by The13thSin · · Score: 1

      Except, then there were Rainbow Tables... but then of course they should've used Salt which I guess they didn't.

      --
      "This should be fun, and by fun, I mean a wholly depressing insight into the cognitive ability of some grown adults."
    83. Re:passwords? by Anonymous Coward · · Score: 0

      For EXACTLY this reason. Sony finally got their asses handed to them and the only people I feel sorry for are the customers.

      I'm sorry. I understand your paranoia and go to similar lengths to protect my own privacy, but expecting it to be common practice is ridiculous. The common user simply doesn't have a good enough model of what is going on to consider following those steps. On top of that most wouldn't care. You could argue it is a problem of education... but claiming a need for user education is usually a cop-out for a system not be usable enough. The problem is that (1) it is legal for a company to require/store information they don't need to provide a service and (2) a lot of "private" information is more useful than it should be (my credit card number should just be a number identifying my credit card account; it should not matter who knows it).

    84. Re:passwords? by vadim_t · · Score: 1

      I despise Sony, but hashes wouldn't have changed all that much.

      Hashes are awesome for small systems. If there are 5 accounts, all of which have good, secure passwords, then things are pretty solid.

      With 77 million accounts though, there are bound to be thousands of accounts with "password" as their password.

      From some googling it seems reasonable that a single pass could be done in maybe 15 minutes on decent hardware. Pick the 10 most used passwords, and in a few hours you'll easily get hundreds of thousands of accounts.

    85. Re:passwords? by DM9290 · · Score: 1

      I'm in Canada. My netflix works.

      --
      No one has a right to their *own* opinion. They have a right to the TRUTH.
    86. Re:passwords? by Anonymous Coward · · Score: 0

      to play *(&^%*&^ video games

      What kind of games are star-bracket-and-caret-percent-star-and-caret video game?
      Are those targeted to people who are so brainwashed by the propaganda of religious schizophrenia abuse organizations ("churches") that they censor themselves for no logical reason, and don't even know why, by any chance?
      If yes, then I bet you like them. :P

    87. Re:passwords? by Anonymous Coward · · Score: 0

      Pretty sure that you should not hold your breath on that.

    88. Re:passwords? by SirGeek · · Score: 1

      The best solution ?

      Get yourself a Discover Card and use their "Single Use" credit card numbers. Once its used it can't be used anywhere else BUT on PSN and by your account. And you can easily generate a new one every single time you "fill" your account.

      I'm just pissed that now I have go through the hassles and headaches of getting all the accounts updated. Thank god I run my own mail server so that only my playstation email was compromised and that will now get updated.

      Such a freaking pain in the arse, time to get a password safe and use a unique password EVERYWHERE online...

    89. Re:passwords? by gstoddart · · Score: 2

      Are those targeted to people who are so brainwashed by the propaganda of religious schizophrenia abuse organizations ("churches") that they censor themselves for no logical reason, and don't even know why, by any chance?

      As Miles Davis said ... It's not the notes you play, it's the notes you don't play.

      If I thought swearing would have helped me make my point any better, I fucking well would have.

      Profanity is like any other aspect of the English language -- it has its uses, but doesn't need to be overused.

      --
      Lost at C:>. Found at C.
    90. Re:passwords? by Anonymous+Cowpat · · Score: 1

      Sony are either evil or grossly incompetent

      I hope that's not an XOR...

      --
      FGD 135
    91. Re:passwords? by schnell · · Score: 1

      But it's interesting to me that you seem to imply that you are happy to do business with an evil company, but not a stupid one.

      Interesting point and worth an explanation. I don't generally tar all of Sony with the same brush as Sony Music. I work in a large enough company to know that one group usually has nothing to do with the others, so I don't hold division A responsible for the misdeeds of division B. For example, I seriously doubt the people at Sony making televisions have any involvement with or clout over the people at the record label.

      Therefore I choose to think of Sony Music as evil and Sony Computer Entertainment as either negligent or (if they did indeed leave passwords in plaintext) stupid. I find it far more fair to boycott the products of the division I dislike - and I don't buy Sony Music products - than to boycott all the products of the company as a whole, so at least my displeasure is registered against the particular offending organization.

      --
      "95% of all Slashdot .sig quotes are incorrect or completely fabricated." -Benjamin Franklin
    92. Re:passwords? by Spazmania · · Score: 1

      For responding to a factual question with a message indicating a refusal to answer and declining to divulge my date of birth?

      Bring it on man.

      --
      Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
    93. Re:passwords? by Man+Eating+Duck · · Score: 1

      So if somebody gets the password database it's safest to assume they've got the passwords in it.

      I'm not a security expert, someone please correct me if I' wrong, but I hope PSN uses salts with the hashed passwords. Without salting an attacker would be pretty much guaranteed to hit quite a few real passwords, many of which would work for other logins as well. 2000 hashes/sec (or whatever) has a great chance of hitting gold when they're applied against 77M rows :)

      If PSN does employ known salts they would only be able to find "a" password that is valid for the PSN network, not necessarily the real plaintext password which would work for other logins. If the salt is secret (not available to the attackers, and reasonably random) the attackers would probably not even be able to do that.

      --
      Are you a grammar Nazi? I'm trying to improve my English; please correct my errors! :)
    94. Re:passwords? by BoogeyOfTheMan · · Score: 1

      You do not need to provide a credit card to sign up for PSN, only if you wish to use one to make a purchase from the PSN store.

    95. Re:passwords? by Anonymous Coward · · Score: 0

      There are existing attacks to quickly find A value that will match to the hash

      No, there aren't. Even for flawed, deprecated algorithms like MD5, there is no known way to quickly find a value that matches an arbitrary hash. Unless the system uses poor or no salt, in which case you can use a rainbow table type approach to break many weak passwords more efficiently than individual brute force attacks would allow.

    96. Re:passwords? by Rakarra · · Score: 1

      And people wonder why so many on-line accounts are set up with completely bogus information.

      Why should I be providing all of this information to play *(&^%*&^ video games?

      Because if you end up finding ways to cheat in games, or you harass other users, or are otherwise guilty of some other misconduct, they need a way of banning you and ensuring that you don't come back. I'm just amazed that they -don't- require a credit card, and that the information you give them could be totally bogus.

    97. Re:passwords? by somersault · · Score: 1

      Yeah that's what I did. Not sure if I'm getting a new number, but don't really need one anyway since the expiry and security code will be different, and if they try to brute force those they're bound to trigger the fraud warning system. My flatmate hasn't even asked for a new card since he keeps a tight watch on his account, and his card provider have been great in the past at refunding him when people scammed his card.. I should probably switch to them sometime!

      --
      which is totally what she said
    98. Re:passwords? by Rakarra · · Score: 2

      You're now guilty of wire fraud, unauthorised system access and several thousand ToS and EULA violations. Don't ever get noticed by Sony, they own you for life and aren't shy in the courtroom

      Wire fraud? No purchases were made, no cash exchanged hands. It's not illegal to give false answers to websites which ask for name or date of birth, nor is it illegal to violate the ToS.

      Sony could certainly shut down his PSN account and there's the off-chance they could sue for breach of contract, but the courts would also come down hard on the prosecutor and whatever you might think of Sony's upper brass, Sony's legal is not nearly stupid enough to find this case a worthy use of their time.

    99. Re:passwords? by speculatrix · · Score: 1

      clearly they decided maybe they're lacking the skills?

      sony job listing on linkedin.com

    100. Re:passwords? by DarwinSurvivor · · Score: 1

      - If you wanted to play any of the games online, you had to have a PSN account. Which meant you had to provide a credit card whether you were ever going to buy anything or not. Wrong. This is not true at all. You can play games without ever providing a credit card. On the other hand, they do require a name, birthdate, and mailing address.

      FTFY.

    101. Re:passwords? by c++0xFF · · Score: 1

      How does building a database of children's names and addresses protect them? Seems to me it does the exact opposite.

    102. Re:passwords? by Anonymous Coward · · Score: 0

      Exactly. If Sony did a half-way decent job the bad guys would have

      1. No way to get passwords from the data except brute force per user
      2. No way to guess which users are vulnerable and worth trying to brute force except maybe demographics (maybe people from Texas have bad passwords? Or people over 35? Who knows)
      3. A high cost per user to either brute force the password or give up after exhausting a set search space. Sony could easily have afforded to set this at $1000 (assuming Amazon cloud prices for sake of argument) per six alphanumeric password. That's enough to basically mean bad guys won't bother.

      But evidently Sony couldn't be bothered. That's negligence right there.

    103. Re:passwords? by qubezz · · Score: 1

      This is precisely why I don't give most companies this information -- because I don't trust them with it. Not to keep it safe, not to use it as they say, and not to provide it to someone else.

      We are Internet. We know who you are. Resistance is futile.

      Thanks to browser fingerprinting, flash cookies, ad network beacons, content beacons, and traffic bugs we put in every web page (digg, stumbleupon, facebook 'like this', twitter), you cannot escape our eye, we know every site you view. We also know your ip address and where you live.

      Oh, and we already know your real favorite pet, you sure were naive back when you had that geocities account. Lying at this point is futile.

    104. Re:passwords? by ZosX · · Score: 1

      But that is a whole other headache. Also prepaid cards are loaded with fees because they typically are used by poor people that have no other options. I had one and left a few dollars in it. After a few months I had a negative balance. I cut up the card. They never mentioned that there would be a monthly service fee in addition to all the other fees you pay just using and adding money to the damn thing. The whole thing is just a scam if you ask me. A bank debit card/visa card would provide a great deal more protection. Especially if you do all your transactions online as visa. I mean think about it. You are putting your money in a non banking institution thus depriving yourself of all the protections offered therein. Are they really going to offer you any kind of insurance against fraud? The card I had mentioned nothing of the sort. Maybe by law they have to offer some protection, but I'd probably say good luck. At first I thought it was a great idea. A throwaway card. But then I realized that every purchase I would make cost me somehow nearly every step of the way where my visa card costs me nothing. If I had no soul I think I would start a credit card company.

    105. Re:passwords? by Chubcorp · · Score: 1

      They were storing passwords in a way that could be unencrypted?

      I'm not positive, but awhile ago (couple of weeks) someone hacked into the PSN and found that no data or anything was encrypted. Possibly because of the fact the the PS3 was 'unhackable' so Sony didn't encrypt anything although something about the way information was sent, like, it couldn't be read. I don't know this is all vague memory I'm going off of here.

    106. Re:passwords? by Nyder · · Score: 1

      As a previously happy PS3 user, I'm infuriated at their shoddy handling of this whole thing. The delay in notifying customers was inexcusable, and I still don't understand how passwords could have been compromised... I refuse to believe that even Sony would have stored them in plaintext. The only thing that makes sense to me is that they were stored in hashes but Sony is concerned that the hashed passwords are subject to brute force attacks. I spent a good chunk of last night changing all my online passwords that were the same as the one used in my PS3 account, and that meant dozens of accounts. (Thank goodness none of them were bank-related.) I guess that I should have moved to a system of unique passwords for each site before, and this finally forced me to do it.

      I am struggling to find a bright spot anywhere in this, but if I were to find one it would be that Sony must understand how badly they have pooched this situation. I would expect some serious mea culpas and free crap out of them (like free PlayStation Plus for a year or something) out of this. I don't know whether I actually want that, but it should be interesting to watch them grovel for my online trust and/or business back.

      Too bad it took something bad happening to open your eyes. Peeps been telling you how fuck up sony is for a long time, but in your fanboyism outlook, you thought we were talking shit.

      Sorry you had to find out this way, but think of it like this.

      Whomever stole your info, had a whole week to do shit before you found out.

      --
      Be seeing you...
    107. Re:passwords? by Unequivocal · · Score: 1

      Well, they require *a* birthdate, and one you can remember later, but they don't verify it's really yours. I never put my real birthdate into these systems for exactly this reason. Just think of a birthdate near yours that you can remember and use that -- this may help keep thieves out of the really important accounts like banks, etc.

    108. Re:passwords? by Unequivocal · · Score: 1

      Dictionary attacks can reverse some one way hashes. You just re-hash all the dictionary words and combinations of dictionary words you can afford through the same hash algo that they used and then just match between the password file and the dictionary hashes.

      This is why you should always "salt" your password hashes with a unique random value. The value can be stored in plaintext and all it does is force the attacker to create a new dictionary hash table for every salted hash password they wish to crack, which greatly increases expense and difficulty.

      Of course if a user's password is strong (upper, lower, syms, nums) and long, then it becomes a whole lot harder to crack their hashed p/w with brute force / dictionary-like lookup tables. Can still be done and probably gov't agencies do it periodically when they really want something. Who knows maybe even bot operators do it (they would seem to have the horse power if they were inclined to use it that way).

      I was reading some docs on truecrypt recently where they suggest that less than 20 chars of hard p/w is not really secure against brute force anymore.

    109. Re:passwords? by Anonymous Coward · · Score: 0

      It is possible to remove the unencrypted password RAM on the server-side. It's a simple matter of altering the authentication program to dump the unencrypted password to a location of choice after performing the hash comparison and verifying that it is correct. Simple as pie, yo.

    110. Re:passwords? by Anonymous Coward · · Score: 0

      If the security answers were compromised, it doesn't much matter whether the password was hashed.

    111. Re:passwords? by kiddygrinder · · Score: 1

      bullshit, you can create a psn account without a credit card. everything else you said was valid.

      --
      This is a joke. I am joking. Joke joke joke.
    112. Re:passwords? by kiddygrinder · · Score: 1

      who's giving them a free pass? the people who don't get it don't care and everyone else realises sony is basically distilled satan with added 3 stooges (minus any humor).

      --
      This is a joke. I am joking. Joke joke joke.
    113. Re:passwords? by Anonymous Coward · · Score: 0

      Why, because somebody might impersonate you on IGN?

      Um, because he said

      many of those 77 million people likely used the same password here as they did for those forums or for other sites

      I mean I understand not reading TFA, even TFS, but at least read TFC you're replying to.

    114. Re:passwords? by Debro · · Score: 1

      Int Generate_random_encryption_key()
      Return(4)

    115. Re:passwords? by AJH16 · · Score: 1

      Yes, I'm familar with dictionary attacks and mentioned them in my previous post. You are also correct that it is possible to brute force an individual password, but it would be time consuming and expensive to do it if it is immune to dictionary attacks and properly salted. It is very much computationally feasable to run all the permutations for one, but becomes increasingly less computationally feasable to do it on a large scale. Say you can crack a properly salted hash in an hour that isn't dictionary crackable. Now multiply that by 77 million. I don't really need to worry about my password being cracked any time soon even if they can do it 1 per minute.

      --
      AJ Henderson
    116. Re:passwords? by Anonymous Coward · · Score: 0

      Wow. The shitheaded $ony trolls were out in force today downmodding anything that was against their fucked-up corporate overlords, huh?

    117. Re:passwords? by AmiMoJo · · Score: 1

      Putting rootkits on CDs is evil. Storing passwords in plaintext is stupid.

      I'd put the rootkit down to stupidity too. It was developed by a 3rd party who sold it to Sony. They must have billed it as a solution to CD piracy and Sony was too stupid to properly investigate and test it. This was Sony's music division after all, i.e. a bunch of record execs who are clearly clueless about technology.

      As a general rule you should never attribute malice to what can adequately be explained by stupidity.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    118. Re:passwords? by AmiMoJo · · Score: 1

      I wonder how much these replacement cards cost Visa and if they plan to ask Sony to cover the cost.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    119. Re:passwords? by Unequivocal · · Score: 1

      Assuming the passwords at Sony were hashed at all, which isn't a sure thing at this point. Would be shocking if they weren't but then this whole debacle is fairly shocking already.

    120. Re:passwords? by AJH16 · · Score: 1

      Yeah, agreed. That's why I really want to know if and how they were hashed. I'm trying to figure out the personal impact on me here and if I should be almost able to ignore it other than asking for a new CC number or if I should be freaking out that I need to change my password on any other accounts that shared that password or security questions.

      --
      AJ Henderson
    121. Re:passwords? by AragornSonOfArathorn · · Score: 1

      GP is probably talking about prepaid points cards, not prepaid credit cards. It's often cheaper to use those points cards anyway, because you can sometimes find them on sale.

      But I agree about prepaid credit cards. In general, they are evil :)

      --
      sudo eat my shorts
    122. Re:passwords? by mug+funky · · Score: 1

      that the best you can do? lol.

      trolls on ritalin.

  3. DRM by UninformedCoward · · Score: 3, Funny

    Hows that online requirement DRM working out for you guys?

    ~UC

    1. Re:DRM by Anonymous Coward · · Score: 0

      Don't worry ,the cognitive dissonance will set in and they'll blame "them evil hackers", not Sony, for being unable to play their precious games offline. The people must have their soma.

  4. skynet by Anonymous Coward · · Score: 0

    skynet is trying to steal my identity!

  5. Sony isn't using the term "massive identity theft" by elrous0 · · Score: 5, Funny

    They're calling it an "unexpected mass friendship opportunity."

    --
    SJW: Someone who has run out of real oppression, and has to fake it.
  6. SonyDownhill by thestudio_bob · · Score: 2, Interesting

    Gee, Sony just catch a break lately. I'm wondering if they are going to be asked to appear before the US Senate to explain their actions, just like Apple and Google? I think this is a little more serious than just tracking my phone location.

    --
    The real Sig captains the Northwestern. This one captains /.
    1. Re:SonyDownhill by vlm · · Score: 2

      I'm wondering if they are going to be asked to appear before the US Senate to explain their actions,

      http://www.opensecrets.org/pacs/lookup2.php?strID=C00282038

      $211,925 tries to say "No"

      Google sent four times that just to Barack Obama alone, and that didn't save them.

      So I'm guessing the answer will be "Yes"

      --
      "Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
    2. Re:SonyDownhill by greg1104 · · Score: 2

      One senator is already writing them nasty notes.

    3. Re:SonyDownhill by Jawnn · · Score: 1

      http://www.opensecrets.org/pacs/lookup2.php?strID=C00282038

      $211,925 tries to say "No"

      Google sent four times that just to Barack Obama alone, and that didn't save them.

      So I'm guessing the answer will be "Yes"

      Well now, see? There's your problem. Google didn't grease the right palms. Obama doesn't hold Senate hearings. The Senate does.
      I swear. These Washington newcomers can be so slow on the uptake sometimes. Learn how the game is played before you start handing out the cash.

  7. Unencrypted = Stupid by Bloodwine77 · · Score: 4, Informative

    It amazes me that a company as large and established as Sony would make such a boneheaded move as storing sensitive information in plaintext. Passwords and answers to secret questions should always be hashed. Credit card information and other sensitive information should be encrypted (preferably AES-256 or stronger).

    1. Re:Unencrypted = Stupid by drinkypoo · · Score: 4, Interesting

      We need laws for this crap now. Someone doesn't even try to use adequate obfuscation, they are accessories. Specifically, for protection of SSNs (yes I know the fact that they are good for so much is stupid, but we live in reality) and credit card numbers, and anything else equivalent.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:Unencrypted = Stupid by 0123456 · · Score: 4, Insightful

      Why are you surprised that big companies would do stupid things? Particularly one who thought that installing rootkits on peoples' computers when they played a CD was a pretty darn cool idea?

    3. Re:Unencrypted = Stupid by alen · · Score: 1

      Engineer - yes we can make it secure, we just need another 3 months to code and test it

      PHB - no way, XBL is kicking our a$$. we release tomorrow. we'll just add a firewall and use the cloud to secure the data

    4. Re:Unencrypted = Stupid by fuzzyfuzzyfungus · · Score: 1

      I'm assuming that the credit card portion of the system had to pass PCI DSS tests, which would presumably mean some form of encryption in use. Presumably, though, it didn't preclude some sort of boneheaded-but-efficient(since, after all, PSN CC information would presumably be being retrieved a lot for casual game purchases and the like) storage of the keys/credentials in some vulnerable spot.

    5. Re:Unencrypted = Stupid by Random2 · · Score: 1

      RTFA?

      Likely does not mean certainty. Stop hyping speculation.

      --
      "Our goal each year should be to increase the number of goals we set for ourselves!"
    6. Re:Unencrypted = Stupid by blueg3 · · Score: 1

      Passwords should be stored as hashes, yes. Answers to secret questions can only really be stored as hashes if you insist on people reproducing spelling, capitalization, and punctuation accurately and you don't intend to use the secret questions for over-the-phone authentication. Other sensitive information can be encrypted, but obviously an automated system that *uses* that information must have access to the encryption key necessary to decrypt the data. Sure, you can have your database and the system that uses the sensitive information on separate systems, but if a person just hacks in to both, they can decrypt the database's data.

      If you can't decrypt and use the sensitive information, there's no reason to store it in the first place.

    7. Re:Unencrypted = Stupid by rsmith-mac · · Score: 3, Informative

      To give Sony all the credit they deserve (however little it is), the sensitive records like passwords probably weren't stored in plaintext.

      It's standard operating procedure at most companies to treat any data breaches as if the data was plaintext and will be immediately exploited. Once the hackers have taken the data, you have no way to tell if they have a way to decrypt/reverse it or not, so you simply assume they do.

      At the same time.almost no one feels like explaining to users what password hashes are and why their data is probably safe, so the public announcements always reflect the assumption above and present the worst case scenario to users, and maybe encryption is mentioned somewhere. Whether the data was decrypted or not, if you say it was then you've covered your ass. It's not as if most laypeople believe that the encryption will hold anyhow.

      In short, Sony's pretty damned stupid, but whether anything was encrypted or not they're going to treat it as if it wasn't, and their warnings are going to reflect that. Just because they aren't talking about it being encrypted doesn't mean it was stored in plaintext. The resolution is the same either way: assume the bad guys have it in plaintext form, and watch your credit reports.

    8. Re:Unencrypted = Stupid by Junta · · Score: 1

      Passwords and answers to secret questions should always be hashed

      Does approximately zero good if 90% of your users have trivial passwords. In fact, 'secret answers' will almost *always* be simple, one-word english text, rendering hashes meaningless. Even if Sony did do hashing, they are going to keep it simply and say "you're screwed" to avoid setting expectations high for people with crappy passwords.

      Credit card information and other sensitive information should be encrypted (preferably AES-256 or stronger).

      If you compromise a running system, then many bets are off here. They could have done this and either:
      -Every user logged in at the time had their password in memory so that they could decrypt (assuming password is the key to per-user crypto-protected storage)
      -The filesystem was using crypto-protection for offline attacks, but given an online attack, the encryption didn't matter (global crypto-protected storage).

      No one should say 'It's encrypted, it's all ok', they should think hard about what it *means* and what the exposures are.

      --
      XML is like violence. If it doesn't solve the problem, use more.
    9. Re:Unencrypted = Stupid by vlm · · Score: 2

      It amazes me that a company as large and established as Sony would make such a boneheaded move as storing sensitive information in plaintext.

      If you remove the assumption that they were owned the same day they were shut down, the logical result is they got owned 77 million card entries ago... Sniff and store each new CC... Months / Years later they get noticed, oops.

      That would also fit with why they didn't restore from backups onto bare metal on day one and be back online within 24 hours. If the backups, going back months or years, are all perfect backups of the infection...

      --
      "Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
    10. Re:Unencrypted = Stupid by _0xd0ad · · Score: 2

      Answers to secret questions can only really be stored as hashes if you insist on people reproducing spelling, capitalization, and punctuation accurately and you don't intend to use the secret questions for over-the-phone authentication.

      Spelling - yes; but capitalization and punctuation can just be ignored. Strip punctuation, convert to all-lowercase, then hash.

    11. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 0

      Question: what's the best way to store the answer to a secret question, if you only intend to ever ask the user to provide the xth and yth character at any one time (ostensibly to provide some protection against key capture software on single use public machines)?

    12. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 0

      Answers to secret questions can only really be stored as hashes if you insist on people reproducing spelling, capitalization, and punctuation accurately and you don't intend to use the secret questions for over-the-phone authentication.

      Except 'secret questions' are retarded, so no-one should be using them for authentication in the first place.

      The great thing is that if joebob@hotmail.com actually gave his mother's real maiden name when asked that as a 'security question' and did it again on another site using the same email address, that account is now toast.

      'Security questions' are just another layer of passwords except people reuse those passwords on different sites and they're easy to guess if you know the person in question and they actually answer honestly. This is why my mother's maiden name is 3x7R%t.

    13. Re:Unencrypted = Stupid by Sir_Sri · · Score: 2

      we don't know how any of their data was stored, or accessed. That's sort of the problem; Sony isn't talking, which is leading to wild speculation, including yours.

    14. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 0

      You can store a hash of a credit card but it's pointless. Brute forcing the hash is trivial because credit card numbers are only 16 digits long which makes for a very small search space, even with a salted hash.

    15. Re:Unencrypted = Stupid by Bloodwine77 · · Score: 1

      The problem with answers to secret questions is that they are essentially passwords themselves. If the cracker or identity thief can see the answers then they can easily reset your password to what ever they desire. It is because of this that they need to be hashed and treated with the same severity as passwords themselves. The answers can be normalized (remove punctuation, either lower or upper case the string, remove spaces, and perform any other normalizations you desire). It is not perfect but should only break down in edge cases. As for over-the-phone verification, you got me there. I understand what you are saying about how the support personnel needs to be able to see the answers when talking to the customer on the phone. While it lessens security somewhat, I guess AES-256 encrypting the answers (instead of hashing) would solve that.

    16. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 0

      r u an idiot, they didn't store it in plain text, but the fact that someone has the encrypted information, even if it can't be unencrypted for 3 million years still means its comprimised.

    17. Re:Unencrypted = Stupid by h4rr4r · · Score: 1

      Really?
      In my limited experience it seems the bigger the company the more likely they will do this. This is because they can.

      Some Mom & Pop does this they will be right out of business. Sony does this and they won't even see the hit on the quarterly report.

    18. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 5, Informative

      Yes, I trust Congress to make laws that will cause secure implementations to be made.

      Remember, these are the guys who can't make a tax code that requires companies to actually pay _any_ tax on billions of dollars' of income.

    19. Re:Unencrypted = Stupid by Tom · · Score: 1

      Encryption is not a panacea. If you can decrypt it, so can the guy who rooted you. It'll just take him a bit more time.

      Some data (like you said) can be one-way hashed, but not all of it.

      --
      Assorted stuff I do sometimes: Lemuria.org
    20. Re:Unencrypted = Stupid by h4rr4r · · Score: 1

      CC info should never have been retrieved.

      GameServer tells CC server via 1 way communication to charge card on file for $GAMER. Then CC machine tells LogServer if it worked or not. Then GameServer is told by LogServer what happened. Credit Cards are loaded onto CC server in a similar one way method.

    21. Re:Unencrypted = Stupid by blueg3 · · Score: 1

      Good call. You could take the same secret question answers and subject them to two transformations: normalization + hashing for online password reset requests and encryption for offline requests. Decent normalization should be able to do a good job.

    22. Re:Unencrypted = Stupid by nick13245 · · Score: 1

      I'm sure they were encrypted. AES-256 is a symmetric encryption algorithm. The key has to be stored somewhere, many times in the same database the credit card numbers are being stored. How else would the credit card numbers get stored to the database in the first place? If they got system level access (which from what they are saying, it sounds like they did...), I'm sure they have encryption keys as well.

    23. Re:Unencrypted = Stupid by ((hristopher+_-*-_-* · · Score: 1

      Was it not hashed?

      Any website that allows you to have you're password emailed to your email address isn't storing them hashed. So there are _many_ sites with that kind of security issue.

      I actually thought that Sony was a password reset, but I have no idea.

      Thing is whoever done the crime had inside information, thats clear.

      It's no use blaming Sony, it's a wakeup call for a lot of big businesses. It's been getting worse over the past few years, I would expect it just to get worse with everything in our homes going online and requesting payment info.

      Probably the biggest wakeup should be for users. NO system is secure if it has to provide itself over public networks, like the internet.

      My advise would be to buy a password generator keyring, have a low limit credit card for online transactions and don't use your main card online. Don't bother about name,address, email etc., it's not worth worrying about it because it's becoming practically impossible to keep that private. If you move house a lot, then it's no issue. :)

      I feel for Sony, they have given me a lot of fun times and memories. Also sucks for Japan too, they love their Sony brand. I wonder if they feel hurt when a national brand gets done over after what's going on there. I imagine so.

    24. Re:Unencrypted = Stupid by DrXym · · Score: 1

      It amazes me that a company as large and established as Sony would make such a boneheaded move as storing sensitive information in plaintext. Passwords and answers to secret questions should always be hashed. Credit card information and other sensitive information should be encrypted (preferably AES-256 or stronger).

      First AES is an encryption algorithm so it has little relevance for storing passwords which require a hashing algorithm. The answer to the security question could be hashed but it's questionable to what purpose it would serve. And for all you know data was hashed, salted, used a secure hashing algoritm and all the rest. But if someone stole the entire db and knew the salting algorithm they could still eventually crack the values. Or perhaps they hashed but didn't salt, or maybe some of the db was hashed only but more recent accounts were stronger. Things in life are never straightforward. As such you want to practice defence in depth. Implement two databases - an account database and a login database. Both dbs are separate from each other so that if one is compromised it does not affect the other. In front you that you have webservices that munge the data to various web servers. In front of that is a firewall. In front of that are the outward facing consumers of the webservices and in front of that is another firewall. All inward traffic would be protected with 2-way SSL and all outward traffic with 1-way SSL. Maybe we'll discover Sony was completely slapdash about it all and made some naive security mistakes. Or perhaps they ran a pretty tight ship but were subject to a sophisticated attack, even some social engineering. Or perhaps one of their ops guys used their superadmin rights to lift a backup of the entire db. I would have more sympathy with the latter explanations than the former. I'm still pretty pissed though. Fortunately the debacles with Kotaku and other forums meant I've already gone through a round of strengthening passwords, ensuring that more security sensitive sites like banks / payment services do not share pwds with online stores which do not share pwds with forums / throwaways. But it's still a pain in the ass to do again and possibly cancel my credit card too.

    25. Re:Unencrypted = Stupid by c · · Score: 0

      > It amazes me that a company as large and established
      > as Sony would make such a boneheaded move

      Are you kidding? This is Sony. Their corporate mission statement goes beyond "not invented here" to more like "not invented by someone working in my department". Not only am I not surprised that essentially all PSN user accounts got stolen and (apparently) they can't recover from backups, but I'm waiting to see what novel approach Sony takes to make a bad situation even more stupid.

      --
      Log in or piss off.
    26. Re:Unencrypted = Stupid by arth1 · · Score: 1

      use the cloud to secure the data

      This is wrong on so many levels I don't even know where to start!

      Yeah, it's so wrong that only Sony could do it. The new Sony, that is -- after around 1999 or so, the quality has dropped below the floor, and the WTFs are now the rule and not the exception. I wonder what happened to turn such a great company into such trash?

    27. Re:Unencrypted = Stupid by stumblingblock · · Score: 1

      Yes, it is likely that Sony will NEVER live down the installation of a rootkit on unsuspecting clients computers. So many otherwise responsible people will feel no sympathy for them, in fact they may ENJOY seeing Sony twist in the breeze. Unfortunate for their customers, but it shows how unwise it may be to be a Sony customer

    28. Re:Unencrypted = Stupid by hibiki_r · · Score: 1

      Credit card information was probably encrypted, if they wanted to achieve PCI DSS compliance. The requirements are far higher than just strong encryption: The encryption key should not be known by anyone, or directly knowable by any single person. The knowledge of any one trusted person in the company should not be enough to weaken the strength of the encryption.

      In practical terms, the kind of system one needs to be PCI compliant (and at Sony's size, they not only have to claim that they are compliant, but are very likely audited regularly), the cards usually are encrypted and decrypted in a dedicated server, and the encryption service, the only one that has the key, does not even store it in a filesystem: Multiple people have to use some kind of security token, and when enough tokens are combined, the service can then calculate what the key was.

      This doesn't make intrusion impossible: Insiders can still use the encryption service to get some clear text numbers. Still, decrypting an entire database without being detected in process should be extremely difficult.

    29. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 0

      Bad hashing does crap all. Bad security is easy, good security is hard. Even many security auditors are bad at telling the difference. If I took 100 slashdotters and made them all implement a security system like this I'd wager 70 of them would be trivial to break and 10 more would be hard, but breakble.

      Want to know what the difference between someone who knows how to do security and someone who does is? The one who does knows just how likely even he is to screw it up.

    30. Re:Unencrypted = Stupid by Eunuchswear · · Score: 1

      This is why my mother's maiden name is 3x7R%t.

      I don't know any other way to put this, but,,,,

      Luke, I am your father.

      Nooooooooooooooo!

      --
      Watch this Heartland Institute video
    31. Re:Unencrypted = Stupid by Hatta · · Score: 1

      Any website that allows you to have you're password emailed to your email address isn't storing them hashed. So there are _many_ sites with that kind of security issue.

      I have NEVER encountered a website that allows you to retrieve your password by email. Every website that I have ever registered on generates new random passwords if you forget your own. What kind of web sites are you going to that are run by such horribly irresponsible people?

      --
      Give me Classic Slashdot or give me death!
    32. Re:Unencrypted = Stupid by gl4ss · · Score: 1

      look, if they were storing the cc's at all they broke their contracts with their credit card processors.

      if that were the case, it would be a major fuckup. or maybe they had a special deal because the didn't bother to do repeat payments properly, this is entirely possible.

      --
      world was created 5 seconds before this post as it is.
    33. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 0

      PCI DSS is a self-answered survey that you do for CC industry once a year. As such, it's nothing more than a mandatory get-out-of-jail-free-card for the processing companies. "It's not OUR fault, they SAID they were in compliance right here, see!" As the IT manager of a small business that processes card transactions every day, I've long since learned to roll my eyes at PCI DSS.

      On another note, our small shop has apparently done a significantly better job at security than one of the worlds largest corporations. Sad. Just Sad.

      I haven't purchased Sony anything in years ... they continue to prove that decision wise.

    34. Re:Unencrypted = Stupid by AJH16 · · Score: 1

      Over the phone is simple, don't display it to the rep. Have the rep enter the answer same as the client would.

      --
      AJ Henderson
    35. Re:Unencrypted = Stupid by AJH16 · · Score: 2

      Yes and no, I agree for the average user, assume the worst is good, but for someone like me who takes precautions to make sure my passwords will hash securely, I'm comfortable not changing non-financial passwords in the event of a disclosure as long as they were hashed. It's a very significant and important distinction for those who take carefully controlling our security seriously but don't obsess over having it take over the usability side. (ie, change every password every time any possible breach may or may not have occurred on every account regardless of sensitivity.)

      --
      AJ Henderson
    36. Re:Unencrypted = Stupid by Zenaku · · Score: 1

      If the cracker or identity thief can see the answers then they can easily reset your password to what ever they desire.

      On some shitty sites, sure. Most reputable services would not allow a password reset purely based on the security questions. Once the user answers them, the server should still only send a password reset link to the email address on file for the user.

      Doesn't help if the attacker also has access to your email, of course, but if you're in that situation not much of anything is going to help.

      --
      If fate makes you a motorcycle, you become a motorcycle.
    37. Re:Unencrypted = Stupid by DigitalSorceress · · Score: 1

      + insightful * 1,000,000

      --

      The Digital Sorceress
    38. Re:Unencrypted = Stupid by Bloodwine77 · · Score: 1

      I don't use the website myself (I am happily married), but I've read that Plenty of Fish (an online dating site) sends you periodic emails reminding you to log in to check out the latest singles and for your convenience includes your password in the email in case you forgot it.

    39. Re:Unencrypted = Stupid by countertrolling · · Score: 1

      ...we live in reality...

      We make the reality

      And you know as well as anybody that any prospective legislation will never be applied to anything the size of Sony.

      --
      For justice, we must go to Don Corleone
    40. Re:Unencrypted = Stupid by countertrolling · · Score: 1

      Unfortunate for their customers, but it shows how unwise it may be to be a Sony customer

      At around 29 bucks, maybe it's not so unwise to become a Sony investor..

      --
      For justice, we must go to Don Corleone
    41. Re:Unencrypted = Stupid by mekkab · · Score: 1

      This french D&D site: dnd.ezael.net. I used a modification of my toss-off password and boy was I surprised to see it sent back to me in cleartext in the "welcome!" e-mail!

      --
      In the future, I would want to not be isolated from my friends in the Space Station.
    42. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 0

      In Australia, knowing someone's SSN won't get you anywhere.

    43. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 0

      PCI

    44. Re:Unencrypted = Stupid by Kalriath · · Score: 1

      Unless you turn over more than $10,000,000 in credit card transactions a year in which case PCI L1 (or is it L4, I forget which way it goes) applies. In this circumstance, you're required to have an annual rigorous audit to prove you comply with the standards. Your piddly small business (or for that matter, mine) has nothing on what the gigantic players have to put up with.

      --
      For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
    45. Re:Unencrypted = Stupid by sjames · · Score: 1

      You're assuming PCI isn't just a scam to see how many flaming hoops they can get you to jump through before they let you join their frat.

    46. Re:Unencrypted = Stupid by swillden · · Score: 1

      Answers to secret questions can only really be stored as hashes if you insist on people reproducing spelling, capitalization, and punctuation accurately and you don't intend to use the secret questions for over-the-phone authentication.

      Spelling - yes; but capitalization and punctuation can just be ignored. Strip punctuation, convert to all-lowercase, then hash.

      If you really wanted to, you could even help with spelling. Hash multiple variations of the word and see if any of them match.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    47. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 0

      Ditto, best thing to do is to assume the worst happened when they were hacked, even if they didn't get anything of value. It triggers everyone to change their passwords and take a higher level of precautions ASAP. They last thing Sony needs is to say "they didn't get anything", then 6 weeks later find out "they got all your credit card data" and in the meantime people have had their identity stolen!

    48. Re:Unencrypted = Stupid by Anonymous Coward · · Score: 0

      I temporary worked as a programmer for TomTom, a well known navigation device company with millions of customers. Not only were (are?) all customer passwords stored as plaintext, the development database copies also included these, so even temp hires like me had unrestricted access to this. On the plus side they didn't store creditcard information.

    49. Re:Unencrypted = Stupid by fuzzyfuzzyfungus · · Score: 1

      I'm assuming that some sort of ill-designed(but checkbox-filling) 'encryption' implementation would be one of the flaming hoops. There seems to be good reason to believe that what Sony did was magnificently ineffective; but that an entity of their size, handling credit cards(across multiple jurisdictions, no less) almost certainly checked every checkbox on the magic list of security cure-alls...

    50. Re:Unencrypted = Stupid by plumby · · Score: 1

      There are laws (or at least mandatory standards laid down by Visa and Mastercard) for the protection of credit card data - PCI DSS. If there's any way that the hackers could have got access to card data in any useful way, they Sony are likely to be failing miserably in their obligations under this.

    51. Re:Unencrypted = Stupid by AmiMoJo · · Score: 1

      I'd say regulation of hazardous chemicals is a better analogy. The rules in place don't prevent every disaster but they certainly do cause the majority of companies to take the risks seriously and put in place heavy penalties for those that don't.

      They key is making data loss a crime rather than just a civil matter people can sue over. That way when it happens the state is obliged to investigate and prosecute, plus the penalties can be given a relatively high minimum to prevent courts being too lenient.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    52. Re:Unencrypted = Stupid by _0xd0ad · · Score: 1

      If they entered more than a word or two the set of misspelled permutations would get prohibitively large rather quickly.

      I could see spell-checking the phrase and correcting any unknown words with their top matches, though. After that it should be pretty safe to assume it will be the same every time it was entered regardless of spelling (unless it was spelled really badly). Hash both the original and the spell-checked answer.

      I don't conceptually like the security question anyway, though. They are really just simple, low-security passwords with a fairly obvious hint. They're a concession to users who can't remember secure passwords, to avoid the extra tech support work created by resetting people's forgotten passwords. I treat security questions as extra passwords, and it's unfortunate that the websites usually don't clarify how long the answer may be and which characters are significant. Generally I use alphanumeric with no symbols, mixed case (although I realize most systems will probably ignore the capitalization - it doesn't hurt anything to have it)... but even then there's the question of how long it may be. Usually I find that 16-20 digits works okay.

    53. Re:Unencrypted = Stupid by sjames · · Score: 1

      I'm sure they were very careful to make sure the swap partition was encrypted....

      They might have even gone the extra mile and encrypted the whole drive, except for the boot partition which held the key so the machine would boot.

  8. Credit card numbers WERE taken too by Anonymous Coward · · Score: 5, Informative

    I posted this in the last thread, but PSN users are already seeing their credit cards being fraudulently used!

    So if you're affected, CANCEL YOUR CARD!

    It's not a possibility anymore, it's a certainty.

    1. Re:Credit card numbers WERE taken too by RobDude · · Score: 3, Informative

      That seems a little extreme.

      You aren't liable for fraudulent charges. And until Sony sends you a certified letter stating that your credit card was compromised you don't know that your card was. I'll just wait until I see a fraudulent charge, then make a 10 minute phone call and have a new card/number mailed out to me. The biggest pain is updating the reoccurring bills/payments.

      Even if they had access to your credit card number you don't know what they are going to do with it. Sell it? Maybe. Or maybe they are just using this to piss off Sony. And, according to Sony, they only have the credit card #s - not the CVV or CV2 code. So, it would be reasonably difficult to make a purchase.

      I'll alert Capital One as soon as I see a fraudulent charge.

    2. Re:Credit card numbers WERE taken too by TheCyberShadow · · Score: 2

      I posted this in the last thread, but PSN users are already seeing their credit cards being fraudulently used!

      Note that this information is currently based on a single e-mail.

    3. Re:Credit card numbers WERE taken too by _0xd0ad · · Score: 2

      Yeah. More worrisome is the fact that if it is a debit card, the money is gone before you can even contest the charge.

      For a credit card, I'd probably wait it out and hope for the best. A debit card, though, would best be cancelled immediately.

    4. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      No. It is not reasonably difficult to make purchases. I had 10,000 dollars of charges racked up at a NYC camera store while I was in Ohio.

    5. Re:Credit card numbers WERE taken too by bendytendril · · Score: 3, Informative

      I received fradulent charges the day after this occured. My bank called me and I had to cancel my card.

      --
      sig: pv qid
    6. Re:Credit card numbers WERE taken too by Pennidren · · Score: 1

      You aren't liable for fraudulent charges.

      Maybe not, but your credit score sure is.

    7. Re:Credit card numbers WERE taken too by DaftDev · · Score: 1

      My card number was used fraudulently in the UK a day after the hacks on PSN occurred. A friend also had his card number stolen as well, and he is a PSN user. Of course there's no way to prove that the number was swiped from PSN yet, but the timing of the theft is interesting.

    8. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      I posted this in the last thread, but PSN users are already seeing their credit cards being fraudulently used!

      Yeah, well so are many, many others.

    9. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      What makes you say it has anything to do with the PSN ?

      Thousands of credit cards get cloned each month. And fraudulent transactions are made.

      77 millions got stolen and 2 or 3 users report a breach of their credit card account.

      Makes me wonder if their cards have been cloned elsewhere.

    10. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      While I agree it is a good idea to go ahead and get a new card (a simple enough process) all I see on that site is 2 unverified claims of credit card fraud supposedly resulting from the PSN breach. There is really no way for the 2 individuals to know (if they were actually CC fraud victims) that their data was stolen from PSN rather than the Applebees they handed their card over to to pay for dinner with the family last Friday. Or, this being the internet, they could just be a couple trolls looking to stir stuff up.

      Point remains though, ounce of prevention vs pound of cure. Cancel 'em if ya got 'em.

    11. Re:Credit card numbers WERE taken too by tgeek · · Score: 1

      I'd say there's at least a 50/50 chance you have very little understanding of probability or statistics. With over 70 million PSN accounts compromised, it's very likely there will be people who have fraudulent activity on their financial accounts that is completely unrelated to the PSN breach.

    12. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      Citibank already just issued me a new one the day after this came down...

      I think the major ones already know

    13. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      What foolish lackadaisical attitude of a numbskull. You deserve to be e-raped for complacency.

    14. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      Wish I could vote you up.

      As soon as I heard the news yesterday, I grabbed my card and called the number on the back. Of course, they disabled the card immediately and are shipping me a new one.

      The second thing I did was tell all my friends. Publicly.

      That Sony still hasn't contacted everyone affected amazes me. They have our contact info, they just haven't used it.

      Sadly, I got an email from Angel Online, a Japanese PSN MMO game saying I should change my password. But still nothing from Sony.

    15. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      And you still trust Sony, after keeping you in the dark for 6 days. How long do you thing it took Sony to realize that CCs were stolen? I am sure not 6 days.

      Keep on feeding your money to companies like Sony (installing rootkits on your PC, removing promised features from their beloved console - Other OS, and suing people for altering the products they purchased and own to do what they want it to do) Seriously, you trust a company like that?

    16. Re:Credit card numbers WERE taken too by L4t3r4lu5 · · Score: 2

      And, according to Sony, they only have the credit card #s - not the CVV or CV2 code. So, it would be reasonably difficult to make a purchase.

      Absolutely. It's well beyond the ability of any petty criminal to buy a magnetic strip writer from eBay and put the stolen card numbers onto blanks / gift cards / any magnetic strip card. This was never done before internet purchases requiring CVV / CV2 codes became commonplace, and hardly anybody used cloned cards to withdraw cash at ATMs. Plus, store clerks always check the receipt card number against the one printed on the card itself, because they're vigilant pillars of the community.

      --
      Finally had enough. Come see us over at https://soylentnews.org/
    17. Re:Credit card numbers WERE taken too by mkraft · · Score: 3, Insightful

      The CVV or CV2 codes aren't required to make purchases in all places. Yes, for most cards you aren't liable for fraudulent purchases, but the money has to come from some where so the credit card companies end up taking a hit and they raise their rates. Besides if you know your card number might have been stolen and don't report it, you might end up having to pay for fraudulent charges since at that point it's basically your fault for not telling the credit card company.

      More importantly, the hackers also have your name, address and birth date. That information is nearly enough info, combined with the credit card information, to have your card canceled and another one issued to them. They could initiate a USPS change of address (since they have your name and address) to wherever they want, call your credit card company to have a new card sent out and then simply activate that card when they get it.

      It's much easier to preemptively have your credit card company reissue a card now, then try and go clean up a much more complicated mess in the future. That's what I did and my credit card company said that was a smart move on my part.

    18. Re:Credit card numbers WERE taken too by RobDude · · Score: 1

      Quite the contrary....

      Our current credit/debit/electronic payment system it *horribly insecure*. My World Of Warcraft account has more security around it than my life savings. And nobody seems to have a problem with it.

      I've had fraudulent charges appear. I went down to my bank and I said, 'Yes that charge is fraud. Now, tell me, how can I NEVER have this happen again?'

      The guy stared at me like I was crazy. 'What?'

      I said, 'What security solutions do you offer to secure my card?'

      And he looked confused. 'Umm, well, we issue you a new card....with a new number'.

      But the fact remains, every time I go to a restaurant and pay with my credit card the lady swiping my card has all the information she needs to buy whatever she wants. That's by design. That is how the current system works.

      I said, 'How about a dual-factor authorization? Can I get a fob that generates a 5-6 digit keycode that needs to be entered along with my credit card number? So that, whenever I pay for something, it's only valid for 10 minutes or something?'

      He said....'Ummm, no'

      I said, 'How about limitations on the location? I only want to use this card in town. I don't travel very often. Can you make it so that this card only works in $MYCITY unless I log into the website and update it, for the rare case when I do travel?'

      And he said, 'Uhhhhh, no, I don't think we can do that'.

      And I said, 'Okay. Well, I really only want to use this card to pay bills. I only have 5 or 6 bills and they are due each month (well, one is due every 3 months, but still). Can I make a whitelist of companies that are authorized to bill my account and have any other attempt immediately declined?'

      And he said, 'No.'

      And I said, 'Okay - well, how about you just have an automated voice system where my cell phone rings every time someone tries to use my card and if I don't press '1' it is denied'

      And he, now visibly annoyed, said 'No'.

      Businesses are in the business of staying in business. They want money. That's what they do. As long as customers are willing to jump through hoops to make their antiqued systems work, that is what they will do. Seriously, I have more control over SPAM in my inbox than who is authorized to bill me for hundreds if not thousands of dollars. Because people are content with this system. And when it goes wrong, the sit on hold, wait in line, get a new card, and spend hours on the phone updating information.

      Make it *the banks* problem. They are far more likely to fix their problem than they are to fix your problem.

    19. Re:Credit card numbers WERE taken too by RobDude · · Score: 1

      The only way someone would end up on your credit score is if someone established a new line of credit in your name. That's identity theft. Getting a new credit card would not prevent that in any way.

      Your credit card company is not going to report a fraudulent charge as you not paying your bill.

    20. Re:Credit card numbers WERE taken too by _0xd0ad · · Score: 1

      However, if an unauthorized charge shows up, you dispute it and the credit card company has to eat the loss, so you are protected in any event. Rather than secure the system which allowed fraudulent charges to be made, they prefer simply to accept the losses as a cost of doing business.

      Debit cards, on the other hand, are dangerous. I have one, but I almost never use it.

    21. Re:Credit card numbers WERE taken too by RobDude · · Score: 1

      The reason there is a '2' in CV2 is because there is already a CV1.

      The CV1 is encoded on the magnetic strip. When you swipe it, more information than just the credit card number is passed along.

      Thus, when you swipe the card, the # and the CV1 are used to determine that the card is legit. When you buy online the card # and the CV2 is used. Even if you purchase a magnetic strip writer you couldn't duplicate the original card's data because the CV1 data is unknown.

      I'm not saying there aren't ways around it. But I am saying there are some barriers. A combination of luck, your card provider and who ends up with your data is going to determine whether or not you see a charge on your card.

      I'm sure we'll never see any actual data on how many credit card numbers were stored verse how many get used; but I'm fairly certain it will be less than 100%

      Sony had my credit card and, thus far, no charges. As soon as I get one, I'll notify my CC company.

    22. Re:Credit card numbers WERE taken too by RobDude · · Score: 1

      I don't see how getting a new card # will help with the address/name/birthdate information.

    23. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      You aren't liable for fraudulent charges.

      Maybe not, but your credit score sure is.

      Uhhhh.... NO

    24. Re:Credit card numbers WERE taken too by HAKdragon · · Score: 1

      While I've been keeping a close eye on my online credit card statement and everything looks legit, I did call my bank and have the card that's tied to my PSN account canceled. I figured being without a credit card for a week is probably better than some of the possible alternatives.

      --
      "Our opponent is an alien starship packed with atomic bombs. We have a protractor."
    25. Re:Credit card numbers WERE taken too by Patch86 · · Score: 1

      Depending on your jurisdiction, failing to cancel a card when you have good reason to expect it has been stolen/compromised puts the liability back on you.

      It's a nasty trick on the part of the banks, but a legally tested one that they may very well use on you if they're feeling tight-fisted that day. Don't risk it- order yourself a replacement card and move on.

    26. Re:Credit card numbers WERE taken too by Pennidren · · Score: 1

      Your credit score can be negatively impacted simply by being a victim of identity theft and/or having fraudulent charges posted to one of your accounts (even without "real" negative repercussions such as you not paying bills you were not even aware of).

      The rationale is that you, as a customer, may frequently engage in "risky" purchasing behavior which makes you a more likely victim of these crimes. Sort of like how your car insurance can go up if you get into an accident through no fault of your own.
      If you only have one incident there will be low or no impact, so this PSN fiasco is not going to ruin your credit score overnight. But who knows what financial issues you will go through in the next few years? (It seems like these breaches are occurring pretty often, of late.)

      Source: I worked for a debt collection agency for a few years.

    27. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      It can take several weeks to dispute fraudulent charges. In that time you either have to pay the full bill or interest on it.

    28. Re:Credit card numbers WERE taken too by RobDude · · Score: 1

      As soon as Sony notifies me that my card has been compromised, I'll notify my bank. I don't have time to read the blog of every company I do business with. All I know is that, when I try to log into PSN, it says they are down for maintenance.

      I'm not concerned that someone at the bank is going to spend hours tracking down my online identity to find my Slashdot posts and show that I had reason to expect my card info was stolen.

    29. Re:Credit card numbers WERE taken too by Pennidren · · Score: 1

      Your credit score can be negatively impacted simply by being a victim of identity theft and/or having fraudulent charges posted to one of your accounts (even without "real" negative repercussions such as you not paying bills you were not even aware of).

      Oops, meant to bold the second part. Disputing charges (whether fraudulent charges or legitimate charges made by you to vendors which did not follow through on delivery of purchased goods/services) can negatively affect your credit score.

    30. Re:Credit card numbers WERE taken too by tgd · · Score: 1

      Source: I worked for a debt collection agency for a few years.

      Good to know the debt collection agencies lie to thier employees as much as their employees lie to their victims.

    31. Re:Credit card numbers WERE taken too by Five+Bucks! · · Score: 1

      How can their money be stolen from their chequing (debit card) account when the data taken from PSN includes credit card info? I think I'm missing something...

      In either case, I got in contact with Master Card and they said I'm free to request a new card if I wanted, but the data taken from PSN doesn't include the pin number (for those with chip cards) or the security number on the back. The customer service agent went on to say that fraudulent purchases are insured against anyway, so there's no worry there.

      There really doesn't seem to be a legit reason to cancel your card.

      Nevertheless, this whole thing sucks and Sony can chew my wang.

      --
      52 52'23" W 47 32'07" N
    32. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      You don't need a valid cvv to make a purchase.

    33. Re:Credit card numbers WERE taken too by _0xd0ad · · Score: 1

      No you don't.

    34. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      What if you know your card has been compromised, and you sit back and do nothing until the criminals start using it? Could that make you at least partially liable? Is there something about this in the agreement you signed?

    35. Re:Credit card numbers WERE taken too by AK+Marc · · Score: 1

      Unless the credit reporting agencies are committing fraud in violation of a large number of federal statutes, you are wrong. They are required to report the data used to determine your score. Having a single fraudulent account for which you have to cancel a card and get a new one issued does not show up on your credit report. How do I know? I've done it and looked at my credit report. Either my credit report was in violation of a large number of federal laws, or you are wrong.

      Now, if you are talking about someone who had "real" identity theft, where someone stole from multiple financial institutions using their name, then evidence of that will end up on a credit report (though illegally, but that's only the little laws, of which so many are ignored). But that's not related to the initial "cancel your card associated with PSN" statement here. Whether there was a fraudulent charge will not reflect on your credit report when you change your account number.

    36. Re:Credit card numbers WERE taken too by the+eric+conspiracy · · Score: 1

      The big worry is that somebody will use the information garnered to create a new credit card account in your name, take out a bank loan, etc.

      If I were in this situation I'd put a lock on my credit histories.

    37. Re:Credit card numbers WERE taken too by Solandri · · Score: 1

      You aren't liable for fraudulent charges. And until Sony sends you a certified letter stating that your credit card was compromised you don't know that your card was. I'll just wait until I see a fraudulent charge, then make a 10 minute phone call and have a new card/number mailed out to me.

      The credit card companies don't pay for fraud. Their merchant services agreements force the merchants to pay for any fraud. So if there's a fraudulent charge on your card, it ends up costing merchants, who in response have to raise the prices you pay when you buy from them. I won't tell anyone they must cancel and reissue their card, but do keep this in mind before you dismiss this as "doesn't cost me anything."

    38. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      Capital One? Seriously? Fuck those guys. They send out more pre-approved credit offers than ANYONE ELSE. Chase comes in a close second, but Capital One is the reason I finally felt compelled to put myself on the opt-out list.

    39. Re:Credit card numbers WERE taken too by _0xd0ad · · Score: 1

      Really, it bothers you that much to get junk mail?

    40. Re:Credit card numbers WERE taken too by alieneye · · Score: 1

      It's not a possibility anymore, it's a certainty.

      It's not a certainty. With 77 million accounts, a certain number of PSN users are going to be the victim of fraud every day anyway.

      Regardless, I just had new card numbers reissued.

    41. Re:Credit card numbers WERE taken too by RobDude · · Score: 1

      Yes, it does it passed on to the merchant. But it is still a hassle for the credit card company. And maybe, just maybe, when enough merchants have enough fraud they'll say, 'Umm, ya know what, this isn't working'.

      Maybe I'm just an optimist....but if something is causing enough pain, someone will fix it. We *can* do so much better than our credit card system.

    42. Re:Credit card numbers WERE taken too by __aamnbm3774 · · Score: 2

      You aren't liable for fraudulent charges.

      There are all sorts of exceptions to that rule. The first most common is that you have a certain period of time, generally only a few days, to find and report such fraudulent charges or you will not be refunded 100%. (do you check your transactions every day while on vacation?) Second, what if they used a Debit card and their checking account was emptied. Sure, they might eventually get their money back, but it could take a month or more.

      So yea, this might actually affect people in a significant way. Quit downplaying this ridiculous breach in security because you monitor your Capital One card every single morning.

    43. Re:Credit card numbers WERE taken too by RobDude · · Score: 1

      Whoa there cowboy...

      I never said anything that downplayed the seriousness of the security breach. I'm not a fan of Sony or PSN. I deeply regret my one purchase I made. Sony can DIAF for all I care.

      What I did say was that *I* would not be cancelling my *credit* card until either I have written confirmation from Sony that my credit card number was stolen or until I saw a fraudulent charge.

      That's *me*. In *my* situation. If you used a debit card, your situation might be different. Personally, I do monitor my credit card activity in near real-time. I get text alerts whenever a purchase is made (or attempted). But, even before that, I considered it prudent to check your activity regularly.

      This Sony hack isn't the only security breech that has ever existed. And many aren't nearly so public. So, regardless, it's good to monitor your card's activity.

      In my case, in my situation, I'm not going to preemptively cancel my card and get a new one when it's no more work to wait for a charge and then cancel. There is a chance I won't get any charges on my card and it will save me the time of getting a new one. The chance of that happening might be small, but it is greater than 0. Thus, it is in my best interest to wait.

    44. Re:Credit card numbers WERE taken too by DaveGod · · Score: 2

      Bearing in mind of course... Say 70m PSN users, lets assume that 50% of them had credit cards on there and that the average frequency of credit card fraud generally is once per person every 20 years (no, I couldn't be bothered looking for a real statistic, or using real math).

      In the week or so since the breach, the average person would have had an approx 1/(20*52)= 1 in 1040 chance of incurring fraud anyway.

      Therefore chances are during that week we could anyway have expected around 1/1040 * (70m * 50%) = 33,654 people who had cards on PSN to have been victims of fraud.

      In that context, that website's 2 seems a bit inconclusive, even before considering the reliability of the source material.

    45. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      Who told you this? It's complete bullshit.

    46. Re:Credit card numbers WERE taken too by Haffner · · Score: 1

      And until Sony announces that the data was stolen, you don't know that it was. Wait, we've heard this before.

      --
      "Going to war without the French is like going deer hunting without your accordion." ~General Norman Schwarzkopf
    47. Re:Credit card numbers WERE taken too by mkraft · · Score: 1

      The address/name/birthdate information is publicly available. Your CC# should not be publicly available and you definitely don't want your CC# and billing address linked together since that's enough to start making online purchases. If a hacker has just your name and address or just your CC# that's not usually enough to make purchases, but having both is. By getting a new card # you greatly decrease the chance of fraud.

    48. Re:Credit card numbers WERE taken too by RobDude · · Score: 1

      Who said anything about trusting Sony?

    49. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      You aren't liable for fraudulent charges.

      Like shoplifting, you still pay for it. Better safe than sorry. And you will potentially be found liable unless you can prove otherwise if your stolen CC number is used to purchase illegal services.

    50. Re:Credit card numbers WERE taken too by Kaenneth · · Score: 1

      I think that's why credit card envelopes generally have "Address correction requested" or "Return Service Requested" printe on them; they are not supposed to be forwarded, but sent back to the sender.

    51. Re:Credit card numbers WERE taken too by keytoe · · Score: 1

      For a credit card, I'd probably wait it out and hope for the best. A debit card, though, would best be cancelled immediately.

      Never, ever use a debit card for anything other than a card present PIN type transaction for exactly this reason. Get a credit card, put the purchase on it, then pay it off immediately.

      Doing this means that the disputed amount is a debt you owe and no longer cash you have. When that amount is 'locked', who cares if you can't do anything with the debt. You sure do care if it's actually cash, however.

    52. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      It's much easier to preemptively have your credit card company reissue a card now, then try and go clean up a much more complicated mess in the future. That's what I did and my credit card company said that was a smart move on my part.

      Same here. My card company resisted my requests to reissue for quite some time, telling me they had everything under control WRT the PSN situation. But I insisted, saying they couldn't possibly know where my card might be fraudulently used next as it almost certainly wouldn't be via PSN ... it's interesting that it's when I asked for something in writing saying that as I'd told them about it they wouldn't hold me responsible for any fraudulent behaviour within the next few months that they relented and just reissued my card.

      It's enlightening to know your card company is perhaps a bit more security conscious than mine ... at risk of looking like a phisher :), could you mention who they are?

    53. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      No, it bothers me this much to get pre-approved credit offers, which have to be shredded, rather than simply thrown away like most junk mail.
      But if I got junk mail in the same quantities I used to get pre-approved credit offers, then yes, it would bother me that much.

    54. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      My debit card was recently cloned, and the bank shut the card down once the thieves started trying to drain the account through POS transactions. They tend to follow a pretty predictable pattern, and it probably helped that it was happening a couple thousand miles away from where I live. The funds have already been reinstated, and I haven't even received my replacement debit card yet. Citizens, for what it's worth.

    55. Re:Credit card numbers WERE taken too by Kalriath · · Score: 1

      The MSA also shunts the liability back onto the bank if the merchant attempts 3DS verification (even if 3DS isn't supported by the card issuer), so long as they do not accept a transaction where 3DS explicitly declined (i.e. the user failed to correctly respond). Morale of the story: if you're processing credit cards online, make sure you're attempting 3DS.

      --
      For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
    56. Re:Credit card numbers WERE taken too by Kalriath · · Score: 1

      Well, I just got two emails from Sony, telling me to change my password (when possible) and that some fucker might have my credit card details. It's a week late, but meh.

      --
      For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
    57. Re:Credit card numbers WERE taken too by mkraft · · Score: 1

      Supposed to doesn't always equal does.

      I still can't get my credit card company to stop sending me those stupid credit card checks. When I get them they go immediately into the shredder.

    58. Re:Credit card numbers WERE taken too by mkraft · · Score: 1

      It's enlightening to know your card company is perhaps a bit more security conscious than mine ... at risk of looking like a phisher :), could you mention who they are?

      Considering I don't even know my new number yet and my card company won't give my new number out over the phone, you couldn't phish with just the company name even if you try, but to make things interesting I'll let you try to discover it on your own. :) They're pretty good at security, they even automatically blocked one of my purchases I made a few months back because they said it was unusual (it was) and wouldn't let it go through until I authorized it. They aren't the best and don't have the best reward plan, but they've always been dependable.

      Pretty much any major credit card company (American Express, Capital One, Chase, etc) should do the same though. If you report a possible loss of credit card info, they should reissue a new card to you. It's actually cheaper for them to send you a new card than to try to hundreds (or thousands) of dollars of fraudulent charges

      The people who are likely to get screwed are people who used Debit (Credit) cards on PSN as those aren't nearly as well protected as credit cards and the funds come directly from your bank account. The exception to that would be people who have specific "debit card" accounts with very little money in it to limit loss if the card is stolen.

    59. Re:Credit card numbers WERE taken too by swillden · · Score: 1

      the money has to come from some where so the credit card companies end up taking a hit and they raise their rates

      It doesn't really change your point, but the "credit card companies" (AKA banks) normally don't take the hit. The merchant who accepted the fraudulent payment usually ends up having to eat the loss.

      Besides if you know your card number might have been stolen and don't report it, you might end up having to pay for fraudulent charges since at that point it's basically your fault for not telling the credit card company.

      It might be "basically your fault", but you're still only liable for at most $50, by law (in the US). In practice, you won't pay a penny.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    60. Re:Credit card numbers WERE taken too by Anonymous Coward · · Score: 0

      My only disagreement is with your comment about CVV/CV2s. I am able to make purchases on my credit card online without presenting a CV2. Rarely am I ever asked for it, so I think it's still quite easy to make purchases.

    61. Re:Credit card numbers WERE taken too by _0xd0ad · · Score: 1

      Never, ever use a debit card for anything other than a card present PIN type transaction for exactly this reason.

      That's a bit like saying your excellent driving habits will make the thief less likely to wreck your car if it gets stolen.

      Get a credit card, put the purchase on it, then pay it off immediately.

      In other words, don't use debit cards, and use your credit cards as if they were debit cards, i.e. don't use them to loan yourself money that you don't have. I concur on both points.

      I wouldn't use my debit card at all if it weren't that a certain grocery store only accepts cash or debit cards. But at least my debit card never leaves my hand, so I can be reasonably sure that as long as they're following the correct procedures my card info will still be safe. If you have to hand the card to someone, though, it only takes a second for them to run it through a magnetic skimmer, and it only takes one such dishonest employee to have your account emptied out.

  9. Re:I guess I didnt miss much by Anonymous Coward · · Score: 0

    Go ahead, blame the victims. I bet you feel so superior now.

  10. Mr Schadenfreude by maroberts · · Score: 1

    is alive and well here

    --

    Donte Alistair Anderson Roberts - hi son!
    Karma: Chameleon

  11. Firmware by joeflies · · Score: 1

    Sony tried to prevent the release of custom firmware due to concerns that it could be used for things other than running linux or homebrew. Perhaps their is some validity to those concerns.

    1. Re:Firmware by Anonymous Coward · · Score: 0

      What does the firmware on the box have to do with anything???
      If they really were using something in the firmware as a substitute for network security they are bigger idiots then they are getting credit for.
      The custom firmware spat was more about Sony wanting to keep content channle closed so that anyone that waned to release a game had to give Sony a cut.

    2. Re:Firmware by DamienRBlack · · Score: 1

      Perhaps they should have secured there network correctly and not counted on the hardware in the user's hands to do it for them.

    3. Re:Firmware by shentino · · Score: 1

      Custom firmware is just an excuse to bash geohot.

      The bottom line is that trusting the client to handle security for you is a bonehead move. You just don't do that period.

      Considering that PSN is accessed over the internet, and consequently exposed to machines other than PS3's, you'd think that Sony could be more careful.

    4. Re:Firmware by Anonymous Coward · · Score: 0

      If all that was needed to compromize 77 million accounts was modified client firmware then I wouldn't trust Sony to put together a sandwich, let alone a secure payment network. You never trust the client; that's rule #1.

    5. Re:Firmware by h4rr4r · · Score: 1

      No. Trusting the client is moronic. Perhaps if they had not been such morons they would not have had such issues.

    6. Re:Firmware by Anonymous Coward · · Score: 0

      I think you nailed it.

      They did something very sloppy they trusted the client.

      Indeed they are not getting enough idiot credit, they are much much bigger idiots.

    7. Re:Firmware by fuzzyfuzzyfungus · · Score: 5, Insightful

      Never. Trust. The. Client.

      If their online systems' security depends on all clients playing by a specific set of rules, it is Broken.(even barring custom firmware, PS3s communicate over the internet via reasonably normal protocols, so it isn't as though the public-facing infrastructure was ever invisible to PCs running whatever people wanted them to run).

      Especially for something as large and potentially valuable as 77 million accounts, many with cards on file, there would just be no way that you could make the client secure enough to serve as a trusted part of your security system: your pirate will give up if you can't flash a firmware in software or do a relatively simple mod-chip install. A more serious hacker might be willing do dump some ROMs, if possible, maybe snoop bus traces if they can get to them, install mod chips that require SMT skills, etc. For 77 million accounts, though, you have to consider the possibility that somebody would commission a serious forensic teardown of your system, decapping, microscopes, and the lot.

    8. Re:Firmware by delinear · · Score: 1

      Completely agree with you, but it won't stop Sony and the bought-and-paid-for-media shifting the blame. A report on the BBC yesterday already claimed the attack was likely caused by hackers incensed at what happened to Geohot (whereas in fact it sounds more like a determined criminal attack to me, stealing credit card details, etc) yet spectcularly failed to mention the OtherOS debacle that allegedly spurred Geohot on in the first place. The responsibility is always either the users or the hackers, never the multi billion dollar profit machine who have the means to take preventative action.

    9. Re:Firmware by matt_gaia · · Score: 1

      Nah, geohot himself is a good reason to bash geohot.... This was just an out-and-out f' up by the security teams in the SCEA/SNEA division. If they have any common sense left about them (and it's looking less likely everyday) they'll sack the folks dealing with security from this generation and do it right next time.

    10. Re:Firmware by IICV · · Score: 1

      Never. Trust. The. Client.

      If their online systems' security depends on all clients playing by a specific set of rules, it is Broken.(even barring custom firmware, PS3s communicate over the internet via reasonably normal protocols, so it isn't as though the public-facing infrastructure was ever invisible to PCs running whatever people wanted them to run).

      Exactly! There have been Wiis and Xboxes with custom firmwares for years now, and nobody has managed to leverage that into a full-scale breach of their respective online systems.

      This is no more or less than pure and absolute incompetence and overconfidence on Sony's part.

    11. Re:Firmware by Maximum+Prophet · · Score: 1

      For 77 million accounts, though, you have to consider the possibility that somebody would commission a serious forensic teardown of your system, decapping, microscopes, and the lot.

      For $77 million accounts the Russian Mob (via the ex-KGB) would commission a serious beatdown, kneecaping, blackmail, and the lot. As always, xkcd to the rescue. http://xkcd.com/538/

      If any one employee has access to that kind of data, they're in trouble.

      --
      All ideas^H^H^H^H^Hprocesses in this post are Patent Pending. (as well as the process of patenting all postings)
    12. Re:Firmware by fuzzyfuzzyfungus · · Score: 1

      Given that Sony seems to have their autopilot set to "amateur hour" some days, anything is possible; but I'd assume that something like the signing keys would be a secret, stored in an HSM, and accessible only with the cooperation of a number of people. Putting that in any one person's hands would be nuts...

    13. Re:Firmware by DCFusor · · Score: 1

      You're totally correct. "The BruceS" has mentioned this many times as well. If you're only guarding a little value, the locks don't have to be so good to make it not worth an attacker's while to break in. But if what you're guarding is massive, there's a different cost-benefit tradeoff on both sides, and it behooves you to pay attention to that as things change. Or better yet, anticipate the change. Sony was surly (a typo that I left as it was better than what I planned) planning on being successful with PSN- so why did they not plan for such success and the negative attention that brings?

      So on top of being more evil than most, they're also incompetent. I've always thought that perfect evil can't exist as "the devil breaks his own tools when they cease to serve him well".

      --
      Why guess when you can know? Measure!
    14. Re:Firmware by AK+Marc · · Score: 1

      Too bad I already posted in this one or I'd just mod you down. Using this as an excuse to make up things to smear homebrew is rude and just plain stupid. The facts will come out, and if it was done from a console (which I'd say is unlikely), we will address Sony's incompetence for that as we cross that hurdle.

  12. Re:Sony isn't using the term "massive identity the by Bloodwine77 · · Score: 2

    You did not lost your identity, you gained additional account holders!

  13. Expulsion by Anonymous Coward · · Score: 0

    If only this were enough to ban Sony and their 'products' from N.A....they more than deserve it.

  14. Makes you wonder by Anonymous Coward · · Score: 0

    I reckon Sony aren't the only ones who are dumb enough to not encrypt user details. I've worked for several companies who don't encrypt their employee data and I could read the lot (not that I cared).

    I do wonder though if the hackers were interested in the user details or if they simply wanted to download Mass Effect 2 for nothing...

  15. I feel like this needs to be here by Anonymous Coward · · Score: 0

    http://anonnews.org/?p=press&a=item&i=848

  16. Re:Sony isn't using the term "massive identity the by DamienRBlack · · Score: 1

    It isn't identity theft, it's identity loaning. You know, like what you do to our games. That'll teach you to pirate. /sony

  17. Re:Sony isn't using the term "massive identity the by sakdoctor · · Score: 2

    Massively Unexpected Online Identity Theft.

    The only way to win...

  18. Leaving PSN Down by TheNinjaroach · · Score: 4, Interesting

    I think the fact Sony has left the PSN in a completely disabled state for the past week could hint at some internal problems with disaster recovery. Their servers have been compromised and can no longer be trusted. In my world, that's a perfect time to re-build your systems from a pristine backup. So why doesn't Sony patch the vulnerability and deploy new servers? Perhaps it's because they don't have any good backups to restore from..

    --
    I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
    1. Re:Leaving PSN Down by Bobfrankly1 · · Score: 4, Informative

      I think the fact Sony has left the PSN in a completely disabled state for the past week could hint at some internal problems with not knowing what the hell they're doing in the first place. Their servers have been compromised and can no longer be trusted. In my world, that's a perfect time to re-build your systems from a pristine backup. So why doesn't Sony patch the vulnerability and deploy new servers? Perhaps it's because they don't have a clue what the vulnerability is...

      FTFY.
      Sony said it has temporarily shut down the PlayStation Network and Qriocity services and hired an outside security firm “to conduct a full and complete investigation into what happened,” but refused to offer details on the hack.

    2. Re:Leaving PSN Down by fuzzyfuzzyfungus · · Score: 1

      The alternate possibility(no more comforting in terms of competence) is that they have backups; but their system suffers from some comparatively deep-seated or systemic fucked-upitude. If they trusted the client or something equally dumb, all the backups in the world wouldn't save them from having to make some rather time-consuming changes and then test them...

    3. Re:Leaving PSN Down by ThatMegathronDude · · Score: 1

      The vulnerability is a massive lack of security throughout the system, namely trusting the clients (PS3 firmware) to manage security. The fix is a rewrite of the security model and patch of all PS3 systems ever made.

    4. Re:Leaving PSN Down by Anonymous Coward · · Score: 0

      Or are unsure of the attack vector and whether or not they know what to patch.

    5. Re:Leaving PSN Down by Xelios · · Score: 1

      Maybe it really does have something to do with a breach of the dev network, if such a thing even exists. If they throw PSN back online without properly patching this hole they're just opening it up to a fresh attack.

      --
      Murphey's fighting Occam, and we're in the stands.
    6. Re:Leaving PSN Down by bioster · · Score: 1

      So why doesn't Sony patch the vulnerability and deploy new servers? Perhaps it's because they don't have any good backups to restore from..

      Perhaps they don't know how they were cracked? Also fairly likely is that as they bring the services back up they need to re-patch and re-check every service for vulnerabilities. Their last clean backup may still contain vulnerabilities.

    7. Re:Leaving PSN Down by Tom · · Score: 1

      So why doesn't Sony patch the vulnerability and deploy new servers? Perhaps it's because they don't have any good backups to restore from..

      Or they don't know what the vulnerability is and don't want to risk it being cracked again within the hour of re-opening it?

      --
      Assorted stuff I do sometimes: Lemuria.org
    8. Re:Leaving PSN Down by Anonymous Coward · · Score: 0

      You're making a bit assumption that Sony knows where and when they were hit.

    9. Re:Leaving PSN Down by delinear · · Score: 1

      They claim that the reason the servers have been down so long is because they're doing just that - they don't want to bring the system back online still vulnerable. Makes you wonder what the issue is that it's taking so long to fix.

    10. Re:Leaving PSN Down by Anonymous Coward · · Score: 0

      this seems to be a job for HBGary Federal.

    11. Re:Leaving PSN Down by TheNinjaroach · · Score: 1

      That's a completely possible situation as well..they are so clueless they couldn't find the vulnerability if they had to. Or maybe it's something else all together. Until we know more, it's pure speculation.

      --
      I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
    12. Re:Leaving PSN Down by Anonymous Coward · · Score: 0

      For the conspiracy theorist in me, I believe this will open up a perfect opportunity for Sony to setup a new PSN and start using a money generating network similar to the XBox 360's network. This is their chance to get away from their free network and try to stop the hemorrhaging of money already happening with their consoles and games.

    13. Re:Leaving PSN Down by DarkOx · · Score: 1

      More likely they know what the vulnerability is but don't have a good way to fix it without major breakage. If it was simple buffer overflow or something where someone spoofed a PS3 and sent PSN some malformed data I am sure it would be fixed by now with a few input validation patches. More likely there is something very fundamental to the operational scheme that is exploitable.

      Now I am sure all the PSN interfacing is done through libraries which are part of the PS3 monitor code that Sony can update but I would speculate they are having problems keeping all the changes under the hood opaque to all that software shipped on read-only blue-ray media.

      --
      Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
    14. Re:Leaving PSN Down by AK+Marc · · Score: 1

      Makes me wonder if Sony is still wondering what the issue is.

    15. Re:Leaving PSN Down by Anonymous Coward · · Score: 0

      I would think that is because the intruders have acquired all the login names and passwords. Really, what is there to restore? All accounts have been compromised. They all have to be wiped and refreshed.

    16. Re:Leaving PSN Down by SuperTechnoNerd · · Score: 1

      Perhaps they feel it's an inside job.. At least partly.

    17. Re:Leaving PSN Down by Bobfrankly1 · · Score: 1

      Perhaps they feel it's an inside job.. At least partly.

      As in maybe someone decided to play a SonyBMG music cd off one of the PSN network servers?

  19. So they took OtherOS out? by slasher234 · · Score: 0

    And now they are raped right in the ass by big anonymous buba.
    Just what they deserve.
    First owned private keys, now owned PSN which is I remind you is the sole reason for updating the firmware
    which removes the OtherOS option.

    Right in the ass, Sony! I really like that
    That what you get when you take our OS out!
    Huge kudos to hackers that did it (And I hope have strong enough balls not to brag about that)

    1. Re:So they took OtherOS out? by Anonymous Coward · · Score: 0

      This hurts customers as much if not more than Sony. Tell me would you shoot your friends and relatives to get back at the government?

      If this job was done by angry-yet-ethical hackers why didn't they just deface the website, instead they stole and are using customer data. No this was not done by the self-righteous people you think did. This was done by greedy individuals solely for monetary gain. They only exploited the recently revealed hole in the playstation as a means to carry it out. These people are not the ones that claim to be bashing Sony and looking out for the consumers. These are the nigerian scammers that send you phishing spam and try to install rogue anti virus malware on your machine.

      As much as I dislike Sony these people are worse and do not deserve any praise.

    2. Re:So they took OtherOS out? by interkin3tic · · Score: 1

      I know we hate sony for the rootkit thing and for taking away other OS (I mean, it was LINUX!) but that's absurd. Removing other OS justifies at most a boycott, not theft, especially not stealing from CUSTOMERS, not sony.

    3. Re:So they took OtherOS out? by slasher234 · · Score: 0

      If just a website was defaced, thats nothing, and nether would they shut the whole thing down if there weren't suspected a theft. Maybe the ethical hacker did breach their customer data and didn't take it? And about hurting your neighbours, well come one, nobody is killing anybody. PSN down means that these kids will just go out for a change and maybe even date someone in real life as opposed to playing in games.

    4. Re:So they took OtherOS out? by slasher234 · · Score: 1

      Its not proven if there was a theft. I feel that what hackers did was to wipe their sensitive systems, thats why they can't get it up and running And probably due to scale of the breach hackers could take the account information. The question if they did isn't answered, and probably won't be ever.

    5. Re:So they took OtherOS out? by slasher234 · · Score: 0

      Why was I modded down?

    6. Re:So they took OtherOS out? by Kalriath · · Score: 1

      Because you're wrong.

      --
      For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
  20. Fallout by Canth7 · · Score: 5, Insightful

    More interesting to me than how the intrusion occurred or how lax Sony's security practices are will be what the public backlash level is like. IT security departments tend to whip up a frenzy with the potential for "end of the company" concerns for data breaches on a regular basis. However, reality is that data loss doesn't always seem to have a particularly negative effect for the company that loses the information. Point in example would be the TJX data loss - http://it.slashdot.org/story/07/03/29/1618239/TJX-Is-Biggest-Data-Breach-Ever. Somehow this hardly seems to have put a dent in corporate profits. TJX's stock is up 100% since 2006 when the breach occurred. http://www.google.com/finance?q=tjx Point being is, if nothing seriously negative happens to Sony then it's no wonder that firms continue to have poor security practices. After all, why bother spending the effort and money to secure data when there is no return on the investment?

    1. Re:Fallout by X.25 · · Score: 5, Interesting

      TJX's stock is up 100% since 2006 when the breach occurred. http://www.google.com/finance?q=tjx Point being is, if nothing seriously negative happens to Sony then it's no wonder that firms continue to have poor security practices. After all, why bother spending the effort and money to secure data when there is no return on the investment?

      Many years ago, I was in a meeting with heads of a bank, discussing their need for penetration testing, auditing, etc.

      So, after all that talk, one guy simply asks:

      "Why would we spend dozens and hundreds of thousands of dollars on security services/products/staff, when it costs us 200 dollars to issue few press releases that claim how no valuable data was lost, and everything will be just fine?"

      I had no answer to this.

      That's why in 2011. we are witnessing things like this.

      That's why in 2011, Sony will still be determined to be PCI/DSS compliant, although they probably don't satisfy 50%-70% of requirements.

      It's because they don't give a fuck and don't care. There is nothing you/we can do to them, they are on the top of the food chain.

      Because humans are greedy, like flashy toys and are too blind to see what's happening in front of their eyes.

      Oh well, back to work :)

    2. Re:Fallout by Anonymous Coward · · Score: 0

      I have a response:

      Because then you will spend hundreds of thousands of dollars later when your network is breached, spend even more cleaning up the mess, then your reputation as a company, no matter what you may think of the masses or how stupid you think they may be, will be forever tarnished.

      But hey, I am only a professional security consultant. What the hell do I know?

    3. Re:Fallout by AK+Marc · · Score: 2

      That's why the free market fails and the government must step in. It costs more than $200, but because banks have successfully convinced people that "bank fraud" should be blamed on the customers of the banks (calling it "identity theft"). But if the externalities are forced to be accounted for by the government (people suing for their inconvenience and fines from the government), then they'll have to re-think their policies. But it will take nothing less than government action for companies to take things like this seriously.

    4. Re:Fallout by Wordplay · · Score: 1

      Depends. TJX doesn't exactly cater to the technically-knowledgeable crowd in particular. Sony straddles that line: yes, the consumer electronics have a broad appeal, but they have significant markets in high-end computers, youth who are reasonably tech-knowledgeable by way of mainstreamed geek culture, early-adopter products like their ebook readers, and so forth.

      These people are more likely to get an idea of just how big of a fuckup this was, especially since it's getting plenty of press. Moreover, eventually this press is going to start touching on the past Sony controversies regarding DRM rootkitting and possibly even something as niche as the OtherOS removal they just got spanked for in Finland. Even if people don't fully understand those issues, they'll get the idea that Sony has an increasingly long history of negative results for their consumer, whether out of malice or incompetence.

      The youth thing is going to be the killer, IMO, if there is one. If someone in the 25-40 set sours on Sony now, all their disposable income goes to someone else. That's potentially decades of lost revenue.

    5. Re:Fallout by Anonymous Coward · · Score: 0

      ... issue few press releases that claim how no valuable data was lost, and everything will be just fine?"...

      Because the truth when it is found that data was compromised that will adversely all parties, playing the guessing game of what made it out and what did not will impact confidence and future prospects while initiating an attempt in deterrence may have at least deterred the suspects.

      I would have thrown that out and walked since they obviously have no real intention of supporting IT when all we are is a cost and not short term ROI. typical fat cat mentality while cashing in while putting in minimal effort towards anything security centric, please don't tell me he was the CIO, I see that title tossed out there with zero regards to the person having practiced anything beyond blackberry/Windows password authentication.

    6. Re:Fallout by g1zmo · · Score: 1

      The grandparent's example of TJX is clearly a counter-example to your claim.

      I understand where you're coming from -- thinking in terms of the technological costs of properly "cleaning up" the mess -- but much like a major oil spill, dollars spent on a little PR spin are 1000x more cost-effective than actual cleanup efforts and completely avoid the consequences that you describe.

      --
      I have found there are just two ways to go.
      It all comes down to livin' fast or dyin' slow.
      -REK, Jr.
    7. Re:Fallout by Anonymous Coward · · Score: 0

      You probably should have mentioned to them that VISA can levy fines of up to $5000 PER CARD in such an incident.

      And if you /flagrantly/ avoid PCI rules then they /will./

      But most people have a shitty audit by a shitty auditor and then when VISA says "you got hacked" they say "but your auditor said we were OK" and VISA goes, "Well, just fix it then."

    8. Re:Fallout by Anonymous Coward · · Score: 0

      "I had no answer to this."

      I would have simply said "Morality" just to watch their own faces go blank as they struggle to comprehend the meaning.

    9. Re:Fallout by zevans · · Score: 1

      It's because they don't give a fuck and don't care. There is nothing you/we can do to them, they are on the top of the food chain.

      The company may be untouchable, yes. But in the UK, under the Data Protection Act, YOU, the employee, can be held legally responsible, even if acting under company orders.

      This focuses the mind of the analyst who is about to do something that they know is wrong or negligent; it also stops the Directors playing games with the legal concepts of "person" and "company."

      --
      "... and more and more now there are all kinds of electronic goodies available" -- Pink Floyd 1972
  21. An ill wind blows nobody well by Sheetrock · · Score: 0, Flamebait

    We're at the point where consoles have achieved parity with personal computers in all ways except freedom. Which begs the question, why not go back to personal computers for gaming? It's ironic, but for most games that come out on consoles a keyboard and mouse are the superior input solution, and you can do a lot more with a computer besides.

    The whole situation brings to mind a discussion I had about information security the other day at the bakery. Ten years ago, who even thought you could play music on a computer? And now look at things. We need to get to a point where instead of using credit card information for transactions we use tokens instead -- that way, if someone gets into a database, they end up with a whole bunch of tokens instead of credit cards. Good luck using tokens anywhere else, they don't take em. Or maybe we should go back to paper for billing.

    Anyway, computers are conclusively better if only for the fact that you can play MP3s while you game. That rules.

    --

    Try not. Do or do not, there is no try.
    -- Dr. Spock, stardate 2822-3.




    1. Re:An ill wind blows nobody well by dev.null.matt · · Score: 1

      Ten years ago, who even thought you could play music on a computer?

      I was definitely playing mp3s on my computer in 2000. Limewire was very popular then, as was Kazaa (or however it was spelled). Torrenting didn't exist yet, but 2001 is certainly not a time when you couldn't play CD quality music on a computer.

    2. Re:An ill wind blows nobody well by vlm · · Score: 1

      We're at the point where consoles have achieved parity with personal computers in all ways except freedom.

      And resolution. 1080 vertical lines would have been quite an achievement on a PC ... in 1988 ... I haven't owned lower than 1600x1200 since the mid 90s.

      And user interface. give me my trackball and keyboard for FPS.

      --
      "Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
    3. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      " Ten years ago, who even thought you could play music on a computer? And now look at things."

      Uhh....Ten years ago, the first napster had already been created, grown into a major phenomenon, and then been forced offline by the courts.

      Portable MP3 players were common items at Fry's and Compusa thirteen years ago.

      Games like Redneck Rampage were delivered with a full set of regular music CD tracks on the game CD fourteen years ago.

      ?

    4. Re:An ill wind blows nobody well by BenFenner · · Score: 1

      We're at the point where consoles have achieved parity with personal computers in all ways except freedom. Which begs the question, why not go back to personal computers for gaming?

      You meant "raises" the question.

      It's ironic, but for most games that come out on consoles a keyboard and mouse are the superior input solution, and you can do a lot more with a computer besides.

      I'll disagree with that, but it's easy to plug in a USB "controller" so I'll still agree with you there.

      The whole situation brings to mind a discussion I had about information security the other day at the bakery. Ten years ago, who even thought you could play music on a computer?

      Seriously? I think I downloaded my fist MP3 in 1997. Before that Midi files were all the rage. Before that, someone programmed the first consumer available computer to play music by controlling the electrical signals sent through the machine and picking it up with an inductive loop.

      We need to get to a point where instead of using credit card information for transactions we use tokens instead -- that way, if someone gets into a database, they end up with a whole bunch of tokens instead of credit cards. Good luck using tokens anywhere else, they don't take em.

      Now you've just gone off the reservation. *sigh*

      Or maybe we should go back to paper for billing.

      Anyway, computers are conclusively better if only for the fact that you can play MP3s while you game. That rules.

      Oh, you're a troll. Fuck. I didn't read your entire thread until piecing it apart. Shame on me.

    5. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      I just spent all of last evening debugging bluescreens, which finally involved grabbing third party DLL's and renaming existing ones where the game was installed.

      While I was busy downloading them and getting my machine updated (mostly waiting for an update to fail to install on startup, which it does every single boot now), I unpacked, reconnected, and played Katamari on my PS2.

      That's why.

    6. Re:An ill wind blows nobody well by Missing.Matter · · Score: 1

      Anyway, computers are conclusively better if only for the fact that you can play MP3s while you game.

      Xbox can do this.

    7. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      You can play music on the PS3 while you game too

    8. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      Ten years ago, who even thought you could play music on a computer?

      Uh, CD-ROM drives were standard in computers since the mid 90's, so I'd imagine pretty much everyone thought you could play music on a computer ten years ago.

    9. Re:An ill wind blows nobody well by delinear · · Score: 1

      Some of us moved to consoles from computers because we were sick of all the messing around and platform and driver inconsistencies and incompatabilities and DRM nonsense and ridiculous install times. With my XBOX, I just drop in a disk and play. I don't spend two days reading forums and tweaking config files. From what I can see, the situation hasn't improved in the 6 years since I gave up on PC gaming (well, all bar Orange box and DoW2) - if anything it's worse, with online only DRM etc (sure the consoles all have DRM, but it's the kind that's largely unobtrusive and doesn't care if I'm connected to the server while playing). I have PCs/laptops/smartphones/whatever for when I need to do something that feels like work, and a console for when I want to do something that feels like play.

    10. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      But my 360 can do that...

    11. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      you can play your music on xbox while you game as well. it just needs to be loaded locally to the xbox... network streaming doesn't work in game for various reasons.

    12. Re:An ill wind blows nobody well by ninjakoala · · Score: 1

      "why not go back to personal computers for gaming?"

      Well, every time I do, I have to sit and wait for endless updates of the OS and games through various cloud services. Heck, some retail games even require that your connection doesn't drop out during game play or your lose your progress. Services are all over the place (EA, Steam, Microsoft), you aren't guaranteed that you can use your preferred input method (Bioshock 2 didn't support gamepads at launch for instance) and some just hate playing with an input device that wasn't meant for gaming in the first place (like me). Yes, for some game types keyboard and mouse are convenient but for most I'd rather have a 360-style controller. Especially since my arthritic condition makes it rather painful to use keyboard and mouse for gaming for any extended period of time.

      "and you can do a lot more with a computer besides."

      This is certainly true. However, while it is a jack of all trades it is not a master of them.

      Gaming on computers has become more convenient recently with Steam, Games for Windows Live (at least if they all guaranteed that you could play the games as you would on your console as a bare minimum), OnLive, but there's still DRM from hell and all the hassle that comes from having a rig that's not entirely devoted to gaming.

      "Anyway, computers are conclusively better if only for the fact that you can play MP3s while you game. That rules."

      Yes. Been doing that since 2005 on my Xbox 360.

      --
      Against the grain
    13. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      It seems like you have not tried to play recent ("AA") games on a PC recently. The one advantage that consoles will always have over PCs is that console owners will never have to wonder "Will my ps3 run this" for too long. the answer will always be yes or no.

      PCs have great customisability, but unfortunately that's a major hurdle for games that have steep resource requirements. It's just not possible to test every combination of graphics card, monitor, cpu and RAM quantity and there are always people who get a less than ideal experience.

    14. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      Ten years ago, who even thought you could play music on a computer?

      ...wait, what? I'm stuck at this sentence.

    15. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      Ten years ago, who even thought you could play music on a computer? And now look at things.

      Dude, what kinda of crap computers were you using 10 years ago?

    16. Re:An ill wind blows nobody well by tgd · · Score: 2

      I was playing MP2s on my computer almost ten years before that.

      And MOD files five years before that.

      And (okay, going to stop before I age myself here ...)

    17. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      It's ironic, but for most games that come out on consoles a keyboard and mouse are the superior input solution

      most games ported from pc that come out on consoles FTFY

      Go play Tekken, Ratchet & Clank, Heavevnly sword... etc or any game for Wii (Games designed for consoles) with a keyboard and mouse - of course you can but it would be as crappy experience as if guy with a game pad tried to compete with elite Couterstrike PC gamers.

      We need to get to a point where instead of using credit card information for transactions we use tokens instead -- that way, if someone gets into a database, they end up with a whole bunch of tokens instead of credit cards.

      PSN makes this possible with prepaid cards (as Blizard with WOW and others) so your 'idea' is already working IRL.

    18. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      Those of us with Xbox 360s are able to listen to MP3s while we game, too....

    19. Re:An ill wind blows nobody well by Lectoid · · Score: 1

      network streaming doesn't work in game for various reasons.

      That is false. I have my mac sharing itunes songs using Nullriver software's "connect360". It's awesome.

      --
      Is it just me, or do you hate it when people say "Is it just me..."?
    20. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      I agree with most of your post, except the last line. You can play MP3s while you game with Xbox as well. I don't know about PS3.

    21. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      You're 30? Me too!

      (getting a mod player on my iphone got me to dig through my mod/s3m file archive from when all I had was a 286)

    22. Re:An ill wind blows nobody well by Anonymous Coward · · Score: 0

      We're at the point where consoles have achieved parity with personal computers in all ways except freedom. Which begs the question...

      No it doesn't. It raises the question.

      http://begthequestion.info/
      http://www.wsu.edu/~brians/errors/begs.html

      Don't try and be smart by using fancy buzz-phrases if you don't actually know what they mean. It ends up having the opposite effect, as well as corrupting English language and spreading bad practices like a virus as others become desensitized to the incorrect forms.

  22. undivided attention of Anonymous by fhage · · Score: 4, Insightful

    I wonder if Sony regrets waving the red flag. http://news.cnet.com/8301-13506_3-20050310-17.html. Anybody heard from geohotz in the last few days?

    1. Re:undivided attention of Anonymous by ArcCoyote · · Score: 1

      Anonymous might be a bunch of trolls and griefers, and would love to pwn Sony hard, but they've denied responsibility for this and wholesale identity theft just isn't their thing. They typically don't go beyond DDoSing and harassing the people they feel are responsible. They're not carders... but if they did decide to start stealing from millions of people, I hope the FBI/DoJ partyvans all of 'em.

      I'm thinking the motivation for this was financial vs. ideological, and organized crime is behind it.

    2. Re:undivided attention of Anonymous by Anonymous Coward · · Score: 0

      Anonymous might be a bunch of trolls and griefers, and would love to pwn Sony hard, but they've denied responsibility for this and wholesale identity theft just isn't their thing.

      You're buying into the media portrayal of Anonymous as a structured entity. You are personifying them as something that has "things" they do, and "things" they don't do.

      I'm thinking the motivation for this was financial vs. ideological, and organized crime is behind it.

      Do you have names for these organized criminals or do they remain anonymous?

    3. Re:undivided attention of Anonymous by Anonymous Coward · · Score: 0

      I don't know. This attack seems a little too competent to be Anonymous. I'm guessing the usual suspects of cyber-crime - people who were after the CC numbers for purposes of fraud.

    4. Re:undivided attention of Anonymous by Anonymous Coward · · Score: 0

      Ah, but you are also mistaken. You equate Anonymous with any random set of anonymous people. That's so wrong it isn't even right.

      Anonymous isn't a structured entity, I'll grant you that. But they (he? it?) are loosely connected by a mindset. It's a hive-mind without central controller, if that makes any sense.

      Not everyone that is anonymous is part of Anonymous and vice versa. And even the 'is part of' phrase is already stretching the concept.

    5. Re:undivided attention of Anonymous by Anonymous Coward · · Score: 0

      This is likely NOT Anonymous. The timing of this event, however, makes me believe that whoever is responsible had figured out how to get into PSN previously and only carried out their big attack/data theft after Anonymous said the would DDoS Sony.

      While this certainly hurts Sony, this also potentially hurts regular users far more. If Anonymous is only interested in punishing evil corps, they wouldn't take it out on PSN users themselves. I feel that whoever carried this out wanted to divert attention to Anonymous.

      If whoever did this is caught, I hope that they are prosecuted to the full extent of the law. On the other hand, rumor is that the arrogance of Sony's management lead them to believe that the PS3 and PSN would never be "hacked." Supposedly all of the customer info, including PASSWORDS, was stored in an unencrypted format (read: Plain Text) which means the attackers basically were able to obtain this info with no extra effort once they broke into PSN.

      If this rumor is correct, which would not surprise me, then this is clear criminal neglect on Sony's part as well and I feel they should also be held criminally responsible.

    6. Re:undivided attention of Anonymous by Ruke · · Score: 3, Insightful

      Definitely. If Anonymous had stolen 77 million PSN accounts, you'd see 77 million PSN accounts available for torrent at The Pirate Bay. Someone would be claiming the hack, and they'd be offering proof, and they'd be bragging about how easy it was. Anonymous is generally in it to ruin Sony's day; credit card fraud is a couple of steps beyond "doin' it for the lulz."

    7. Re:undivided attention of Anonymous by zevans · · Score: 1

      Yeah I saw him the other day in a flash new automobile. Wonder where he got the money...? :-)

      --
      "... and more and more now there are all kinds of electronic goodies available" -- Pink Floyd 1972
  23. Assume all accounts are compromised by Anonymous Coward · · Score: 0

    The most rational thing to do is to assume that all your online accounts are compromised. How many accounts are secretly compromised? How long until your passwords are dumped to some hackers hard drive?

    After the LifeHacker attack, I've moved to a very complicated password system. Each online account gets its own password, usually 15 characters long, comprising of a random series of special characters, uppercase, lowercase, and numbers. These passwords are stored in my wallet, and do not exist digitally anywhere except the particular website. The card in my wallet is basically a business card with random characters all over it. I memorize the location of the password, and how long it is, per website. To login, I pull out my card, and read across while typing in the password.

    The plan is to replace the card every four years, and changing all my passwords on all the websites.

    No duplicate passwords are ever used. The "secret questions" are always answered with random gibberish.

    The most annoying thing is websites that restrict the length of your password, or the number of a particular sort of character... it forces me to search through my card to find a series that fits the criteria.

    CAPTCHA: intrude, lol

    1. Re:Assume all accounts are compromised by cliath · · Score: 1

      cool you can lose your accounts, while someone steals your wallet, too!

    2. Re:Assume all accounts are compromised by Anonymous Coward · · Score: 0

      how? the card is just a wall of random characters... perhaps if there was a huge conspiracy to crack my passwords, and my wallet was stolen by a well funded clandestine agency... so they could steal my identity and run up a bill of $1000 on my credit card...

    3. Re:Assume all accounts are compromised by Anonymous Coward · · Score: 0

      The accounts aren't stolen, but if you lose the card and you haven't memorized the passwords then you do lose access to your accounts. You can probably get back into them all after some lengthy phone conversations, but it would be a major pain in the ass.

  24. Get a gaming PC by Dan667 · · Score: 1

    sony is never going to do what is in the users interest.

    1. Re:Get a gaming PC by SpanglerIsAGod · · Score: 1

      But Ubisoft will.

      --
      War doesn't show who is right - just who is left.
  25. I'm waiting for US Feds to lose 100M+ accounts by peter303 · · Score: 1

    The only reason it probably hasnt happened yet is their system is hacker-resistant being based on COBOL and 9-track tapes. IRS and SS both have legacy systems.

    1. Re:I'm waiting for US Feds to lose 100M+ accounts by Anonymous Coward · · Score: 0

      The only reason it probably hasnt happened yet is their system is hacker-resistant being based on COBOL and 9-track tapes. IRS and SS both have legacy systems.

      The only reason you probably haven't heard about it is they would never tell you if it did.

    2. Re:I'm waiting for US Feds to lose 100M+ accounts by Walking+The+Walk · · Score: 1

      The only reason it probably hasnt happened yet is their system is hacker-resistant being based on COBOL and 9-track tapes. IRS and SS both have legacy systems.

      More likely it has happened already and they just don't know it yet.

      --
      A recursive sig
      Can impart wisdom and truth
      Call proc signature()
    3. Re:I'm waiting for US Feds to lose 100M+ accounts by Anonymous Coward · · Score: 0

      I guess the difference is when someone compromises Sony, they get the police after them. If someone were to compromise the IRS, they would get the CIA after them.

    4. Re:I'm waiting for US Feds to lose 100M+ accounts by Anonymous Coward · · Score: 0

      More than likely the systems do not have any internet connections.

      And if they did, the systems use RACF, ACF2, or Top Secret as a security system. All of which have been using encryption on the password database for years.

    5. Re:I'm waiting for US Feds to lose 100M+ accounts by Tacvek · · Score: 1

      The CIA could only go after Foreign entities, with some limited exceptions. If it was a US citizen, it would be much more likely (but still rather unlikely overall) to find MI6 going after them on invitation of the US Government.

      Of course with with FBI's much more obvious tailing and eavesdropping, the US Citizen would be very unlikely to notice MI6 or CIA operatives, should either being going after them.

      --
      Stylish sheet to fix many problems in Slashdot's D3: https://gist.github.com/801524
  26. Companies need to stop holding on to CC data by Anonymous Coward · · Score: 0

    77 million users personal data and potentially credit card data now in the hand of hackers and they wait a week to come clean about it??!!!! There's really no reason Sony should store credit card info anyway. I'll gladly deal with the "minor" inconvenience of having to type it in every time rather than trust some company to take care of my data. Laws should be created that limit the types and personal data a company can store on it's customers to the minimum required for the transaction. And how long they can keep the data they are aloud to store. Otherwise we'll keep seeing these types of breaches over and over.

    1. Re:Companies need to stop holding on to CC data by delinear · · Score: 1

      That and/or credit card companies need to give us more options to create one time use card numbers, or card numbers that only work with a specific retailer or have limited funds against them. This used to be reasonably commonplace ten years ago but it seems like we've gone backwards in the availability of such features, none of the major card providers seemed to offer anything comparable when I was shopping around last year, which is crazy at a time when everyone is scaremongering about identity theft. Give me the tools I need to protect my security and I'll use them.

    2. Re:Companies need to stop holding on to CC data by ufpdom · · Score: 1

      I wonder what this does for the PCI Rating (ttps://www.pcisecuritystandards.org/ )

      --
      There's no Freedom like UFP-dom
  27. Are they telling people? by f5hacka · · Score: 1

    Is 77 million all the accounts? If not, are they telling the people specifically if their accounts got hacked?

    --
    Hi
  28. New ID by Anonymous Coward · · Score: 0

    There really has to be an overhaul of the whole SSN identification system. Pretty soon everyone will have had their information stolen in one form or another. Just entering your SSN in google up until a couple of years a go I saw hundreds of public records of my information. This is old news and nothing is being done against corporations/institutions like this in return.

    Going back to the thread....First Texas and now this? Insane!

  29. Just when I thought they couldn't get worse. by Bytesahoy · · Score: 1

    I had already planned on not purchasing anything from them again, but I already had a PS3 and I do enjoy playing games online. But now my credit card info is at risk because of their poorly secured network. If I can help it, Sony is never getting another penny from me. Fuck Sony.

    --
    Scourge of the Wastes
    1. Re:Just when I thought they couldn't get worse. by Anonymous Coward · · Score: 0

      I stopped trusting them back in 2005 with their rootkit debacle. They haven't seen a dime from me since.

  30. Just Plain Text? Don't be ridiculous... by bhunachchicken · · Score: 1

    This is Sony we're talking about - they will of course have installed in a rootkit into the data... ;)

    1. Re:Just Plain Text? Don't be ridiculous... by Anonymous Coward · · Score: 0

      Don't be stupid, they only try to install rootkits into their customers systems.

  31. Might not be bad... by Junta · · Score: 4, Interesting

    There are two schools of thought here...

    If the passsword is stored as a hash on the server, then it is more resistant to attacks against the storage of the server. However, this does require the password be transmitted over the wire in one way or another on every connection. A man-in-the-middle attack with ip spoofing or dns cache poisioning has a non-trivial shot at compromising the password.

    If the password is stored 'in the clear' on the server side and treat the password as a shared secret, then *if* you design the authentication right, you render man in the middle infeasible with the tradeoff of storage attack being a large exposure. A common scheme is to have client have a packet, concatenate with the password, calculate hash, then strip password before transmit. Server then repeats calculation and only accepts payload if secret matches. Usually, server responses are protected the same way, meaning only the server you *meant* to talk to can meaningfully respond because it needs your password to calculate correct hash responses.

    All that said, it's also entirely likely that Sony has crypted hash passwords, but it's safer to say 'your password is compromised', because of how many users have passwords like 'yourmom65' rendering the hashing pointless.

    --
    XML is like violence. If it doesn't solve the problem, use more.
    1. Re:Might not be bad... by Anonymous Coward · · Score: 2, Informative

      actually, you can store the password as a hash _and_ not transmit it in clear for authentication...

      1. server has hashed pw + salt1
      2. server randomly generates salt2, sends salt1 and salt 2
      3. client calculates x == hash(hash(pw, salt1), salt2)), sends it to server
      4. server calculates hash(hashed pw, salt2) and compares to x

      result: server has hashed pw and pw is never transmitted in clear...

    2. Re:Might not be bad... by traindirector · · Score: 3, Insightful

      If the password is stored 'in the clear' on the server side and treat the password as a shared secret, then *if* you design the authentication right, you render man in the middle infeasible with the tradeoff of storage attack being a large exposure.

      And why couldn't a hash of the password be used as a shared secret? As long as the client can do the hashing, I see no reason the hash couldn't be used in place of the original password.

      As a potential answer to my own question, maybe they wanted to make sure their log in form would work on a web browser without scripting.

    3. Re:Might not be bad... by aaaaaaargh! · · Score: 1

      If the passsword is stored as a hash on the server, then it is more resistant to attacks against the storage of the server. However, this does require the password be transmitted over the wire in one way or another on every connection.

      What an utter nonsense.

        Server stores hash, client computes hash, transmits hash, server compares hash. Not very hard. For additional security, you should encrypt the whole session with a session key derived from the server's public key.

    4. Re:Might not be bad... by Anonymous Coward · · Score: 0

      no, that is a bad idea... because now everyone who knows the password hash can authenticate himself against the server.
      So anyone playing MITM can access all resources (but still doesn't know the password). This is at least a _little_ bit more secure (because of password reuse) but not secure enough...

      don't feel bad though, MS did exactly that mistake with their NT-Lan-passwords ;)

      see my last post for a better solution...

    5. Re:Might not be bad... by aaaaaaargh! · · Score: 1

      Oh yeah, and I forgot to mention that you should use salts, of course.

    6. Re:Might not be bad... by akh · · Score: 2

      There's no need to transmit or store a password in the clear at an time. For example:

      When choosing a password:

      1) User chooses a password which is then hashed on the client side.
      2) The hashed password is then transmitted over a secure channel to the server.
      3) The server stores the hashed password in its user database.

      To authenticate a user one can do the following:

      1) The server chooses a random value (a nonce). A nonce is used to prevent replay attacks.
      2) The plaintext nonce is transmitted to the client.
      3) The client hashes the nonce using the user's hashed password. (This can be done e.g. by appending the nonce to the hashed password and taking the SHA-1 hash of the resulting string.)
      4) The hashed nonce is then transmitted back to the server.
      5) The server uses the user's hashed password (retrieved from its database) to hash the nonce that it sent to the client.
      6) If the both hashed nonces are the same then the user is authenticated.

      Additional layers of security can be added such as adding a salt to the initial password hash to defend against brute force and rainbow table attacks if the server's database is compromised.

      --
      Accept Eris as your Fnord and personally sate her
    7. Re:Might not be bad... by Anonymous Coward · · Score: 0

      Exactly. (Please mod parent up)

      There is _no_ reason why the shared secret cannot be a (salted) hash of the password instead of the password itself.

      And _even_ if they wanted to make sure their log in form would work without any scripting (i.e. sending the passwords in plaintext over the network every time someone logs in) they should STILL have the passwords stored locally as hashes PRECISELY because of situations like the one that just happened. Not doing it is simply poor (if not negligent) practice (and I say this as someone who's not a professional programmer/cryptographer/security expert).

      Also, this wouldn't be an issue at all if any HTML log in page was served over SSL/HTTPS (especially since the key-delivery part is simple to implement: just make sure every playstation has a hardcoded public key for the purpose of symmetric key exchange or just buy an SSL cert from Comodo lol).

      Sorry, but, no. There is _no_ sane reason for Sony to not store every single password in hashed form, security-wise. Performance-wise, well... they must have saved a few CPU cycles by not calculating hashes, but just look how well that went...

      Besides being borderline criminal, they're also incompetent. Yay.

      (Thank god I wouldn't touch anything labeled Sony with a ten-foot pole... after all, I used to have a MiniDisc and use the SonicStage software, so I should know better than to trust Sony not to fuck things up, as they always do.)

    8. Re:Might not be bad... by Anonymous Coward · · Score: 0

      This is the most retarded drivel I've *ever* read. You encrypt the hand shake. SSL has solved this since forever.

    9. Re:Might not be bad... by Anonymous Coward · · Score: 0

      The issue here is that in the case of a breach you might expose the user's password to an attacker and the user might have used the same password on another service. It's fairly simple to devise a scheme where you never need to pass the password across the wire nor save it on the server; The server simply needs to send a per-user salt to the client for it to hash the password with - it's this hashed value which then becomes the shared secret for every subsequent over-the wide transaction.

    10. Re:Might not be bad... by Anonymous Coward · · Score: 0

      At the risk of sounding like a nub, doesn't your second option sound incredibly dangerous?

      The authentication scheme shouldn't care how the data is stored on the disk; it strikes me that there's no reason to have the data on the disk unencrypted, at the very least. That way if someone does compromise the system, they still have to aquire the keys to the files somehow. If these are only stored in volatile memory (with an offline backup on optical media in case the system needs to be restarted), or on something like a TPM, they're not going to be getting at that data any time soon.

      Even if there is something I'm overlooking; why in the hell does SONY store payment card data? All they're supposed to store is an authentication number, which is uniquely generated for that card against that merchant (PSN) and can't be used by anyone else. There's no reason I can see for the rest being unencrypted (yes, even the basic name/address stuff) except performance; systems are supposed to be designed for worst case scenarios, and holding unencrypted data suggest to me that they didn't.

      Of course, this is all assuming that the data actually was unencrypted, and they've not just forgotten to say it was.

    11. Re:Might not be bad... by bigjocker · · Score: 2

      This is nonsense. You can double hash passwords. That's the correct way:

      plaintext: 1234
      salt: xyz
      salt+plaintext hash: opqr
      you store on DB: xyz-opqr

      when the user requests the login page, the server creates a new salt, stores it in the session (server side) and sends the two salts to the client (session one and DB one):

      server extracts salt from DB: xyz
      server creates a session salt: abc
      client receives session salt: abc
      client receives DB salt: xyz
      user enters password: 1234
      client hashes using DB salt: opqr
      1st hash is: opqr
      1st hash with salt is: xyz-opqr
      client hashes using session salt: hijk
      2nd hash is: hijk
      client sends the twice hashed password to the server: hijk

      Now the server hashes the DB password using the session salt (that was stored on the server side session, remember not to trust the info from the client), and the two should be the same, without the server needing to know the plaintext password.

      This is basic auth and security stuff. Which means sony must have hired some second hand programmers to develop this whole system. Creepy indeed.

      --
      Life isn't like a box of chocolates. It's more like a jar of jalapenos. What you do today, might burn your ass tomorrow.
    12. Re:Might not be bad... by nedlohs · · Score: 1

      But then hash(pw,salt1) is both stored and transmitted, and hash(pw,salt1) is the only thing needed to know in order to authenticate which makes it exactly equivelant to the password. So you are storing the password in the clear, and you are transmitting it in the clear too.

      So you've reduced the security of the local system (now someone who obtained the hashed passwords can authenticate with them directly). That seems a remarkably stupid idea.

    13. Re:Might not be bad... by DarkOx · · Score: 1

      Server stores hash, client computes hash, transmits hash, server compares hash. Not very hard.

      Brilliant, you basically have just turned the hash into the password. I don't need your password now, just the hash which you are transmitting. You accomplished exactly nothing!

      --
      Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
    14. Re:Might not be bad... by _0xd0ad · · Score: 1

      But then hash(pw,salt1) is both stored and transmitted

      At what step in that process was hash(pw, salt1) ever transmitted?

    15. Re:Might not be bad... by aaaaaaargh! · · Score: 1

      Crap you're right. Not my day. Everyone flame me to death if you wish...

    16. Re:Might not be bad... by DeadCatX2 · · Score: 1

      I only see salt1, salt2, transmitted to client, and x being transmitted to server.

      Server only stores hash(pw) and salt1.

      Or did I miss something?

      --
      :(){ :|:& };:
    17. Re:Might not be bad... by Viceice · · Score: 1

      Sony makes Playstations. To access PSN, you need a PS. So why not ship each PS with an OTP generator? Infact, I would think with a little clever engineering, you could even write one as a firmware update and then retrofit all the PS on the network.

      Then the server could store the password as a hash. And when authentication is required, the PS first identifies itself with it's serial number, then it transmits the hash of the password supplied, hashed again with the OTP.

      And since the OTP is only used to establish secure communication between the PS and the server, you don't even need to bind the PS or the OTP to your account, unlike the implementation banks use or the way battle.net is secured using OTP.

      --
      Sometimes I wish I was a plumber, then I'd know how to deal with other people's shit.
    18. Re:Might not be bad... by Junta · · Score: 2

      Because then the 'hash' becomes the 'password' for all intents and purposes, bringing you right back to square one: your password is stored 'in the clear' on the server. Even if not keyboard friendly, an attacker gives not much of a rat's ass about that detail.

      --
      XML is like violence. If it doesn't solve the problem, use more.
    19. Re:Might not be bad... by Junta · · Score: 1

      If the CA is rigorous, trusted, then yes.

      If you have a self-signed cert, like a lot of applications do, or a compromised CA... welcome to man in the middle.

      --
      XML is like violence. If it doesn't solve the problem, use more.
    20. Re:Might not be bad... by Junta · · Score: 1

      But then if malicious client knows 'xyz', they can compromise the system without knowing the password. This is the crux of the problem with that scenario, it assumes the attacker must compromise the password and while trying to protect it, turns the hash into a 'plaintext password' equivalent.

      --
      XML is like violence. If it doesn't solve the problem, use more.
    21. Re:Might not be bad... by Viceice · · Score: 1

      Parent nearly had it right. One forgets that each PS is a unique device. Sony could fit an OTP generator into the firmware, and the above works if you replace the salt with an OTP.

      --
      Sometimes I wish I was a plumber, then I'd know how to deal with other people's shit.
    22. Re:Might not be bad... by AJH16 · · Score: 1

      Your in the clear example seems flawed though. All you really need is a shared secret in addition to the hash value. This could be accomplished with two different hash algorithms being used, one for the actual transmission and one for the signing. The client would still know both the shared key and be able to generate the matching hash for the actual hash storage of the password. The server would have the shared key hash stored and also have the password hash to validate. This way a storage breach gives nothing and yet you still have the advantages of both systems.

      --
      AJ Henderson
    23. Re:Might not be bad... by bigjocker · · Score: 3, Informative

      No, they not. That's the point of double hashing. If you know 'xyz' you still need to know 'opqr' to send a valid hash (remember that you need to hash 'xyz-opqr' with the session salt). Since the server never sends 'opqr' to the client, the only way to generate it is through HASH(xyz + plaintext_password).

      --
      Life isn't like a box of chocolates. It's more like a jar of jalapenos. What you do today, might burn your ass tomorrow.
    24. Re:Might not be bad... by Anonymous Coward · · Score: 0

      You have no clue what you are talking about. Passwords should only ever be stored in a salted and hashed form.

    25. Re:Might not be bad... by LordLimecat · · Score: 1

      maybe they wanted to make sure their log in form would work on a web browser without scripting.

      Not being a web dev, surely there are webserver modules that will perform the hashing server side; while this would expose you to MITM, at LEAST you wouldnt have a plaintext password stored, and at LEAST you couldnt MITM the consoles.

    26. Re:Might not be bad... by ais523 · · Score: 1

      But in that case, the actual password isn't needed to log in; only its salted hash, which means that people can log in with only information in the server's database, much the same as with a plaintext password (although this is still better, as it saves the person in question from having their login details compromised on other sites with the same password).

      --
      (1)DOCOMEFROM!2~.2'~#1WHILE:1<-"'?.1$.2'~'"':1/.1$.2'~#0"$#65535'"$"'"'&.1$.2'~'#0$#65535'"$#0'~#32767$#1"
    27. Re:Might not be bad... by nedlohs · · Score: 1

      No I did.

    28. Re:Might not be bad... by Kumiorava · · Score: 1

      Now if attacker has your hashed password from the server it's still possible to get authenticated. Am I thinking too simple way when I would just send the password over secure channel to the server, hash the password at the server and compare the hash to the one on the database?

    29. Re:Might not be bad... by igb · · Score: 1

      That doesn't work. It makes the password the hash, and means that an observer of the transaction can replay it later. The point about storing plaintext is that you can send the client a random nonce, which they catenate with the password and return as a hash. Whether that plaintext is abc or md5(abc) is irrelevant: the point is that the client and the server have to share a secret.

    30. Re:Might not be bad... by darkfire5252 · · Score: 1

      You can't add a salt to the password hash if you're going to require that the client be able to hash the password before sending it.

    31. Re:Might not be bad... by traindirector · · Score: 1

      Being a web dev, I agree--the better decision is certainly to use SSL for the web form and transmit the password, hashing it on the server but never storing it.

      In asking the question, I was trying to determine if there could be a good reason Sony stored the password in a readable form. As opposed to the likely not-good reasons, being either ineptitude or thinking your plain-text password along with your email address and user name might come in handy...

    32. Re:Might not be bad... by traindirector · · Score: 1

      Perhaps I wasn't clear. I was suggesting that the procedure with concatenating the nonce can still be done, just using the hash as the starting point instead of the plain-text password. The only extra step would be hashing the password on the client side at the beginning of the procedure. Wouldn't this provide the same protection against MITM without the server having the password in plain-text?

    33. Re:Might not be bad... by AK+Marc · · Score: 1

      No, it's not the same. That hash may be compromised, but you neglected password reuse. I'd bet many (most?) use their PSN password for some other service as well. So if you only ever hash it, then you'll only ever lose that "password" to the one site. But with plaintext, they have an additional vector of attack for the 77 million compromised accounts (for which they already have the email address, DOB and mailing address for) to use to get into other services - email, social networking, and more importantly to them, financial accounts.

    34. Re:Might not be bad... by AK+Marc · · Score: 1

      So you compromise my hash. That doesn't then give you the password for my email account and my bank (if I were like most people and reused passwords). Just keeping PSN safe is important. However, assuming password reuse also adds in other considerations. And many of them are addressed by using the hash as a password rather than the password itself.

    35. Re:Might not be bad... by Anonymous Coward · · Score: 0

      You are right; the hashed password & salt1 have to be kept secret.

      This requirement could maybe be ignored if you have a "commutative hash", that is:

                      hash(hash(pw, salt1), salt2) == hash(hash(pw, salt2), salt1)

      then, the server only transmits salt2, and the client calculates and sends back hash(password, salt2), which cannot be deduced from the hashed password and salt1.

      I do not know any hash function that has this property though... and the scheme seems a bit fragile

      If you want some authentication that survives a publication of all the "secrets" on the server, use public/private cryptography - have the client create a keypair and send the public part to the server. Then, accept logins if they can decrypt a challenge. This is of course more difficult to manage for the client...

    36. Re:Might not be bad... by DriedClexler · · Score: 1

      But correct me if I'm wrong (I've read about salt but am still confused about what defenses it does and doesn't provide), that doesn't stop hackers who can guess the password (from a common list), since they can still check that hash(salt + plaintext_password), iterated as necessary, matches the hash stored in the password file.

      So it would require them to generate new hashes for a common password list, but not make the passwords stronger than their being on the common list permits.

      Then again, I guess you're hosed anyway if the attacker can guess the password, so the system doesn't even attempt to be secure against that kind of attacker.

      (Did I get all that right?)

      --
      Information theory is life. The rest is just the KL divergence.
    37. Re:Might not be bad... by Palshife · · Score: 1

      As an attacker, which would you rather learn, the hash for one system or the password the user chose for possibly numerous other systems as well?

      --
      Attention deficit disorder is a complicated issue, spanning several major... HEY LET'S GO RIDE BIKES!
    38. Re:Might not be bad... by _0xd0ad · · Score: 1

      As long as the salt is different for every single user, they can't do a single global search to find everyone whose password was "password". They have to hash salt+"password" separately for every single account.

    39. Re:Might not be bad... by Idbar · · Score: 1

      Well, I'm thinking the same way EAP/TTLS PAP does. You can either send passwords hashed but then you have to have them in the clear at the server, or you can send them in the clear and perform the hashing in the server.

      Provided that you have a secured tunnel, transmitting passwords "in the clear" and perform the hashing in the server works almost like https.

    40. Re:Might not be bad... by DriedClexler · · Score: 1

      Okay, thanks, that clears up the confusion I was having about how salt helps.

      --
      Information theory is life. The rest is just the KL divergence.
    41. Re:Might not be bad... by kevinNCSU · · Score: 1

      Congratulations, you're full circle back to the starting point of the GP post ;)

    42. Re:Might not be bad... by Anonymous Coward · · Score: 0

      Mod up! I don't have any mod points. AC's don't get mod points. :)

      It could also just be authenticated over a secure connection like SSL and have the plain text not be in the clear. Not as secure as this double hash method, but still mitigating the MITM.

    43. Re:Might not be bad... by Cramer · · Score: 1

      Correct... same mess with more math.

      The secret created from the password and salt1 is stored in the database and is therefore open to theft. If you are in possession of that secret, you don't need the password.

    44. Re:Might not be bad... by LordLimecat · · Score: 1

      I cannot imagine there is a single good reason. All Windows and Linux systems (as well as most well-configured Cisco routers, firewalls, etc; and well-set up routers) use hashed passwords. Windows has to support clients going back 11 years with compatibility, and every single one of them logs in using an NTLM hash; there are no Windows services that I am aware of that store a user/password database unhashed, and it has been this way at LEAST since W2K (and presumably going back to NT, in 199x).

      You would have to be reinventing the wheel, and that badly, in order to manage to screw this up; hashed passwords is one of the first things they teach you in any kind of school you would go to.

    45. Re:Might not be bad... by SpaghettiPattern · · Score: 1

      However, this does require the password be transmitted over the wire in one way or another on every connection.

      Security isn't your forte I see. Encrypted sessions are common nowadays and the man in the middle attack is technically ruled out long ago. But clearly not everyone knows.

      Anyway, passwords have their flaws. Systems -like SSH and PGP- where private keys are stored on the file system are not an alternative for passwords. Electronic keys with an inaccessible private key are but these aren't commonly used yet.

      --

      I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
    46. Re:Might not be bad... by Anonymous Coward · · Score: 0

      So basically instead of Hanlon's Razor, this can be explained by Flew's Corollary:

      "Never attribute to stupidity that which is adequately explained by simple laziness."

    47. Re:Might not be bad... by ArsenneLupin · · Score: 1

      As long as the client can do the hashing,

      If all the client needs to communicate is a hashed password, then the client only proves that he has the hashed password, and not the plaintext. Ergo, the hashed value is a password equivalent, and the DB actually stores password equivalents.

      It could be made to work with hashing algorithms that are "splittable" (for example, using discrete exponentiation and relying on the fact that discrete logarithm is a "difficult" problem).

      If b is a given number, p the unknown password, and b^p=h , then calculating h from b and p is easy, but going back from h to p is difficult.

      So, if the database stores h, all the server needs to do is make up a challenge c, and send C=b^c to the client. Client calculates A=C^p to the server, which is actually equal to b^(c*p) = b ^ (p*c) = (b^p)^c = h^c, which the server can calculate.

      So, a man-in-the-middle cannot figure out the password (because that would involve taking the discrete log of A in base C), an intruder having access to the DB cannot get hold of the plaintext password (because that would involve taking the discrete log of h in base b), and he cannot use the hash as a "password equivalent" either (because that would involve taking the discrete log of C in base b).

    48. Re:Might not be bad... by ArsenneLupin · · Score: 1

      Done like this, the hacker would not need to bother figuring out the password 1234 at all, but instead he would use opqr directly (derived via the constant DB salt xyz...)

    49. Re:Might not be bad... by keytoe · · Score: 1

      Done like this, the hacker would not need to bother figuring out the password 1234 at all, but instead he would use opqr directly (derived via the constant DB salt xyz...)

      Exactly. This just changes the secret that the hacker has to guess from plaintext to the hashed password - which is stored on the server. If the server is compromised, you still have the keys needed to gain access.

      This does prevent wire sniffing, but that's not what we're talking about in this story. This was an intrusion. Presumably servers were compromised and stored credentials were stolen.

    50. Re:Might not be bad... by X.25 · · Score: 1

      If the CA is rigorous, trusted, then yes.

      If you have a self-signed cert, like a lot of applications do, or a compromised CA... welcome to man in the middle.

      I am really dying to hear how exactly are you going to do man-in-the-middle attack against my self-signed cert.

      No, I really do.

      Stop with that nonsense.

    51. Re:Might not be bad... by nurb432 · · Score: 1

      All that said, it's also entirely likely that Sony has crypted hash passwords, but it's safer to say 'your password is compromised', because of how many users have passwords like 'yourmom65' rendering the hashing pointless.

      Then they should have presented it that way, and not scare people outright and look like fools.

      --
      ---- Booth was a patriot ----
    52. Re:Might not be bad... by mywhitewolf · · Score: 1

      Not so, the world is bigger than the PSN network, and using a password has is more secure as it doesn't give away any information about your password that could be used against you in a direct attack.

    53. Re:Might not be bad... by Anonymous Coward · · Score: 0

      Because then the hash *is* the password, and if I steal your hash then I can write software which will use that hash to log in as you. This is a very old, very well known issue.

    54. Re:Might not be bad... by easyTree · · Score: 1

      Ye be walking the plank afore the day's out JimLad. Aaaaarrrrrrrgh!

    55. Re:Might not be bad... by swillden · · Score: 1

      That doesn't work. It makes the password the hash, and means that an observer of the transaction can replay it later.

      Have the client concatenate a server-provided nonce with the password, hash the result and send the hash to the server. If you want to get really fancy there are even zero-knowledge proofs that can be used.

      There's no legitimate reason to store plaintext passwords.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    56. Re:Might not be bad... by Anonymous Coward · · Score: 0

      Because then the hash -is- the password.
      I simply have to steal your hash and I can transmit that to the server to login.
      Of course assuming a little salt it would certainly protect your other accounts if you use the same password for multiple sites, but it would do nothing to protect that site. Which is probably pointless anyway since if they have access to the password hashes they likely already are able to do whatever they want to your account.

      -my 2 cents

    57. Re:Might not be bad... by Anonymous Coward · · Score: 0

      That's pretty neat.

    58. Re:Might not be bad... by kiddygrinder · · Score: 1

      not exactly nothing, now those who use their password across multiple accounts are protected. it's not good practice, it's just what people do.

      --
      This is a joke. I am joking. Joke joke joke.
    59. Re:Might not be bad... by vegiVamp · · Score: 1

      If you breach server security, you then effectively get hash(pw, salt1). thus, you don't *need* the original password to calculate x.

      --
      What a depressingly stupid machine.
    60. Re:Might not be bad... by Anonymous Coward · · Score: 0

      If the password is stored 'in the clear' on the server side and treat the password as a shared secret, then *if* you design the authentication right, you render man in the middle infeasible with the tradeoff of storage attack being a large exposure.

      And why couldn't a hash of the password be used as a shared secret? As long as the client can do the hashing, I see no reason the hash couldn't be used in place of the original password.

      And what would using a hash of the password accomplish over using the password as the shared secret? If the hashed password is leaked in a storage attack, it can be used in place of the password for authentication. There are ways to get this right, but your proposal isn't one of them.

    61. Re:Might not be bad... by Anonymous Coward · · Score: 0

      However, this does require the password be transmitted over the wire in one way or another on every connection.

      Blatantly false.

      I quit reading after that totally clueless sentence.

      5-digits ID, seriously?

    62. Re:Might not be bad... by AmiMoJo · · Score: 1

      The password should be stored as a hash with slat but transmitted by the browser in the clear. The server then hashes it and compares that to the stored hash. That way if the storage is compromised the attacker has to brute force each password because they can't use the hash alone to log in.

      Okay, a man-in-the-middle attack would reveal the plaintext password of a limited number of accounts (depending where the attack takes place) but that is a million times better (literally) than losing all 77 million passwords at once.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    63. Re:Might not be bad... by Anonymous Coward · · Score: 0

      And why couldn't a hash of the password be used as a shared secret? As long as the client can do the hashing, I see no reason the hash couldn't be used in place of the original password.

      As a potential answer to my own question, maybe they wanted to make sure their log in form would work on a web browser without scripting.

      Think through that for a second. If a hash of the password becomes the shared secret, then the system is just as insecure if someone breaks in and obtains the hashed passwords.

      The only advantage such a system would have is that people reusing passwords between multiple websites wouldn't have to be as worried. But that relies on the system being used solely for PSN, since if it were widespread we'd be back to step one.

    64. Re:Might not be bad... by Anonymous Coward · · Score: 0

      Or, hey, maybe they could just use SSL like the rest of the goddamn civilized world instead of cobbling together some ridiculous scheme of their own.

  32. I do not care by equex · · Score: 1

    This is the exact reason I do not use online services that involves real money or that requires real ID (like Facebook). I know I am probably missing out on a lot of games and stuff but I don't care. All I have is an online banking thing for which you need a physical key generator even if you know all the rest of the personal ID. To this day I have never used real information for email signups and other accounts. I keep all my important data stored safely locally (as in NOT a cloud/online storage service) on DVDs and in some cases I burn double backups in case one fails. Hard disks that are thrown away are securely wiped, and then smashed in the ground 2-3 times for good measure. It's nice to know that in case I for some reason I don't have internet, I won't really be affected. All my games and data is present. Even if you steal my wallet or cellphone and find my old disks, you won't get very far !

    --
    Can I light a sig ?
  33. Sony a hardware company not a software one so that by Anonymous Coward · · Score: 0

    Sony a hardware company not a software one so that why the keys are in hardware and not software.

  34. Battered-wife syndrome by Anonymous Coward · · Score: 0

    What else explains peoples' insistence on giving money to this company of greedy bozos?

    Top eight lies of history:

    8) "No, really, just the Sudetenland. C'mon, guys, you won't even miss it." -- Adolf Hitler

    7) "Don't worry, honey, I'm on the Pill." -- Your girlfriend

    6) "See this bitchin' chemical weapons factory on wheels?" -- Colin Powell

    5) "There will be cake after the test." -- GlaDOS

    4) "The check's in the mail. Seriously, man, you don't have to do that..." -- You, when the electric company finally sends someone around with a pair of wire cutters

    3) "No, seriously, guys, I swear, he was in here. Ask Pete! I saw Nick and Joe bring him in on Friday, and now there's nobody here. It doesn't even smell all that bad. What?" -- St. John

    2) "Duke Nukem Forever will ship by Christmas 2002." -- George Broussard

    1) "We loooooove our customers. Customers! Customers! Customers! It's all about customer service! We would never do anything to harm our customers' interests, take away their rights, or otherwise throw knives at their backs." -- Sony

  35. Is PCI DSS not relevant for Sony? by Desita · · Score: 1

    From Alan Calder's blog: Why was Sony storing credit card numbers? http://www.alancalderitgovernanceblog.com/2011/04/out-of-an-abundance-of-caution/

    1. Re:Is PCI DSS not relevant for Sony? by hibiki_r · · Score: 1

      Storing credit card numbers is par for the course. The question is how well said card numbers are protected.

      If a merchant is compliant with PCI, getting a copy of the key should be extremely difficult even for an insider that has a root shell on the server that does the encryption/decryption. Arguably, the best way to go at decrypting the CC numbers is to just use the decryption service that legitimate apps use, after stealing their login credentials. The limiting factor at that point is to figure out how many numbers one can decrypt without being detected: One would hope that the flurry of activity generated by sending a few extra million requests to the server would raise flags all over the place, unless it was done extremely slowly.

      So the issue is not if the encrypted CC data was accessed (which one would expect it was), but if the system was PCI compliant, and whether the encryption keys were also compromised.

  36. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    No not superior, sad really, sad for the loss, sad for the fact that someone feels that that type of behavior is acceptible, sad when I see a 6 year old friends son cutting people appart with a sword with no sense of what he is doing or how it may be affecting his moral compass. What is that big popular game "Grand Theft Auto"? now thats a title that inspires accepting that there is no moral impact to gamming.

  37. False Claims by Anonymous Coward · · Score: 0

    Where does this story get its data from. 77 Million accounts stolen is ambiguous and downright shoddy journalism. The better headline might be
    "77 Million PSN Accounts information has been stolen", but this number is the total amount of registered users and does not reflect the number of affected users, as this information is currently unavailable. Please research before opening your mouth and spilling fear mongering false information.

  38. bad news by Anonymous Coward · · Score: 0

    Its bad for most gamers.

    www.mobilegamesarena.net

  39. Not Trolling.... by Evildonald · · Score: 1

    Seriously, how many times does Sony need to fuck over consumers before they stop buying their products? If you bought a Sony product and they fucked you over, why are you surprised? They do something like this every year!

    1. Re:Not Trolling.... by JustAnotherIdiot · · Score: 1

      Because they're the middle man. I want to buy game A or I like games from company B, but sadly I need to buy sony's hardware to play said games.
      I'm not going to care about stuff like this, because I want to buy/play/support company B.

      --
      What do I know, I'm just an idiot, right?
    2. Re:Not Trolling.... by schm0 · · Score: 1

      While this data breach is certainly a major setback, I think "every year" is a bit of a stretch.

  40. In all seriousness... by bhunachchicken · · Score: 1

    Whilst I have read a lot of people pointing fingers at Sony and jeering them for this breach, some of the more savvy commentators are now asked how safe ANY online data really is.

    Suppose you really did have a situation where the user's personal details and CC data were encrypted. Would you actually just put a press release along the lines of:

    "Yeah, we got hacked. The hacker downloaded 77 million account details, all of which was AES secured. Nothing to see here, move along."

    Or, would you tell people to delete their CC details and change their password anyway..?

    I'm not saying that encryption is pointless, but it feels like the reasonable action would still be to err on the side of caution.

    In a situation like this, there's no knowing how far the criminal underworld might be willing to go to attempt to crack the data wide open. Some might already employ massive server farms for this very purpose.

    1. Re:In all seriousness... by Dainsanefh · · Score: 0

      The thing is, if somebody is borrowing your CC # for a temporary shopping spree, you can always chargeback the transaction with a few single clicks online and you won't have to pay a penny. Not sure what the fuss is all about.

      --
      Twitter: @dainsanefh
    2. Re:In all seriousness... by Anonymous Coward · · Score: 0

      They're probably running massive farms of PS3s with pre-3.21 firmware and Linux, just like the Air Force.

    3. Re:In all seriousness... by Anonymous Coward · · Score: 0

      Then the question is "How secure is the key you used to encrypt the data?".
      AES or any other encryption is useless if the folks that can steal the data can steal the key at the same time.
      Want a real-world example? Blu-Ray.

      This is why key management matters, and entities that are serious about this stuff use FIPS 140-2 Level 3 or higher devices to generate/use their master encryption keys and strong access controls around authorizing access to use the keys. It is much easier to manage a data breach of encrypted data when the encryption key only exists within authorized physical devices under your complete control.

      The problem is that PHBs do not understand the intangible value this provides when comparing it to the tangible costs of $10-a-day outsourced IT staff for system design, implementation, and support. You pretty much get what you pay for in the information security arena. Quality, specialized expertise that provides value costs money. That is true for just about any field - from carpenters and florists to doctors, lawyers, lobbyists, government officials, developers, IT consultants, and information security is no exception.

    4. Re:In all seriousness... by Em+Adespoton · · Score: 1

      This actually raises a good point...
      If someone breaks into your network, it doesn't really matter if everything is AES encrypted against a corporate key... if the hacker is also able to gain access to that key and guess/figure out/pull from emails the password.

      This is why security zones are important in a company. Certain data sets should never be allowed to see each other.

  41. Stolen? by blueg3 · · Score: 1, Insightful

    Was the sensitive information deleted from Sony's system, denying them access to it? If not, how is that stealing? I thought the People of Slashdot were against calling it "stealing" when information is merely duplicated without taking access away from the original holder?

    1. Re:Stolen? by RyuuzakiTetsuya · · Score: 1

      When we are talkin about metallica's "Sandman" it's ok to start getting nitpicky over the details. When some jerk just stole my credit card info on the the other hand...

      --
      Non impediti ratione cogitationus.
    2. Re:Stolen? by Anonymous Coward · · Score: 0

      Are you really trying to equate breaching someone's network and stealing private, sensitive information to making a copy of "Ben Stiller's Latest Family Crapstravaganza"?? Oh wait, no. You're just a smelly stinky troll. Go troll yourself in the troll-hole.

    3. Re:Stolen? by Anonymous Coward · · Score: 0

      It's not stealing.

      The thing is... people tend to call things like this "stealing" because it will inevitable result in people being deprived of the money in their credit cards.

    4. Re:Stolen? by The+Moof · · Score: 2

      The last time I checked, my identity couldn't be stolen with a copied MP3.

    5. Re:Stolen? by blueg3 · · Score: 2

      If someone steals your identity, do you no longer have it? Who are you then?

    6. Re:Stolen? by Anonymous Coward · · Score: 0

      If someone steals your identity, do you no longer have it? Who are you then?

      Whether or not someone steals your identity, you are still a dumbass. /obvious

    7. Re:Stolen? by AK+Marc · · Score: 1

      When someone releases something under copyright, they, at the same time they release it, also release it into the Public Domain (though with a built-in delay) And they are purposefully sending the information around to people. One person copying the data in their own home didn't "steal" it from anyone.

      However, your credit card data isn't copyrighted. It isn't released publicly. It isn't in the Public Domain (either now or on a time-delay release). It is a secret. When it is "stolen" you are correct in that "stolen" isn't technically correct. The secrecy of the credit card is stolen. It was taken and will never be given back. It is forever denied to the owner of the credit card.

      But my guess is that you know the difference, but are playing dumb because you have an emotional agenda you are trying to further, regardless of the truth or usefulness of your statements.

    8. Re:Stolen? by AK+Marc · · Score: 1

      When someone steals your identity, they have actually stolen (via fraud) from a financial institution. So they did commit theft. But not from the person whose identity they "stole." Identity theft is a term invented by the banks to blame their customers for their shoddy security practices. And, like all uses of the word "theft" as stated by corporations, it is incorrect.

    9. Re:Stolen? by Kielistic · · Score: 3, Insightful

      Kind of. A personal identity is singular and is assumed to only exist for one person. If one person uses an identity it is assumed another is not.

      Also using another's identity most certainly can and does bring harm to the creator/originator of that identity.

    10. Re:Stolen? by The+Moof · · Score: 2

      Sort of, via my credit score. They use my identity to use my credit, not a copy of it. Anything they do to damage my credit becomes my burden to bear, not reflected on a copy of it. Credit isn't something that can be copied like a file.

    11. Re:Stolen? by feepness · · Score: 1

      The last time I checked, my identity couldn't be stolen with a copied MP3.

      You would still have your identity, so nothing was stolen.

    12. Re:Stolen? by blueg3 · · Score: 1

      Also using another's identity most certainly can and does bring harm to the creator/originator of that identity.

      Absolutely. "Identity theft" causes direct financial damage to the person whose identity is "stolen". I just think both words in the term are sort of a poor fit. You still have your identity, but someone else has information about your identity that they're using for a variety of nefarious things. (One of those things could be stealing your money, of course. Or any manner of other forms of financial damage.)

      I also, of course, don't think "stealing" should apply to unauthorized access to confidential data (the case in TFA) or to unauthorized copying of copyrighted material (either for a profit or not).

    13. Re:Stolen? by Anonymous Coward · · Score: 0

      If someone steals your identity, do you no longer have it? Who are you then?

      Whether or not someone steals your identity, you are still a dumbass. /obvious

      So you're saying you don't have an answer?

      Or at least you don't have an answer that won't make you look like a hypocrite? Does "steal" mean "whatever's the most convenient definition for my worldview this moment"? "A term over which I can nitpick specifics if it results in me getting free music, movies, and software, but is damn well colloquially and commonly defined if it suddenly inconveniences me"?

    14. Re:Stolen? by Anonymous Coward · · Score: 0

      Ok then:

      Provide me a list of your real name, address, SS number, CC numbers, Bank accounts, Mothers maiden name, all user names and passwords.

    15. Re:Stolen? by Anonymous Coward · · Score: 0

      Last time I checked, your identity couldn't be stolen at all. You get to keep it until you suffer from massive amnesia or die. no matter how many other people may try to impersonate you.

    16. Re:Stolen? by blueg3 · · Score: 1

      Go murder your neighbor.

      You should be okay with that, right, since it's not stealing?

    17. Re:Stolen? by Anonymous Coward · · Score: 1

      If your identity or personal information is stolen, the attached credit information and reputation becomes damaged, unlike electronic copies which leave the original unaltered and perfectly usable by the original possessor.

      Nice try though.

  42. 77 million by Anonymous Coward · · Score: 0

    Cool. I'm sure to be lost in the crowd.

  43. Karma's a bitch. by straponego · · Score: 2

    So what are the ramifications for Sony if they violated PCI standards?

    1. Re:Karma's a bitch. by ToxicBanjo · · Score: 1

      I was wondering this myself. At the very least, violating PCI standards is gonna add huge weight to the class action lawsuit that is sure to come.

      --
      There are only 10 kinds of people in the world. Those that understand binary and those that don't.
    2. Re:Karma's a bitch. by Jawnn · · Score: 1

      Fines that will have a barely perceptible impact on their corporate bottom line. Now, the market responses (stock and consumer) to such a finding may be much larger, but still just barely significant. As has already been pointed out, the TJX breach has had little long-term effect on their profitability. Sony will simply open their wallet and move on. Serious and meaningful punishments are for "the little people", not major multi-national corporations.

    3. Re:Karma's a bitch. by Anonymous Coward · · Score: 0

      The irony is that if you have been breached, you are in violation of the PCI standards as they read. This ensures that the PCI Security Standards Council is never liable for a breach occurring at a merchant who was in compliance with their standards.

      I also noticed that some posters were defending Sony in saying that "at least they didn't get the CVV/CVV2 numbers, so illicit purchases will be difficult to make". The intruder didn't get the CVV/CVV2 codes because it is illegal to store them. So Sony is basically saying "We know this is really bad and inexcusable on our part, but hey: at least we didn't break the law."

      Finally, for those of you who are waiting to see if any fraudulent charges appear on your card, you may want to check your cardholder agreement first. Some agreements have clauses that state that if the cardholder is aware that their card may have been lost or compromised and fail to report it to the issuer, that cardholder may be liable for some/all charges assessed against the card.

      Card canceled. I suppose I will keep my online gaming limited to my PC and 360 from here on out.

    4. Re:Karma's a bitch. by Anonymous Coward · · Score: 0

      So what are the ramifications for Sony if they violated PCI standards?

      Banishment to ISA land?

    5. Re:Karma's a bitch. by Anonymous Coward · · Score: 0

      They lose indemnification from the cardholders and credit authorizers for fraudulent activity. In other words, the fraudulent charges (if they can't be reversed) could drop in Sony's lap.

  44. FUD by dreamchaser · · Score: 2

    "- If you wanted to play any of the games online, you had to have a PSN account. Which meant you had to provide a credit card whether you were ever going to buy anything or not."

    Completely wrong. I have a PSN account and never, ever gave them credit card info.

  45. Makes you wonder... by Junta · · Score: 4, Insightful

    In a world with plenty of well understood crypto schemes like public-private key systems where you can prove yourself without a shared secret... why the hell do we trust so much of our wealth with a trivial to see/copy account number being tossed around like crazy?

    --
    XML is like violence. If it doesn't solve the problem, use more.
    1. Re:Makes you wonder... by xtracto · · Score: 1

      fuck moderation points
      Oh man... this is so sweet. To imagine that I was here at slashdot about 6 years ago helping to uncloak Sony's Rootkit fiasco.

      These idiots do not learn... to all you people and government. THIS is what happens when you let companies get off only with a slap on the wrist.

      These Sony idiots should be hit with massive lawsuits, and by massive I mean requiring them to pay millions of dollars.

      I know the USA government won't do it... however I hope Europe will do them right.

      --
      Ubuntu is an African word meaning 'I can't configure Debian'
  46. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 0

    Certainly I am not anti-video game. Maybe anti-morally bankrupt video game. You know "Grand Theft Auto" or any game that gives you 10 ways to kill and mame or steal or pillage, human or other species. I just think you have to overcome some natural prohibitions on killing in your intellectual side to actually do and enjoy those games. The kill or be killed mentality practiced on the killing fields say daily fosters good social behaviors. There are good competitive video games that foster positive social skills. I don't think you can argue that these games are neutral when it comes to behavioral traning.

  47. Music on a computer 10 years ago? Errr, yeah. by Viol8 · · Score: 2

    The mp3 has been around since the mid 90s and plenty of other simpler formats were around before that. Macs were doing 8 bit PCM music back in the late 80s and if you want to be pedantic about it synthesized music on a personal computer has been around since the 8 bits days in the early 80s.

  48. Re:I guess I didnt miss much by Unkyjar · · Score: 2

    Seriously, I mean why give me a game that allows me to steal cars and shoot people when it's doesn't even emulate the experience properly?!! I go out and try these techniques on the street and they don't work at all the way they do in the game. It's morally negligent I say! I could be killed because of the bad info I'm getting from my video games!

  49. The most important takeaway from this... by oddaddresstrap · · Score: 1

    is the new height at which it sets the bar for an epic fail.

  50. Keeping it offline is NOT helping by Jahf · · Score: 1

    I went to log in to PSN today to see which security questions I had picked and answered so that I could blacklist them from other sites and ... I can't get in to check it. Not helpful at all. Fix the holes and at least put it back up in a read-only mode. It has been years since I signed up for OR used PSN ... so I have utterly no clue what information I had there.

    --
    It is more productive to voice thoughtful opinions (reply) than to judge (moderate) others.
    1. Re:Keeping it offline is NOT helping by ciderbrew · · Score: 1

      same here :(

  51. Qlass Aqtion by RockGrumbler · · Score: 1

    Cancelled my card last night. I hope sony gets the q's sued of it for this.

  52. WHY should I have to provide a MERCHANT by Maxo-Texas · · Score: 1

    Sufficient information to steal my identity so that I can BUY their services?

    All Sony should have is my payment each month and some security questions I can choose the answer to.

    --
    She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
  53. Sony is warning users? by dtmancom · · Score: 2

    Sony hasn't warned me of anything, and I know they have my correct email address attached to my PSN account. I am getting all of my information from 3rd parties. That irritates me more than their getting hacked in the first place. And yes, I canceled the credit card attached to my PSN account yesterday.

    1. Re:Sony is warning users? by elrous0 · · Score: 1

      Ditto for me. AFAIK, they haven't sent out a single email to the effected users. They've just issued that lame press release. Millions of users who don't follow the news are no doubt oblivious to what's happened right now.

      --
      SJW: Someone who has run out of real oppression, and has to fake it.
    2. Re:Sony is warning users? by AJH16 · · Score: 1

      According to some of the posts I read, they did e-mail affected users. I'm hoping this means I'm not affected since I didn't get an e-mail. I'll probably call them later to see if they can verify.

      --
      AJ Henderson
    3. Re:Sony is warning users? by Sponge+Bath · · Score: 1

      I read the Sony email received by a friend of mine yesterday. It had the usual weasel speak: "some personal information was stolen, maybe including credit cards, check with credit agencies, monitor accounts, thanks for your business, blah blah blah". I have not received such an email yet.

    4. Re:Sony is warning users? by Anonymous Coward · · Score: 0

      Was wondering the same thing tonight, but then I got my email from SCEE about half an hour ago, in poorly machine translated Dutch.

      Translated back it'd read something like:
      "... certain user information of PSN & Qreocity services was compressed due to an external intrusion."

    5. Re:Sony is warning users? by Anonymous Coward · · Score: 0

      Sony hasn't warned me of anything, and I know they have my correct email address attached to my PSN account. I am getting all of my information from 3rd parties.

      That irritates me more than their getting hacked in the first place.

      And yes, I canceled the credit card attached to my PSN account yesterday.

      same with me, nothing from sony... at all

    6. Re:Sony is warning users? by mywhitewolf · · Score: 1

      I got an email from sony while reading this slashdot, so a statement has only just been released to the consumers.

    7. Re:Sony is warning users? by elrous0 · · Score: 1

      Yeah, I finally got mine too. Took them long enough.

      --
      SJW: Someone who has run out of real oppression, and has to fake it.
    8. Re:Sony is warning users? by Walter+White · · Score: 1

      I received notification on the 26th. perhaps they're working their way through 77 million email addresses.

  54. Sony Stock! by Anonymous Coward · · Score: 0

    Time to Short Sony Stock!!!! :-)

  55. sometimes you have to by YesIAmAScript · · Score: 0

    You cannot do mutual authentication if the server doesn't know your password. And if it only has a hash, it doesn't know your password.

    Additionally, Sony didn't say they were storing passwords in a way that could be unencrypted. It may be that losing the hashes is considered a severe enough incident to report that your password was compromised. Many security experts would agree with this, as even with hashes a breach of them exposes common passwords can be easily found through brute forcing a short list of common passwords or rainbow tables as applicable. See the gawker incident for a case of this.

    --
    http://lkml.org/lkml/2005/8/20/95
    1. Re:sometimes you have to by AJH16 · · Score: 1

      Why can't you use two different hashes, and use one hash which is never seen by the outside world as your mutual shared key?

      --
      AJ Henderson
  56. Re:I guess I didnt miss much by DynamoJoe · · Score: 1

    Oh dear. This topic hasn't been done to fucking death at all. By all means, rehash it. I'm sure we're all extremely interested to hear your unique viewpoint on the morality of violent video games. I, for one, breathlessly await your scintillating insights on the matter. (no, not really)

    --
    bah.
  57. Re:I guess I didnt miss much by degeneratemonkey · · Score: 1

    You haven't actually presented any objective rationale for your assumption that violent games are intrinsically not neutral. You state your opinion repeatedly, and then you assert that you "don't think" anyone can disagree with you. You make broad sweeping generalizations without paying a modicum of attention to the very real complexities of psychological development.

    "Moral compass" derives from a number of factors. To lend some shred of credence to your assertions, I will posit that if a child plays Grand Theft Auto for hundreds of hours and has no other source of perspective on the material encountered therein, the video game could certainly have a substantial (and potentially negative) impact on the child's understanding of the world. However, video games do not exist in a vacuum. Video game experience does not preclude parental influence. I'm fairly certain that bad social behavior derives most profoundly from parental influence, far, far above any other factors.

    Your moral crusade, I do not want it.

  58. Re:I guess I didnt miss much by praetorian20 · · Score: 0

    sad when I see a 6 year old friends son cutting people appart with a sword with no sense of what he is doing

    You have a 6 year old friend who got laid? Awesome!

  59. Ok Sony, so basically, by unity100 · · Score: 2

    You have sued hotz, harassed those who modded/jailbroke your devices, suppressed hotz, and .....

    'some' people basically handed your ass over to you in a different fashion ?

    in the end, it seems you have annoyed far more dangerous circles in the internet hacker underground than the jailbreakers/mod hackers.

    enjoy. and next time, remember that it is not good to treat people like cattle, and suppress/repress them.

    1. Re:Ok Sony, so basically, by RyuuzakiTetsuya · · Score: 1

      Uh. Most likely whoever broke in did it for the money. Not in retaliation.

      First off, you can't brag about a break in this big and second off, pissing off millions of psn users isn't the way to get then to see it your way.

      --
      Non impediti ratione cogitationus.
    2. Re:Ok Sony, so basically, by kvvbassboy · · Score: 1

      Money was probably the most important factor. But, why Sony? Ideology definitely had a role.

    3. Re:Ok Sony, so basically, by RyuuzakiTetsuya · · Score: 1

      That's really hard to prove until they catch the perps who did it.

      Given that past break ins tended to be whoever was vulnerable, and not largely targeted based on ideology. When was the last time a break in of this nature was based on ideology? Usually those kinds of break ins tend to be defacement of services, etc. Not theft of customer data. I'm pretty sure Albert Gonzalez had no beef against TJX when he broke in, he just wanted the damn money.

      --
      Non impediti ratione cogitationus.
    4. Re:Ok Sony, so basically, by slinches · · Score: 1

      It could have been a target of opportunity rather than ideology. A professional hacker may have heard about the poor security of PSN from all of the news of the PS3 hacks and realized that it would be a relatively easy way to get a lot of valuable data.

      --
      Knowledge Brings Fear
    5. Re:Ok Sony, so basically, by unity100 · · Score: 1

      those vulnerabilities were there for a long time. and they werent hacked until now. moreover, there are more profitable avenues to hack for money, than a fucking game network.

    6. Re:Ok Sony, so basically, by slinches · · Score: 1

      For all I know, it could have been ideological. I wasn't saying that I know any better, only that there are other possible motivations. Deducing someone's motivations in things like this is very difficult and we'll likely never know with any certainty the reasons behind it unless the hacker wants it known. I was simply pointing out that the timing is not necessarily indicative of malice towards Sony.

      --
      Knowledge Brings Fear
    7. Re:Ok Sony, so basically, by unity100 · · Score: 1

      it IS ideological. hacking a gaming network is much less profitable and safe than acquiring credit card numbers through other means, and then charging them inconspicuous small amounts every month. which is the preferred way they do such things. chances are high that a lot of people have such fradulent charges in their cc statement. noticing requires people to check their statements and know their spendings.

  60. real data? by Tom · · Score: 1

    You still put your real data into anything that doesn't actually need it (e.g. if you want something delivered, you obviously need to put in your real address) ?

    Seriously?

    Have they sent everyone to dumb school?

    The first rule of privacy is to not give people your data. Unless you understand why they need it. Very, very few online services need your birthdate, for example. I always put in a fake one (always the same, so it's easy to remember). Same for address and practically anything where I don't understand what they need it for but they insist on having it.

    The second rule, of course, should be that companies shouldn't request and store data that they don't actually need. Because all security, encryption and whatever else you have is always breakable. Not having the data is the only thing that's 100% safe.

    --
    Assorted stuff I do sometimes: Lemuria.org
    1. Re:real data? by Anonymous Coward · · Score: 0

      You have to provide your real name, address, etc as billing info when using a credit card to purchase anything online. Which is what I'd wager most people on PSN did.

    2. Re:real data? by Anonymous Coward · · Score: 0

      They set the terms of sale.

      Okay, so I've figured it's really profitable to murder people and take their wallets but there's this little thing that makes it kinda tricky; law if I remember correctly. The argument of "just take your business elsewhere!! Lol!!" is getting tiring now...they ALL do it. Meet the new boss, etc. The law is wrong here, they shouldn't get to play chicken with my livelihood as a "condition of sale".

    3. Re:real data? by Kalriath · · Score: 1

      Good luck getting past AVS with a fake address.

      --
      For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
    4. Re:real data? by Anonymous Coward · · Score: 0

      Just make sure your fake birthday is one you like, because eventually ChoicePoint will update it globally when they see the same one enough. Go too young, and they might disenfranchise you in Florida.

    5. Re:real data? by Tom · · Score: 1

      They don't teach reading comprehension in dumb school, I see. I did say "where I don't see what they need it for". Obviously if I want to verify that I am who I claim to be then I'll put in real data. Just I'll put in my real credit card where I order stuff and my real address when I want them to send me something.

      --
      Assorted stuff I do sometimes: Lemuria.org
    6. Re:real data? by Tom · · Score: 1

      I order stuff via credit card all the time without giving the vendor my address, when it's a digital download. The credit card company obviously knows who I am, but part of the service I pay them for is that they stand inbetween me and the vendor and tell the vendor "you don't need to know anything about this guy, if we verify the number is correct, then you know you'll get paid and that's all that should matter to you".

      Again, sometimes I see why they need it (if I order physical stuff, they obviously need an address to deliver to). But very often they ask for stuff that has no relation to the transaction. Usually out of laziness (same form for everything) or out of some strange desire to "know" me (euphemism for "sell higher qualified data").

      --
      Assorted stuff I do sometimes: Lemuria.org
    7. Re:real data? by Kalriath · · Score: 1

      I see they don't teach research in dumb school.

      AVS is the system whereby the billing address on the credit card is validated against the user provided address to ensure that they are the same. Which is to say, if a merchant uses AVS validation, your fake address is going to result in your order being declined or marked as high risk/fraud - whether they're shipping shit to you or it's just a PSN purchase.

      --
      For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
  61. According to Sony, unencrypted passwords accessed by traindirector · · Score: 1

    Unencrypted passwords being accessed is not speculation. Sony was pretty clear about this point:

    Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. -Official Playstation Blog

    I think if they could say "encrypted password hashes", they would. Unless they're trying to make things seem worse than they are in some misguided attempt to come out looking better in the end.

  62. Re:I guess I didnt miss much by somersault · · Score: 1

    no sense of what he is doing or how it may be affecting his moral compas

    He's playing a game. When I "cut people apart" in computer games, I don't think of it as actually cutting people apart. When I "kill" other people in multiplayer games, I just think of it as scoring a point, same as taking a piece in chess or hitting a target on a dartboard or something.

    Your moral compass may affect your enjoyment of these games, but any game that has the right type of story/gameplay to be able to brainwash you into changing your moral compass should already be rated 18.

    --
    which is totally what she said
  63. Re:I guess I didnt miss much by h4rr4r · · Score: 1

    human or other species
    Other species?

    Do you eat meat?
    Know anyone who hunts?
    Know any farmers or people who keep chickens?

  64. Re:I guess I didnt miss much by somersault · · Score: 2, Insightful

    You don't really sound like you've played the game, the way you talk about it makes it sound very serious. You don't actually have to kill innocent bystanders unless you want to, just the same as real life. Many missions call for you killing people, but what do you expect in a game about gangsters? Actually, you don't even have to do the killing missions if you don't want to.. you could just be a taxi driver, paramedic, or firefighter if you really wanted to just be super-good all the time.

    --
    which is totally what she said
  65. Sony is about a week late. by JustAnotherIdiot · · Score: 1

    I had read news articles warning me about this a week ago, good job keeping your users informed Sony.

    --
    What do I know, I'm just an idiot, right?
  66. Credit Monitoring by Anonymous Coward · · Score: 0

    I have been fairly patient with Sony thus-far, as it is hackers that caused this, but now that they have finally stepped up and admitted that our data was stolen, I fully expect Sony to have to bite the bullet and provide free credit monitoring to all PS3 customers effective immediately. If they do not, get ready for a massive class-action.

  67. What are the odds... by Anonymous Coward · · Score: 0

    What are the odds that Anonymous was behind the breach? They did have an ongoing attack against Sony leading up to this.

  68. Could this be the work of Anonymous? by Anonymous Coward · · Score: 0

    Maybe this is the work of someone Sony pissed off. Lord knows there are enough people mad at these money grabbing bawds. I am laughing right now. I have a PS3 and it is just collecting dust.

    NE1 want to buy a slightly used PS3? It's a little dusty but works like a charm. Even still has Linux on it.

  69. Trackball is not for all genres by tepples · · Score: 1

    And user interface. give me my trackball and keyboard for FPS.

    True, a trackball is ideal for first-person shooters and for fixed-camera shmups like Centipede, Ikaruga, or Perfect Cherry Blossom. But games other than such shooters exist. What's the best controller for, say, a platformer or a fighting game?

    1. Re:Trackball is not for all genres by Anonymous Coward · · Score: 0

      What's the best controller for, say, a platformer or a fighting game?

      The best controller for those kind of games is a digital joystick.

      And I can also tell you the worst controller for any game: a gamepad. Those only got popular because they are dirt-cheap to make leaving more profit for the console manufacturer.

  70. Nintendo by DarkOx · · Score: 1

    Boy I sure am glad Nintendo only know me by WII Number and I have never given them my CC either, always just bought WII points cards to add points to my account for purchases. So even their database gets published me and probably lots of other account holders WONT CARE. Stupid Sony Stupid...

    --
    Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
    1. Re:Nintendo by JustAnotherIdiot · · Score: 1

      Unless they changed it since I had a wii, it doesn't store your credit card number.
      Which frustrated me some, since typing in a credit card number (especially with the wiimote) every time you wanted to buy something was a pain.

      --
      What do I know, I'm just an idiot, right?
  71. Monitor size; Amiga; custom soundtracks; Spock by tepples · · Score: 1

    why not go back to personal computers for gaming?

    Because most PC monitors are not big enough for two to four players holding gamepads, and the general public is unwilling to try to connect a PC to a TV.

    for most games that come out on consoles a keyboard and mouse are the superior input solution

    How would a keyboard and mouse/trackball work for, say, Street Fighter series or Smash Bros. series? And given that the input APIs on Windows combine all connected keyboards into one virtual device and all connected mice and trackballs into one virtual device, what do players 2 through 4 use?

    Ten years ago, who even thought you could play music on a computer?

    Any owner of an Atari ST, Amiga, or Apple IIGS computer was playing music twenty years ago: Amiga and IIGS through built-in sampler hardware, and ST through an external MIDI synthesizer. And as AC pointed out, Napster had already made its mark ten years ago.

    Anyway, computers are conclusively better if only for the fact that you can play MP3s while you game.

    Custom soundtracks have been possible on consoles since Xbox 1 back in 2001.

    And about your sig: Yoda, Spock Sarekson, and Benjamin Spock aren't the same, but perhaps that was your point.

    1. Re:Monitor size; Amiga; custom soundtracks; Spock by anonymov · · Score: 1

      How would a keyboard and mouse/trackball work for, say, Street Fighter series or Smash Bros. series? And given that the input APIs on Windows combine all connected keyboards into one virtual device and all connected mice and trackballs into one virtual device, what do players 2 through 4 use?

      Gamepads?.. Like, you know, any of those in $5 to $100 range that you can buy in any store.

      It's not that mice/keyboards are limited to PC and gamepads to consoles, it's that you can grab any USB gamepad and stick it into your PC with reasonable chances it will work everywhere, and you couldn't - as far as i can remember, correct me if i'm wrong - just grab any cheap mouse/keyboard for your console.

    2. Re:Monitor size; Amiga; custom soundtracks; Spock by vgerclover · · Score: 1

      why not go back to personal computers for gaming?

      Because most PC monitors are not big enough for two to four players holding gamepads, and the general public is unwilling to try to connect a PC to a TV.

      for most games that come out on consoles a keyboard and mouse are the superior input solution

      How would a keyboard and mouse/trackball work for, say, Street Fighter series or Smash Bros. series? And given that the input APIs on Windows combine all connected keyboards into one virtual device and all connected mice and trackballs into one virtual device, what do players 2 through 4 use?

      Weird, last time I checked my Logitech Rumblepad 2 worked perfectly on my PC, just like my friend's X-Box 360 controller when we played New Super Mario Bros in 1080p on his 32" TV.

      Ten years ago, who even thought you could play music on a computer?

      Any owner of an Atari ST, Amiga, or Apple IIGS computer was playing music twenty years ago: Amiga and IIGS through built-in sampler hardware, and ST through an external MIDI synthesizer. And as AC pointed out, Napster had already made its mark ten years ago.

      I don't think he is talking about synthesizers.

    3. Re:Monitor size; Amiga; custom soundtracks; Spock by OverlordQ · · Score: 1

      Because most PC monitors are not big enough for two to four players holding gamepads, and the general public is unwilling to try to connect a PC to a TV.

      HDMI out on computer to HDMI in on TV. Done.

      --
      Your hair look like poop, Bob! - Wanker.
    4. Re:Monitor size; Amiga; custom soundtracks; Spock by xero314 · · Score: 1

      as far as i can remember, correct me if i'm wrong - just grab any cheap mouse/keyboard for your console.

      Consider yourself corrected. The PS3 supports standard USB keyboards and mice.

    5. Re:Monitor size; Amiga; custom soundtracks; Spock by tepples · · Score: 1

      The PlayStation 2 also supported standard (but not PS/2 ones, which added to the jokes a decade ago). Perhaps the complaint is that 1. not enough PS3 games support mouse and keyboard, 2. PS3 games can't legitimately be modded to introduce new control schemes, and 3. games don't support multiple mice or keyboards for shared-screen co-op.

    6. Re:Monitor size; Amiga; custom soundtracks; Spock by tepples · · Score: 1

      last time I checked my Logitech Rumblepad 2 worked perfectly on my PC, just like my friend's X-Box 360 controller when we played New Super Mario Bros in 1080p on his 32" TV.

      I thought New Super Mario Bros. Wii was made exclusively for Wii, not PC. Just because you can make a "backup" of your Wii game and emulate it on a PC in your country doesn't mean that's legal in every country. But more to the point, just because you're willing to buy a second PC to put in the TV cabinet doesn't mean everybody is willing to pay for a second PC and a second antivirus subscription when even the PS3, which was introduced at a price of 599 USD, has become cheaper than a professionally built gaming PC.

  72. Nothing to Hide. by Anonymous Coward · · Score: 0

    What's all this fuss, you have "nothing to hide"(tm) after all?

  73. Why was this data accessible from the Internet? by mkraft · · Score: 1

    I could understand a single person having his data stolen by someone hacking that persons account, but why was it possible for someone to log in and grab every single PSN users' account data? All that data should never have been stored on a system accessible the Internet.

    The only thing I can think of that would explain what happened, is that Sony stored the entire customer database on the PSN networks servers and used SQL to display/edit the account of the logged in user. A simply SQL injection bug would allow accessing everyone's account info. That wouldn't be possible if Sony kept all the personal info on a separate system with only the user name and a hashed password stored in the stored database on the PSN server. My guess is that's what Sony's busy doing now, moving the account data to a server not accessible from the Internet, but that's too little too late.

    On a side note, I saw no evidence of fraud on my credit card account, but I cancelled it last night any way. When I called to cancel I was told I was the 2nd person the guy on the other end talked to about the Sony breach. The other person already had fraudulent charges on his account. So if you have credit card info stored on PSN, cancel that card now as it's only a matter of time before you get hit.

    1. Re:Why was this data accessible from the Internet? by anonymov · · Score: 1

      It's either:
      a) Sony is really, _really_ stupid and you could really fondle their privates^H databases just by logging into dev network, or
      b) Hacking into dev network and hacking into their customer database was 2 separate things just clumped together by media.

      Hard to guess, as there's no official information on attack vector anywhere.

  74. Credit Card = Stupid by indeterminator · · Score: 2

    The problem with the whole credit card system for online payments is that you will need to give your secrets out to anyone who you want to pay, and trust that they handle those secrets properly. It just doesn't work.

    1. Re:Credit Card = Stupid by AmiMoJo · · Score: 1

      This could be solved by having the card generate a single use code that can be typed in instead of using the actual CC number. A low power LCD or eInk display on the card could display it, or you could even have a special USB card reader that simply types the code for you when a button is pressed. That code would only be valid for one transaction made within say 60 seconds of being generated.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  75. The iOS supposed tracking was a HUGE issue? by HeavyDevelopment · · Score: 1

    The tech media and politicians had their panties in a wad over the iOS/Android "tracking". Guess what? Sony's lack of security actually did allow the personal information for 77 million users to be exposed. You know, opposed to theoretically being able to access your approximate location. I wonder if there are going to be Congressional hearings about this? Oh wait, the dried up turds in Washington don't use the Playstation network. So what do they care? The hypocrisy of what people find important and creates media buzz opposed to what really is important makes me wonder sometimes.

    Ha, ha, ha......this just makes me laugh.

    --
    Badges!?! We don't need no stinking badges!
  76. Not just hackers - DEVIANT HACKERS! by tgeek · · Score: 1

    Oh my god! I just checked my past bank statements! These aren't just hackers they're deviant pervert hackers! They're using my CC to sign up for lesbian-midget-amputee-bondage porn websites (with the optional deluxe live streaming package!) And they have been for months! Even before I had a PS3! What's Sony gonna do about this?

  77. Class action time! by Yosho-sama · · Score: 1

    I'm interested in getting in on this. I have to change my damn credit card now and my company is charging me $5. That's as much as a PSone game which I purchased and now is a liability.

    --
    My kingdom for a donkey!
  78. I've been robbed... by Gorkamecha · · Score: 2

    I've been robbed, and I'm not even sure what they have stolen. I've had my PS3 for years, it collects dust most of the time lately - But I'm sure I setup a PSN account back in the day. So, I know they have some data. I have a pretty good idea what that data is - But I can't be sure. And since their site is down, I can't go in and check. Wonderful. And I'm getting this info from the media - Where's my letter saying "Hey, we got robbed, they took this and it was yours." Or some sort of note. Anything. Sony...Hello?

    1. Re:I've been robbed... by SpanglerIsAGod · · Score: 1

      I don't know my PSN password. I tried to log in manually a few times recently and it didn't work. On the upside it's obviously not a password I've used elsewhere.

      --
      War doesn't show who is right - just who is left.
  79. FBI by Anonymous Coward · · Score: 0

    The FBI still has machines which use 8" floppies (they are the largest consumer of these disks in the word).

  80. Re:According to Sony, unencrypted passwords access by robmv · · Score: 1

    Not defending Sony, but if I must tell to my customers that we detected unauthorized access and they got the password hashes, I will report that we believe someone got access to the passwords database, hashed or not those are password related and the common user will not understand what is a hash or why if they are encrypted they must care to change it. This do not means they are storing hashes or not, there is a high probability than not but it is not conclusive

    Note: password encryption is not a panacea either, if someone accessed the servers, they probably could access the encryption keys too because some code needs to decrypt them to validate the user, that is why you hash with a powerful algorithm and encrypt if you want more protection

  81. legal by Anonymous Coward · · Score: 0

    Are we suing them them for failure to provide basic security of personal information required to participate within its environment? Is there legal footing for that? I am furious!

  82. They sue their own customers... by plastick · · Score: 2

    A company that sues it's own customers is a company that does not care about protecting your information.

  83. HA HA by Anonymous Coward · · Score: 0

    I find it laughable there is actually that many IDIOTS that would buy a Playstation or sign up for PSN. I find it extrememly laughable that you all got your just desserts for your stupidity. So: HA frinkin' HA!

  84. Debit vs Credit by Tanman · · Score: 1

    If you use a debit card, you are much more at risk than credit. Debit cards move money, credit cards issue credit.

    I never use debit cards or checks. Both of those leave you wide open. Use credit for everything

    1. Re:Debit vs Credit by Anonymous Coward · · Score: 0

      In the US you are only legally liable for the first $50 of loss if your debit card gets stolen as long as you report the theft within (IIRC) 30 days.

      Granted, if your bank sucks they might drag their feet on restoring money to your account. When my debit card info was stolen a while back my credit union restored the money instantly, even the first $50, and said that they would cancel any overcharge fees that came about because of the fraud (luckily, none did anyway). Your bank's policies might vary -- but if you don't trust your bank, why are you keeping your money there?

  85. That's it? "Sorry"? by X.25 · · Score: 5, Insightful

    So, you peek into PS3 internals, you get slapped with lawsuits, police raids your home and they send army of lawyers after everyone.

    Someone steals 77m accounts from Sony, all they have to say is basically...

    Sorry?

    Fuck you Sony.

    1. Re:That's it? "Sorry"? by Kohath · · Score: 1

      What should they say? Please tell us.

    2. Re:That's it? "Sorry"? by the+eric+conspiracy · · Score: 1

      They should pay for credit account monitoring and identity theft insurance for all involved.

      But that's ok, we are going to see some lawyers make a bundle on this.

    3. Re:That's it? "Sorry"? by sycorob · · Score: 2

      They should get massively fined, in proportion to the monetary losses they are pushing onto customers, banks and vendors. $100 per account sounds like a good start. The money should go towards getting their users' credit histories back on track, as well as additional monitoring by the credit bureaus.

      They should fall out of PCI compliance, and be forced to bring their system fully up to compliance before they can charge even one more credit card. Or, they should only process pre-paid PSN cards, and leave merchant processing to the big boys who can secure the data properly.

      Overall, If people who are publishing the internals of the PS3 are subject to lawsuits, fines and possible imprisonment, then it stands to reason that revealing the private information of 77 MILLION people should have similar ramifications. If Sony can just say "We're sorry, we're working on it," then Geohot should have had that option too.

    4. Re:That's it? "Sorry"? by SheeEttin · · Score: 1

      Steal $100, go to jail. Steal $100 million, get slap on wrist (and bonus in your high-paying finance job).

    5. Re:That's it? "Sorry"? by Sprouticus · · Score: 1

      Everything posted above is spot on. Reasonable response to a major data theft due to sony not taking proper steps to secure their data. Wish I had a few dozen mod points.

    6. Re:That's it? "Sorry"? by boombaard · · Score: 1
      I'm not really trying to troll, but that's the American justice system for you.. To quote Greenwald writing about something Obama said about Bradley Manning:

      Obama: "We're a nation of laws. We don't let individuals make their own decisions about how the laws operate. He broke the law."
      The impropriety of Obama's public pre-trial declaration of Manning's guilt ("He broke the law") is both gross and manifest. How can Manning possibly expect to receive a fair hearing from military officers when their Commander-in-Chief has already decreed his guilt?

      Or this, an equally disturbing (though probably less obviously so because this concerns "foreigners":

      When I saw that, I was going to ask how the NYT could possibly know that the people whose lives the U.S. just ended were "militants," but then I read further in the article and it said this: "A government official in North Waziristan told Pakistani reporters that five children and four women were among the 23 who were killed." So at least 9 of the 23 people we killed -- at least -- were presumably not "militants" at all, but rather innocent civilians (contrast how the NYT characterizes Libya’s attacks in its headlines: "Qaddafi Troops Fire Cluster Bombs Into Civilian Areas").

      Or, about a guy who hit a bicyclist in NYC causing "spinal cord injuries, bleeding from his brain and damage to his knee and scapula, according to court documents. Over the past six weeks he has suffered “disabling” spinal headaches and faces multiple surgeries for a herniated disc and plastic surgery to fix the scars he suffered in the accident."

      This kind of egregious hit-and-run is, obviously, a very serious crime. Milo is incredulous at the suggestion from Erzinger’s attorneys “that Erzinger might have unknowingly suffered from sleep apnea”, and wants Erzinger to be charged with a felony. Justice must be served: the case “has always been about responsibility, not money”, he wrote to DA Mark Hurlbert.
      Yet Hurlbert, looking at Erzinger’s wealth, decided that the case really was about the money after all:

      “The money has never been a priority for them. It is for us,” Hurlbert said. “Justice in this case includes restitution and the ability to pay it.”
      Hurlbert said Erzinger is willing to take responsibility and pay restitution.
      “Felony convictions have some pretty serious job implications for someone in Mr. Erzinger’s profession, and that entered into it,” Hurlbert said. “When you’re talking about restitution, you don’t want to take away his ability to pay.”

      In other words, Erzinger has bought his way out of a felony charge, over the strenuous objections of his victim; it’s very unlikely that online petitions will do any good at this point. Just another thing to add to the list of things that money can buy, I suppose. [The story continues here]

      Or this about regulators who refused to regulate banks because fining them would hurt them financially. Or this about a state AG being bought by the mortgage lenders he's supposedly investigating/prosecuting. Or

    7. Re:That's it? "Sorry"? by Anonymous Coward · · Score: 0

      Someone steals 77m accounts from Sony, all they have to say is basically...

      Sorry?

      No they didn't. They may "regret" all this, but it's not really their fault. Sony is the real victim!

    8. Re:That's it? "Sorry"? by the+eric+conspiracy · · Score: 1

      Your facts are rather reminiscent of Baloney. Let's just pick one:

      "BP not being sued or fined or anything over the GoM disaster"

      A quick Google search picks up the following:

      BP, Drilling Partners Sued by U.S. Government Over Gulf Oil Spill for 21 billion dollars.

      BP Sued by Pointe Au Chien Indian Tribe Over Spill Damage, Fishing ..

      BP sued by $132.6 billion New York State pension fund - Jun. 23, 2010

      Most of the other citations you list are equally dubious.

      As far as the Sony case, there are already class action lawsuits in progress in the US. I am sure they will be saying a lot more than "Sorry".

    9. Re:That's it? "Sorry"? by trawg · · Score: 1

      They have also refunded everyone their PSN fees :)

    10. Re:That's it? "Sorry"? by Anonymous Coward · · Score: 0

      No. Fuck the person or persons who stole the numbers. I may very well be in that 77 M. Sony deserves flames for its conduct, and perhaps Sony deserves criticism and a lawsuit for improperly security its data should a finding a fact prove that, but I did sue Hotz. I didn't raid anyone's home. Nor did 77 M other people. That "Fuck you Sony" is actually a "Fuck you 77 million PlayStation consumers". Even if my credit card is safe, I still will wonder, and I will still need to devote additional effort to protecting myself.

      Sorry, but fuck whomever decided this was a justified response, and fuck whomever decides to profit of that stolen data.

    11. Re:That's it? "Sorry"? by Kohath · · Score: 1

      Your credit cards already provide "credit account monitoring" and insure you against theft from your account. This is already paid for by the 2% the credit cards take on every credit card transaction.

  86. Re:According to Sony, unencrypted passwords access by mkraft · · Score: 1

    Weren't the encryption keys stored on the PS3 itself? If so they are already accessible which is probably part of the problem. If Sony was storing the server encryption keys on the PS3, then they were screwed the moment the PS3 was hacked. They should have shut down updated the PSN network servers the moment the PS3 master key was leaked.

  87. Where is the praise for geohot now? by Anonymous Coward · · Score: 0

    Before hacking the ps3 and cracking its security was yelled allover the world in praise of geohot and how awesome he is at making a strike for the little guy against the giant evil corporations!

    Im not saying this is his fault, but Im illustrating a point when people hack shit, its never in the best interest of anyone because all it takes is one person and in this case one person(s) screwed 77 million others. So yeah where is the harm is hacking your ps3? Everyone should do it!

    1. Re:Where is the praise for geohot now? by Anonymous Coward · · Score: 0

      The security of Sony's online network should have nothing to do with the DRM on its console. This is Sony's fault, not Geohot. That just fanboy scapegoat crap.

  88. Re:I guess I didnt miss much by Labcoat+Samurai · · Score: 1

    Certainly I am not anti-video game. Maybe anti-morally bankrupt video game. You know "Grand Theft Auto" or any game that gives you 10 ways to kill and mame or steal or pillage, human or other species. I just think you have to overcome some natural prohibitions on killing in your intellectual side to actually do and enjoy those games.

    I enjoy these games, have a "natural prohibition on killing" in real life, and have never really felt like it required much suppression. Has anyone ever pissed you off and you thought "I want to kill that jackass"? Presumably if it actually came to it, the reality of the situation would come crashing down and the fantasy would lose all of its appeal. Not so with a video game, where the entire scenario has only the veneer of reality. Murder is easy when you dehumanize your target, and dehumanization is easy (and guilt-free) when your target was never human to begin with.

  89. Re:According to Sony, unencrypted passwords access by robmv · · Score: 1

    There are bad software architectures and bad security bugs, but I do not believe the key to sign code to be run on the PS3 is the same they use to encrypt internal PSN data, that would be a BIG error. About the key found on the PS3, there is no other way to use symmetric key cryptography without one key on the side doing the signature validation so one key must be hidden on the PS3, and a bug on how they implemented the algorithm allowed people to deduct it, not that they found it in plain text

  90. Re:According to Sony, unencrypted passwords access by gl4ss · · Score: 1

    psp and ps3 are both compromised.

    well, developer versions of them were compromised from day one and available to anyone with cash I suppose, so it was a bad plan from the start if it was like that.

    --
    world was created 5 seconds before this post as it is.
  91. Re:It only does... by acedotcom · · Score: 1

    Identity Theft

    --
    they say it is often more relevant then the comment above, all we know is its called the Sig!
  92. Really quite pissed off. by Flipstylee · · Score: 1

    I own three (3) products made and/or licensed by sony:

    (1) Dvd burner purchased many years ago,
    (1) 42" Lcd Television purchased 2 years ago,
    and (1) PS3 purchased about 6 months ago.

    These products represent the last of the money they will have ever gotten from me,
    Because i now see that even if they decided to dabble in medicine and came up with a cure for cancer,
    no doubt it would be stored incorrectly, and come with the side effect of herpes.

    Perhaps i'm over-reacting but to do something this stupid and wait as long to own up to it is just bullshit.

  93. Wish I could log in to change my info by wooden+pickle · · Score: 1

    I don't even remember if I ever entered my CC info on PSN. Too bad I can't log in and check. =/

  94. Meaning by ThatsNotPudding · · Score: 1

    that the even more lucrative Xbox hacking project is still underway Given the massively large pot of gold in them thar Xbox hills, the hacking may be slow, but the Chinese government / Russian Mafia is patient.

  95. Who cares about password? It's down! by Aqualung812 · · Score: 1

    Really, who gives a shit if they have your PSN password. Their service is down right now. When it comes back up, they just need to do a forced password change. Easy.

    Unless, you were stupid enough to use the same password for everything.

    --
    Grammer Nazis - I mod you "troll" unless you actually add something on-topic. Yes, I know I have mispellings in my sig.
    1. Re:Who cares about password? It's down! by AK+Marc · · Score: 1

      You said the answer. Most people do reuse passwords.

  96. It is upsetting by CTU · · Score: 1

    The worst part about whats going on with PSN was the fact I only heard about it through /. and other online news sources and nothing from Sony themselves. If I did not check these sites I would have had no knowledge about the hack. I wonder if there will be any class action lawsuits going on after this is cleared up as I seen it stated that CC info might have been leaked.

  97. What do you do? by theamarand · · Score: 1

    It's scary that Sony would allow this to happen.

    On the one hand, it's a trust issue. I'm must less likely to trust Sony's network at this point. They would have to proactively earn my trust back in various, public, audited ways.

    On the other hand, what do you do when this happens to one of your accounts? The network isn't even back up yet. If the criminals have all of my information that Sony has, how can Sony guarantee that I'm a legitimate person, signing in and changing my password? Send me snail-mail with a one-time password? That's so costly and time-consuming.

    I don't want to have to think about, or worry about, any of this security crap when I just want to play a game.

    And this is why I think "cloud computing" is a bad idea. Putting all of your stuff out there, where someone could gain access to it? Scary!

  98. Really quite pleased. by InsaneProcessor · · Score: 1

    I am so ridiculously pleased that I haven't purchased a single Sony product in the last 6 years.

    --

    Athiesm is a religion like not collecting stamps is a hobby.
  99. Lik-Sang anyone? by ufpdom · · Score: 1

    I remember many years ago Sony shut down a decent shop called Lik-Sang . Karma's a bitch i'm guessing.

    --
    There's no Freedom like UFP-dom
  100. What harm could they possibly do? by isnoop · · Score: 1

    I'm not concerned the Sony hackers might have my CC number. After all, Sony surely took that perfectly usable data and hobbled it in such a way that it only works with their own products and services.

    That's just what they do.

  101. Relax. Deep Breath. by Anonymous Coward · · Score: 0

    There is one secure network. The one that is turned off.

    Don't forget that many (not all) hackers get busted, and to be sure, Sony and their "partner" have as good a chance as any to catch the motherforker or motherforkers who did this. As for identity theft.... they didn't get SSN's, nor did they get the security code on the credit card. That doesn't make you safe, it just makes it harder for the perps. Even if they use it, you're not liable, so please, all, let's take a deep breath.

    There is a huge difference between being at fault and being responsible. I don't think you can say that Sony is at fault, but clearly they are responsible (much like maybe a baseball coach isn't at fault for his team sucking but he is held responsible). I don't care that they waited, you're stupid if you do. They need to do whatever they need to do to catch the person responsible. Unless you're in a swivel chair at Sony, you don't know why they did what they did. I'm guessing that they didn't want to say anything until they were 100% certain that what they were saying is true.

    As Sony is responsible to us, their customers, they will need to make amends. How, I do not know. I don't want any rushed features or anything (though I wouldn't mind my "other os" option back) but something.

    I really enjoy those who gripe about "if you peek at the internals you're bad but Sony only has to say sorry". Yes, asshat, that is exactly true. Sony was trying to stop people from doing that to prevent EXACTLY what happened. While many, perhaps even the preponderance of people wouldn't use the information for evil, clearly it takes but one.

  102. Re:I guess I didnt miss much by Omestes · · Score: 1

    Know any farmers or people who keep chickens?

    Why yes! They keep them safe and warm and happy.

    Farmers love them chickens.

    --
    A patriot must always be ready to defend his country against his government. -edward abbey
  103. Kinda Ironic/Karmic by theygoto11 · · Score: 0

    Sony was really keen on protecting their digital media rights... user information? Not so much. http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal

    1. Re:Kinda Ironic/Karmic by tekrat · · Score: 1

      That's a good point. And since they let someone else "download" your data, and each copy of said data is worth $150,000 per instance, times 77 million....

      Isn't Sony part of the people suing Limewire for a Trillion Dollars???

      I think the time has come for everyone to sure Sony.

      Wouldn't it be nice if we could call up the RIAA and say "stop suing us, it wasn't fire sharing, it was a data-breach!"

      --
      If telephones are outlawed, then only outlaws will have telephones.
  104. Just called and warned a couple of friends... by thatbloke83 · · Score: 1

    ...about this. They aren't particularly tech savvy people, but my brother didn't even know PSN was down as he hadn't turned his PS3 on for 2 weeks.

    Anyway, got off the phone with another friend and 5 mins later he got this email:

    Valued PlayStation Network/Qriocity Customer:

    We have discovered that between April 17 and April 19, 2011, certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into our network. In response to this intrusion, we have:

    1) Temporarily turned off PlayStation Network and Qriocity services;

    2) Engaged an outside, recognized security firm to conduct a full and complete investigation into what happened; and

    3) Quickly taken steps to enhance security and strengthen our network infrastructure by re-building our system to provide you with greater protection of your personal information.

    We greatly appreciate your patience, understanding and goodwill as we do whatever it takes to resolve these issues as quickly and efficiently as practicable.

    Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state/province, zip or postal code), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence that credit card data was taken at this time, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, to be on the safe side we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.

    For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security, tax identification or similar number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. When the PlayStation Network and Qriocity services are fully restored, we strongly recommend that you log on and change your password. Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them, as well.

    To protect against possible identity theft or other financial loss, we encourage you to remain vigilant to review your account statements and to monitor your credit or similar types of reports.

    We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience. Our teams are working around the clock on this, and services will be restored as soon as possible. Sony takes information protection very seriously and will continue to work to ensure that additional measures are taken to protect personally identifiable information. Providing quality and secure entertainment services to our customers is our utmost priority. Please contact us at www.eu.playstation.com/psnoutage should you have any additional questions.

    Sincerely,
    Sony Network Entertainment and Sony Computer Entertainment Teams

    Sony Network Entertainment Europe Limited (formerly known as PlayStation Network Europe Limited) is a subsidiary of Sony Computer Entertainment Europe Limited the data controller for PlayStation Network/Qriocity personal data

  105. Hurray Geohot! by tekrat · · Score: 1

    Actually the one person who screwed 77million others was the CEO of Sony. You can bet *his* credit card numbers aren't compromised, you can bet his bonus for this year isn't even at risk. And you can bet that Sony will spin this in such as a way as to screw you all, over and over again.

    --
    If telephones are outlawed, then only outlaws will have telephones.
  106. Watch out by Anonymous Coward · · Score: 0

    "Hey, we gave away a bunch of your personal information. Watch out."

  107. For me, procrastination finally pays off by unassimilatible · · Score: 1

    I've been wrestling with buying a PS3 for years, paralyzed by indecision. The latest of late-adopters avoids the security breach!

    Even better, some guy in Nigeria is offering me a ridiculous amount of money just to help him withdraw some of his money stuck in escrow, so now I can afford a PS3 for free once they fix the security issues. Win-win, suckas!

    --
    Slashdot "libertarians": Small government for me, big government for those I disagree with. -1, I disagree with you
  108. Re:I guess I didnt miss much by h4rr4r · · Score: 1

    For a dozen weeks or so anyway. Then it is a bad time to be a chicken.

  109. Re:Relax. Deep Breath. by anonymov · · Score: 1

    Sony was trying to stop people from doing that to prevent EXACTLY what happened.

    Wait.
    So, you say they knew EXACTLY their security is so bad, some guy could hack them with just a bit of modding of the console.

    And they tried to prevent EXACTLY that by going after that one guy instead of, you know, securing the data so it couldn't be stolen by just anyone with google and soldering iron?

  110. Re:Relax. Deep Breath. by Anonymous Coward · · Score: 0

    No, I never said that.

    I said they try to prevent people from hacking their equipment so that those people don't use that information to hack their servers. And their servers getting hacked is EXACTLY what happened. (you sure got excited by my capitalization)

  111. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    Good balanced approach to trying to argue mitigating factors to ethical and moral development. The same argument is made by people who do not want to have any responsibility towards global warming or any of its fall out. Granted all the car driving and power station and industrial pollution is not the only thing that causes global warming but is one thing that is under our control. It may be that parental influence is a strong influence. But say your child had a "bad" friend, which is influencing them, you would try to remove that influence from his life. A "bad" video game where the child spends time with (where the parent is not there to advise at every step what is right and wrong) where the game has its own morality and rewards for certain behavior and punishes for others, it has an influence on the child. I think we need to remove bad influences from developing minds where we can. Why should a parent have another "bad" influence to have to counter with all the other "bad" examples of behavior out there.

  112. Why isn't everything encrypted, Sony? by TiggertheMad · · Score: 1

    Putting rootkits on CDs is evil. Storing passwords in plaintext is stupid. Being evil doesn't make you stupid.

    Someone on /. has a sig that say something like 'Sufficiently advanced malice is indistinguishable from stupidity' which seems pretty prophetic in this case. In the end is the net outcome any different?

    Anyway, a better point to look at is: With society being where it is, why is anything being stored in a DB in plain text anymore? You can't do partial string searches on hashed values but how often do you need to do 'like' db searches on SSNs, Addresses, City, State, Zip, Names, and birth date fields? As a developer, I am saying to my fellow devs: Paranoia is your friend, encrypt every dam thing you can. Given enough success, your product WILL be hacked.

    --

    HA! I just wasted some of your bandwidth with a frivolous sig!
  113. Re:Relax. Deep Breath. by anonymov · · Score: 1

    No. Just no.

    You see, it depends on assumption that it was geohot's and rebug's work that led to the breach - which I have trouble believing is true, as it would imply colossal stupidity on Sony's part.

    If it was true, it would be like bank defending it's security by beating people who tried to use the WC, because there is unlocked safe vault door on the way there.

  114. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    Good point. We are social animals and we are ominivors (not all of us eat meat). But then that is one of the ways you can justify killing other people, by identifying them as of a different group (ethnic, religious, political, species) then it's OK to kill, right? Killing for food is a different issue. I was talking about sentient beings. Often other groups are talked of as allien creaters, not worthy of life. I just don't think practicing illegal or immoral acts over and over and over and getting rewarded for them has redeeming social value, especially in children. Every thing that is fun (or tastes good) is always good for you.

  115. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    "You don't actually have to kill innocent bystanders unless you " your serious that this is a defense of your position?

    " what do you expect in a game about gangsters" I expect no less from a game about gansters. The original point or the Irony of it is that a multiplayer site that has ganster games is hit on by gansters. Not only Ironic but maybe self fullfilling.

      I suspect that the ones that hit Sony were not the ones that were alway playing the paramedic.

  116. Ecclesiastes 5 by Anonymous Coward · · Score: 0

    "Don't be surprised when you see the poor kicked around, and justice and right violated all over the place. Exploitation filters down from one petty official to another. There's no end to it..."

    Ecclesiastes 5:8-9

    You're absolutely right, X.25, justice is absolutely missing in this situation.

  117. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    But at the same time you are practicing parts of your brain, Leaning what is valued and what is not. Too often the simulation has its own reality. Like the practice of Aikido which has its own build in dissonance where half the time you are practicing defending against unbalanced attacks and the other half you are practicing doing unbalanced attacks so your partner can practice. Here you are simuating a attack , another simuation, but prepares you for a real attack. Not only do you train your muscles but you train your perceptions and thought process on how to react. Those logic and moral circuits in your brain are not seperate from the ones you use in the real world. You may not know it but the game has its effect.

  118. Re:Relax. Deep Breath. by Anonymous Coward · · Score: 0

    I'm speaking more conceptually, not directly about geohot or rebug per se. What I'm saying is, they don't know what others can do, so they try to prevent people from hacking into their shit. I'm more explaining why Sony did that and saying that you can't defend exploiting their code while decrying them for being hacked. So it's okay to hack the console, but wrong to hack the servers that house the data. I get the philosophical difference, but from a corporate point of view, they are both the same thing.

  119. Ha! by Daetrin · · Score: 1

    You know what's "funny"?

    The credit card i registered on PSN was the Sony branded credit card i got when they had the special offer to get $100 off a new PS3. I used that deal to pick up my first PS3. Then a little over a year later (right after the warranty expired of course) i ended up using most of the points i'd accumulated with that account to get a PS3 Slim after my first PS3 got the yellow light of death.

    You know what? This entire generation of consoles has been kinda filled with fail. Even my Wii managed to get a disk reader error that i needed to take it in for, and recently it's started getting corrupted memory. Anyone else remember the days when you would just buy a console and expect it to, you know, work?

    --
    This Space Intentionally Left Blank
    1. Re:Ha! by mywhitewolf · · Score: 1

      Anyone else remember the days when you would just buy a console and expect it to, you know, work?

      after enthusiastic blowing on the cartridge, yes...

  120. Re:Sony Greed by InsertCleverUsername · · Score: 1

    Well put. I'm also a conscientious objector to all things Sony, but my primary reason is that I just can't reward the jerk-off's evil practice of creating their own stupid, proprietary solutions for problems we've already solved. Memory stick anyone?

    --
    Ask me about my sig!
  121. Hackers one shotted Sony by Anonymous Coward · · Score: 0

    Kind of sad really

  122. Statement Info by slateX · · Score: 1

    I was trying to figure out which card I used on my PSN account. The charge description for sony psn points would read like: "PLAYSTATION NETWORK 877-971-7669 CA" then a few numbers. Hope this helps.

  123. Get protected now! by Anonymous Coward · · Score: 0

    Identity Theft is America's Fastest Growing Crime! Get Identity Theft Protection for only $9.95 a month includes credit monitoring, access to credit report and full restoration services.

    Our Identity theft services are provided by Kroll Inc., the largest risk management firm in the world with over 30 years experience in security and risk mitigation. Kroll offers expertise from varied backgrounds and qualifications such as: Criminal justice, psychology, insurance, collections, law enforcement, credit bureaus and financial institutions.

    Go to www.prepaidlegal.com/idt/ssquestel now!

    i have the services and its great. i get an email every month if any activity is done on my credit report
    Honestly, id rather have it and not need it than need it and not have it

  124. Re:I guess I didnt miss much by interkin3tic · · Score: 1

    I have on occasion lamented that I did not get involved with online gaming. Well maybe it was for the best. As we know the gaming where you run around killing and maiming and destroying promotes good character.

    I detect sarcasm. And you're right: violent games does not "promote good character." Much like any entertainment and/or religion don't make you a good person, GTA will not make you a good person. Won't make you a bad person either, obviously, but it's true that violent games cannot take the place of good parenting and/or morality.

  125. Re:I guess I didnt miss much by somersault · · Score: 1

    I don't think my position needs a defence tbh, however I do think your opinion shows that you haven't actually tried the game, rather just read about it. It sounds far worse than it is, as do many movies and TV programs that people demonise without ever watching them. If I told a Christian of a book with violence, rape, incest, etc, they'd say that was horrible and they wouldn't read it, but I'm just talking about the bible :)

    PSN caters to many markets btw, from fuzzy wuzzy kids games up to Saints Row (which is like GTA, but worse in terms of morality I'd say). You might as well say that it's ironic that a library burned down just because in some books, buildings are burned by arsonists..

    --
    which is totally what she said
  126. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    I think violent gaming and acting out gangster lifestyle's promote warmer fuzzier feelings towards those moral wastelands. I think it is true that there is a behaviorist component to all games, what is valued what is not, what is rewarded and what is not and that has an affect on you whether you know it or not. "The lesson taught is never the lesson learned" .

  127. Re:I guess I didnt miss much by biek · · Score: 1

    There are good competitive video games that foster positive social skills.

    Online? With voice chat?? This I gotta see.

  128. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    I think your position does need defending and I specifically said that I was not anti-video game, just ones that promote killing, maiming, mass murder, theft, you know practicing anti-social or illegal or immoral behavior for fun. Fuzzy wuzzy games are fun, tennis , auto racing, ... but there are dark side games that I don't think appropriate for kids, The irony is that the Sony site was hacked by someone playing a hacker game. You know typing in, a virtual world, sneaking around stealing, getting emmense rewards and satifaction from defeating the enemy (firewalls and other security protection). How is that different than playing some of the video games I mentioned. No one got hurt right? just a scoreboard. Well the truth is that behavior hurts real people and I see it as ironic that the video game virtual world would have its virtual cyber world hacked.

  129. Who cares about passwords? by Bob-taro · · Score: 1

    Why all this focus on whether the passwords are encrypted? If someone has my CC number, address and date of birth, I'm going to be way more concerned about my identity being hijacked than whether they can impersonate me on PSN!

    --
    Prov 9:8 Do not rebuke mockers or they will hate you; rebuke the wise and they will love you.
  130. Re:I guess I didnt miss much by Labcoat+Samurai · · Score: 1

    But at the same time you are practicing parts of your brain, Leaning what is valued and what is not. Too often the simulation has its own reality. Like the practice of Aikido which has its own build in dissonance where half the time you are practicing defending against unbalanced attacks and the other half you are practicing doing unbalanced attacks so your partner can practice. Here you are simuating a attack , another simuation, but prepares you for a real attack. Not only do you train your muscles but you train your perceptions and thought process on how to react. Those logic and moral circuits in your brain are not seperate from the ones you use in the real world. You may not know it but the game has its effect.

    Except that I am aware that I'm playing a game. When I roleplay a character in a PnP roleplaying game, I do things I would not do in real life as though I were a different person. It is an opportunity to be something I am not, whether that is stronger, smarter, more desirable to women, or potentially more morally bankrupt. It is a safe sandbox in which to explore that fantasy without having to deal with any of the consequences of actually being that person. GTA is much the same. I am consciously applying a morality that is different from what I apply in the real world because I know that the reasons for applying my morality in the real world do not apply. I can use imagination and fantasize that it is real and that I am this other person, but there is always that metaknowledge that it is a fantasy.

    Why do we like scary movies? Certainly the rush of the fantasy is nice, but who out there would want to actually be chased by a slasher? It's escapist entertainment, and the fact that there is always that firm lifeline back to the real world is what makes it safe and acceptable.

    So no, I'm very consciously behaving according to a different moral framework.

    I'm not even sure what makes GTA or video games in general so special. Long before GTA ever existed or video games were beyond the 8-bit era, I'd have the occasional violent fantasy regarding bullies or jerks. I don't see how it's fundamentally different from imagining that some school bully was an action figure I had and then having another of my action figures (who was supposed to be me) beat the everliving piss out of him.

  131. SRP6 by TuringCheck · · Score: 1

    If I could do it with the very limited functions Java ME provides (just so I could write a WoW client for mobile phones :-) they could certainly do it for a PC or PS(P).

  132. Re:storing CC info by TuringCheck · · Score: 1

    In practice most of the businesses that need some form of recurring payments will store CC details. Why? Because most CC processors will not do that on their behalf, they just process the payment one-time. Had to implement a system allowing irregular recurring payments and it was a f*ing nightmare. When investigating "how others do it" it turned out that everybody and their dog were storing CCs.

  133. Re:I guess I didnt miss much by interkin3tic · · Score: 1

    I think violent gaming and acting out gangster lifestyle's promote warmer fuzzier feelings towards those moral wastelands.

    I think that religion more often promotes warm, fuzzy feelings for morally bankrupt actions. I also think that you're basing your ideas on very little concrete evidence.

  134. Re:I guess I didnt miss much by somersault · · Score: 1

    I love racing games and some kids games (the Lego ones for example, though they involve a lot of destruction of course). Children shouldn't be playing games that their parents haven't checked over, so that argument isn't against violent games, it's against poor parenting. My dad saw that we just found a zombie shootin game on the Amiga amusing rather than disturbing and so let us play it. Later on I tried the Resident Evil demo when I was around 13, but I just found it annoying and disturbing rather than entertaining, and decided not to bother with it. I tried Manhunt after a massive media fuss was kicked up, but it was a very dull game. Plenty of gore, no fun.

    I think the guys doing this are perfectly aware of the problems they can cause with stolen credit card info. Yes it could be thought of as a game, just as bank robbing is portrayed as a glamorous affair in movies, but they know they're hurting real people, and they don't care. I'd never scam a credit card from a real person, but I take things by force all the time in games, from Chess to Lego Star Wars.

    Race driving is basically doing something that would itherwise be illegal, but you're doing it in a controlled environment where it's accepted that you have less risk of hurting anyone. Things like paintballing and computer games are a similar idea. They're a lot of fun even for very 'moral' people. My brother in law is the nicest guy in the world, likewise my sisters hate overly violent or sexual themes in movies, but they all love playing GTA. One of my sisters basically just loved the taxi driving missions like I said.

    --
    which is totally what she said
  135. already spending millions of dollars by SethJohnson · · Score: 1

    and by massive I mean requiring them to pay millions of dollars.

    Oh, you can bet they're already spending millions of dollars. They spent that from the day their service went offline and have continued to spend it each day it's unavailable to users.

    The infrastructure costs of a firedrill like this are enormous. Consider that the State of Texas Comptroller's Office has already spent more than $1.8 million just to hire consultants to come in and figure out how their own staff screwed up and left 3.5 million people's SSN's, DOB's, names, and addresses on a publicly-available server for over a year. In the case of the Comptroller's Office, it appears that two of the consultants were campaign contributors, so it's not like the Comptroller's Office is wasting money on strangers.

    I agree with you that millions should be spent to compensate the victims, though, if that's what you meant.

    Seth

  136. Credit Card companies to take action? by Zeko · · Score: 1

    So do the credit card companies have grounds to take legal action against Sony? This breach is going to cost the credit card companies millions of dollars as they have to deal with increased customer call volumes, fraud investigations and time and effort to issue new credit cards and numbers. I'm sure Sont can't just get away with saying 'Sorry' to them. I supposed Sony could 'settle' with the CC companies and just pay them out, but still ... stuff like this has a ripple effect and doesn't just cost Sony money. Who can say how many companies are taking a financial hit because of this. Harmonix is certainly taking a hit because they can't sell any Rock Band tracks while this is going on.

    --
    "When you gotta shoot, SHOOT! Don't talk." Tuco Benedicto Pacifico Juan Maria Ramirez
  137. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    Yah like the global warming lie or Obama's birth certificate, oh wait the globe is warming, even in Kenya.

  138. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    My point was that video games can desenitize you to certain otherwise illeagal, imoral behaviors. If killing and stealing are OK is some venues, then it is easier to move that over to other venues. Some of that gets into anonymity. It has been shown that people who are anomymous will do more cruel and selfish things if they are masked. This is true with video games, It gives and outlet for otherwise bad behavior. For some it gets it out of your system but for kids I think it goes deeper and has a more profound effect. The same with cyber crime.

    If you remember the movie Bonnie and Clyde. they were just good family oriented folks that robbed banks, I remember the scene where his brother I believe asked him why he killed the guard in one heist, he said he forced him to do it. Then it was OK and they got back to the picnic. There you had a family culture that was morally bankrupt, but from the outside you did not see it. You have/had many fine folks in the south that still hate other races (personal experience here informs this fact). All the play is life training like baby lion cubs rolling and swatting, all getting ready for latter in life. I think some of these games are a net negative to society, at least for those that learn the lesson of the game and don't get a firm outside influence of a moral compass. You can say its parenting but I say if the game was not their it would not be an issue, for the kids at least.

  139. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    "Why do we like scary movies?" not all of us like scary movies.

    It role playing, thats wha you do sometimes when someone wants to train you to say make a sale, or take a job interview or do a job interview, or how to overcome bad habits.. it is a technique certainly and we learn through doing. In a protected envirionment we can extend into roles and behaviors we would be too shy to do in a more edgy envirionment. For adults this is fine, for kids they have less of a defense on walling off fantasy vs reality, in fact much of their learning is practicing with toys and play with friends.

    It is not just a virutal world that is the problem, but the reward system build in that is not real, it has an agenda and we learn and adapt behavior while we play and there is not one area of our brain that is exclusively for fantasy play, not one area for logic or judgement. We are excesizing those in a protective envirionment but we are excersizing those. We can't see shifts in moral compass we can't feel them they are in the unconsious part of us. We can claim that we are in control and that the repeated play at killing and stealing is not affecting us but that is silly.

  140. How do we know the events are related? by Labcoat+Samurai · · Score: 1

    So I once had a credit card number taken by what I can only assume was a waiter at a restaurant, since I only ever used that card to pay for meals. There are other ways to have your card information stolen. With 77 million PSN users, the odds that a given identity theft victim also happens to be a PSN subscriber seem reasonable.

  141. Re:I guess I didnt miss much by Labcoat+Samurai · · Score: 1

    For adults this is fine, for kids they have less of a defense on walling off fantasy vs reality, in fact much of their learning is practicing with toys and play with friends.

    Indeed, though with my other example, I played out violent fantasies with my action figures too. I guess the difference there is I only got out what I brought with me, rather than a game setting where they permit you to do things you may have never thought to do, but nevertheless, it's not as though I needed video games as a kid in order to have violent fantasies in play.

    On the other hand, I'm not advocating that we have all of our kids play grand theft auto, either. I'm not crazy :)

    It is not just a virutal world that is the problem, but the reward system build in that is not real, it has an agenda and we learn and adapt behavior while we play and there is not one area of our brain that is exclusively for fantasy play, not one area for logic or judgement. We are excesizing those in a protective envirionment but we are excersizing those. We can't see shifts in moral compass we can't feel them they are in the unconsious part of us. We can claim that we are in control and that the repeated play at killing and stealing is not affecting us but that is silly.

    Not affecting us? As in, not affecting us in any way whatsoever? Typing this post affects me. Trivially, everything we do has some impact on us. But I'm unconcerned about it. I'm a less arrogant, more patient, more considerate, and more compassionate person than I was before I played my first Grand Theft Auto game. Related? I seriously doubt it. But if violent video games are extremely fun and entertaining and have had no discernible negative effect on my behavior or morality, color me unimpressed.

  142. Re:I guess I didnt miss much by Labcoat+Samurai · · Score: 1
    One other thing:

    It is not just a virutal world that is the problem, but the reward system build in that is not real, it has an agenda and we learn and adapt behavior while we play and there is not one area of our brain that is exclusively for fantasy play, not one area for logic or judgement. We are excesizing those in a protective envirionment but we are excersizing those.

    I'm not convinced it's as easy as that. Context plays a huge role, too. I've had times where I noticed a cardboard cut-out out of the corner of my eye, thought it was a real person, and had a very immediate and strong reaction to it that was beyond my control (I hadn't expected there to be a person silently standing there). When I realized it was a cardboard cut-out, my entire perception shifted instantly. It didn't look any different; it just took on an entirely different context, which completely altered my gut feelings about it. I don't have the gut feeling that a pedestrian in GTA is a person.

    Why does the gut feeling matter? I honestly believe that most of our morality comes from instinct. We're social animals, hard-wired for compassion, empathy, and cooperation. We want to build relationships. We want to trust and care for others and we want others to trust and care for us. On the other hand, we've evolved an ability to be very violent. There are limited resources at our disposal, and survival is paramount. If we always felt compassion and empathy for everything we encountered, we would be outcompeted by other humans who could do so selectively. So, typically, killing a stranger bothers us less than killing someone we know. Killing an animal bothers us less than killing a stranger. Breaking a vase bothers us less than killing an animal. And so on. The less *genuinely* humanlike something seems, the less of an aversion there is to harming it.

  143. Sony knew this was coming and didn't do shit by Nyder · · Score: 1

    Look, Sony purposely setup the Dev's network like they did.

    They also knew when someone reverse engineered the USB debug util, that all bets were off. That it wouldn't take someone long to figure out how to make it seem like they have a Dev. machine.

    They also knew that making it so only certain firmwares can connect to the PSN, that the hackers will try to figure a way around it.

    Did they decide to change how they do the Dev Network, to keep it and PSN safe?
    No, they decided to sue everyone and anyone that talked about hacking the PS3.

    We call that denial.

    Sony got what it deserved. Sorry that it affected it's customers, but then, you had been warned what type of company Sony is, and their incompetence proved dangerous this time.

    Sony never, ever cared about it's customers. It only cares about money. Sorry it took something like this to wake you up, but hey, at least Sony told you right away. err, i mean, a week later.

    See what I mean? They don't give a fuck about you.

     

    --
    Be seeing you...
  144. Invalid Credit Card by selex · · Score: 1

    That is the message I got every time I tried to put my credit card into the PSN. I think now I should be glad for that. As long as I had the PS3 I had to buy the prepaid card and use that to buy games. Even if they did get the number, that card has $20 available balance. Selex

  145. is it ? by unity100 · · Score: 1

    there are much more profitable avenues to hack for money, than a fscking gaming network.

    and these vulnerabilities were out and known for a long time. why they were not hacked until now ?

  146. Re:I guess I didnt miss much by kiddygrinder · · Score: 1

    seem pretty neutral to me, the only real urges i got from gta was to drive on the wrong (ie not left) side of the road after a marathon playing session. maybe i'm playing it wrong.

    --
    This is a joke. I am joking. Joke joke joke.
  147. When are we going to fix this properly? by larwe · · Score: 1

    I'm really tired of reading these kind of stories. Databases on commercial providers ARE going to be stolen. It is irresponsible to be storing dangerous information given that hacks and theft are inevitable. For instance, why does Sony need to know my exact DOB? They actually only NEED to know whether I'm allowed to buy all games/DLC on the system, or only content that's suitable for people less than 18yo. This problem is much bigger than "just" PSN. If anyone cares, I wrote up a proposal - really more a philosophy, with a technical proposal to counter the "it will never work" arguments - at http://larwe.com/blog/larwe.php/2011/04/27/sony-and-the-libertarianism-of-data Grrrr.

  148. Just wondering... by Anonymous Coward · · Score: 0

    Since I haven't updated my PS3 firmware after the OtherOS incident (avoiding to agree with the removal, and waiting to see if Sony was forced to put it back), and according to the article, the login and password have been stolen, how the heck am I supposed to access my PSN account to change the password if I don't want my OtherOS feature to be deleted when I'm forced to update the firmware?

  149. Credit Card Fraud Costs by MrL0G1C · · Score: 1

    Do the credit card companies step up their charges to Sony because of this? Or perhaps they should be suing Sony for the cost of the resulting credit card fraud, They've been negligent and should pay for that.

    --
    Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
  150. The public is unwilling to use PC HDMI out to TV by tepples · · Score: 1

    HDMI out on computer to HDMI in on TV. Done.

    I myself know it's possible, but the general public is unwilling to do that, as CronoCloud and others have explained in previous comments (1 2 3 4 5 6 7).

  151. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    But as the military knows, practicing killing makes it easier for someone to kill when the time comes. If you took a bunch of trained military men and untrained (lets say non-hunters) and put them in a situation where you were in a confrontational situation, and guns were provided, Those people who have been trained to project authority with a gun would choose that option more readily as a tool of control, would recognize that as a tool they were familiar with, it would be in their arsenal of tools. Having a tool means that you probably will use it, having a skill or a behavior, it becomes part of your repetoire of actions. And we are talking about things buried in the unconsious, so the logical rational arguments you make I am sure you believe, but you should think about the unseen effects, the below the water level effects of play. I am more concerned for children as they learn things deep and quick, like language, it just seeps in to their heads and is stored at an irrational level. All the arguments people have given me for violent gangster type video games have been rational arguments. Too many people think that is all there is. Its not true. I don't suggest the all dark games are instant and powerful corrupters, but practiing dark things over and over does have an effect over time, an effect we do not control or even are aware of. As I have learned from teaching for years "The lesson taught is never the lesson learned" . Our unconsious is like that student and the fantasy play we partake in is like that lesson. We think that our logic and good intensions control the depth and extent of the effect, and that our logic and rational mind control the boundries of that effect. Good luck with that.

  152. Re:I guess I didnt miss much by Labcoat+Samurai · · Score: 1

    But as the military knows, practicing killing makes it easier for someone to kill when the time comes. If you took a bunch of trained military men and untrained (lets say non-hunters) and put them in a situation where you were in a confrontational situation, and guns were provided, Those people who have been trained to project authority with a gun would choose that option more readily as a tool of control, would recognize that as a tool they were familiar with, it would be in their arsenal of tools. Having a tool means that you probably will use it, having a skill or a behavior, it becomes part of your repetoire of actions.

    Sure, ok, but that doesn't suggest to me that your morality is impacted. The person who never trained in firearms might punch or kick in that confrontational situation. That will be less effective, certainly, but it isn't fundamentally more moral.

    And we are talking about things buried in the unconsious, so the logical rational arguments you make I am sure you believe, but you should think about the unseen effects, the below the water level effects of play.

    Well actually, I devoted much of my last post to unconscious gut reactions.

    I am more concerned for children as they learn things deep and quick, like language, it just seeps in to their heads and is stored at an irrational level.

    I'm more concerned about children too. But I also think we, as a society, are a bit prone to overreaction with regard to our children. I would agree that their minds are more impressionable, but I don't think they're as fragile as we, as a society, seem to think they are. You're fighting a losing battle if you try to shelter children from every negative influence. You just have to make sure you give them the tools to evaluate what they see and put it in the right context.

    All the arguments people have given me for violent gangster type video games have been rational arguments. Too many people think that is all there is. Its not true. I don't suggest the all dark games are instant and powerful corrupters, but practiing dark things over and over does have an effect over time, an effect we do not control or even are aware of.

    Ok, that sounded ominous.... until it occurred to me that if it's an effect I'm not aware of, I'm not sure why I should care about it. Must be a pretty subtle effect. I'll spend my time worrying about the things that affect me in noticeable ways.

    As I have learned from teaching for years "The lesson taught is never the lesson learned" . Our unconsious is like that student and the fantasy play we partake in is like that lesson. We think that our logic and good intensions control the depth and extent of the effect, and that our logic and rational mind control the boundries of that effect. Good luck with that.

    I see nothing of substance here. Give me a real reason to be concerned about it, not some vague warning about an insidious effect on our unconscious minds. Give me a meaningful bottom line. Give me a reason to care.

  153. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    "The person who never trained in firearms might punch or kick in that confrontational situation." or if they have not been trained and supported in the idea that violence is a good if not first option then maybe they would not fight but neutralize the situation or leave rather than be confrontational. Actually this is the reaction of someone that has actual fight training because they know the consequnces of their actions more than one that has just played at it. Its the amatures that are the real danger because they do not know what they are doing, why or how.

    "Well actually, I devoted much of my last post to unconscious gut reactions."
    Your point was seemed to indicate that you had a gut reaction was inviolate, unchanged, cast in concrete, your moral compass, the great unchanging hidden inner behaviour map.. I dont think so, your unconsious moral compass is a work in progress changing minute by minute as we act, think, sleep.

    "You're fighting a losing battle if you try to shelter children from every negative influence."
    Agreed. But often you have input in the middle of the process. The places you don't are things like long game playing session in virtual worlds that have their own moral logic, or in multiplayer games, the other players, just like playmate, some are good some are bad, or the youth culture which is a major influence that parents don't see and have little input into. I guess like bad friends, bad video games should probably be remoted as influences where possible.

    "I see nothing of substance here. Give me a real reason to be concerned about it, not some vague warning about an insidious effect on our unconscious minds. Give me a meaningful bottom line. Give me a reason to care."

    Well let's see Columbine Shooting, Gabriel Giffords and company but according to this survey the shootings in schools has declined http://youthviolence.edschool.virginia.edu/violence-in-schools/national-statistics.html

    Hell only 9% of male students in 2007 reported carrying guns in school and only 3% of females. So must not be a problem.

    1 out of 3 woman report being raped, abused or beaten in their lifetime

    http://www.rescue.org/campaign/wakeup-congress?ms=gg_nonb_zzz_zzzz_pm_zzzzzz&gclid=CJzbjbuFwKgCFcm8KgodMU69wg

    Gun violence per state.

    http://www.guardian.co.uk/news/datablog/2011/jan/10/gun-crime-us-state

  154. Re:I guess I didnt miss much by Labcoat+Samurai · · Score: 1

    "The person who never trained in firearms might punch or kick in that confrontational situation." or if they have not been trained and supported in the idea that violence is a good if not first option then maybe they would not fight but neutralize the situation or leave rather than be confrontational.

    Quite possibly. And maybe they'll do that anyway. Humans already possess these capacities, and there are a number of factors that go into what decision a person makes. But humans have it in them to be violent already regardless of what tool or weapon you put in their hands.

    "Well actually, I devoted much of my last post to unconscious gut reactions." Your point was seemed to indicate that you had a gut reaction was inviolate, unchanged, cast in concrete, your moral compass, the great unchanging hidden inner behaviour map..

    You misunderstand. I was saying that I have a gut reaction that determines my perspective of something. Committing violence against a friend is an abhorrent idea. Committing violence against a stranger is abhorrent, though perhaps less so. Committing violence against an animal seems disturbing and unpleasant. Committing violence against a person's property seems inappropriate. Committing violence against a facsimile of a real person, seems uncomfortable. Committing violence against a facsimile of a fake person seems like nothing at all. My point is that training yourself to be desensitized to violence against facsimiles of fake people does not seem more profound than training yourself to be desensitized to committing violence against styrofoam cups. They aren't people. There is no place in my head that is confused on this point, either logically or unconsciously. And that is evidenced by my unconscious reaction to them. They don't elicit a reaction that is remotely similar to what a real person elicits.

    "I see nothing of substance here. Give me a real reason to be concerned about it, not some vague warning about an insidious effect on our unconscious minds. Give me a meaningful bottom line. Give me a reason to care."

    Well let's see Columbine Shooting,

    No no, you don't get to just point to bad things and claim that they were caused by the effect you describe. If I'm going to put any faith in your theory, you have to come up with some plausible cause and effect. Let's start with me. You say that it has an effect on my unconscious that I do not notice. That's a hypothesis. Now give me something testable. What predictions are made by your hypothesis? How can we test them? In short, why should I give this any credibility? "Bad stuff happens in the world and I personally think the two are related" is not going to cut it.

    Gabriel Giffords and company but according to this survey the shootings in schools has declined http://youthviolence.edschool.virginia.edu/violence-in-schools/national-statistics.html

    Hell only 9% of male students in 2007 reported carrying guns in school and only 3% of females. So must not be a problem.

    1 out of 3 woman report being raped, abused or beaten in their lifetime

    http://www.rescue.org/campaign/wakeup-congress?ms=gg_nonb_zzz_zzzz_pm_zzzzzz&gclid=CJzbjbuFwKgCFcm8KgodMU69wg

    Gun violence per state.

    http://www.guardian.co.uk/news/datablog/2011/jan/10/gun-crime-us-state

    Gabrielle Giffords was shot by a lunatic, violent crime does continue to decrease, and while rape is a very serious problem, many of these statistics are more a matter of creative definition than anything else. Wonder how high the proportion of men who have been "raped, abused, or beaten" is. I hate "inclusive or".

  155. PCI-DSS expert by chaostaco · · Score: 1

    Sorry for being a few days late, but I noticed a schism between those who know PCI-DSS and those who don't. I won't insult you with the obvious things you can search online, but the basic idea is that if you are storing credit card info, you have to encrypt it strongly and keep the keys safe. As I implement PCI-DSS for a living, I would bet that somebody definitely had access to (but might not have found) encrypted credit card data, and since Sony can't be sure who it was they had to cautiously tell everyone about the worst case scenario. Since the only true protection in today's encryption is time, just change your password and credit card number today (I know it sucks), and you will be safe for now. - j

    1. Re:PCI-DSS expert by _0xd0ad · · Score: 1

      I would bet that somebody definitely had access to (but might not have found) encrypted credit card data, and since Sony can't be sure who it was they had to cautiously tell everyone about the worst case scenario.

      You're a bit late to the party - numerous people have already reported that unauthorized transactions have been made on their credit/debit cards.

    2. Re:PCI-DSS expert by chaostaco · · Score: 1

      When you are talking about 77 million people, you will have thousands of people with their credit card data already compromised for various common reasons, but they will blame this Sony breach for their problem rather than admitting that maybe their local bartender learned to write or that their personal data has already been for sale for years. Unless it is found that Sony was storing unencrypted credit card numbers or that their encryption keys were compromised, people reporting unauthorized transactions from a sample size that large doesn't mean much.

    3. Re:PCI-DSS expert by _0xd0ad · · Score: 1

      Correlation doesn't imply causation, but it does waggle its eyebrows suggestively and gesture furtively while mouthing 'look over there'.

      Sure, it's possible that they just happened to notice that their debit cards were charged with several-hundred-dollar purchases right after this data breach by sheer coincidence...

  156. Re:I guess I didnt miss much by StillNeedMoreCoffee · · Score: 1

    "There is no place in my head that is confused on this point, either logically or unconsciously. "

    Again your view is that your gut is inviable,does not change, is not influenced and will not be influenced in any way by anything ever again because it is you and you are this unchanging thing. I think not. All we have to do is look at the tens of thousands of cases of PTSD to see that the sleep people loose, the fear they have, the flashbacks that they experience are not under conscious control. Events that happened to them or things that they participated in effected them on an unconsious level. Sure your claim that nothing touches you and you have it under control is laudable but does not look at the reality. So this argument of yours that the gaming has no effect is incorrect. Now if you had said, sure gaming has an effect and I have not noticed any shift in my values or perceptions over the years due to the gaming I might think you actually saw there there was a cause and effect that was unseen, but you continue to ignore that. But then that is the fuel for psychologist and psychiatrists, that is what their business is and as I understand it it is very profitable. Well maybe not so much of late because the new insurance rules make it easier for them to just prescribe psyco active drugs instead of even talking to patients. But I digress.

    Again, what does the military does to get people to feel its ok to point a gun at people and shoot them is simulate that action through drills and target practice, simulating what is going on. Practicing stabbing and shooting and hitting where no one gets hurt. The second part of the training is to tear down personality, foster obediance to authority and demonize the enemy and provide rewards for obedience and going against the enemy. Violent video games do the simulated training of using the weaponry and some hand to hand and demonize the enemy and provide rewards. If you knew anything about the insidiousness of brain washing and mind control and Rovian propaganda you would know that we are controlable and that you can be moved from here to there in your thought process and values slowly step by step, and like aging, much of the time it takes someone who has not seen you for awhile to tell you you have changed. Often we don't realize it or we justify it, but it does not feel like change, its us, its always been us, we are the same as we were when we were 5. I think not.

  157. Re:I guess I didnt miss much by Labcoat+Samurai · · Score: 1

    "There is no place in my head that is confused on this point, either logically or unconsciously. "

    Again your view is that your gut is inviable,does not change, is not influenced and will not be influenced in any way by anything ever again because it is you and you are this unchanging thing.

    No. This is kind of frustrating to be honest. My view is that real human beings and facsimiles of fake human beings feel fundamentally different *in my gut*. They don't feel the same in my gut, but I rationalize that it's ok to kill them because they aren't real, thus possibly desensitizing me to the murder of actual people. They feel as different in *my gut* as a person and a styrofoam cup. In order to rebut this argument you must either tell me that the facsimiles of people in GTA actually *do* mean more to me on a gut level than a styrofoam cup or you must show that destroying styrofoam cups would also condition me to be a murderer. I'm snipping the rest of your post, because it's based on a false premise. You have to walk before you can run, and before you can bring up PTSD, you have to show that killing video game facsimiles of people is actually similar, to my unconscious, to killing real people.

  158. Re:The public is unwilling to use PC HDMI out to T by OverlordQ · · Score: 1

    I myself know it's possible, but the general public is unwilling to do that

    Yes they are, what % of households have TiVO, Dish, etc.

    --
    Your hair look like poop, Bob! - Wanker.
  159. The living room vs. the desk by tepples · · Score: 1

    quote>

    HDMI out on computer to HDMI in on TV. Done.

    the general public is unwilling to do that

    Yes they are, what % of households have TiVO, Dish, etc.

    The public thinks of DVD players, DVRs, cable boxes, and video game consoles as "consumer electronics appliances" designed for the living room, as opposed to a general-purpose "computer" designed for a desk. How many of the seven comments linked in my grandparent post did you actually read? I'd like to see evidence that even 10 percent of living room TVs in the United States have a PC connected to them. And how often do you expect the owner of a tower PC to carry it back and forth between the living room and the room with the PC desk?

  160. Reiki Therapy for Cancer Patients by Roadmaster111 · · Score: 1

    Reiki is a light-touch, energy-based therapy that reduces stress and increases relaxation for better health. See how Reiki is touching the lives of cancer patients at the Washington Cancer Institute at Washington Hospital Center.