The Glade 4.0

fangirl much?

To start, I sure am glad I don't have a PSN account about now. And, as a onetime victim of identity theft, I feel for everyone who's data has been stolen. I'm not going to make cracks at Sony for flipping a **** when /their/ data is compromised, and not even having the decency to apologize when it's your data that's misappropriated.

And to anyone who thinks I was involved in any way with this, I'm not crazy, and would prefer to not have the FBI knocking on my door. Running homebrew and exploring security on your devices is cool, hacking into someone elses server and stealing databases of user info is not cool. You make the hacking community look bad, even if it is aimed at douches like Sony.

One of the things I was contemplating back in early January was a PSN alternative, a place for jailbroken consoles to download homebrew and game without messing up anyone else's experience. Unfortunately events led me off of that path, but gamers, if I had succeeded you would have a place to game online with your PS3 right now. I'm one of the good guys. I used to play games online on PC, I hated cheaters then and I hate them now.

Also, let's not fault the Sony engineers for this, the same way I do not fault the engineers who designed the BMG rootkit. The fault lies with the executives who declared a war on hackers, laughed at the idea of people penetrating the fortress that once was Sony, whined incessantly about piracy, and kept hiring more lawyers when they really needed to hire good security experts. Alienating the hacker community is not a good idea.

Now until more information is revealed on the technicals, I can only speculate, but I bet Sony's arrogance and misunderstanding of ownership put them in this position. Sony execs probably haughtily chuckled at the idea of threat modeling. Traditionally the trust boundary for a web service exists between the server and the client. But Sony believes they own the client too, so if they just put a trust boundary between the consumer and the client(can't trust those pesky consumers), everything is good. Since everyone knows the PS3 is unhackable, why waste money adding pointless security between the client and the server? This arrogance undermines a basic security principle, never trust the client. It's the same reason MW2 was covered in cheaters, EA even admitted to the mistake of trusting Sony's client. Sony needs to accept that they no longer own and control the PS3 when they sell it to you. Notice it's only PSN that gave away all your personal data, not Xbox Live when the 360 was hacked, not iTunes when the iPhone was jailbroken, and not GMail when Android was rooted. Because other companies aren't crazy.

And let's talk about Sony's use of the word illegal. It is illegal, criminally so, to break into someone else's servers. But when the same word is used to refer to streaming a song from a non RIAA approved website, or to *gasp* playing a homebrew game on your PS3, respect for the word and those who say it is lost.

Weighing in quickly on the whole hacker vs cracker thing. I am a hacker. Whoever did this were hackers also. The media will never start using the word cracker. To me, a hacker is just somebody with a set of skills; hacker is to computer as plumber is to pipes. And the same ethics should apply, if you want to mess with the pipes in your own house, go for it. But don't go breaking into people's houses and messing with their pipes. (Note that I do not endorse water piracy)

To the perpetrator, two things. You are clearly talented and will have plenty of money(or a jail sentence and bankruptcy) coming to you in the future. Don't be a dick and sell people's information. And I'd love to see a write up on how it all went down...lord knows we'll never get that from Sony, noobs probably had the password set to '4' or something. I mean, at least it was randomly generated.

Not really, I like the PS3 over the 360 mainly because of Blu-ray

Until I can stream Blu-ray 1080p video and 5.1 channel sound through the Internet, I don't give a **** about it.

There are differences of opinion here regarding how bad the Sony intrusion is. Well, not how bad it is. It’s pretty **** bad. It's mostly about whether or not the Internet will even remember something like this in another week's time. It took almost a week for them to speak with any clarity regarding the intrusion, and then when they did, it was worse than the rumors. Which I guess explains a lot.

They suggest that people might have stolen your credit card number. Not that they did, but that they might have, which is worse, and in my own (not especially complex) risk assessment utterly identical: cancel everything, full stop, consider this an opportunity to simmer a new password schema, activate 2-Step Authentication where available. Fume publicly. Also: shake my tiny fist at the unknowing and insensate sky.

I did this as well. Chase asked why, and as soon as the Word Sony left my mouth they had a temporary card in my hand and had ordered me a new one, completely expecting that response.

I had to change a couple of passwords, but not many.

I also contacted the credit groups and put that whole potential fraud, I hope someone pipe bombs the owner of SoE, alert on my credit stuff.

heh.. Blu Ray is a disc format...

Until I can stream Blu-ray through the Internet, I don't give a **** about it

Netflix already streams 1080p/5.1 to PS3's.

Soooo... start giving a ****?

UPDATE 4/29:

Hackers that claim to have the stolen PSN data are attempting to sell credit card information on several message boards. They claim to have names, addresses, phone numbers, email addresses, birth dates, and full credit card information (number, expiration, and security code) for sale. TrendMicro security expert Kevin Stevens says that they offered to sell the information back to Sony, but the company refused.

Stevens also says that 2.2 million credit cards are included in the database. Reports of fraudulent charges have been popping up on Twitter, on message boards, and in the inboxes of gaming journalists. There's no way to know for sure whether these claims are true, and even if they are there's no way to determine if they're tied to the PSN breach.

Source: cnet

honestly I would bet Sony's existing security measures were just as secure as say your bank.

Q: Was my credit card data taken?
A: While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained. Keep in mind, however that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network or Qriocity, and is therefore not stored anywhere in our system. UPDATE: While we do ask for CCV codes, we do not store them in our database.

Management at Sony Network Entertainment International, the company that manages the network platform for the two services, wasn't aware of the vulnerability, said Hasejima.

"Originally I asked to kill myself and retain some honor, but now, they are forcing me to live with this shame and bring it on my family as well... They said LOL newb and told me I was pwnt", said Hasejima.