4 ms·

Anyone want to pull out a packet-sniffer and verify?

bradleyland 16y ago
If you were able to see the data using a packet sniffer, that would mean they're not using SSL to transmit the data... "No sergeant, your men are already dead."
- marshray 16y ago
  Or you're any of the hundreds of organizations that are known to have root or intermediate CA certificates. E.g., the former government of Tunisia. Or any of the unknown number of intermediates who are not known.
  - omh 16y ago
    This is only the case if those root certificates are installed on the Playstation. I'm not sure if we know which ones are. For the purposes of PSN they'd only need Sony root certificates, but I expect that they have others for general web browsing.
    - marshray 16y ago
      My guess is they have a large-ish set of root certs like every other SSL/TLS library, but one or more may be marked 'magic' in some way. Plus they'll probably want the option to utilize third-party CDNs at some point which often implies a common CA. Given the rest of what's known about their design I doubt they've deliberated it at a particularly high level in their organization. Or at least, high enough where management doesn't see the benefit of maintaining their own trust root and is glad for the opportunity to outsource something critical.
- joshfraser 16y ago
  Good. I posted that before they updated their post to clarify that they were sending data over SSL. It doesn't sound like the issue is as bad as they had originally insinuated.
- ZoFreX 16y ago
  I believe it's lieutenant :) (I have seen that film far, far too many times)
johnuk 16y ago
I have, only things I see is: HTTP Request - Update check. HTTPS Request - Login. HTTP - Friend list update. HTTP - PSN keep alive message every few mins. It seems the problem is stemming from custom firmware: http://arstechnica.com/gaming/news/2011/02/report-psn-hacked-showing-stunning-lack-of-credit-card-security.ars?comments=1&start=80#comment-21339341 http://arstechnica.com/gaming/news/2011/02/report-psn-hacked...

If you were able to see the data using a packet sniffer, that would mean they're not using SSL to transmit the data... "No sergeant, your men are already dead."

marshray 16y ago
Or you're any of the hundreds of organizations that are known to have root or intermediate CA certificates. E.g., the former government of Tunisia. Or any of the unknown number of intermediates who are not known.
- omh 16y ago
  This is only the case if those root certificates are installed on the Playstation. I'm not sure if we know which ones are. For the purposes of PSN they'd only need Sony root certificates, but I expect that they have others for general web browsing.
  - marshray 16y ago
    My guess is they have a large-ish set of root certs like every other SSL/TLS library, but one or more may be marked 'magic' in some way. Plus they'll probably want the option to utilize third-party CDNs at some point which often implies a common CA. Given the rest of what's known about their design I doubt they've deliberated it at a particularly high level in their organization. Or at least, high enough where management doesn't see the benefit of maintaining their own trust root and is glad for the opportunity to outsource something critical.
joshfraser 16y ago
Good. I posted that before they updated their post to clarify that they were sending data over SSL. It doesn't sound like the issue is as bad as they had originally insinuated.
ZoFreX 16y ago
I believe it's lieutenant :) (I have seen that film far, far too many times)

johnuk 16y ago

I have, only things I see is: HTTP Request - Update check. HTTPS Request - Login. HTTP - Friend list update. HTTP - PSN keep alive message every few mins. It seems the problem is stemming from custom firmware: http://arstechnica.com/gaming/news/2011/02/report-psn-hacked-showing-stunning-lack-of-credit-card-security.ars?comments=1&start=80#comment-21339341 http://arstechnica.com/gaming/news/2011/02/report-psn-hacked...