3 ms·
This comment struck me as strange: “Sony is saying the credit cards were encrypted, but we are hearing that the hackers made it into the main database, which w
by joshklein 15y ago
This comment struck me as strange:
“Sony is saying the credit cards were encrypted, but we are hearing that the hackers made it into the main database, which would have given them access to everything, including credit card numbers,” said Mathew Solnik, a security consultant with iSEC Partners who frequents hacker forums to track new hacks and vulnerabilities that could affect his clients."
I am by no means a security expert (let alone novice) - though I know what words like "salt" and "hash" mean - and this seems to my layman ears like a gross distortion of the threat. If their encryption was approached properly, Mr. Solnik's comment makes no sense at all; don't the crackers just have a huge database of gobbledygook (assuming Sony approached their encryption intelligently)?
This is not a rhetorical comment - I would be interested to hear from our resident HN security gurus on the actual threat to Sony customers.
- mcav 15y agoI'm no expert, but Sony must be able to decrypt the card information in order to use it to process payments. So even if the card numbers were encrypted, it's possible hackers could obtain the passkey for decrypting the data, if it was also stored on a compromised server. (Generally speaking. I don't know what happened here.)
- jonknee 15y agoYou don't hash credit card numbers because doing so would mean you would need the user to input the credit card number again upon a purchase which defeats the whole purpose of keeping the number around in the first place. If it's encrypted on the server it must also be able to be decrypted at some point (on some Sony server) to be able to process the transaction, so it all depends on how deep the hackers got.