4 ms·

Wait. Please tell me I'm misunderstanding. You needed only to enter a user's e-mail address and birth date to change his/her password? So, even without the prev

Wait. Please tell me I'm misunderstanding. You needed only to enter a user's e-mail address and birth date to change his/her password? So, even without the previous (actual) hack, you could use this page to change the password of a family member, friend, co-worker, and nearly anyone else you've ever exchanged e-mails with if you know their birthday (or they publish it on Facebook)? How does someone even conceive of something like that without realizing the glaring problem with it? How does it pass muster at a major corporation that has hired security consultants? This is utterly flabbergasting.

pushingbits 15y ago
Yeah... I'm really not into the whole boycotting thing and I never really understood (for example) the people who would flat out not buy Microsoft products because of their at times very questionable business practices (especially when the worst of them happened a while ago). I'll happily look past a gaffe here or there especially when it comes from the PR department or from the corporate lawyers as long as a company puts out a quality product. And I quite like a few of Sony's products, too. They seem to put more thought into industrial design than most other companies. But right now I can only pick up my Sony digital camera and earphones in distaste and it will probably be a long while until I buy anything made by Sony. This is just way too much incompetence and in too short an order and they won't even stand up straight for it, instead pointing the finger at Anon or geohot. Yuck.
- gmartres 15y ago
  > (especially when the worst of them happened a while ago). The whole https://secure.wikimedia.org/wikipedia/en/wiki/Standardization_of_Office_Open_XML https://secure.wikimedia.org/wikipedia/en/wiki/Standardizati... thing is quite recent.
CWuestefeld 15y ago
...and this was the solution that they spent the last month feverishly building.
- weaksauce 15y ago
  Why is the de facto standard way of email exchange plus old password plus maybe a birthday not workable? Unless psn stored the passwords in plaintext, the hackers modified data, and Sony does not have a clean backup.
  - LokiSnake 15y ago
    The main issue is that all the info used for password reset are in the hackers' hands. There may not be a perfect method, but maybe having a system that calls the phone number on file to give you a password reset code would have been more secure.
    - blahedo 15y ago
      The hackers may have the email address, but they presumably can't read the email sent to that address. Hence "email exchange".
      - weaksauce 15y ago
        You are correct; that is what I meant. Users may have used the same password on the psn and their email account though. If sony did the right thing and only stored salted hashed passwords then that would be mitigated a bit. Another option would be to send out a new password via mail to the billing address if they had no other way to do it electronically. Out of luck if you moved since then. Make the old password a requirement so mail thieves cannot steal your account. I was pissed that I needed to change my credit card number because of these clowns. If someone wants to make a cool startup make a credit card number that is a one off that will only work for a certain time frame(extendable), dollar limit, and business name(though this one might be tougher because the business name given to the credit card company might be different than the business name I would enter).
        markelliot 15y ago
        CitiCard, for one, offers unique 1-off numbers for online transactions just as you suggest. Last I checked AmEx Gold cards also granted this feature.
code_duck 15y ago
The use of DOB as an element of security has always made me question sites like Facebook offering to display it in public. Social networking would easily create an identity thief utopia if not kept in check. I actually gave a fake DOB on Facebook... then on my birthday five people came and wished me well, which is nice, but do anyone paying attention, this somewhat defeated my attempt to not make my DOB public.
- JeremyBanks 15y ago
  The use of DOB as an element of security has always made me question its use as an element of security. It's used in many places, is not typically considered confidential, and is relatively easy to look up in publicly-available information. Lots of security conventions ("mother's maiden name" for another example) are very silly.
  - amalcon 15y ago
    Address is my favorite one: any homeowner's address is a matter of public record. What a great security question to use all over the place.
CodeMage 15y ago
How does someone even conceive of something like that without realizing the glaring problem with it? How does it pass muster at a major corporation that has hired security consultants? This is utterly flabbergasting. I could understand that much outrage if Sony deliberately designed the password reset process to require only e-mail address and DOB. However, the article says that the password reset page had an exploit that allowed you to do that. It's still shoddy security, but at least it's not sheer idiocy.

pushingbits 15y ago

Yeah... I'm really not into the whole boycotting thing and I never really understood (for example) the people who would flat out not buy Microsoft products because of their at times very questionable business practices (especially when the worst of them happened a while ago). I'll happily look past a gaffe here or there especially when it comes from the PR department or from the corporate lawyers as long as a company puts out a quality product. And I quite like a few of Sony's products, too. They seem to put more thought into industrial design than most other companies. But right now I can only pick up my Sony digital camera and earphones in distaste and it will probably be a long while until I buy anything made by Sony. This is just way too much incompetence and in too short an order and they won't even stand up straight for it, instead pointing the finger at Anon or geohot. Yuck.

gmartres 15y ago
> (especially when the worst of them happened a while ago). The whole https://secure.wikimedia.org/wikipedia/en/wiki/Standardization_of_Office_Open_XML https://secure.wikimedia.org/wikipedia/en/wiki/Standardizati... thing is quite recent.

CWuestefeld 15y ago

...and this was the solution that they spent the last month feverishly building.

weaksauce 15y ago
Why is the de facto standard way of email exchange plus old password plus maybe a birthday not workable? Unless psn stored the passwords in plaintext, the hackers modified data, and Sony does not have a clean backup.
- LokiSnake 15y ago
  The main issue is that all the info used for password reset are in the hackers' hands. There may not be a perfect method, but maybe having a system that calls the phone number on file to give you a password reset code would have been more secure.
  - blahedo 15y ago
    The hackers may have the email address, but they presumably can't read the email sent to that address. Hence "email exchange".
    - weaksauce 15y ago
      You are correct; that is what I meant. Users may have used the same password on the psn and their email account though. If sony did the right thing and only stored salted hashed passwords then that would be mitigated a bit. Another option would be to send out a new password via mail to the billing address if they had no other way to do it electronically. Out of luck if you moved since then. Make the old password a requirement so mail thieves cannot steal your account. I was pissed that I needed to change my credit card number because of these clowns. If someone wants to make a cool startup make a credit card number that is a one off that will only work for a certain time frame(extendable), dollar limit, and business name(though this one might be tougher because the business name given to the credit card company might be different than the business name I would enter).
      - markelliot 15y ago
        CitiCard, for one, offers unique 1-off numbers for online transactions just as you suggest. Last I checked AmEx Gold cards also granted this feature.

code_duck 15y ago

The use of DOB as an element of security has always made me question sites like Facebook offering to display it in public. Social networking would easily create an identity thief utopia if not kept in check. I actually gave a fake DOB on Facebook... then on my birthday five people came and wished me well, which is nice, but do anyone paying attention, this somewhat defeated my attempt to not make my DOB public.

JeremyBanks 15y ago
The use of DOB as an element of security has always made me question its use as an element of security. It's used in many places, is not typically considered confidential, and is relatively easy to look up in publicly-available information. Lots of security conventions ("mother's maiden name" for another example) are very silly.
- amalcon 15y ago
  Address is my favorite one: any homeowner's address is a matter of public record. What a great security question to use all over the place.

CodeMage 15y ago

How does someone even conceive of something like that without realizing the glaring problem with it? How does it pass muster at a major corporation that has hired security consultants? This is utterly flabbergasting. I could understand that much outrage if Sony deliberately designed the password reset process to require only e-mail address and DOB. However, the article says that the password reset page had an exploit that allowed you to do that. It's still shoddy security, but at least it's not sheer idiocy.