3 ms·

What's worse is that every bit of data we took wasn't encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it's just a mat

What's worse is that every bit of data we took wasn't encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it's just a matter of taking it. This is disgraceful and insecure: they were asking for it. I'm not sure that is true for any company with as much surface area. I would be extremely disappointed if it were true of any of Canada's five major banks, for example. Google has been under continuous hacking attack from China and so far they haven't had to 'fess up to storing passwords in plaintext.

kevindication 15y ago
"Any" is probably an exaggeration. I'd cede that and accept "most." We can hope that Google is an exception because of the caliber of employee they hire, since obviously they also have a lot of domain knowledge. But, I think that only means we're quibbling about the embarrassment level of these breaches.
- raganwald 15y ago
  Sorry for the delay... Parenting! Any ways, I agree we shouldn't quibble about any/most. I also agree that a big surface area (such as units with independent web strategies all over the world) increases the likelihood of there being some breach of security. What I find embarrassing here is that we aren't talking about one of the Sony properties having a breach, it's lots and lots of them. I suggest that this is symptomatic of a problem with Sony itself, not just the surface area they present. What I'd expect from a well-managed company with a big surface area is yes, some property might have a breach, but that would be the exception. It's beginning to look like Sony's lax security with respect to customer information is the rule and not the exception. JM2C, I am not claiming I know this for a fact.
  - kevindication 15y ago
    Understand regarding parenting. I do that myself. :-) I do see your point about Sony, and they may in fact be an outlier here. I think I've been accustomed to the story of customer information breaches from large corporations though, and so maybe I'm overly pessimistic?
46Bit 15y ago
Banks hopefully encrypt them, but even a cursory glance when logging in to most nowadays shows they don't hash them (asking for individual characters). Or at least, you hope they aren't storing hashes of individual characters of your password ... even with salt.
- mattmanser 15y ago
  A lot of UK ones have two layer, one password which I can only hope is a salted hash, one security key which asks for individual characters. My business account also has a different two layer, one password, one authentication device.

kevindication 15y ago

"Any" is probably an exaggeration. I'd cede that and accept "most." We can hope that Google is an exception because of the caliber of employee they hire, since obviously they also have a lot of domain knowledge. But, I think that only means we're quibbling about the embarrassment level of these breaches.

raganwald 15y ago
Sorry for the delay... Parenting! Any ways, I agree we shouldn't quibble about any/most. I also agree that a big surface area (such as units with independent web strategies all over the world) increases the likelihood of there being some breach of security. What I find embarrassing here is that we aren't talking about one of the Sony properties having a breach, it's lots and lots of them. I suggest that this is symptomatic of a problem with Sony itself, not just the surface area they present. What I'd expect from a well-managed company with a big surface area is yes, some property might have a breach, but that would be the exception. It's beginning to look like Sony's lax security with respect to customer information is the rule and not the exception. JM2C, I am not claiming I know this for a fact.
- kevindication 15y ago
  Understand regarding parenting. I do that myself. :-) I do see your point about Sony, and they may in fact be an outlier here. I think I've been accustomed to the story of customer information breaches from large corporations though, and so maybe I'm overly pessimistic?

46Bit 15y ago

Banks hopefully encrypt them, but even a cursory glance when logging in to most nowadays shows they don't hash them (asking for individual characters). Or at least, you hope they aren't storing hashes of individual characters of your password ... even with salt.

mattmanser 15y ago
A lot of UK ones have two layer, one password which I can only hope is a salted hash, one security key which asks for individual characters. My business account also has a different two layer, one password, one authentication device.