Topic: PSN = Privacy? Security? Never!

[Chozo Ghost]

It is fun to think this was some Mission Impossible type operation, as opposed to some 400 pound hacker doing this from his parent's basement. Most likely it was the latter, but it would be awesome if it was the former and that's the sort of thing Sony Pictures could make a movie about.

[oohhboy]

It's just really strange that they have decided to relocate at all as if they realised their on site security was as poor as their online security. It might have been easier for someone to get physical access than to hack their way through. I doubt it was Sony themselves that suggested the move since that costs substantial amounts of money, more likely the security consultants they had to bring in to put out the fire.

Oh one more thing, when they said the Credit Card data was encrypted, that could mean anything. If I shift every letter 2 to the right "A" becomes a "C" etc it's "encrypted". There is no such thing as unbreakable encryption that isn't a one time pad, it is always a factor of time and power. What might take a million years for a desktop might take a month for a guy with a bot net.

[broodwars]

The PS Blog's been updated with more answers to commonly asked questions about the hack.  In short, all trophies are safe (knew they'd answer that one eventually), your download history is safe, they're going to be hosting special events for players of their subscription games as well as implementing a "make good" plan for them (which I assume means giving free weeks in exchange for the ones lost), and they're currently "examining" reparations for players who have been "patient" with the downtime.

[Chozo Ghost]

Every PSN user should get a $50 PSN credit.

[BranDonk Kong]

Every PSN user should be released from the TOS of the PlayStation Network, and you should be allowed to use your console as you please, since you own it. Oh, and this investigation should go on for years, and anyone who becomes financially effected by this ID theft should be able to sue Sony for all damages, and then some. Anything less is bullshit.

[lolmonade]

Every PSN user should get a $50 PSN credit.

Realistically, we'll be lucky to get a free PSN game, if anything.  Probably looking at maybe a free month of Playstation Plus, the way this article reads.

[BranDonk Kong]

That won't be good enough, and the lawsuits will come pouring in.

[UncleBob]

I'm not sure why anyone thinks SONY is automatically going to give them anything.  It's not like SONY has a history of giving two flips about removing advertised features from their consoles.

[Stogi]

http://venturebeat.com/2011/04/28/hackers-brag-that-they-have-playstation-network-credit-card-numbers/

One reader, who wished to remain anonymous, told us that he was informed by Sony yesterday that his credit card may have been compromised. He check with his card issuer and found two charges totaling $400 that he had never made. He called his issuer and had the charges reversed. He had his card canceled and ordered a replacement.

Uh oh.

[lolmonade]

That won't be good enough, and the lawsuits will come pouring in.

There's already a class action for it. 
 
Wasn't saying that compensation was adequate, just that it's the most I would expect from Sony, as that would cost them very little.
 
Ruh-Row
 

Security researchers said Thursday that they had seen discussions on underground Internet forums indicating that the hackers who infiltrated the Sony PlayStation Network last week may have made off with the credit card numbers of Sony customers.
The comments indicated that the hackers had a database that included customer names, addresses, usernames, passwords and as many as 2.2 million credit card numbers, the researchers said.
Kevin Stevens, senior threat researcher at the security firm Trend Micro, said he had seen talk of the database on several hacker forums, including indications that the Sony hackers were hoping to sell the credit card list for upwards of $100,000. Mr. Stevens said one forum member told him the hackers had even offered to sell the data back to Sony but did not receive a response from the company."

 

[Chozo Ghost]

http://venturebeat.com/2011/04/28/hackers-brag-that-they-have-playstation-network-credit-card-numbers/

One reader, who wished to remain anonymous, told us that he was informed by Sony yesterday that his credit card may have been compromised. He check with his card issuer and found two charges totaling $400 that he had never made. He called his issuer and had the charges reversed. He had his card canceled and ordered a replacement.

Uh oh.

I'm a bit skeptical because that article is full of things like:

Hackers are saying on underground internet chat rooms

one forum member told him

One reader, who wished to remain anonymous

So this amounts to little more than hearsay, and anonymous hearsay at that. Who is saying these things? Some unknown person on an undisclosed forum who wishes to remain anonymous? I think we need some more proof than that. I'm not saying this isn't true, but you also can't believe everything you hear either (especially when the source is some anonymous person on the internet).

[Stogi]

You should have read the beginning of the article. They got all there information, except for the part I quoted, from the NY Times.

I found that part to be the most intriguing, though unreliable.

[MegaByte]

I see Sony is still advertising Qriocity on Hulu...

[ShyGuy]

I canceled my DC Universe online subscription a couple months ago, but they probably still had my CC # on file, didn't they?

[Stogi]

Yuuupppp

[UncleBob]

Yet more SONY lies mistakes...

http://blog.us.playstation.com/2011/04/27/qa-1-for-playstation-network-and-qriocity-services/

Former:

Keep in mind, however that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network or Qriocity, and is therefore not stored anywhere in our system.

Now:

UPDATE: While we do ask for CCV codes, we do not store them in our database.

[nickmitch]

Credit card companies should be able to compensate all losses and possibly trace any purchases made. Sony shouldn't even have to compensate for that. Plus, PSN is a free service, so unless you're subcribed to anything that uses the service or the PSN Plus or whatever, they don't really owe you ****. On the other hand, if you are paying for something, they should just go the Netflix route and give you a week free. Other than that, Sony shouldn't have to do more than give people a little something for the inconvenience.

Just playing devil's advocate.

[UncleBob]

Few things - one, if it's a debit card tied to the account, it can be a major hassle, as debit transactions are totally different than credit transactions.

Two, forcing credit card companies to trace down/eat fraudulent charges raises prices for everyone.

Three, it costs $3-$5 for a replacement debit/credit card (some banks charge the individual for these as well)... Who's going to get to eat those costs?

Fourth, Individuals may have made the decision to purchase their $300+ system (and $60 games) based on SONY's claims of online multi-player.  Even if you're not paying a monthly fee, you still paid for the service.

[broodwars]

Unfortunately, Sony isn't legally obligated to reciprocate anything other than DCU Online; subscribed Free Realms players; and possibly PSN Plus customers (though since that program pretty much just gives you discounts on stuff you play offline, I highly doubt it will be reciprocated).  It's still in their best interest from a PR stance to give their customers something to make up for everything that's happened.

[ShyGuy]

If it's shown that they weren't maintaining PCI security standard, the credit card companies can go after them and some states governments too, I believe.

[UncleBob]

After revealing that they did, in fact, ask for the security code - it lends slightly more credibility to the purported 2.2 million credit card numbers that supposedly had the security code with them.  *IF* those turn out to be the real deal, then SONY is going to be in a crap load of trouble, as they're not supposed to store the security code in any format what-so-ever.

[Chozo Ghost]

PSN is a free service, so unless you're subcribed to anything that uses the service or the PSN Plus or whatever, they don't really owe you ****.

While that much may be true, Sony still owes something to the millions of users whose credit card information which has been compromised. It is a hassle to replace the credit cards, and apparently it also costs a fee to do that. So for both the hassle and the fee of credit card replacement Sony owes people something. Like I said, a $50 PSN credit for each user would be ideal and would help defuse some of the lynch mob that is going to be knocking on Sony's door over this. Anything less such as a free month trial of PS Plus would be a bunch of crap and a slap in the face.

[BranDonk Kong]

It doesn't matter if you paid for the service or not - if SONY has your CC info, if means you paid for SOMETHING at some point, and they failed to protect your information that SONY requested from you, so there has to be some accountability. I don't give a flying **** about trophies, my family's financial situation is just a tad more important. I don't want a $50 PSN credit, I'd rather have $50. It doesn't matter anyway, I'll just wait for the lawsuit like everyone else and hopefully get something out of it. As long as it hurts SONY financially, the customers win.

[Stogi]

$50 bucks for 77 million people? That's over 3.5 billion. There is no way they are going to do that, even in credit.

[Chozo Ghost]

But there's little overhead for the stuff on PSN because its digital downloads. Sony charges $3.5 billion, but it wouldn't cost Sony $3.5 billion. See my point? Also, of those 77 million accounts many of them may be abandoned anyway so the credit wouldn't even be redeemed in every case.