Support NeoGAF

[TheSeks]

I worked at a university parking department for a while and we had access to every ones information. I put in a plate number and I got names, every address they ever lived in, social security, family, homes, criminal record, loans, boats, etc. Its all out there guys, don't kid yourself.

Looked up through the states DOT? Dunno why a university would need that stuff outside of name and registered car, but hey: Just proves my point. The information is already out there and you just think it isn't.

 

[kurisub306]

Well, I checked my statements today and found 2 charges of $15 on 4/11/2011 to BLIZZARD ENT*WOBLIZZARD E BLIZZARD.COM which I'm assuming is World of Warcraft stuff…which is freaking me out considering I've never even played that before.

Sony's press release says it occurred between 4/17-19, so I have no idea if my card was already out there, or if this is connected to the psn hacking. Either way I'm taking a trip to my bank tomorrow.

 

[Dead Man]

No offense, but that's kinda reaching. We might as well say Anonymous is responsible for the attacks if we're going to say the data was in "plain text".

If it was encrypted with any decent security, it would not have been included in the data lost section. Maybe I am being pessimistic, but after the random number fail, I do not have a lot of faith in Sony security. If the passwords were not compromised, why were they put in the section saying they were definitely compromised? Yeah, I am making some assumptions, namely that there is an internal consistency to the descriptors used, which may be a mistake on my part.

 

[EricHasNoPull]

A little OT but.. I cheapped out and only donated $100 to Armenia and $100 to Japan.

 

[Agent X]

Question to all: When PSN goes back up and you changed your passwords, will you guys still purchase stuff on PSN?

Sure, but from now on I'll be using PSN cards exclusively.

 

[Kyoufu]

Guys I got an email from Sony repeating exactly what was said on the official blog/PR.

Should I freak out????????/////

 

[graywolf323]

He's referring to this story linked to earlier:

arstechnica.com/gaming/news/2011/02/report-psn-hacked-showing-stunning-lack-of-credit-card-security.ars

Ars used to be great but lately they have been having more and more sensationalist stories which seem to be just to get hits

 

[Hex]

From the OP:


Maybe they were not stored as plaintext, but if not I doubt they would have been included in the definite information lost section.

They would have to be.
Even if encrypted, if they are out there they are out there and they are listing what is out there.
You think people would not sit and try and break encryption or would not take them just because they were encrypted?

 

[stupei]

They still have tons of information. That's not good for anyone.

Doubt they'll be able to register credit cards or anything, but they could certainly fill up an inbox or two


by cancelling the old card and getting a new one.

Canceling the card isn't necessarily enough. They have all your basic information that a bank would need, all they need to do is make a fake card, show up and say oh yeah, no, I found it. The teller isn't supposed to accept it, but people are also supposed to check your ID when you swipe a card. Nobody does that either.

I mean it's possible the guy at the bank gets some kind of commission for signing new accounts and it even counts if he's transferring all my stuff from old accounts to new ones, but I don't see how it's really in his or his company's best interest to lie about things that make banks sound like unreliable vaguely terrifying places. He basically said your debit card is like a key to all your accounts and once it's been compromised, you need to seriously consider a new account because leaving liquid cash in the hands of potential human error is insane.

That sounds pretty reasonable to me.

So not trying to be alarmist; just realistic. A debit card is a much bigger deal than a credit card.

Guys I got an email from Sony repeating exactly what was said on the official blog/PR.

Should I freak out????????/////

Pretty sure I saw Sony was already quoted in one of the articles as saying everyone in all regions is compromised. It's not just the people getting the email; it's everyone.

So no need to freak out any more than you already were.

Edit: And again, I'm not trying to be overly alarmist, but people shouldn't downplay other people's legitimate concerns about their personal finances or discourage them from taking precautions. Saying that there is no reason to hesitate to use a debit card on PSN after this is seriously ignoring the reality of the current situation.

 

[duckroll]

Okay, I am FUCKING outraged at this. I'm not angry that Sony's security failed. That shit happens, although if you're not fucking incompetent it happens less. That's another issue which I generally don't get worked up about. What I am outraged about is the handling of this entire situation.

SONY KNEW AND THEY SAID NOTHING.

In one of the previous threads which is now locked, a jr member helpfully provided a tip off that his friend at SCEA suggested that personal information including usernames/emails/addresses/passwords/etc were DEFINITELY taken, and that CC data was PROBABLY NOT taken but that they did not know. This was DAYS ago. THEY FUCKING KNEW.

The assumption on our part, an assumption of GOODWILL, was that if Sony said nothing at all, it meant that nothing was compromised since they were required by law to tell people if it is compromised. Guess what? THEY JUST DIDN'T GIVE A FUCK. In 5-6 days, who knows what could have happened? That's a huge gap. Totally and utterly irresponsible.

Oh and guess what? The statement and the email is only coming from SCEA right now! I have received NO EMAILS for my other accounts, including my primary account. How is this acceptable? This slow and utterly inefficient communication to the consumer regarding high risk information of the more severe nature is unacceptable.

I no longer have any faith whatsoever in PSN, and I will have to carefully consider if I ever want to use this service again.

 

[FINALBOSS]

That is also a fucked up practice that needs to be stopped, by every single company that requires you to accept a TOS and EULA

Yup.

If they wrote those TOS in laymans terms and people actually read them, they would never be signed again.

They are truly terrifying to read.

 

[DevilWillcry]

How did people get the idea that only people with suppose compromise info are getting email?I mean its right in the OP....

Just think of it like this Ninja, the amount of confusion and repeated info in this thread is extremely telling of the level of intelligence we're dealing with here.

 

[Griffin]

Its an inference really..

If you base it off the Press release you can make the same assumption..

In a situation like this a company would do anything to save face in a press release. So if the PW was encrypted along with your CC info which SHOULD HAVE BEEN ENCRYPTED.. Fuck every single personal detail should be encrypted its a common practice in other industries..

The press release would have had something like this.

"Even though Your CC information and password were encrypted we feel it is important to inform you that the encrypted information might have been obtained"


That way they could save a bit of face.

Breaching into the system could be a tougher challenge than de-crypting the passwords. Sony could have thought, hey if they can breach into PSN, who says the can't decrypt our passwords.

 

[kswiston]

Gmail, paypal, credit card, ebay and bank account passwords changed to unique passwords per account. Probably should have done that before.

Other accounts are not as sensitive, so I will deal with them later. Not going to bother changing my cc number unless it's actually stolen.

 

[IMACOMPUTA]

So how likely is it that Best Buy will let me return an opened copy of Portal 2 PS3?

I bought it in order to redeem the free Steam copy, but seriously fuck this.
I've waited a week. I want my money back.

Returned the PS3 copy. Bought the PC copy. Actually went really well. They didn't give me any hassle.

It's still fuck Sony!

 

[Aruarian Reflection]

Guys I got an email from Sony repeating exactly what was said on the official blog/PR.

Should I freak out????????/////

Is Sony finally emailing all PSN users to let them know what's going on? I use PSN so rarely, I can't even remember which email address I used for the account, let alone the password. I'm also hoping my credit card expired.

 

[LiK]

Okay, I am FUCKING outraged at this. I'm not angry that Sony's security failed. That shit happens, although if you're not fucking incompetent it happens less. That's another issue which I generally don't get worked up about. What I am outraged about is the handling of this entire situation.

SONY KNEW AND THEY SAID NOTHING.

In one of the previous threads which is now locked, a jr member helpfully provided a tip off that his friend at SCEA suggested that personal information including usernames/emails/addresses/passwords/etc were DEFINITELY taken, and that CC data was PROBABLY NOT taken but that they did not know. This was DAYS ago. THEY FUCKING KNEW.

The assumption on our part, an assumption of GOODWILL, was that if Sony said nothing at all, it meant that nothing was compromised since they were required by law to tell people if it is compromised. Guess what? THEY JUST DIDN'T GIVE A FUCK. In 5-6 days, who knows what could have happened? That's a huge gap. Totally and utterly irresponsible.

Oh and guess what? The statement and the email is only coming from SCEA right now! I have received NO EMAILS for my other accounts, including my primary account. How is this acceptable? This slow and utterly inefficient communication to the consumer regarding high risk information of the more severe nature is unacceptable.

I no longer have any faith whatsoever in PSN, and I will have to carefully consider if I ever want to use this service again.

so what about that Yuna costume?

 

[malingenie]

This thread. Archive-worthy.

 

[daffy]

Canceling the card isn't necessarily enough. They have all your basic information that a bank would need, all they need to do is make a fake card, show up and say oh yeah, no, I found it.

PIN Number?

 

[Hex]

Guys I got an email from Sony repeating exactly what was said on the official blog/PR.

Should I freak out????????/////

 

[JetBlackPanda]

its nuts to me how many people have noticed fraud like activity on there cards because they are looking after this PSN thing.

is this a crazy coincidence or not?

if not you people should watch your bank better.

 

[duckroll]

so what about that Yuna costume?

I'll probably get it because I have like 2-3 dollars left in the wallet, but I no longer want to buy anything more from PSN, because I no longer know if I feel safe even logging in to PSN, or leaving any information there. Not because it might get hacked, but that the next time, Sony might take 2 weeks to tell me that something was compromised.

 

[Zoe]

Sorted how? If they have access to your debit number, they essentially have access to all of your accounts. Unless by "sorted" you mean "create new accounts and transfer all automatic payments over to the new accounts," then sure.

A debit card number is not the same as your bank account number.

 

[Metalmurphy]

Okay, I am FUCKING outraged at this. I'm not angry that Sony's security failed. That shit happens, although if you're not fucking incompetent it happens less. That's another issue which I generally don't get worked up about. What I am outraged about is the handling of this entire situation.

SONY KNEW AND THEY SAID NOTHING.

In one of the previous threads which is now locked, a jr member helpfully provided a tip off that his friend at SCEA suggested that personal information including usernames/emails/addresses/passwords/etc were DEFINITELY taken, and that CC data was PROBABLY NOT taken but that they did not know. This was DAYS ago. THEY FUCKING KNEW.

The assumption on our part, an assumption of GOODWILL, was that if Sony said nothing at all, it meant that nothing was compromised since they were required by law to tell people if it is compromised. Guess what? THEY JUST DIDN'T GIVE A FUCK. In 5-6 days, who knows what could have happened? That's a huge gap. Totally and utterly irresponsible.

Oh and guess what? The statement and the email is only coming from SCEA right now! I have received NO EMAILS for my other accounts, including my primary account. How is this acceptable? This slow and utterly inefficient communication to the consumer regarding high risk information of the more severe nature is unacceptable.

I no longer have any faith whatsoever in PSN, and I will have to carefully consider if I ever want to use this service again.

According to Sony they only knew yesterday.

http://blog.us.playstation.com/2011/04/26/clarifying-a-few-psn-points/

 

[Rebel Leader]

The update they made says that the hackers claims are unsubstantiated. Also they say that only specially devised custom firmware users would be at risk here, which is interesting.

EDIT: Beaten, fast thread

it's almost.....

Grease lightning fast

 

[DevilWillcry]

If it was encrypted with any decent security, it would not have been included in the data lost section. Maybe I am being pessimistic, but after the random number fail, I do not have a lot of faith in Sony security. If the passwords were not compromised, why were they put in the section saying they were definitely compromised? Yeah, I am making some assumptions, namely that there is an internal consistency to the descriptors used, which may be a mistake on my part.

I think this is Sony protecting their asses just to be safe more than anything.

 

[TheSeks]

Okay, I am FUCKING outraged at this. I'm not angry that Sony's security failed. That shit happens, although if you're not fucking incompetent it happens less. That's another issue which I generally don't get worked up about. What I am outraged about is the handling of this entire situation.

SONY KNEW AND THEY SAID NOTHING.

I no longer have any faith whatsoever in PSN, and I will have to carefully consider if I ever want to use this service again.

Yes, this is what you should be outraged for. But I don't think it should full stop you from using PSN. Because it could happen to XBL/Steam/et. al. services as well. However, it should make you leery toward Sony and their lack of communication when things break. Which is what people should be demanding and pitchforking for. Six days with no news and having to learn via "rumors"/leaked information before the official confirmation fucking sucks.

 

[Dead Man]

Okay, I am FUCKING outraged at this. I'm not angry that Sony's security failed. That shit happens, although if you're not fucking incompetent it happens less. That's another issue which I generally don't get worked up about. What I am outraged about is the handling of this entire situation.

SONY KNEW AND THEY SAID NOTHING.

In one of the previous threads which is now locked, a jr member helpfully provided a tip off that his friend at SCEA suggested that personal information including usernames/emails/addresses/passwords/etc were DEFINITELY taken, and that CC data was PROBABLY NOT taken but that they did not know. This was DAYS ago. THEY FUCKING KNEW.

The assumption on our part, an assumption of GOODWILL, was that if Sony said nothing at all, it meant that nothing was compromised since they were required by law to tell people if it is compromised. Guess what? THEY JUST DIDN'T GIVE A FUCK. In 5-6 days, who knows what could have happened? That's a huge gap. Totally and utterly irresponsible.

Oh and guess what? The statement and the email is only coming from SCEA right now! I have received NO EMAILS for my other accounts, including my primary account. How is this acceptable? This slow and utterly inefficient communication to the consumer regarding high risk information of the more severe nature is unacceptable.

I no longer have any faith whatsoever in PSN, and I will have to carefully consider if I ever want to use this service again.

I don't know if I am redtext angry, but yeah, it is a pretty shabby response.

 

[Stuggernaut]

Ona side note..."Tyler flew and Sony knew" is all that keeps playing in my head as I read this thread

 

[dream]

According to Sony they only knew yesterday.

And as we all know, when Sony says something we can take that to the bank.

Literally.

 

[MiamiWesker]

Looked up through the states DOT? Dunno why a university would need that stuff outside of name and registered car, but hey: Just proves my point. The information is already out there and you just think it isn't.

I forget the name of the service we were using but we only looked at names, addresses and registered cars but I could see other options in the menu and it had almost everything. Your info is out there. Not username and passwords or credit cards so that is an issue. But worry about your name, address and stuff, guys... its out there.

 

[bone_and_sinew]

Question to all: When PSN goes back up and you changed your passwords, will you guys still purchase stuff on PSN?

Only with PSN Cards.

 

[Polari]

Source? The fact that Sony mentioned passwords being stolen, not encrypted passwords being stolen. Do you think they wouldn't use anything they could to make this less of the huge fucking disaster it is? The lawyers are going to have a field day with this. I wouldn't be surprised if this leads to legislation over data security practices.

 

[Ickman3400]

just got my email. I guess I should be happy? lol

 

[Professor Beef]

I'll probably get it because I have like 2-3 dollars left in the wallet, but I no longer want to buy anything more from PSN, because I no longer know if I feel safe even logging in to PSN, or leaving any information there. Not because it might get hacked, but that the next time, Sony might take 2 weeks to tell me that something was compromised.

What if Jack Tretton himself came and delivered to you a $20 PSN Card? Would you buy from the store still?

This has nothing to do with anything, I'm just being silly.

 

[Rebel Leader]

According to Sony they only knew yesterday.

Investigation takes time.

This isn't Law&Order or CSI where it's found out in minutes.

Even murder mysteries take years.

 

[Vestal]

Breaching into the system could be a tougher challenge than de-crypting the passwords. Sony could have thought, hey if they can breach into PSN, who says the can't decrypt our passwords.

true but again they could have sugar coated the PR a bit to save some face if infact they were encrypted.

 

[BobLoblaw]

Hope this hasn't been posted (I searched), but an article's up on msnbc about this. Front page.

 

[alr1ght]

Data breach laws state that customers have to be notified if it was unencrypted. That's not to say it was encrypted and they're being nice and telling everyone out of goodwill.

this is California law

1798.29. (a) Any agency that owns or licenses computerized data
that includes personal information shall disclose any breach of the
security of the system following discovery or notification of the
breach in the security of the data to any resident of California
whose unencrypted personal information was, or is reasonably believed
to have been, acquired by an unauthorized person. The disclosure
shall be made in the most expedient time possible and without
unreasonable delay, consistent with the legitimate needs of law
enforcement, as provided in subdivision (c), or any measures
necessary to determine the scope of the breach and restore the
reasonable integrity of the data system.

(d) For purposes of this section, "breach of the security of the
system" means unauthorized acquisition of computerized data that
compromises the security, confidentiality, or integrity of personal
information maintained by the agency. Good faith acquisition of
personal information by an employee or agent of the agency for the
purposes of the agency is not a breach of the security of the system,
provided that the personal information is not used or subject to
further unauthorized disclosure.
(e) For purposes of this section, "personal information" means an
individual's first name or first initial and last name in combination
with any one or more of the following data elements, when either the
name or the data elements are not encrypted:
(1) Social security number.
(2) Driver's license number or California Identification Card
number.
(3) Account number, credit or debit card number, in combination
with any required security code, access code, or password that would
permit access to an individual's financial account.
(4) Medical information.
(5) Health insurance information.
(f) (1) For purposes of this section, "personal information" does
not include publicly available information that is lawfully made
available to the general public from federal, state, or local
government records.

http://www.leginfo.ca.gov/cgi-bin/displaycode?section=civ&group=01001-02000&file=1798.25-1798.29

 

[bangai-o]

i dont know what the Yuna costume is all about, but I did get that one FF13 costume of the girl with the belly dancer outfit, for my avatar.

so yeah. get that.

 

[Cipherr]

According to Sony they only knew yesterday.
[/url]

God damned horseshit, and you know it.

 

[daffy]

it's almost.....
http://i51.tinypic.com/s0vsxg.gif
Grease lightning fast

muahahaaha

 

[Dead Man]

According to Sony they only knew yesterday.

http://blog.us.playstation.com/2011/04/26/clarifying-a-few-psn-points/

Nah, they knew that they didn't know, they should have said that.

 

[Metalmurphy]

And as we all know, when Sony says something we can take that to the bank.

Literally.

Seeing as they know have involved the authorities and actually hired people to find out what happened I'm not so sure they'd just flat out lie about it.

 

[Ningo]

wow even my local news website is covering this

http://www.adelaidenow.com.au/sonys-playstation-network-hacked-leaving-up-to-77-million-exposed/story-e6frea6u-1226045536603

 

[pantyhelmet]

This thread. Archive-worthy.

OH PLEASE YES..i plan to link to it ad nauseam at every opportunity!

 

[Oozinator]

You know what's hilarious?


If you ever read the TOS for EA games or 2K games...or hell, anyone for that matter, it explicitly says they will share your personal information with anyone they feel like.

isn't that what you Americans call "free speech"

 

[Apath]

According to Sony they only knew yesterday.

http://blog.us.playstation.com/2011/04/26/clarifying-a-few-psn-points/

I'd write it off as to still being up in the air then. Of course Sony is going to try and mitigate damages as much as possible, but tipsters aren't 100% reliable either.

People should save their rage and such for the post-mortem when we can actually look at all of the facts and get a clearer picture instead of this constant trickle of information, fear, and anger.

 

[Loudninja]

God damned horseshit, and you know it.

Damn you have inside knowledge please tell me more.

 

[Uno Venova]

Nah, they knew that they didn't know, they should have said that.

They did say they were unsure if people's info was taken.