Current PSN outage: Don't abuse or we lose this thread.

[Tower Turn 13]

Wasn't it supposed to be back up today?

 

[Leadpaint]

The real question is did Sony store information on their so called secure admin/dev server in an unencrypted format. Sending your information from your ps3 to the PSN network in an encrypted form does not mean that its actually stored on their server in encrypted form once its archived on the server, does it?

 

[Tower Turn 13]

No, they simply don't have enough data to harm me in a significant way. Credit card isn't related to me, they don't have neither my real name nor my date of birth. Just a valid e-mail and a valid street adress, that's it. The cc info I don't care, because if anything goes wrong the bank company will deal with it. Some people are sharing more on their facebook pages, you know.

I'm not thinking I won't be affected, I just *know* I won't be.

Being careful about this issue is not a bad thing, but the bolded is why I don't have a facebook. I don't prefer some multi-billion hipster-corporation to own my memories.

 

[Sprite]

I personally was a bit worried about it, and just on the off chance i have chnaged some passowrds on various systems that I use because of the similarities. As for Debit card info its only sugested that they might have got hold of this and not 100% confirmed they have stolen this.

I will keep off from contacing my bank just yet but I may do this soon to have a new card sent.

As for these people crying about they will jump ship to another system, then be my guest, I for one will be logging back in and and putting my new credit card details in (once needed). I agree with the comment above, I have allot of info on places like facebook and personal blogs. let alone various other websites that hold my card info like play, Amazon, Apple and various smaller sites.

I just hope its updated soon.

 

[dschoene]

The password thing had me scratching my head as well. I've designed my fair share of applications, which have their own user management and one of the most basic principles is never to store the actual password anywhere, not even in encrypted form. If Sony or whoever is behind the design of PSN has made such a blunder, I would say we're talking about an epic fail here and it would sure as hell lead to a lot of suing. There must be a lot of drooling lawyers waiting to go in for the kill.

And the sad bit is that it is even a likely scenario. Why else would they list passwords as one of the exposed items. It really beggars belief.

 

[MNLumberjack]

Wasn't it supposed to be back up today?

They've speculated about that for days it was supposedly going to be up in Japan on Monday and the rest of the world Tuesday.
I'd say just sit back and relax this could take awhile.
In the meantime maybe a break from video games isn't to bad.
It is spring after all

 

[Darren.]

"Maxconsole has just received an e-mail news tip from a supposed developer who wishes to remain anonymous. The tip received concerns the latest PSN downtime. According to his information, Sony is planning to make PSN a pay only service just like Xbox LIVE. Apparently, PSN + hasn't take off in the way that Sony had hoped, and they are looking to make it a pay only service to provide users with the best possible functionality. The work they are reportedly carrying out right now is laying the foundations for this to happen in the near future as well as fixing security exploits."

2 problems with that,

1) Wheres the link
2) If Sony did that we could file a lawsuit against them because it CLEARLY states when we bought our PS3s, free online gaming.

 

[CodeRedR51]

Wasn't it supposed to be back up today?

Sony said it could be up to another week.

 

[Dravonic]

The problem with this statement is that you are assuming that Sony let them steal it, i.e. that due diligence was not carried out.

Scaff

It either wasn't carried out, or sony is really, really stupid. Without going into specifics, the amount of rookie mistakes that led to this whole fiasco is overwhelming. It really makes me wonder if they just didn't care at all about keeping this information safe.

 

[TJ13]

2 problems with that,

1) Wheres the link
2) If Sony did that we could file a lawsuit against them because it CLEARLY states when we bought our PS3s, free online gaming.

There is a message board on gamefaqs.com about it, Really dont think it will happen due to this Mass security breach...

Edit: I read somewhere that the hackers were going after Custom Firmware players, (Cant find it but was on google's news page when PSN was typed in search)

 

[Darren.]

There is a message board on gamefaqs.com about it, Really dont think it will happen due to this Mass security breach...

👍 Yeah I agree. They cannot just say "PSNs down lets reward people with PSN being a Pay only service", this will not happen I hope.

 

[Hun200kmh]

I see a lot of people here assuming as FACT many things that are being just SPECULATED.

I know this in "ze internetz" and a discussion forum etc. But when you shout (example) : "SONY IS STUPID, OUR PASSWORDS AND CC DETAILS WEREN?T ENCRYPTED"

please add a disclaimer /foot note like this:

"NOTE: I'M NOT SURE THIS IS TRUE, SO BEAR IN MIND THAT THE STUPID HERE MAY BE ... ME"

got it?

 

[arora]

I see a lot of people here assuming as FACT many things that are being just SPECULATED.

The only thing I know as fact is that the psn store was being robbed, at this point I don't think anyones info was stolen at all. Was/is it at risk? Of course, but it looks to me like Sony threw that in instead of saying why they shut the psn down.

 

[Flerbizky]

Edit: I read somewhere that the hackers were going after Custom Firmware players, (Cant find it but was on google's news page when PSN was typed in search)

I believe the word you're looking for is "ReBug" (-:

 

[CodeRedR51]

The only thing I know as fact is that the psn store was being robbed...

Actually that's not fact, because we don't know if the hackers actually took anything.

 

[arora]

Actually that's not fact, because we don't know if the hackers actually took anything.

It's fact, I've seen yt vids of clowns doing it 👍

 

[Leadpaint]

Came across this at Rockstar in reference to an gta IV online event for tomorrow (28th) on PSN.

"Note: Due to the extended PlayStation Network downtime, this event has been re-scheduled to Thursday, May 5th (5-8PM Eastern)."

This could be a clue to when the PSN is coming back online.

 

[CodeRedR51]

This could be a clue to when the PSN is coming back online.

No, that's just the new schedule for that event. Doesn't really mean anything.

 

[Darren.]

Came across this at Rockstar in reference to an gta IV online event for tomorrow (28th) on PSN.

"Note: Due to the extended PlayStation Network downtime, this event has been re-scheduled to Thursday, May 5th (5-8PM Eastern)."

This could be a clue to when the PSN is coming back online.

Link?

 

[Dravonic]

I see a lot of people here assuming as FACT many things that are being just SPECULATED.

I know this in "ze internetz" and a discussion forum etc. But when you shout (example) : "SONY IS STUPID, OUR PASSWORDS AND CC DETAILS WEREN?T ENCRYPTED"

please add a disclaimer /foot note like this:

"NOTE: I'M NOT SURE THIS IS TRUE, SO BEAR IN MIND THAT THE STUPID HERE MAY BE ... ME"

got it?

It's really more than just wild speculation. Admittedly, it's not confirmed but it fits very well, makes a lot of sense. You'd have a very hard time trying to explain it any other way.

But sure, don't take anyone's word for granted. Do your own research, reach your own conclusions. That's what I did, that's what everyone should do.

 

[Moglet]

Given that I can get your DOB, car reg, job, town you live in and a whole lot more just from what you have publically avaliable here and could use a good amount of that to dig further on the net. I would guess it would take me no more than a few hours to get more info on you freely and legally on the web that I would have been obtained via PSN.

Particulrly as the PSN data contains a vast amount of duff data, after all who here doesn't have accounts set-up for other markets? Hell the BMW dealership in Washington and Sony's Japanese HQ are getting IDs nicked on that basis.

Is it a good thing that happened, hell no. Is it as big a deal as many are making, hell no. The vast majority of us provide as much if not more info willingly on the web.


Scaff

That's besides the point though, I have chosen to put that information out there and I've taken the risk that goes with it. A mass attack doesn't discriminate and can affect people who are super careful online otherwise.

Of course, there are many many places that store similar information that could also be accessed but they are less obvious and haven't been covered much by the media. So they don't get discussed. I was just pointing out that some people might not be aware of how people can use their information is all.

 

[Leadpaint]

PSN data leak cost could top $24 billion - Report

http://www.gamespot.com/news/6310436.html



This is Funny.

 

[BWX]

PSN data leak cost could top $24 billion - Report

http://www.gamespot.com/news/6310436.html



This is Funny.

24 BILLION? That seems a little ridiculous. No reasons were given for that figure, just some group came up with it.. I don't believe it will cost Sony even a % of that insane number.

 

[t_w_a_h]

@BWX - It is a sensationalised figure for headline purposes but it's not stated as an indicative cost to Sony. Their "calculation" is based on the average "cost of a data breach involving a malicious or criminal act" per account compromised multiplied by the number of PSN users.

Average cost x PSN population
$318 x 77 million

It is a silly calculation, not least because they have no idea how many accounts were compromised and not all accounts will be active or contain valid/any information.

The Ponemon article average cost is based on samples from breaches not considered "catastrophic" (i.e. more tha 150,000 records) so it is not directly comparable but has some interesting points in it though.

Relevant to the US I thought this was interesting:

At the time of this study, most U.S. states require both business and governmental organizations to provide notification to data subjects (customers, consumers, employees and others ) when a breach of sensitive personal information is caused by negligence (insider threats), technology problems or malicious acts. While conditions for notification vary across states, the organization may not be required to notify individuals when:

i) The breached data is encrypted (minimum 128 bit standard).
ii) The breached data elements are not considered protected.
iii) The breach was stopped before information was wrongfully acquired.
iv) Other special circumstances such as national security or law enforcement investigations.

Can it be assumed from the above that some or all of the information potentially compromised in PSN-gate was not encypted (i), considered protected (ii) and the breach was not stopped before information was wrongfully acquired (iii)?.

In the UK DP law is pretty well defined. I am sure the Information Commissioner will be taking a long hard look at DP process, procedure and security protocols in the operation of the PSN. It will be interesting to see what the ICO make of it.

 

[BWX]

@BWX - It is a sensationalised figure for headline purposes but it's not stated as an indicative cost to Sony. Their "calculation" is based on the average "cost of a data breach involving a malicious or criminal act" per account compromised multiplied by the number of PSN users.

Average cost x PSN population
$318 x 77 million

It is a silly calculation, not least because they have no idea how many accounts were compromised and not all accounts will be active or contain valid/any information.

The Ponemon article about the average cost per breach has some interesting points in it though.

Relevant to the US I thought this was interesting:

At the time of this study, most U.S. states require both business and governmental organizations to provide notification to data subjects (customers, consumers, employees and others ) when a breach of sensitive personal information is caused by negligence (insider threats), technology problems or malicious acts. While conditions for notification vary across states, the organization may not be required to notify individuals when:

i) The breached data is encrypted (minimum 128 bit standard).
ii) The breached data elements are not considered protected.
iii) The breach was stopped before information was wrongfully acquired.
iv) Other special circumstances such as national security or law enforcement investigations.

Can it be assumed from the above that some or all of the information potentially compromised in PSN-gate was not encypted (i), considered protected (ii) and the breach was not stopped before information was wrongfully acquired (iii)?.

In the UK DP law is pretty well defined. I am sure the Information Commissioner will be taking a long hard look at DP process, procedure and security protocols in the operation of the PSN. It will be interesting to see what the ICO make of it.

I still haven't been notified by Sony, interesting. Even though my CC wasn't on file there, I tried to use it once and punched in the numbers. I bet Sony still recorded that info. I've already called the bank, I'm getting a new card.

 

[t_w_a_h]

^ An interesting point. Though official communications have been put out there to the world at large, no direct comms have been sent to any of my email accounts linked to a PSN account.

Have we "been informed"?

Who knows eh? I suspect the only winners here are the corporate lawyers!

 

[arora]

I recieved an email last night, basically said the same thing as the blog.

 

[XxOnLySBz4mExX]

This is Funny.

Very funny indeed.

 

[Darren.]

Not funny at all.

 

[STIG_RS6]

^ An interesting point. Though official communications have been put out there to the world at large, no direct comms have been sent to any of my email accounts linked to a PSN account.

Have we "been informed"?

Me either and I find this an absolute disgrace. Why should we find out this information through a blog, or by word of mouth from other internet users?
It's a massive mistake on Sony's part without taking into account the duty of care they have over the protection of information.
If money goes missing from my account it will be Sony who will be held to account.

The amount of time it took them to tell people (by blog) that their credit card details may be at risk is scandalous.
Say you're a security guard at a block of flats (apartment block), you turn up for work and you see evidence of someone breaking in to each and every department, do you:
A) Let everyone who lives in that block know STRAIGHT AWAY that there has been an attempted break in and some of their stuff may be missing
or
B) Say nothing for a week and hope no one finds out?