SSL has known vulnerabilities, which is why sensible information should be encrypted even when using SSL. Even if someone is capable to decrypt the SSL connection (like the guy in that chat log claimed to do), the sensible data inside (like CC data) will still be encrypted.
Correct that there are known vulnerabilities, but that has little to do with decrypting the data-stream. The vulnerabilities can be exploited to trick human beings into think they communicate with a "known" site, but instead they has been tricked to "evilhackers.com"...
Machine to machine (PS3 to PSN) are not vulnerable to this, as they don't let them be tricked to go by a link in a hackers phishing-email...
As for decrypting the data, a hacker needs to have a copy of the private key of the certificate, holded and protected by the web-server...
Correct, that could be prevented if Sony did strengthen their server-certificate with a Diffie-Hellman type of key-exchange, instead of the common RSA key-exchange... Then even with a copy of the private key, the data wouldn't be able to be decryptet by a sniff of a complete datastream. But that demands for support of DH by the client-browser, and a client like IE8 doesn't supports DH key-exchange..
And pure brut-force on the datastream to decrypt it would take years..
My point...
Is it fair to accusing Sony for not implementing and use technology specifically stronger than widely used by other companies for exchanging creditcard- AND banking-info with their customers?
And is it then fair to call it "neglect" by Sony, and accusing them of "probably not done better on internal security" when they got hacked?
haha
