By using this site, you agree to our Privacy Policy and our Terms of Use. Close

Forums - Sony Discussion - What people blaming Geohotz and the "hackers" seem to be missing...

Gnizmo on 28 April 2011
rocketpig said:

You don't really understand how encryption works. You need the key. The key changes.


You can always crak the encryption given enough time. Give it a few weeks to potentially years and they can get what the password used to be.



Starcraft 2 ID: Gnizmo 229

Around the Network
imaprettyhotguy on 28 April 2011
Gnizmo said:
imaprettyhotguy said:

Nope you can have no defenses and still not get hacked if people don't try, and what standard are you talking about, Sony is getting worse PR then all those other ones and they lost less and no they didn't tell users right away one guy in this thread pointed out that other ones told weeks to months for people to be told with actual CC information stolen so yeah, you are wrong 


Security through obscurity is still security. They are still ahead. How can you cite news articles and then say they didn't get bad press over it? You are using the bad press to prove your point! You are proving yourself wrong with your own damned evidence!

Also you might want to read my statements. I never said other companies always told people up front. I made a specific point not to claim that. Many other companies delayed informing people. Most don't. Those that do should be slammed for failing to mention it, because they fucked up.

You really don't understand the word worse do you



imaprettyhotguy on 28 April 2011
Gnizmo said:
imaprettyhotguy said:

Yes they would, encryptions can be broken they have no way of knowing if the hacker has the ability or the tools or the will to break it 


By the time the encryption is broken the password is changed, and your work is null and void. There is no point in taking encrypted passwords. Thats why you encrypt the passwords. Also, it is known now that the data was un-ecrypted. Sony has admitted as much.

Where did Sony admit that? And the passwords could have just been stored in the same database which the hacker just mined for everything he could get doesn't mean the passwords are useful to him if he took them



imaprettyhotguy on 28 April 2011
Gnizmo said:
Ail said:

A lot of people are acting like this is the biggest hack ever.

It isn't like I posted earlier in this thread.

There have been bigger hacks in the last 5 years that stole more sensitive information ( like 100 million confirmed credit card accounts , some of them with SSN and personall information). This is just the one with the most publicity....

And it every previous case it took weeks if not months for the breach to be discovered and notified to people affected...

 

The biggest known case  is Heartland which affected up to 100 millions credit cards and they are even sure when the breach started to occur...

Heck while you guys are all focusing on this, another huge breach happened less than a month ago at another company.

http://www.reuters.com/article/2011/04/03/us-citi-capitalone-data-idUSTRE7321PI20110403

 

For those interested ( and especially Squilliam which seems not very well informed), here are 11 largest data breach in recent history :

http://wikibon.org/blog/the-11-largest-data-breaches-in-recent-history/


Two important bits here. You can't cite a news source and then say it didn't get coverage. Doesn't compute. Secondly, just because you are hearing more about it does not mean it wasn't covered. Major news outlets have not given this a ton of coverage from what I have seen. They have barely given it any at all until the Senator filed a suit. The gaming news is covering it more. Give you 3 guesses as to why that is.

You also kill another of your points. You try to claim there was a lack of response similar to Sony's, but then go on to state the hack wasn't discovered. Do you see the link there? You can't report a data leak you don't know about. Unless it is discovered there is no way to inform the public. The fact that it wasn't discovered in other cases is big news on its own, but linked to the other info as you have it all it does is invalidate more of your response.

So you don't understand the word most now either?



rocketpig on 28 April 2011
Gnizmo said:
rocketpig said:

You don't really understand how encryption works. You need the key. The key changes.


You can always crak the encryption given enough time. Give it a few weeks to potentially years and they can get what the password used to be.

Exactly. Without breaking the encryption immediately (or within whatever specified timeline used by the key), it's useless.




Or check out my new webcomic: http://selfcentent.com/

Around the Network
Gnizmo on 28 April 2011
rocketpig said:

They admitted that passwords were unencrypted?

Jesus Christ.

FUCKING WORDPRESS USES ENCRYPTION FOR COMMENTING.

Fuck off, Sony. Seriously. Just retarded.


"Q: Was my personal data encrypted?
 A: All of the data was protected, and access was restricted both physically and through the perimeter and security of the network. The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack."

I am constantly amazed that anyone in IT would allow unencrypted passwords. I just don't get what they are thinking. There is no benefit to storing that shit in plain text.



Starcraft 2 ID: Gnizmo 229

imaprettyhotguy on 28 April 2011
rocketpig said:
imaprettyhotguy said:
Yes they would, encryptions can be broken they have no way of knowing if the hacker has the ability or the tools or the will to break it 

You don't really understand how encryption works. You need the key. The key changes.

You don't need the key, you can break it without the key



Gnizmo on 28 April 2011
imaprettyhotguy said:

You really don't understand the word worse do you


I do, but you have nothing to back it up. Where is this worse PR? Show it to me. As for your question about the encryption info, well you might want to check the PS blog agan. Do you need another link?



Starcraft 2 ID: Gnizmo 229

rocketpig on 28 April 2011
imaprettyhotguy said:
rocketpig said:
imaprettyhotguy said:
Yes they would, encryptions can be broken they have no way of knowing if the hacker has the ability or the tools or the will to break it 

You don't really understand how encryption works. You need the key. The key changes.

You don't need the key, you can break it without the key

And it would be useless because the key changed.




Or check out my new webcomic: http://selfcentent.com/

rocketpig on 28 April 2011
Gnizmo said:
rocketpig said:

They admitted that passwords were unencrypted?

Jesus Christ.

FUCKING WORDPRESS USES ENCRYPTION FOR COMMENTING.

Fuck off, Sony. Seriously. Just retarded.


"Q: Was my personal data encrypted?
 A: All of the data was protected, and access was restricted both physically and through the perimeter and security of the network. The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack."

I am constantly amazed that anyone in IT would allow unencrypted passwords. I just don't get what they are thinking. There is no benefit to storing that shit in plain text.

Un-fucking-believable.

I've done more work than I care to count in databases using MySQL, MSSQL, and Fox Pro. Never ONCE have I seen a password field unencrypted.




Or check out my new webcomic: http://selfcentent.com/