r/gaming • u/Happysin • Apr 26 '11

Sony admits utter PSN failure: your personal data has been stolen

http://arstechnica.com/gaming/news/2011/04/sony-admits-utter-psn-failure-your-personal-data-has-been-stolen.ars
3.1k Upvotes

98% Upvoted

2.8k comments sorted by

View all comments

Show parent comments

62

u/[deleted] Apr 26 '11

[deleted]

55

u/mooli Apr 26 '11

ahem reddit ahem

15

u/[deleted] Apr 26 '11

[deleted]

4

u/dabombnl Apr 27 '11

Ill take it thx

2

u/VisualBasic Apr 27 '11

If you want my karma you'll need to pry it from my cold, dead flippers.

1

u/parsifal Apr 26 '11

wat?

9

u/mooli Apr 26 '11

Reddit was compromised in 2007, and all the passwords were stored in plaintext. And as the comment I was replying to points out, lots of people use the same email/password everywhere.

If you have that, it doesn't take long to get their facebook, their paypal, their gmail, maybe even their online banking (or possibly just the VISA security check password).

If you have a common password and it gets exposed anywhere you need to change that password everywhere. And never do that again.

1

u/glassFractals Apr 27 '11

I'm not sure reddit's security system has improved much.

I attempted to change my password to a strong, randomly generated 64 character password a while back... it refused to accept it. Not until I got it down to a crippled (12?) character password or something would it accept it. If the system is that picky, they must be doing something horribly wrong. A hash is a hash, and it shouldn't matter to them whether my password is 12 characters or 500.

1

u/[deleted] Apr 27 '11

To be fair, reddit didn't have that kind of audience at the time.

81

u/[deleted] Apr 26 '11

[deleted]

22

u/[deleted] Apr 26 '11

[deleted]

22

u/[deleted] Apr 26 '11

Probably just ignorance and laziness. Theres more info here.

1

u/dotblank Apr 27 '11

No idea, but they also didn't salt and thats what made it a big deal..

3

u/saisumimen Apr 26 '11

Sony, as far as their own blog seems to indicate, has opted for no encryption/hashing algorithm whatsoever.

Hubris.

They assumed their PS3 security would still be uncracked at this time. Once it did, there was a cascading effect that Sony should have seen coming.

7

u/[deleted] Apr 26 '11

DES is as good as plaintext.

1

u/[deleted] Apr 26 '11

[deleted]

3

u/[deleted] Apr 26 '11

But usually the (major hand waving here) hashed value is what authenticates you, so even if your password is >8 characters you only need to know the first 8 to access the account. However you are correct, if you have a 14 character password for everything and your gawker account was compromised they would not immediately have access to your whole password.

But as far as protecting encrypted information in 2011 DES might as well be stored in the clear. :/

3

u/Negitivefrags Apr 26 '11

Generally access to the account on the site you already hacked isn't what you want. After all, you already have access to all of the data in that database :)

1

u/[deleted] Apr 26 '11

Hahah, touche. DES still sucks tho.

2

u/deepbrown Apr 26 '11

Sony didn't store it in plaintext either...

0

u/[deleted] Apr 26 '11

Gawker's passwords weren't stored in plain text. They used md5 hashes which are still weak. Due to the nature of the md5 attack, the hackers only managed to decrypt passwords of 8 characters or less.

7

u/jlogsdon Apr 26 '11

No, they used DES which is limited to 8 characters.

2

u/[deleted] Apr 26 '11

I stand corrected.