Beyond3D Forum

Beyond3D Forum (http://forum.beyond3d.com/index.php)
-   Console Forum (http://forum.beyond3d.com/forumdisplay.php?f=37)
-   -   *ren* PSN Down, Customer Info Compromised (http://forum.beyond3d.com/showthread.php?t=60017)

Nesh 14-May-2011 12:18

Quote:

Originally Posted by mrcorbo (Post 1550718)
My statement isn't predicated on any assumptions. It is based on the level of service I expect from a company holding my personal information. If those expectations exceed what is possible for that company to provide then I will not be using their services.

You can feel free to have lower expectations and I'm quite sure a company will be happy to meet those.

Thats my point. You may form expectations based on what you ideally want and expect the company to follow the procedures to meet those, but that may not actually be the wisest method of handling the issue (or even possible) when there are large complexities involved, uncertainty and risk.

mrcorbo 14-May-2011 17:58

Quote:

Originally Posted by -tkf- (Post 1550843)
Of course you donīt agree, and i am pretty sure that if Sony experiences something like this again they will post something like that. But of course they, like us, would have the knowledge they have now. Something that makes all to easy to suggest something like you do now. The lastpass breach and the Eidos/DeusEX hacks are evidence that the attitude changed to rather safe than sorry when it comes to information.

All good things. And the consensus reaction to this incident being so negative is a big reason why that attitude has changed.

Quote:

Originally Posted by -tkf- (Post 1550843)
And read the timeline again, they had an idea something was wrong, but what is clear is that the attacks was done with skill and dedication to not being easily detected. And since Sony didnīt really have an dedicated security team/function they were screwed, which imho is a disaster. Maybe they relied to much on outside firms when it comes to PSN? I dunno, outsourcing for the fail. I see no reason to defend their poor security measures.

My original post was only to demonstrate that with what we know you canīt just say "they knew for 6 days user information was stolen". You can say "Sony is lying and they knew information was stolen for 6 days" but there is very little info to back that up with.

I haven't suggested either of those two things since their timeline came out. All I said was that it took them 6 days from the time of the incident to get a statement out. That is a fact, and no matter what combination of circumstances and decisions led to that result, I have a problem with it.

According to their timeline (which I believe is true, but incomplete) they confirmed that data was compromised on day 5 and then waited until the next day before they made their statement. That is a fact, and I have a problem with it.

I believe that at some point before they knew that customer data had been accessed that they suspected that customer data could have been accessed. It was at this time I would have expected Sony to inform their customers of this possibility.

mrcorbo 14-May-2011 18:05

Quote:

Originally Posted by Nesh (Post 1550868)
Thats my point. You may form expectations based on what you ideally want and expect the company to follow the procedures to meet those, but that may not actually be the wisest method of handling the issue (or even possible) when there are large complexities involved, uncertainty and risk.

I would prefer that they deal with the uncertainty and risk instead of passing it along to their customers.

I am quite used to companies putting their interests above the interests of their customers. I expect it, even. But there are some areas where this cannot be accepted and this is one of them.

AmFreak 14-May-2011 18:29

Quote:

Originally Posted by deathindustrial (Post 1549365)
The chat logs specifically mentioned that server as being out of date:



It wasn't as of March as shown by the Google cache.

They also claimed that the credit cards where being sent as "plaintext" which as has previously been discussed was bogus - the PS3 sends the data over an HTTPS connection like *every single e-commerce system on the planet*.

So two of the major claims in that IRC session have been repudiated. So personally I take the rest of what's in there as being as equally questionable.

I have little faith in Sony mind you (I've always stuck to PSN cards for that reason), I just do not like reading total fabrications as news is all.

Cheers

First i have to say - good work!
But the out of date server claimed in the irc could have been the truth. The google cache is from the 23rd of March but the irc log is from the 17th of February or earlier as seen here:
http://www.ps3hax.net/showpost.php?p...&postcount=180

So Sony could have updated the servers between the log and the hack.

Nesh 14-May-2011 19:00

Quote:

Originally Posted by mrcorbo (Post 1550904)
I would prefer that they deal with the uncertainty and risk instead of passing it along to their customers.

I am quite used to companies putting their interests above the interests of their customers. I expect it, even. But there are some areas where this cannot be accepted and this is one of them.

And thats what they tried to deal with before they informed the consumer about what was going on.
Hasty communication to the consumer simply because he wants it IS passing uncertainty and risk to the consumer.

BRiT 14-May-2011 20:47

Seems Sony still has a few more items to clean up... http://www.myphl17.com/business/sns-...0,930109.story

Quote:

Bumgarner also found an access point to a server running an identity management system that he said controls access to logins and passwords for employees throughout Sony Pictures Entertainment. He located that system by conducting a Google search using the terms "site:.Sony.com identity."

mrcorbo 14-May-2011 21:09

**double post**

mrcorbo 14-May-2011 21:12

Quote:

Originally Posted by Nesh (Post 1550910)
And thats what they tried to deal with before they informed the consumer about what was going on.
Hasty communication to the consumer simply because he wants it IS passing uncertainty and risk to the consumer.

What risk is that exactly?

How might I have been harmed if Sony had put forth a statement such as the one I suggested?

Quote:

"We have detected an intrusion in to PSN by an unknown agency. We are unsure at this time whether customer data has been compromised. We are continuing to investigate and will provide information as it becomes available."

NavNucST3 15-May-2011 00:09

So I need to wait until I get this e-mail from Sony before I can change my password since I HAVE bought something before?

Quote:

Originally Posted by PS blog
If using a PS3, your password can only be changed on your own PS3 (or a PS3 on which your PSN account was activated), as an added layer of security. If you have never downloaded any content using your account on the system, an email will be sent to the registered sign-in ID (email address) associated with your account when you first attempt to sign-in to PSN. This e-mail will contain a link that will enable you to change your password. In this email, click on the link and follow the instructions to change your password. Once you have changed your password you can sign-in to your account using your new password.

EDIT: Reading that again and I guess I won't be getting an e-mail it seems like I'll need to wait until PSN is back up before being able to change my info...unless there is something I'm missing.

NathansFortune 15-May-2011 00:16

http://blog.us.playstation.com/2011/...ftware-update/

Quote:

We have been working on a new PS3 system software update that requires all PSN users to change their password once PlayStation Network is restored. The update (v3.61) is mandatory and is available now.

If using a PS3, your password can only be changed on your own PS3 (or a PS3 on which your PSN account was activated), as an added layer of security. If you have never downloaded any content using your account on the system, an email will be sent to the registered sign-in ID (email address) associated with your account when you first attempt to sign-in to PSN. This e-mail will contain a link that will enable you to change your password. In this email, click on the link and follow the instructions to change your password. Once you have changed your password you can sign-in to your account using your new password.

We strongly recommend that all PSN account holders with PS3s update their systems to prepare for when PlayStation Network is back online. The release of this update is a critical step as we work to make PlayStation Network significantly more secure. Thank you for your continued support and patience.
Firmware 3.61 available to download now.

Nesh 15-May-2011 00:55

Quote:

Originally Posted by mrcorbo (Post 1550924)
What risk is that exactly?

How might I have been harmed if Sony had put forth a statement such as the one I suggested?

You can form your statement only because now you can look back knowing now what happened

Sony was uncertain about the intrusion and what happened in their servers.

So there was only incomplete or questionable information to pass to the consumer. Incomplete and questionable information create uncertainty and can cause panic (possibly in vain if there wasnt anything serious after all) and anxiety to the consumer as to whether he should worry about and what he should worry about because mass behavior doesnt always follow rational thinking. The consumer would have still been in the same situation demanding an explanation which at the end would have been available at the same date Sony informed anyways about what the hackers possibly had access to

AzBat 15-May-2011 01:04

Cop out. If I have an account that has credit card information attached to it, then I want to know immediately if an intruder gain accessed to the system regardless if they stole any data or not. They felt it serious enough to shutdown the network, then they should have felt it serious enough to notify me too & not 5 days after they did their research.

BTW, time to grab the popcorn. It's going to be interesting to see how this unfolds.

Tommy McClain

AzBat 15-May-2011 01:13

PSN rollout coming...

http://blog.us.playstation.com/2011/...on-begins-now/

Tommy McClain

Update: Kazuo Hirai Video Annoucnement
http://blog.us.playstation.com/2011/...-announcement/

Gitaroo 15-May-2011 01:38

according to the map, Canada doesn't exist.....

Xenus 15-May-2011 01:47

Well it is the US blog. Besides that they need to hurry up and update the first state so I can find out who it is then go on about my normal non gambling induced day. :P

deathindustrial 15-May-2011 02:12

Quote:

Originally Posted by Xenus (Post 1550953)
Well it is the US blog.

Canada is treated as part of the US region by Sony. . .

-1 for being US centric Sony.

Cheers

Arwin 15-May-2011 02:15

Update installing already, came home late from wedding party and almost asleep when I saw the tweets. 3.61 it is, psn not up yet here though.

RobertR1 15-May-2011 02:45

Good news for PSN users. Now where are my freebies! :)

Xenus 15-May-2011 03:15

For that you must wait till the store is up :P

Looks like the northeast wins New your new jersey and on up just lit up.

RenegadeRocks 15-May-2011 03:56

Well, my ps3 ain't online anymore because my home doesn't have internet anymore, for now atleast. But I have downloaded lots of stuff from PSN, so I am guessing an automatic email won't be incoming to my email account. How do I ask SOny to let me change my password without taking my ps3 online? I am not relly sure whether I removed my CC data from my account or not, though I usually do, and I would like to change my pasword even if I am not currently online from my ps3.

mrcorbo 15-May-2011 05:29

Quote:

Originally Posted by Nesh (Post 1550946)
You can form your statement only because now you can look back knowing now what happened

Sony was uncertain about the intrusion and what happened in their servers.

So there was only incomplete or questionable information to pass to the consumer. Incomplete and questionable information create uncertainty and can cause panic (possibly in vain if there wasnt anything serious after all) and anxiety to the consumer as to whether he should worry about and what he should worry about because mass behavior doesnt always follow rational thinking. The consumer would have still been in the same situation demanding an explanation which at the end would have been available at the same date Sony informed anyways about what the hackers possibly had access to

First, they knew quite quickly that the intrusion was serious. That's why they shut the network down.

Secondly, In what parallel dimension did the way they chose to handle this situation prevent panic and anxiety? You saw the public reaction.. The way they handled it resulted in more FUD because it made them look incompetent. After the initial shock, which was going to be unavoidable no matter when the information was released, I would have felt much more secure if it had seemed that Sony were on top of the situation instead of having the situation on top of them.

Xenus 15-May-2011 06:42

Thread name needs updated it going up sectiuon of the country by section at least in the US.

-tkf- 15-May-2011 07:01

Quote:

Originally Posted by mrcorbo (Post 1550973)
First, they knew quite quickly that the intrusion was serious. That's why they shut the network down.

Secondly, In what parallel dimension did the way they chose to handle this situation prevent panic and anxiety? You saw the public reaction.. The way they handled it resulted in more FUD because it made them look incompetent. After the initial shock, which was going to be unavoidable no matter when the information was released, I would have felt much more secure if it had seemed that Sony were on top of the situation instead of having the situation on top of them.

uh? Isnīt it obvious that they were NOT on top of things. And isnīt obvious that is a good part of why they didnīt provide information sooner? They did not know what the f... was going on.

I recall plenty of times where shit hit the fan in my little part of the world abd just on that small scale itīs always fantastic to be clever.. afterwards.

I have this delorean i could make a few million if i were to borrow it to sony, so please return it to me as soon as you are done with it.

AzBat 15-May-2011 08:29

US & Canada are said to be all online. I was finally able to log into the site with my email & old password. It gave me the following message...

Quote:

To sign in, an update of your account information is required. An e-mail message with instructions has been sent to xxxx@xxxx.com. It may take up to 24 hours to receive this message.
Then it booted me back to the login screen again. So it won't actually let me login until I follow the activation instructions sent to my email. That should work just fine. This probably saves them having to send activation emails all the users.

Regardless of the incompetence of the security breach & the lack of communication until 5 days later, I think Sony handled the fiasco rather well. Yes, the 4 weeks of downtime might been a bit much, but I don't think that could have been avoided. It will be interesting to see how they recover as I'm sure they will(at least from the consumer side). I also don't think May NPD results will be too adversely affected since online revenues will take the greatest hit & they don't track those. The last big question is how they will recover from the fallout & flak they will get from developers & publishers. That really could have a lasting effect.

Tommy McClain

Xenus 15-May-2011 08:41

Indeed most can change it directly from the PS3 and I think it hurts the small digital download companies far more. The large ones won't avoid the system but they smaller ones they could lose.


All times are GMT +1. The time now is 09:06.

Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.