Hacker News Reader

It may be that the attackers pwned the servers and skimmed the numbers (including CVV) as they were HTTP POSTed in plain text.

View on HN

That wouldn't work over SSL, as there is no plain text in the HTTP Verb. And I recall a "paper" coming up some months ago that was mentioning the protocols the PS3 goes through, which does confirm that the data is transmitted over SSL.[0]

[0] http://arstechnica.com/gaming/news/2011/02/report-psn-hacked...

The SSL gets decrypted inside the web server process memory, at the latest. Sometimes it's stripped off by an SSL offload accelerator device before even entering the web server.

The numbers probably also cross the wire in plain text between the web server and the database too.

Anecdotal, but I'd say stripping SSL at the border is much more common that leaving it intact to the node.

If the attacker "0wned" the servers the fact there was encryption between you and the server doesn't really help a whole lot, they can just insert them selves in the stack post encryption (or even use the private key to decrypt the encrypted traffic if they wanted to minimize the number of points they touched).

"as they were HTTP POSTed in plain text."

Why on earth would you ever do that?

See my other response above http://news.ycombinator.com/item?id=2487412

Reply on news.ycombinator.com