Hacker News Reader

That wouldn't work over SSL, as there is no plain text in the HTTP Verb. And I recall a "paper" coming up some months ago that was mentioning the protocols the PS3 goes through, which does confirm that the data is transmitted over SSL.[0]

[0] http://arstechnica.com/gaming/news/2011/02/report-psn-hacked...

View on HN

If the attacker "0wned" the servers the fact there was encryption between you and the server doesn't really help a whole lot, they can just insert them selves in the stack post encryption (or even use the private key to decrypt the encrypted traffic if they wanted to minimize the number of points they touched).

The SSL gets decrypted inside the web server process memory, at the latest. Sometimes it's stripped off by an SSL offload accelerator device before even entering the web server.

The numbers probably also cross the wire in plain text between the web server and the database too.

Anecdotal, but I'd say stripping SSL at the border is much more common that leaving it intact to the node.

Reply on news.ycombinator.com