Hacker News Reader

Comment by pilif | Hacker News Reader

In their defense though: What data could ask Sony for? All the data that Sony knew about these accounts has leaked, so what ever they ask for, the hackers with the leaked data know it too.

Exception is maybe the credit card number, but that would mean that only a small subset of the original account holders can change their password.

Or you use a PS3 device ID and only allow changing the password on the device, but that is also known by the attackers and I'm sure it could be spoofed.

Not even sending a token to the email address on file would work in all cases because the users might have lost their email accounts to the breach too (by reusing the same weak password).

View on HN

>Not even sending a token to the email address on file would work in all cases because the users might have lost their email accounts to the breach too (by reusing the same weak password).

Well, in that case, it'd be the user's fault for not having unique passwords, or at least for not changing an email password they knew was compromised, not Sony's fault. Sony can't do anything to ensure the users' email accounts are secure, so emailing a token would probably be the best solution.

The latest PSN update required a password change. They could have also added a required security question and then used that when resetting passwords.

IIRC there was already a security question when you first registered (at least, I made an entry for it in my keepass DB, so I must have been asked one somewhere). It was however not asked to reset the password, which makes me wonder what it was good for in the first place.

Exactly this. All previously stored data is compromised. Obviously, people can't change their birthdates, but the password reset function unquestionably has to rely only on newly-supplied, uncompromised data.

It might not be perfect, but if they have phone numbers for their customers, why not set up an automated phone call system where a PIN is provided in the call? Email accounts can be compromised by hackers but I would think it would be much more difficult to co-opt customer's phone lines.

robo calls would be a bad idea. people lose phone numbers when they move or go away to school. an email token is the best solution. if you are in the subset that lost your PSN email account then you can call sony to sort out some other method of verifying your identity.

Why would people "lose" numbers given the Number portability act, as well as the fact that long distance charges don't really exist any longer. I realize this is slightly off-topic, but your claims don't ring true to me, and I'm hoping you will add some color.

Not all numbers are portable in all cases. When my fiance and I decided to both move cell carriers onto a third carrier to get a family plan, only one of us was allowed to transfer. No way around it.

Also, it's still basically impossible to transfer a land-line number to a cell number, as they are apples and oranges.

This is simply untrue as I've operated. These companies will often take advantage of you if you are not aware. If you utilize a competent SIP trunk provider, they will go to bat for you, and you should never relinquish a number. I realize ILECs present an issue, but again, the law is on your side. Document everything. I will help you for free with this, no problem. Not sure what there is to do post-facto, but I'd raise holy hell.

There's a whole world to discover outside your border. Take a vacation and you'll be amazed!

use a PS3 device ID and only allow changing the password on the device, but that is also known by the attackers and I'm sure it could be spoofed.

Often, every device in a secure network would benefit by having its own asymmetric encryption key. This way, Sony could have easily implemented a challenge-response that only clients could respond to. The hackers would only have gotten the public keys, which wouldn't do them any good outside of some sort of man in the middle exploit, which would require secret control of a part of the PSN network over an extended period of time.

Reply on news.ycombinator.com