Hacker News Reader

Comment by spoondan | Hacker News Reader

Wait. Please tell me I'm misunderstanding. You needed only to enter a user's e-mail address and birth date to change his/her password? So, even without the previous (actual) hack, you could use this page to change the password of a family member, friend, co-worker, and nearly anyone else you've ever exchanged e-mails with if you know their birthday (or they publish it on Facebook)?

How does someone even conceive of something like that without realizing the glaring problem with it? How does it pass muster at a major corporation that has hired security consultants? This is utterly flabbergasting.

View on HN

I could understand that much outrage if Sony deliberately designed the password reset process to require only e-mail address and DOB. However, the article says that the password reset page had an exploit that allowed you to do that. It's still shoddy security, but at least it's not sheer idiocy.

Yeah...

I'm really not into the whole boycotting thing and I never really understood (for example) the people who would flat out not buy Microsoft products because of their at times very questionable business practices (especially when the worst of them happened a while ago).

I'll happily look past a gaffe here or there especially when it comes from the PR department or from the corporate lawyers as long as a company puts out a quality product.

And I quite like a few of Sony's products, too. They seem to put more thought into industrial design than most other companies.

But right now I can only pick up my Sony digital camera and earphones in distaste and it will probably be a long while until I buy anything made by Sony.

This is just way too much incompetence and in too short an order and they won't even stand up straight for it, instead pointing the finger at Anon or geohot.

Yuck.

> (especially when the worst of them happened a while ago).

The whole https://secure.wikimedia.org/wikipedia/en/wiki/Standardizati... thing is quite recent.

...and this was the solution that they spent the last month feverishly building.

Why is the de facto standard way of email exchange plus old password plus maybe a birthday not workable? Unless psn stored the passwords in plaintext, the hackers modified data, and Sony does not have a clean backup.

The main issue is that all the info used for password reset are in the hackers' hands. There may not be a perfect method, but maybe having a system that calls the phone number on file to give you a password reset code would have been more secure.

The hackers may have the email address, but they presumably can't read the email sent to that address. Hence "email exchange".

You are correct; that is what I meant. Users may have used the same password on the psn and their email account though. If sony did the right thing and only stored salted hashed passwords then that would be mitigated a bit.

Another option would be to send out a new password via mail to the billing address if they had no other way to do it electronically. Out of luck if you moved since then. Make the old password a requirement so mail thieves cannot steal your account.

I was pissed that I needed to change my credit card number because of these clowns. If someone wants to make a cool startup make a credit card number that is a one off that will only work for a certain time frame(extendable), dollar limit, and business name(though this one might be tougher because the business name given to the credit card company might be different than the business name I would enter).

CitiCard, for one, offers unique 1-off numbers for online transactions just as you suggest. Last I checked AmEx Gold cards also granted this feature.

I heard of the one off card numbers before but I thought those were for just one month before they expire. Are they not? I haven't seen the amex gold one though thanks.

You're assuming too much. I'd take odds that people used the same pwd for both.

No...this solution was already there before the big hack. I've used it in the past.

The use of DOB as an element of security has always made me question sites like Facebook offering to display it in public. Social networking would easily create an identity thief utopia if not kept in check. I actually gave a fake DOB on Facebook... then on my birthday five people came and wished me well, which is nice, but do anyone paying attention, this somewhat defeated my attempt to not make my DOB public.

The use of DOB as an element of security has always made me question its use as an element of security. It's used in many places, is not typically considered confidential, and is relatively easy to look up in publicly-available information.

Lots of security conventions ("mother's maiden name" for another example) are very silly.

Address is my favorite one: any homeowner's address is a matter of public record. What a great security question to use all over the place.

Reply on news.ycombinator.com