While your defence of Sony is admirable, it doesn't change the fact that you're wrong here. There's a reason Sony is picking up a whole lot more flak for this than most do, and that's because it made some by now fairly-well-documented errors when storing the data that allowed it to be accessed far more easily than should ever be possible. They stored information in plaintext that should never, ever need to be stored that way, they forgot to securely hash passwords and they've repeatedly failed to hire external security auditors to perform penetration testing, even when the PS3 root key hack made it clear that whatever internal auditing was being performed was simply inadequate. Information disclosures of this level don't happen very often, because no matter how good your hackers are, there are fairly elementary things you can do to keep the risk to a minimum. Sony did not do them.nothingspringstomind said:
All Sony have said regarding card information is a) that they haven't found evidence that the card information was taken but don't know for sure, and b) that the card information was encrypted. Encrypted does not mean unbreakable, and encryption is only as good as the person implementing it. Sony have already proven they simply do not understand cryptography - the PS3 root key can be decrypted from two certificates in a matter of seconds thanks to a fundamental implementation failure on their part, and if similar techniques were used and abused elsewhere, Sony could potentially be the least secure major online entity in existence.
) But I'm still changing my card later today.
