April 21 PSN and Qriocity outage

[madhi19]

The more I think about it cold hard cash sound better and better. Hell down south if thing get any worse with the US currency getting devalued they might have to revert to the good old system of barter for gold and pelts soon.

[timmy1]

A couple of days ago I called Sony Reader Store customer service and requested that my account and personal information be deleted (I figured if I can't delete my PSN account yet I can at least get started on ditching all my other Sony products). The rep complied and told me that my account and info had been completely removed.

Since then I've received two emails from them -- yesterday morning I got one asking how my customer service experience was, and a second email today asking how I enjoyed the last book I bought from them (naming the book, of course). I guess my idea of account deletion is different from theirs. Clearly they're still hanging on to my personal info and account history. I'm going to follow up with them tonight.

[Gord Lacey]

So apparently there's a database of 2.2 million credit cards from PSN being sold online...

http://bits.blogs.nytimes.com/2011/0...ers-card-data/

Guess I'll add checking my credit card activity to my daily list of online things to do...

[GrimJack]

Originally Posted by timmy1

A couple of days ago I called Sony Reader Store customer service and requested that my account and personal information be deleted (I figured if I can't delete my PSN account yet I can at least get started on ditching all my other Sony products). The rep complied and told me that my account and info had been completely removed.

Since then I've received two emails from them -- yesterday morning I got one asking how my customer service experience was, and a second email today asking how I enjoyed the last book I bought from them (naming the book, of course). I guess my idea of account deletion is different from theirs. Clearly they're still hanging on to my personal info and account history. I'm going to follow up with them tonight.

Just a note about this. Most organizations do things like this via a data pull, not from the live data.
After changing my email with Amazon I will still 6 months later still get a mailing campaign occasionally on the old email address.

[Dioneo]

Originally Posted by Gord Lacey

So apparently there's a database of 2.2 million credit cards from PSN being sold online...

http://bits.blogs.nytimes.com/2011/0...ers-card-data/

Guess I'll add checking my credit card activity to my daily list of online things to do...

If I held stock in Sony, I would really pray that forum post is bogus. If it is legitimate, it means Sony recorded and stored the cvv2 info for your credit card - the three digit security code that is meant to prevent online fraud!

From the Wikipedia entry on cvv2:

Merchants who require the CVV2 for "card not present" transactions are forbidden in the USA by Visa from storing the CVV2 once the individual transaction is authorized and completed.[3] This way, if a database of transactions is compromised, the CVV2 is not included, and the stolen card numbers are less useful. The Payment Card Industry Data Security Standard (PCI DSS) also prohibits the storage of CSC (and other sensitive authorisation data) post transaction authorisation. This applies globally to anyone who stores, processes or transmits card holder data.[4]

Supplying the CSC code in a transaction is intended to verify that the customer has the card in their possession. Knowledge of the code proves that the customer has seen the card, or has seen a record made by somebody who saw the card.

[eimaj]

Originally Posted by Gord Lacey

So apparently there's a database of 2.2 million credit cards from PSN being sold online...

http://bits.blogs.nytimes.com/2011/0...ers-card-data/

Guess I'll add checking my credit card activity to my daily list of online things to do...

Cancel it and get a new one. This is what I did. Easiest way to avoid fraud.

[Gord Lacey]

Well, Sony didn't ask people for the CVV info, so maybe the hackers have been running the numbers and trying out various CVV combos? 2.2 million sounds like a subset of the actual number of cards that would be stored.

eimaj, I may do that, but I have so many things that are billed to that card each month. Might as well start the process...

[99semaj]

Significant update coming up at midnight:

Kaz Hirai will be holding a press conference tomorrow from Sony Corporation (ADR) (Public, NYSE:SNE) Japan, to address the PlayStation Network hacking crisis.*The conference will be held at 2PM Japan time, which means a lovely 12 midnight time for those in New York and 5AM the next day for those in London.*It is expected that Hirai will announce a new PSN security system, and when PSN will be live for users to enjoy. He also may announce what sort of compensation Sony will offer.

[99semaj]

Some highlights from the press conf:

In closing, Hirai bowed again and apologized again. Responding to press questions, Hirai said that he had received questions about the matter from members of Congress in the U.S. and would answer the questions. In about a week’s time, the service is expected to restart. Hirai said he had not received reports that actual damages had been incurred related to the credit card exposure.

Many sophisticated with Asian business culture will recognize this as a deeply humiliating gesture.

The company will roll out a program with a selection of premium services for consumers. This “welcome back” content will have free downloads, and 30 days of free PlayStation Plus network service. Normally, Sony charges extra for the Plus service, while membership in the PlayStation Network is free. Current members of PlayStation Plus will get 30 days of free service. Music Unlimited, powered by Qriocity, subscribers will get 30 days of free service in countries where it is available

No doubt this will be panned as not nearly enough of a conciliatory gesture.

Hirai said the company is moving servers from San Diego, Calif., to a more advanced data center with better security. It is also installing more security systems with automated software management and enhanced levels of data encryption and better ability to detect data intrusions. The company is adding more firewalls too and it is adding a new chief information security officer, reporting to Hasejima. PS 3 will have a new system software update requiring users to change their user names and passwords. The password can only be changed on the same PS 3 on which the account was created or via validated email.

Maybe i'm just naive, but I would have expected that level of integrity already...

[Gord Lacey]

I think offering Playstation Plus, while a nice move, will result in a bunch of grumpy people in the future. You can download a bunch of free games with Plus, but they expire with your Plus membership so you can't use them anymore unless you pay for membership again. Of course a bunch of people will download a game with a week of the free Plus left, and then complain that the game has expired and how Sony is ripping them off. Just watch...

[audacity]

Well, since Playstation Plus is priced between $4-$6/month depending on whether you buy 12 months or 3 months respectively, Sony is basically saying "sorry guys, have $5 worth of a service you may or may not want".

I'm guessing these subscription fees are largely profit, so if they wanted to go with a PSN Plus sub as the "we're sorry" gesture, a year of service or something comparable would be a bit more appropriate level considering the duration of the outage, plus the inconvenience of the service not being there when people wanted to play their games. Not to mention that whole "oops, hackers got your personal data" thing.

[McPatrick]

I think offering Playstation Plus, while a nice move, will result in a bunch of grumpy people in the future. You can download a bunch of free games with Plus, but they expire with your Plus membership so you can't use them anymore unless you pay for membership again. Of course a bunch of people will download a game with a week of the free Plus left, and then complain that the game has expired and how Sony is ripping them off. Just watch...

you can't keep gamers happy no matter what you do. although you do lose the free content if you don't resubscibe but i find it will be good for getting games cheap with the PS+ discounts they offer. plus i can test our the gamesave backup service as i have already lost my gamesaves once after the blu-ray drive died in my ps3 (thankfully it was stull under warrentry at that time).

[Tezster]

I think a better idea would be to extend the membership of existing PS+ subscribers by at least a month (i.e. the people who have already paid for the service), then give PSN subscribers some form of PSN store credit or discount for their next purchase as a "thank you, and we're sorry" gift.

To be honest, I don't find any type of PS+ subscription on its own that great of a gesture.

[Blackloz]

Luckily I only use Pre-Paid credit cards for any online stuff. I learned my lession 10 years ago and only use the bank issued cc for in person stuff. I guess I cut up Money marts pre-paid card now and onto the cash store for a pre-paid mastercard as I still like to buy stuff online.

[audacity]

Originally Posted by Blackloz

Luckily I only use Pre-Paid credit cards for any online stuff. I learned my lession 10 years ago and only use the bank issued cc for in person stuff. I guess I cut up Money marts pre-paid card now and onto the cash store for a pre-paid mastercard as I still like to buy stuff online.

Are you aware that when you use your CC for "in person stuff", it also goes into a database in many cases, especially when you're shopping in a department store when they track what items were purchased with what credit card (for returns purposes). It would be my educated guess that those databases in question aren't as well secured as the equivalent database at, say, Amazon. I'd hope that the data would be encrypted in both places, but like all encryption systems the Achilles heel is the key management, which is more of an art than a science.

At this point I'd suggest the only "real" protection you have is the fact that Canadian banks will not hold you responsible if there are fraudulent charges on your credit card. You just need to keep tabs on the actual purchases and statements. Online services like Mint.com can help you track your spending and send you alerts when something happens on that front.