News - Sony pictures loses 1,000,000 passwords

[HEXUS]

Further security breaches reveal yet more unencrypted data.

Read more.

[Saracen]

The message for now, though, seems to be that if you've ever handed Sony any personal data you should expect it to be made public by a hacker at some point.

And, by direct extrapolation, you should be concerned about that threat when you hand personal data to ANY organisation. Just because some others haven't hit the headlines yet, does that mean they have better security? Or that they haven't yet been targeted? Or that they have been targeted and had stuff compromised but don't know it? Or that they know it but, when perhaps told "pay up or we go public" they paid up (and I've no idea if that happened with Sony and they refused).

Put it this way. A hacker can't gain data about you from an organisation if that organisation doesn't have it. So, my advice is to think carefully, when personal info is requested, as to whether it's in YOUR interest to give it, or to give all of it.

Sometimes, releasing personal information is in your interests, and sometimes, it's unavoidable if you want a given service, in which case, I think about how much I want that service. For instance, I was after double glazing a while back. I redid the whole house. One company quoted about £14,000. A similar company did not want to attend unless I gave them a phone number, and I am not giving a double glazing company my home phone number (or my mobile, for that matter). And they would not attend to give a quote unless I did. Result .... they lost the business. Well, they're entitled to require the phone number, but it was for their convenience (avoiding wasted trips) not mine. So I gave them a choice .... come and quote without it, or don't come. They chose not to come. I'm sure the company I used in the end are quite happy that a couple of major, brand-name competitors operate that policy.

Anyway, back on topic. The only way we can be sure that out personal data is not compromised is to not give it out. That suggests being very selective about who we give it to, and what information we give and for what reason, if we want to minimise our personal exposure, because this problem for Sony is likely to be the tip of the iceberg, not the whole iceberg.

[Brewster0101]

Is true that everyone wants as much details as possible when they do not need such information. Like registering on forums and like, they don't need your address details or phone number. Why does Sony have this information. All they need is a user name, password and email address.

I hope Sony get a good whoop ass kicking by some lawyers over this.

Sony stinks of arrogance and I am happy if they get thrown to the wall on this.

[aidanjt]

You'd think they would have learnt from the PSN break-in, and immediately convert all the passwords they have stored into hashes. There's no legitimate reason to store passwords in plaintext, ever.

[badass]

You'd think they would have learnt from the PSN break-in, and immediately convert all the passwords they have stored into hashes. There's no legitimate reason to store passwords in plaintext, ever.

Not just hashes. They should be salted as well.

[Whiternoise]

You'd think they would have learnt from the PSN break-in, and immediately convert all the passwords they have stored into hashes. There's no legitimate reason to store passwords in plaintext, ever.

Worth mentioning that a really easy way to check this is to ask for a password reminder on your favourite websites. If you get your password back in plaintext, then you should consider what you have stored on that site and what else you use that password for.

It's not implicit that if they send a "reset your password" email, rather than just telling it to, you that your data is encrypted, so be aware of that too.

Of course you can always fill in the forms with dummy data - there's nothing stopping you.

[watercooled]

You'd think they would have learnt from the PSN break-in, and immediately convert all the passwords they have stored into hashes. There's no legitimate reason to store passwords in plaintext, ever.

I can think of a few exceptions, RSA private key passwords and password managers for instance. But generally, I completely agree - where there isn't a very good reason to not store a hashed password there's no excuse for storing them in plaintext.

Not just hashes. They should be salted as well.

This too, there are plenty of rainbow tables out there and considering the number of people who have very simple passwords (and use the same one for everything), there is again, no excuse for not using them.

Worth mentioning that a really easy way to check this is to ask for a password reminder on your favourite websites. If you get your password back in plaintext, then you should consider what you have stored on that site and what else you use that password for.

It's not implicit that if they send a "reset your password" email, rather than just telling it to, you that your data is encrypted, so be aware of that too.

Of course you can always fill in the forms with dummy data - there's nothing stopping you.

I only really use legitimate data where it's absolutely necessary, when shopping for instance. I also frequently make use of disposable emails from mailinator, for example. There is a simple way to guard against stuff like this - use a password manager. Yes, you do get people who 'don't trust them' (despite not knowing a thing about them) but fail to understand it's a heck of a lot more secure than using the same 6 character dictionary word for everything from banking to forums...

[Saracen]

....

Of course you can always fill in the forms with dummy data - there's nothing stopping you.

Depends what the site is for, and what you've agreed to. It's probably not a good idea if, for instance, it's your bank. It may well be thee case that at the least, it's breach of contract, and puts your account at risk if they catch you doing it.

For that reason, my attitude is that if such data is optional, I don't include it. If it's mandatory, I think very carefully about whether I want whatever that site offers badly enough to give it up. And for things like phone numbers and email addresses, it's why I have "burnable" instances of both - if they get abused, I dump them.

On the other hand, there's sometimes a downside to not filling it some data. If you want help with your PC, on here, then it may ell help to have filled in profile fields. But it's optional.

But for "security" data, personally, I will not EVER provide accurate data to anyone that doesn't have a valid reason to know, like banks or the government. If a forum wants DoB, they'll get nothing or a fictional one if it's mandatory, and I never use things like my mother's maiden name, including for (or rather, especially for) sites where security matters.

It's impossible to keep all personal data personal in today's society, but I'm very selective about who I tell what. You cannot prevent risks to personal data, unless you have a hankering for being a monk in a secluded retreat, but you can minimise them.

[Saracen]

You'd think they would have learnt from the PSN break-in, and immediately convert all the passwords they have stored into hashes. There's no legitimate reason to store passwords in plaintext, ever.

Even hashes have their limitations, especially if you know how the hash is calculated, and have database access.

Years ago (and nor on Hexus) I ran a little check. I ran various standard passwords (like "password" and "letmein", etc) though an MD5 hash generator, and then did a database search on a fairly large forum database. The number of hits was quite shocking.

A hash is decently secure against outsiders, but not at all secure against insider access unless the person creating the password avoids the obvious choice of passwords, like those.

Of course, anyone with more intelligence than a watermelon might use a password like those on forums, but won't on something that matters, like a bank.

[Saracen]

.... There is a simple way to guard against stuff like this - use a password manager. Yes, you do get people who 'don't trust them' (despite not knowing a thing about them) but fail to understand it's a heck of a lot more secure than using the same 6 character dictionary word for everything from banking to forums...

And even password managers can be a risk if not used sensible. For example, anyone that has access to your PC can access the contents of your password manager if you're daft enough to use an insecure master password.

And there's another risk. If you out all your eggs in one basket, for heaven's sake, don't drop the basket. I know someone that pull everything inside a password manager, from bank access details to forums passwords, and didn't keep a backup. Yup, one friend hard disk later, they were in tears.

I do use a password manager. But my master copy is on a device that's NEVER connected to my network other than very rare occasions for system updates, and that never happens when the network router is on. And there are backup copies of that master data on several different types of media, including non-volatile and one copy which, sometimes is a bit out of date but is about 100 miles from where I keep the device. Even in the event of an utter disaster, like my home burning down, I can still get most of my important data, albeit sometimes a bit old, back.

[watercooled]

Oh I'd be wrong to say they are a complete bullet-proof solution but I think they would rarely be worse then using the same rubbish password for everything. For people I know will not backup/use weak passwords I will normally say don't put anything important (bank/paypal) in with less critical stuff (MyFace, etc), try to think of and remember a good, long, pass sentence as the master password and IIRC LastPass (one I often recommend now) does keep secure backups automatically on their servers.

[Saracen]

Oh I'd be wrong to say they are a complete bullet-proof solution but I think they would rarely be worse then using the same rubbish password for everything.....

Absolutely.

.... For people I know will not backup/use weak passwords I will normally say don't put anything important (bank/paypal) in with less critical stuff (MyFace, etc), try to think of and remember a good, long, pass sentence as the master password and IIRC LastPass (one I often recommend now) does keep secure backups automatically on their servers.

It's horses for courses, different strokes for different folks. Any password manager that wants to talk out onto the net is precisely one I would never touch. In fact, I've got such access blocked, just in case. But .... for the type of person you describe, it's a good idea. Storing passwords on someone else's server, especially if they know they are passwords, is a huge no-no for me, but that's because I take my own precautions, and take them seriously. If you don't, that type of storage is certainly likely to be better than not having a backup. Horses for courses.

[aidanjt]

I can think of a few exceptions, RSA private key passwords and password managers for instance. But generally, I completely agree - where there isn't a very good reason to not store a hashed password there's no excuse for storing them in plaintext.

Oh yeah, obviously with that kind of problem non-reversible cyphers are not a solution. Although though it would still be insane to not use some reversible encryption on the password file (and thus, in keeping with the sanity rule regarding the storage of passwords in plaintext. )

[watercooled]

It's not likely I'd put something like an online banking password in an online password manager myself, but I'm a bit over-cautious and it's probably no less secure than having a separate, memorable password for that sort of stuff. But I really like to know the internals of such software, and LastPass seems very over-engineered and they seem to have covered all the angles (obviously we can never be certain any software is completely secure). Your passwords are never stored anywhere in plaintext and they use client-side encryption so you're not relying on them keeping their databases secure. The way they reacted to that recent unknown traffic deal also says to me they are very concerned about the security of their software (if you don't know, they explain it on their blog but they basically did everything they could to ensure everyone was OK, also risking their reputation, just because they had some unexpected network traffic - something I'm sure most companies would completely ignore or not even notice).

[watercooled]

Oh yeah, obviously with that kind of problem non-reversible cyphers are not a solution. Although though it would still be insane to not use some reversible encryption on the password file (and thus, in keeping with the sanity rule regarding the storage of passwords in plaintext. )

Yeah for a huge company like Sony I'm sure they should be able to use something like TPMs where they need reversible encryption.

[Saracen]

.... The way they reacted to that recent unknown traffic deal also says to me they are very concerned about the security of their software (if you don't know, they explain it on their blog but they basically did everything they could to ensure everyone was OK, also risking their reputation, just because they had some unexpected network traffic - something I'm sure most companies would completely ignore or not even notice).

True enough, and I have nothing against them beyond a cynical approach .... or at the very least, a rather cautious one.

Here's an example. A few years ago, I was preparing to do some sub-contract work for a friend's company (he was MD and major shareholder). I read the contract, and pointed out I wasn't signing it as it stood. Some of the conditions were unduly onerous and one-sided. For example, I was expected to provide unlimited indemnity for their computers if they received a virus on an email from me, and that included paying for unlimited professional consultancy to rectify the problem and clean their systems. It was unfair because it imposed no duty on them to take competent precautions that ought to protect them against such an event, because to paid no attention to whether I had taken precautions and was just unlikely enough to have a new attack get past me. And also, it was unfair because while they expected me to indemnify them, they were not prepared to similarly indemnify me against damage caused by a virus from them.

So I refused. My friend was a bit miffed that I thought he would activate that clause. After all, we're friends, and it was a clause inserted by his lawyers into their standard contract. So I pointed out that, right now, he ran the company and would personally be responsible for taking, or vetoing, that action. But what if he retires and sells the company? Even after he's gone, that contract would remain actionable and a new owner wouldn't be a friend. I wasn't prepared to sign a contract with a liability that could have bankrupted me and cost me my home over what was a relatively trivial job with a earning capability of a few grand. It simply wasn't a risk worth taking. We removed the offending clauses. Other people just signed up, without reading (or at least, without understanding) the implications.

My point is that while a given company, or software house, might be reputable and responsible now, there's no guarantee they will stay that way. Once they have personal data, they have it. On the other hand, no matter how they change in the future, they can't abuse what they don't have. Oh, and reputable and responsible or not, it's hard to guarantee absolutely against insider abuse of access. After all, ask Wikileaks and their "victims".