Sony Bastards

From: Ken (SHIELDSIT)26 Apr 2011 23:26
To: Peter (BOUGHTONP) 26 of 157

I know it was sarcastic. I was being dumb.

 

They should know better and I hope they pay for it!

From: Matt26 Apr 2011 23:26
To: koswix 27 of 157
Yes, but it doesn't do syncing itself. Syncing by Dropbox is a pretty good solution which I hadn't thought about, previously mentioned security concerns considered.

You can get Keypass (KeyPassDroid) and Dropbox clients for Android. I haven't tried creating new passwords in KeyPassDroid, I just use it to copy passwords from, and the Dropbox client for Android doesn't do automatic sync as far as I can tell (probably so it doesn't munch your bandwidth), rather you download and upload files manually to it.
From: koswix26 Apr 2011 23:27
To: Ken (SHIELDSIT) 28 of 157
in that case, I don't trust them :C
From: Ken (SHIELDSIT)26 Apr 2011 23:28
To: koswix 29 of 157

Can't be any worse than Sony! :-&

 

At least LastPass encrypts my stuff!

From: Matt26 Apr 2011 23:29
To: koswix 30 of 157
I don't know what is involved, I just know it costs quite a bit if you fail compliance. According to the Evolve Online site, it's €5 per compromised account and €100,000 fine per incident.

So that's at least €100,015 fine of the people in this thread I know have PSN accounts.
From: patch26 Apr 2011 23:35
To: koswix 31 of 157

Self-certification (wrong term, but I can't think of the right one at the moment) can only be done by smaller companies who handle a smaller number of transactions every year. Large companies have to be audited by a certified QSA.

 

The only problem is that the actual requirements in PCI DSS are a bit vague in places, and what you need to do to achieve compliance depends on the interpretation of the QSA. Sony's lawyers will just end up saying that they were compliant so long as you squint at it from the right angle.

From: Drew (X3N0PH0N)27 Apr 2011 00:27
To: ALL32 of 157
Could someone explain how (in actual use) this keepass thing works? I don't really care much about security, but if it's a thing that can remember and fill in my password/s for me, then I'm interested.
From: Ken (SHIELDSIT)27 Apr 2011 01:19
To: Drew (X3N0PH0N) 33 of 157
That's what LastPass does. Haven't used Keypass for a long time and I can't remember how it works.
From: Drew (X3N0PH0N)27 Apr 2011 02:09
To: Ken (SHIELDSIT) 34 of 157
Ok, which is BETTER?
From: koswix27 Apr 2011 02:11
To: Drew (X3N0PH0N) 35 of 157
Lastpass want you to pay to use their Android app :(
From: Ken (SHIELDSIT)27 Apr 2011 02:11
To: Drew (X3N0PH0N) 36 of 157
I love lastpass because it is available on all my browsers, work, home, where ever. Of course it's BETTER because I'm using it! I wouldn't use the inferior product man!
From: Drew (X3N0PH0N)27 Apr 2011 02:11
To: koswix 37 of 157
Well that's fine since I don't have an Android.
From: Ken (SHIELDSIT)27 Apr 2011 02:12
To: koswix 38 of 157
Yeah, I didn't like that. But it's not that expensive is it?
From: koswix27 Apr 2011 03:09
To: Ken (SHIELDSIT) 39 of 157
More expensive than a packet of post-it notes :C
From: Ken (SHIELDSIT)27 Apr 2011 03:14
To: koswix 40 of 157
That's an odd thing to compare it too!
From: JonCooper27 Apr 2011 07:26
To: Ken (SHIELDSIT) 41 of 157
I think the implication is that a packet of post-it notes is his alternative password remembering system
From: 99% of gargoyles look like (MR_BASTARD)27 Apr 2011 08:08
To: Peter (BOUGHTONP) 42 of 157
Surely sensitive data like passwords and password hints should be stored in MD5 hash format? So stealing that data becomes useless (unless one has a shitlol amount of pooter power to break the hash).
From: 99% of gargoyles look like (MR_BASTARD)27 Apr 2011 08:12
To: koswix 43 of 157
You think you have it bad Mr Wix? Some poor bastards have had their money eaten! :O
EDITED: 27 Apr 2011 08:12 by MR_BASTARD
From: Mouse27 Apr 2011 08:55
To: ALL44 of 157
77 million PSN users worldwide. Dunno, a 1/4 of them in Europe? Someone do the maths. That's a substantial fine.
From: Peter (BOUGHTONP)27 Apr 2011 09:09
To: 99% of gargoyles look like (MR_BASTARD) 45 of 157
I can't tell if you're trolling or not. :/

Just using MD5 is only a step above plain text. It's not recommended. Use a more powerful algorithm, along with secret and per-user salts.