Sony: “Passwords Were Not Stored In Cleartext Form”

Dan Lee 71 Comments

In what we hope is the last PSN related story to not contain “hurrah, it’s working again”, Sony has clarified how your credit card information had been stored on PSN:

“We want to state this again given the increase in speculation about credit card information being used fraudulently. One report indicated that a group tried to sell millions of credit card numbers back to Sony. To my knowledge there is no truth to this report of a list, or that Sony was offered an opportunity to purchase the list.

One other point to clarify is from this weekend’s press conference. While the passwords that were stored were not “encrypted,” they were transformed using a cryptographic hash function. There is a difference between these two types of security measures which is why we said the passwords had not been encrypted. But I want to be very clear that the passwords were not stored in our database in cleartext form.”

Many rumours are circulating that the PSN will be back up today. We will let you know as soon as any news breaks.

Source: EU PS Blog, Thanks marshaal5

Tags:

Related stories from TSA

Marvel Tokon on PC blocked from countries without PSN – even the pope can’t play
Sony to retire the PSN branding
Sony promise 5 days extra PS Plus as compensation for PSN outage
PSN is back online, Sony apologises

71 Comments

  1. I am still wondering if I can connect once this is back up, from what I gather the login process will require a password update and will be linked to the email address registered with the PSN account.

    I still do not have an email from Sony on this account to tell me of the problems, everyone else I know does, if I don’t get an email to allow me to login I will go mental.

    • i haven’t received that email either, but email was a c&paste of the article from eu blog. this is in no way connected to the login process.

      • I’m not so concerned about the contents of the email, more the fact that my email address does not seem to be on record at Sony, and if they use this to authenticate logins and passwords once back up and running, I could have an issue on my hands.

      • I also haven’t received an email. So there’s obviously a few of us out there.

      • i confirm 100%, that the email acc i’ve been checking, is the one reg with sony, as i’ve always used the same one.

      • No email for me either

      • I like to pretend that we’re really lucky and that there’s no need to email us as we’re safe. In reality though, I wonder why we haven’t received one yet.

  2. I just wanted to log in to my zavvi account and found out that my password didn’t work anymore. I used the same password and e-mail for my PSN.

    Luckily I could still change it through my e-mail and no orders were made…

  3. So does this mean we can revert back to using our old password again, or is there a risk that a hashed password can be unhashed?

    Also, is this just our PSN password, or is the answer to our security question safe as well?

    • you will be forced to change your pword(even if you weren’t, you should.)
      as for security ans, i would recommend changing that too.

    • Just for info, no, hashed data cannot be un-hashed.
      Hashing involves performing a set sequence of calculations (your hash algorithm) on the data going in. This produces a different value which is the hashed password.
      When you then connect to PSN it performs the hashing again on the password you have entered and checks to see if THE RESULT matches the hash value they have on file. Thus they never actually ‘know’ your password.
      .
      Imagine a sequence of numbers 12345
      Say my hashing algorithm multiplies all numbers together. The hash would thus be 120.
      There is no way that given just ‘120’ you could work out the original password. Obviously in the real world the algorithm is far more complex to ensure that two different password can’t result in the same hash.

  4. I know it’s a bit off topic but PSN is back up and running in Japan.

  5. I heard my PS3 turn itself on this morning for automatic update and though yes! PSN’s working but I was wrong, as it promptly turned itself straight back off :(

  6. Hope it does go live today. Think I will wait till later on tonight if it does though. As others have said everyone will be trying to access it.

  7. Well after patiently holding out these past few weeks ive just got off phone to sony,they said theres no official word they mentioned the press confrence and that hopefully i should be able to play something by the end of the week… an here i was hopeing it would be today but who knows eh.

    • turns off alarm reminder for 6pm :(

  8. Still no sign of it coming back yet.

  9. http://translate.google.com/translate?ie=UTF-8&u=http://ps3life.nl/nieuws/8464-gaat-het-psn-al-sowieso-niet-online-komen-voor-6-mei/&sl=nl&tl=en

    Japanese government will not allow Sony to resume PSN services until Sony provides details on how it will prevent further problems like this. They’ve given Sony till May 6th.

    Source: mainichi.jp

    • great timing by their government, they’ve had a while to issue this demand, but no wait until the week/day customers were expecting it to go live.

    • Well that’s a bit of a bummer :(

    • on the bright side, with the f.b.i. involved & now the japanese government, we should get a highly secure network out of this.

      i’m speculating the f.b.i. are assisting both sony divisions
      f.b.i. ref 4th paragraph “Sony Online Entertainment Issues Security Press Release”(released 3/5)
      http://blog.eu.playstation.com/

  10. Cool beans.

Comments are now closed for this post.