<story><title>Geohot Chimes In</title><url>http://geohotgotsued.blogspot.com/2011/04/recent-news.html</url></story><parent_chain><item><author>shareme</author><text>its not speculation, they passed CC numbers in the clear over SSL instead of hashing them..</text></item><item><author>praptak</author><text>This is interesting: &lt;i&gt;&quot;Traditionally the trust boundary for a web service exists between the server and the client. But Sony believes they own the client too, so if they just put a trust boundary between the consumer and the client(can&apos;t trust those pesky consumers), everything is good. Since everyone knows the PS3 is unhackable, why waste money adding pointless security between the client and the server?&quot;&lt;/i&gt;&lt;p&gt;I wonder if he&apos;s &lt;i&gt;purely&lt;/i&gt; speculating or maybe knows something more. It&apos;s also good to see he can at least still talk about Sony security in general (or can he?)</text></item></parent_chain><comment><author>pilif</author><text>And how would you use that hashed CC number on the server? Unhashing (impossible)? Send the hash to the CC company (good luck)?&lt;p&gt;Do you mean they should have pre-encrypted the CC number before encrypting it again in the standard SSL transaction?&lt;p&gt;Would that have helped? Because if the PS3 knows how to encrypt and you own the server, decrypting is as trivial as just looking at the plain text&lt;p&gt;For people who don&apos;t own the server and are listening in SSL is enough and for people with access to the server neither SSL nor any other encryption is enough.&lt;p&gt;They have done a lot of things wrongly, but this IMHO is not one of them.</text></comment>
<story><title>Geohot Chimes In</title><url>http://geohotgotsued.blogspot.com/2011/04/recent-news.html</url></story><parent_chain><item><author>shareme</author><text>its not speculation, they passed CC numbers in the clear over SSL instead of hashing them..</text></item><item><author>praptak</author><text>This is interesting: &lt;i&gt;&quot;Traditionally the trust boundary for a web service exists between the server and the client. But Sony believes they own the client too, so if they just put a trust boundary between the consumer and the client(can&apos;t trust those pesky consumers), everything is good. Since everyone knows the PS3 is unhackable, why waste money adding pointless security between the client and the server?&quot;&lt;/i&gt;&lt;p&gt;I wonder if he&apos;s &lt;i&gt;purely&lt;/i&gt; speculating or maybe knows something more. It&apos;s also good to see he can at least still talk about Sony security in general (or can he?)</text></item></parent_chain><comment><author>nsfmc</author><text>&quot;in the clear over ssl instead of hashing them&quot;? am i missing something here? 
is ssl insecure? is there some way to charge a credit card that doesn&apos;t actually involve sending the &lt;i&gt;number&lt;/i&gt; to anybody?</text></comment>