Sony adds Two-Factor Authentication to PlayStation Network

Luckkill4u · Aug 26, 2016

VinLark said:
I find steam authenticator to be the best working one. Google authenticator sometimes makes duplicate codes and it's annoying.

I've never had that problem. Authentication apps should be normal in today society because of all the hackers. I've had my Spotify account hijacked quite a few times since April when they had the account info leak. God that company is so dumb, if they just had 2-step verification to begin with they would have kept me as a customer. I ended up figuring out why my account was so easy to hijack, the old password still worked from when I first set up the account but I already switched to facebook login (with 2-Step). It was so stupid spotify wouldn't remove or let me change my password because it was hooked to facebook. Massive security flaw....

Deleted User · Aug 26, 2016

HomebrewJay said:
Is this possible with the PlayStation 3?

Should be. It works (I think) with the whole of PSN.

vb_encryption_vb · Aug 26, 2016

Xenon Hacks said:
All I have to do is pretend to be you and have your carrier mail me a new sim with your number and request a text for the 2FA, now your probably saying the possibility of that happening is slim to none but the possibility would be non existent without 2FA.

The only way to make 2FA truly work is to buy a burner phone, keep it hidden at a place other than your home and never share the number.

My carrier don't use sim cards....

Arras · Aug 26, 2016

Xenon Hacks said:
All I have to do is pretend to be you and have your carrier mail me a new sim with your number and request a text for the 2FA, now your probably saying the possibility of that happening is slim to none but the possibility would be non existent without 2FA.

The only way to make 2FA truly work is to buy a burner phone, keep it hidden at a place other than your home and never share the number.

So you'd somehow have to convince the victim's carrier they moved without telling anyone (since having the sim sent to their real address would be useless) and they managed to lose their sim, without knowing any real info about them. Then, you'd have to request a password reset, which requires knowing the date of birth and/or the security question IIRC. Then, you'd need to obtain their login for their email in order for the password reset to be actually useful for you, and hope they didn't notice somewhere along this ridiculous process (like, say, their carrier calling them to ask wtf is happening).

KazoWAR · Aug 26, 2016

I just woke up to my phone going off the hook getting like 15 texts in the spam of 5 seconds all psn 2 step verification codes, now I am no able to sign in to my account. I am not sent any new codes to enter when I'm prompted.

Zeriel · Aug 26, 2016

I don't feel comfortable with every major company thinking they have a right to my phone number and location.
but I guess I'm the only one who thinks so lol

Chary · Aug 26, 2016

Zeriel said:
I don't feel comfortable with every major company thinking they have a right to my phone number and location.
but I guess I'm the only one who thinks so lol

I really don't like having my phone number in the databases of other companies, but for users who refuse to remove their credit card data, or those who use monthly subs (PS Vue), 2FA is better than having my credit card stolen and my PSN account terminated.

Zeriel · Aug 26, 2016

Chary said:
I really don't like having my phone number in the databases of other companies, but for users who refuse to remove their credit card data, or those who use monthly subs (PS Vue), 2FA is better than having my credit card stolen and my PSN account terminated.

Why do they need to save your credit info tough? can't they just ask you each month? it's their own fault because they
make money with recurring bills. I recently had Amazon steal money from me because they signed me up to a recurring
service without me realizing it.

Deleted User · Aug 26, 2016

Zeriel said:
. I recently had Amazon steal money from me because they signed me up to a recurring
service without me realizing it.

I really can't see that happening. Did you accidentally" press the prime button and confirmed billing address and also credit card info" and there it was?

Zeriel · Aug 26, 2016

VinLark said:
I really can't see that happening. Did you accidentally" press the prime button and confirmed billing address and also credit card info" and there it was?

I have signed for Prime before and canceled so I know how it's done, but for some reason Amazon signed me for it to a credit card I didn't even use,
maybe it was a small fine print on check out? All I know is that I got signed by default and I didn't notice so they ruined my credit and I had to close my
card and pay over 100$ in fees.

Foxi4 · Aug 27, 2016

I'm trying to escape additional authentication, not add more of it. There's nothing more infuriating than Google telling me that "I've never used this device" or "I've never logged on from this place" before and thus my *correct login credentials* are useless, or how they constantly badger me for my phone number, or how my debit card can get randomly flagged because I went on a holiday and didn't share my plans with my bank, since apparently they're my family now. *Nobody* is breaking my passwords, they're so complicated that even I forget them sometimes, and if they get leaked because your database security sucks, additional authentication won't help - I still need new passwords. My name, my address, my GPS position, my IP, my e-mail, my mobile number, my debit card, what else do you want to know about me, the size of my shlong? You *having* that data makes me *less secure* in the event of a breach, not more. The more you know about *me* the less safe *I* am. Ideally companies shouldn't store *any* of my private information. At this point whenever I'm asked for information that'll "help my account be more secure", I either ignore it or fill the blanks with garbage. Punching in a bunch of false nonsense makes it more secure, in fact - in the event of a breach my real identity still isn't exposed.

Chary · Aug 27, 2016

Zeriel said:
Why do they need to save your credit info tough? can't they just ask you each month? it's their own fault because they
make money with recurring bills. I recently had Amazon steal money from me because they signed me up to a recurring
service without me realizing it.

I'd rather they not force me to keep info in there for monthly charges, but there's not much I can do about it. And how odd. Did you contact customer support? Whenever anything goes wrong on Amazon's side of things, they've always comped me for the error, and then some. When they sent me a scratched N3DS XL, I asked for a refund. Instead they sent out a new console. When they charged me a second $175 for the new system, I got on customer support where Amazon refunded both charges and let me keep both 3DSes. I'm sure they would have refunded you and let you keep a free month of whatever service you had.

Zeriel · Aug 27, 2016

Foxi4 said:
I'm trying to escape additional authentication, not add more of it. There's nothing more infuriating than Google telling me that "I've never used this device" or "I've never logged on from this place" before and thus my *correct login credentials* are useless, or how they constantly badger me for my phone number, or how my debit card can get randomly flagged because I went on a holiday and didn't share my plans with my bank, since apparently they're my family now. *Nobody* is breaking my passwords, they're so complicated that even I forget them sometimes, and if they get leaked because your database security sucks, additional authentication won't help - I still need new passwords. My name, my address, my GPS position, my IP, my e-mail, my mobile number, my debit card, what else do you want to know about me, the size of my shlong? You *having* that data makes me *less secure* in the event of a breach, not more. The more you know about *me* the less safe *I* am. Ideally companies shouldn't store *any* of my private information. At this point whenever I'm asked for information that'll "help my account be more secure", I either ignore it or fill the blanks with garbage. Punching in a bunch of false nonsense makes it more secure, in fact - in the event of a breach my real identity still isn't exposed.

OMG, I actually had to leave emails that I had for over a decade with Hotmail/Microsoft because they would FUCKING LOCK EVERYTHING as soon as I changed locations and would have the most asinine verification system,
where you had to give them ALL of your info, phone number, address etc. etc. and THEN sent you an unlock code to another Hotmail email that is also LOCKED :rofl2:

Basically a give us all your info and alternate emails or FUCK YOU because security! I made a new account with another service and avoid Microsoft and Google now.

atomsk · Aug 27, 2016

Sonic Angel Knight said:
Well this is something that should have happend back in 2009 already! O_O How it take this long, what are they doing over there!

2 Factor auth didn't become prevalent until 2010. And with any service it is hard to set up 2 factor auth with such a large amount of accounts. Plus, if anything you should have unique strong passwords for each site that you use.

FAST6191 · Aug 27, 2016

On two factor being abused via sim replacements it has happened, however it is a long and involved thing typically done with something serious to gain (youtube accounts worth taking on, spear phishing, bank accounts and high value targets) and I am not seeing scope for it to reduce in complexity in the years to come -- you would be insane to use MD5 for anything important today as it is fairly readily brute forced, but 10 years ago...
https://www.theguardian.com/money/2016/apr/16/sim-swap-fraud-mobile-banking-fraudsters
http://www.theregister.co.uk/2013/01/21/indian_sms_bank_fraud_arrests/
http://www.yugatech.com/the-internet/sim-card-scam-exposes-weakness-of-2-factor-authentication/
https://www.ftc.gov/news-events/blo...hone-account-could-be-hijacked-identity-thief
http://www.actionfraud.police.uk/alert-how-you-can-be-scammed-by-a-method-called-sim-splitting-may14

A reasonable solution for some is to have a dedicated sim/device for two factor authentication, one used solely for it. Hopefully dual sim becomes a thing outside China.

That said I have had some opposite problems at times with my not having a mobile phone.

Zeriel said:
I made a new account with another service and avoid Microsoft and Google now.

Trouble is now everybody is largely taken care of between gmail, yahoo and hotmail (or live or msn or outlook or whatever it will be 10 minutes from now) and a few other big providers they have kind of gone isolated/walled off. The amount of effort you have to go to ensure your nice email server does not get flagged as spam, or even get deleted before then, is quite ridiculous. If you reckon your site/forum/whatever can deal without gmail, hotmail, yahoo and co then more power to you but it is hard.

Zeriel · Aug 27, 2016

FAST6191 said:
On two factor being abused via sim replacements it has happened, however it is a long and involved thing typically done with something serious to gain (youtube accounts worth taking on, spear phishing, bank accounts and high value targets) and I am not seeing scope for it to reduce in complexity in the years to come -- you would be insane to use MD5 for anything important today as it is fairly readily brute forced, but 10 years ago...
https://www.theguardian.com/money/2016/apr/16/sim-swap-fraud-mobile-banking-fraudsters
http://www.theregister.co.uk/2013/01/21/indian_sms_bank_fraud_arrests/
http://www.yugatech.com/the-internet/sim-card-scam-exposes-weakness-of-2-factor-authentication/
https://www.ftc.gov/news-events/blo...hone-account-could-be-hijacked-identity-thief
http://www.actionfraud.police.uk/alert-how-you-can-be-scammed-by-a-method-called-sim-splitting-may14

A reasonable solution for some is to have a dedicated sim/device for two factor authentication, one used solely for it. Hopefully dual sim becomes a thing outside China.

That said I have had some opposite problems at times with my not having a mobile phone.

Trouble is now everybody is largely taken care of between gmail, yahoo and hotmail (or live or msn or outlook or whatever it will be 10 minutes from now) and a few other big providers they have kind of gone isolated/walled off. The amount of effort you have to go to ensure your nice email server does not get flagged as spam, or even get deleted before then, is quite ridiculous. If you reckon your site/forum/whatever can deal without gmail, hotmail, yahoo and co then more power to you but it is hard.

I'm using protonmail, it's a secure and encrypted service that's really easy to use and has none of the corporate BS,
they could block it as spam if they want but email is only used to receive now days. Nobody actually writes an email
unless they need to complain to a private company for something and they can't block their users

FAST6191 · Aug 27, 2016

Nobody writes/sends email? I have heard of the kids no longer using it, and signing someone up for twitter the other day I saw they instead gave the option for a phone number to be used*, but try telling that to my clients -- email goes wrong and watch my (house) phone start ringing 5 minutes later (maybe 10 if it is the sort of thing that wants a retry or after lunch if they have a second account to reply on). These days with NAS/SAN, external storage, more cloudy options, web services/online accounts and the like and if a PC blows up unless it is the last one in the office or has a nicer screen than the laptop then I often only find out something has broken when I am doing the rounds 5 days later, the only common factor for things being quicker to inform me there being when smoke or sparks are involved.

*loading up facebook it seems that is also an option, curiously tumblr does not have that. Might have to have a little investigation.

Zeriel · Aug 28, 2016

FAST6191 said:
Nobody writes/sends email? I have heard of the kids no longer using it, and signing someone up for twitter the other day I saw they instead gave the option for a phone number to be used*, but try telling that to my clients -- email goes wrong and watch my (house) phone start ringing 5 minutes later (maybe 10 if it is the sort of thing that wants a retry or after lunch if they have a second account to reply on). These days with NAS/SAN, external storage, more cloudy options, web services/online accounts and the like and if a PC blows up unless it is the last one in the office or has a nicer screen than the laptop then I often only find out something has broken when I am doing the rounds 5 days later, the only common factor for things being quicker to inform me there being when smoke or sparks are involved.

*loading up facebook it seems that is also an option, curiously tumblr does not have that. Might have to have a little investigation.

Don't private companies have their own email addresses? I mean general home users only use emails for account confirmation.
I checked my sent emails a while back and the last one was like 3 years old xD

FAST6191 · Aug 28, 2016

Bigger ones will, though it often comes as part of a hosting package if we are still on the setting up your own server topic. Small businesses will often use such things, to say nothing of the likes of https://www.google.co.uk/intl/en_us/mail/help/work.html

Looking at the phones I fix (or a least the cacophony that results if it has been waiting a couple of days for a screen to turn up and I power on the thing to test) then I guess some of the younger people I see might not use it do much for short form text, though over about 25 or so or anybody that interacts with people that age or older and it is still dominant.

I might have to look into this further -- I have seen some comics and videos suggest it ("email, who uses that?" sort of thing) but use a sarcastic tone of voice.

Now if we are talking about mailing lists then... well I have never joined one, never seen one joined by anybody that I can think of and even when I have scanned through things to see what they are I have not felt slightly compelled to join.

4 guys in a car ( ͡° ͜ʖ ͡°)

Deleted User

Guest

That hardmod guy....

Well-Known Member

Well-Known Member

Squid Kid

Never sleeps

Squid Kid

Deleted User

Guest

Squid Kid

Endless Trash

Never sleeps

Squid Kid

Well-Known Member

Techromancer

Squid Kid

Techromancer

Squid Kid

Techromancer

Similar threads

Popular threads in this forum