Report: PSN hacked, custom firmware could pose security risk to users

Re:Report: PSN hacked, custom firmware could pose security r... by marshray on Thursday February 17, 2011 @01:04PM (#2231992)

Or you're any of the hundreds of organizations that are known to have root or intermediate CA certificates. E.g., the former government of Tunisia.

Or any of the unknown number of intermediates who are not known.

[ Parent | on HN ]

Re:Report: PSN hacked, custom firmware could pose security r... by omh on Thursday February 17, 2011 @01:38PM (#2232170)

This is only the case if those root certificates are installed on the Playstation. I'm not sure if we know which ones are.

For the purposes of PSN they'd only need Sony root certificates, but I expect that they have others for general web browsing.

[ Parent | on HN ]

Re:Report: PSN hacked, custom firmware could pose security r... by marshray on Thursday February 17, 2011 @01:57PM (#2232266)

My guess is they have a large-ish set of root certs like every other SSL/TLS library, but one or more may be marked 'magic' in some way. Plus they'll probably want the option to utilize third-party CDNs at some point which often implies a common CA.

Given the rest of what's known about their design I doubt they've deliberated it at a particularly high level in their organization. Or at least, high enough where management doesn't see the benefit of maintaining their own trust root and is glad for the opportunity to outsource something critical.

[ Parent | on HN ]