> I mean, any competent developer would immediately realize that this password reset system is flawed by design, especially with the fact that the user's information requested is the information the hackers already have!
That's not actually the problem here. It's pretty standard practice to only ask for an email address to initiate a password reset. Google, for example, only asks for email address. Asking for additional information, like DOB, isn't really a security measure. It's more of an annoyance prevention measure, to make it slightly harder for random people to initiate password resets in your name.
The problem with what Sony was doing is that you could circumvent the verification that you had access to the email address you gave. The way it is supposed to work is that you initiate a password reset, and the site sends you a link that you have to follow to get to the form where the actual password reset takes place and you enter a new password.
The security comes not from knowing your email address and DOB, but rather from having to actually have access to the email.
The way Sony's site was working, when you initiated the reset request it was possible to figure out what the link was that sent in the email, and hence finish the reset process without having access to the email. Oops.
That's not actually the problem here. It's pretty standard practice to only ask for an email address to initiate a password reset. Google, for example, only asks for email address. Asking for additional information, like DOB, isn't really a security measure. It's more of an annoyance prevention measure, to make it slightly harder for random people to initiate password resets in your name.
The problem with what Sony was doing is that you could circumvent the verification that you had access to the email address you gave. The way it is supposed to work is that you initiate a password reset, and the site sends you a link that you have to follow to get to the form where the actual password reset takes place and you enter a new password.
The security comes not from knowing your email address and DOB, but rather from having to actually have access to the email.
The way Sony's site was working, when you initiated the reset request it was possible to figure out what the link was that sent in the email, and hence finish the reset process without having access to the email. Oops.