Out of Pod Experience

At the very least change any passwords related to the one you used on Steam. Tho if the bank offers it for free I don't see why there is a reason to not consider changing your card.

Doing so every once in a while is a good security measure anyway.

Again Valve is NOT Sony.

Yet, Can I has free Portal 2 plz valve?

I heard something interesting on the steam forums.

One of the ways lately to break encryption is to use a GPU or a series of GPUs to break encryption on passwords. To prevent this companies are using random generators on top of encrypting to add a great deal of random characters into the data sent to be compared on the server.

So the encryption on the sensitive stuff is likely many characters long. And not some 5-8 character key. Tho it does bring up a good point which is that you need to make sure your home wireless key is something very long and not something that can be easily broken by a GPU.

Again be safe and change your passwords. But don't be silly in blaming valve. They aren't sony.

that might work for the pw's themselves but not for the CC's. if what has been said it's true, CC's are encripted in AES256 and salted, which means that by the time they manage to get a CC number, with the current tech level, the universe has already ended

that said however, AES256 is only as safe as how safe you keep the decryption key.

They noticed almost a week before they announced it, they had the forum offline for about 4 or 5 days before the announcement for "maintenance".

Valve won't know if anyone who has had their CCs compromised, it would be nearly impossible to prove most cases of CC fraud where connected to that breach since people use the same card to purchase other places on the net. Couple friends of mine that do use steam have already had their CCs used by other people.

Remember, encryption is only as strong as the weakest employee's knees.

Relevant XKCD's:
Password Strength
Security

Fortunately, I don't have anything to do with steam. But I was a PSN member.

At some point those numbers are held in an unencrypted state before they are stored encrypted. They will be decrypted from the database before they are transmitted to whatever financial institution that handles their payment processing. Most banks either use PGP or SSH to handle transmission of data from their clients. I have worked with American National, Lasalle, Bank of America and Harris, and know how they take payment transmissions. 3 of which use PGP and one of which uses SSH. We don't send encrypted account numbers, we encrypt the entire transmission via one of those two methods and they handle decrypting the information on their end. Harris is the only one that doesn't have encryption on the physical files themselves, but relies on SSH to encrypt the transmission, once it's on their end I don't know what happens to it, but the file itself isn't encrypted, only the means of transmission.

At some point those credit card numbers are in an unencrypted state, and there are machines at Steam that handle encrypting and decrypting that information. There is the possibility of compromising that system and capturing that data.

When you type in that credit card number, you're not encrypting it yourself, their application encrypts that number and stores it in their database.

At some point these numbers are indeed in an unencrypted state, there is something that has to encrypt them, if you compromise that, you have a way to reverse the encryption. It's not that difficult.

This would be entirely different if they hadn't been breached and some data store somewhere outside of their network was breached instead, but no, the actual location where everything happens from taking orders to storing orders and transmitting them was breached. That is the problem with this situation. The other problem is I seriously doubt they will be able to find the exact point at which they were breached, this could have been an issue for months without them knowing.

well I guess Barakkus has a point. he's right, but while cautiousness is advised in this situation, it's also true that atm things have been quiet and we still don't know enough to go into a panic.

fk em

let em steal from my account. i don't want it to happen, but what do you expect? This is a digital world, this is going to happen from time to time.

They have my card info, but ultimately that sht is on the FDIC, that's why we have it

i have no horse in this fight.
worst case scenario? minor inconvenience.

Nah, but if I were a hacker, and I found I could access that information, I would definitely be trying to find a way to decrypt that data before leaving.

The gaming industry is a perfect target actually for people trying to steal data. Usually lax security and millions of purchases a year. It's a bit easier though for them because they can target gamers individually with this RMT crap and get them to give up their numbers freely rather than hack companies. Most of the time they're after stealing accounts to resell the assets later though. A lot of the RMT companies will also use CC numbers gamers give up to purchase currency/items/whatever to open new accounts for farming as well.

After Sony got hacked, I had my CC number changed even though I haven't paid for anything from them in a few years aside from ordering an expansion for EQ2.

If you do online purchases it's always a good idea to change your CC numbers that you use online every couple of years anyways. Unfortunately most places aren't as great with security regardless of the industry.