I’ve been driving around in my mighty Toyota Starlet 1997 for about 18 months+ now and have finally gotten tired of only having a radio as my only source of audio.

I can get away with using radio when in the CBD with good alternative stations like Active who don’t have too many ads, but when doing roadtrips often there are large sections with no coverage or only poor quality commerical stations.

So I decided to buy a new stereo and settled on a Sony CDXGT500U stereo – primarily due to it meeting my two requirements in the cheapest formfactor – both an AUX 3.5mm input jack AND a USB socket for taking MP3s (sadly no Ogg or Flac tho).

Being a sucker for DIY I decided to have a go at installing it myself – I didn’t need anything too flash like new speakers or cable runs, just wanted the inputs really. Fortunately the installation of the stereo was pretty easy, but I ran into the good old problem of proprietary connectors/standards used by the different vendors.

1. There’s no single standard for the mounting of devices in the car dash – in the case of this stereo, the mounting brackets supplied aren’t required and instead it bolts directly into the Japanese-style mounts.
2. Sony doesn’t use a standard for their stereos.
3. Neither does Toyota use a standard for their cars.

To make it work (without going to the pain of soldering/custom wire wrapping) I had to buy *two* different adapters – once for Sony->ISO and another for Toyota->ISO which cost a good $15 each from retailers.

We all love lots of daisy chained adapters!

On the plus side, I now have a new stereo installed, dragging my car out of the 80s and into 2011. It’s also the most expensive thing in the car now, although being a Starlet, it’s hardly a theft magnet.

This Starlet be totally pimped yo!

By now most people have heard of the Sony Playstation Network getting hacked and around 75 million accounts worth of information being obtained.

Ignoring the whole fact that someone owned Sony so badly and that they’re not even sure if credit card details got exploited, I want to examine the information that is being stored with Sony.

There are three key bits of information obtained from the breach:

1. Login credentials of PSN users.
2. User identify information, consisting of phone number, email address and age.
3. Possibly credit card information.

The last mention is the most important – obviously any credit card breach is bad (also PCI-DSS compliance, WTF Sony?), but Sony isn’t sure if the card DB has been exposed or not at this stage and is making a general just-in-case recommendation.

Login credentials may be an issue depending how smart you are – if you’re one of those people who uses the same login on every site, this is a clear example of why you shouldn’t, and you can now enjoy changing the login details on every single site you use… (how many more provider compromises does it take till you learn this is bad??)

So assuming you didn’t use credit cards and used unique credentials, this limits the exposure to user identity information – this is causing huge outcry in the media, with some great quotes from different countries police stating how this is going to lead to widespread identity theft.

Which raises the following points:

• Why are bank and other key systems requiring identification so poorly setup that all that you need is name, age and address to obtain?
• All these details are already available online for anyone with a bit of sense, it’s hard to keep all this stuff private in the days of social networking.
• What are the penalties for companies not conducting the proper validation and security checks on people signing up to things like loans?

Sure it’s bad that the information got compromised, but let’s consider that most of the identity information is already public.

Birthdates are easy to get with the widespread popularity of social networking, same for addresses which can be found from domain records, social networking, websites and more, along with contact details.

If this information is enough to then take out a loan or a bank account, then I think those providers have some pretty heavy explaining to do – far too many have sloppy validation checks which don’t reflect the realities of the 21st century.

Just last week, I had to “validate” my home address to obtain a driver’s license. All that’s required to prove my identity is some photo ID and a service bill with an address on it.

Faking a bill is hardly complex, most laser printers will make something that’s good enough to pass any regular inspection, it’s a step that is only going to catch out the most clueless of exploiters.

Wake up companies, seriously….

I know that some providers to take precautions, even when this may lead to some customer inconvenience/annoyance.

• National Bank (NZ) would refuse to tell me anything about my account, unless I rang them from a number that matched their records for my account.
• Visiting banks in person often requires photo ID, which can be faked, but takes a bit more effort.
• My approach in business has always been to ensure a customer was emailing/calling from a known account, otherwise we would call back to confirm requests on their recorded number.

Although some of these approaches are becoming less trust worthy…

• Email accounts are commonly broken into – because of this, if we get unusual requests or password reset requests, we often call back the client to confirm.
• With the adoption of VoIP technologies, it’s becoming easier to assume someone’s phone number and send/recieve phone calls on their behalf.

Sadly there isn’t really a truly valid fix, there’s no identification that can be issued that can truly validate people’s identity and secret words or passwords are usually weakened by the fact that humans suck and choose terrible words or reuse them often.

I think the best fix is simply making sure service providers validate information such as ensuring customers have their last invoice & account number before making changes and that financial institutions or credit agencies follow strict security procedures such as photo identification.