In the US, at least, credit cards don't usually have PINs; debit cards do, and they go through Visa or MC's networks too, but they pull money from your bank account, rather than a line of credit. Of course, that's fine, if you always have enough money...

How does one file a formal complaint?

Your zip code is a very poor choice for authentication.

Stores ask for your zip code because they're interested in customer demographics, not authentication.

It's in Visa's best interest that merchants not request ID; remember, credit card companies work very hard to make sure the merchants assume most of the risk. From Visa's perspective, they want customers to have an easy time making transactions, and not requiring ID makes it easier. They don't particularly care if someone rips off a merchant.

Hahaha. Thanks, I need a laugh :) I think I might do that from now on...

I tell stores "you don't need my zip code" when they ask. As far as I can tell, they just enter "00000" into their terminal instead.

I use one particular site just once a month, to make a loan payment, and I can never remember the password. I got tired of having to reset my password through the "forgot your password" thingy every single month, so eventually I chose a password something along the lines of "ThisSiteSucks!". Then I IM'd it to a friend of mine, telling him to remind me of the new password if I ask.

Of course, my password for that site is in our IM logs now, which is where I look it up every month, but the worst that could happen would be someone making loan payments for me, which I wouldn't really complain about...

American Express, for one. Here's a fun screenshot I took a while back. The "password strength" meter is also humorous; it just chooses the number of bars based on how many letters and numbers there are; it doesn't bother checking if the password itself is strong. For example, it gives "aaaaa555" the highest rating.

There's some other site I use regularly that also has the same policy, but I can't think of what it is at the moment.

I've never understood this "no spaces" rule that seems to be mentioned everywhere. You're going to hash the string anyway, and spaces are as hashable as anything else, so why prohibit them? I should be able to use a full limerick as my password, spaces and punctuation included...

You don't need one device for each password, if the service provider provides a phone app for you, like Blizzard. I'd be perfectly fine with adding an 'Auth apps' folder on my phone and sticking all the 'keyfob' apps in there, and I would gladly make use of it.

I didn't say it's ok to do ;) Besides, they fixed it. If you reset your password, the issue goes away. I don't really see what more you want.

This is the solution Amazon will give you if you contact them about it. (The reasons this situation arose are, of course, historical. It's the sort of thing that can happen if you want to improve the way you store passwords, but don't want to prevent existing customers from logging in.)

This issue only affects people who have not changed their account password for something like five years.

I'm seeing the same thing in Chrome on Win7...

They don't, unless that customer trumpets their use of the service in that manner to the world...

As I understand it, OtherOS had already been disabled in slim PS3s (though the firmware still contained the code), and that's what Geohot was attempting to reenable. Sony's reaction was to remove OtherOS from existing fat PS3s. I may be remembering it wrong, though.

In other words, Sony decided to remove OtherOS from slim PS3 models (that is, they shipped without the option), despite the fact that the hardware can handle it without issues, a decision which certainly appears arbitrary. It looks to me like they no longer wanted to sell consoles with OtherOS enabled, and they took the first opportunity they could to disable it in the older PS3s as well (perhaps so they wouldn't have to maintain multiple sets of firmware). I would suggest that Geohot's difficult-to-execute hack was simply a convenient scapegoat for a decision Sony had already wanted to make (for whatever reason).

That's all speculation, of course.

All *fail0verflow* did was try to get the functionality back, and Sony named them in the motion as well, so we're sort of stuck defending both them and Geohot since Sony named them together. (I do agree that the relative size of each party has nothing to do with who is right and who is wrong.)

Whether or not Geohot was wrong to publish the key, one thing is certain: the bulk of Sony's claims in the motion are ridiculous, and that reflects poorly on them.

You mean they wouldn't have disabled OtherOS on the fat PS3s if he hadn't said he intended to enable OtherOS on the slim PS3s (which he wanted since slim PS3s are capable of it and the decision to remove the menu option was arbitrary and pointless)? Yeah, geohot is totally the bad guy here. *eyeroll*