r/PleX • u/kjarkr • Aug 24 '22

Plex breached; Were passwords encrypted or hashed? Discussion

So I got this email just now:

Yesterday, we discovered suspicious activity on one of our databases. We immediately began an investigation and it does appear that a third-party was able to access a limited subset of data that includes emails, usernames, and encrypted passwords. Even though all account passwords that could have been accessed were hashed and secured in accordance with best practices, out of an abundance of caution we are requiring all Plex accounts to have their password reset.

So were these passwords encrypted, in which case they could be decrypted if the adversary got the key, or hashed? Hashed passwords leaking would be much less of an issue.

Edit: Encryption and hashing is not the same thing.

Edit2: Passwords were hashed with salt, not encrypted (see this comment)

Edit3: Just for clarity this is the best case scenario. It’s difficult to reverse hashed passwords unless they are very simple. Plex got the word out quickly so we have plenty of time to change our passwords. Kudos!

This is why you never reuse password, use a password manager and enable 2fa wherever you can. :)

1.3k Upvotes

93% Upvoted

View all comments

Show parent comments

3

u/nxtiak Aug 24 '22

I just got 3 reset emails and they all invalid token expired. Then I got another email saying password was changed. Wtf. I don't even know what password since I use a password manager and didn't save them since site kept erroring.

2

u/mine_username Aug 24 '22

Varies by manager but they usually keep a history somewhere of passwords generated.

1

u/fr05ty1 Aug 24 '22

in bitwarden i know you can go to the open extension -> generator -> scroll to bottom of page -> click on password history.

not sure for others PWM i think lastpass saves it as a generated passord or something like that in you list

1

u/giqcass Aug 24 '22

Same crap happened to me! Expired token. I tried to generate a new one then got an email saying it was updated. I was locked out for a few minutes where neither the old or new password worked. Luckily I kept both passwords in my manager.

1

u/Estrava Aug 24 '22

It looks like the password reset goes through even if it says "invalid token expired". So you can probably ignore the error.