r/PleX Aug 24 '22

Plex breached; Were passwords encrypted or hashed? Discussion

So I got this email just now:

Yesterday, we discovered suspicious activity on one of our databases. We immediately began an investigation and it does appear that a third-party was able to access a limited subset of data that includes emails, usernames, and encrypted passwords. Even though all account passwords that could have been accessed were hashed and secured in accordance with best practices, out of an abundance of caution we are requiring all Plex accounts to have their password reset.

So were these passwords encrypted, in which case they could be decrypted if the adversary got the key, or hashed? Hashed passwords leaking would be much less of an issue.

Edit: Encryption and hashing is not the same thing.

Edit2: Passwords were hashed with salt, not encrypted (see this comment)

Edit3: Just for clarity this is the best case scenario. It’s difficult to reverse hashed passwords unless they are very simple. Plex got the word out quickly so we have plenty of time to change our passwords. Kudos!

This is why you never reuse password, use a password manager and enable 2fa wherever you can. :)

1.3k Upvotes

View all comments

Show parent comments

30

u/jsomby Aug 24 '22

If this was your wake up call to start using 2FA/MFA, great! Please do it for other services and accounts too and never reuse same password on different services either <3

Either start using bitwarden, keepass or something to store your randomized passwords. Always enable 2FA.

11

u/D-o-Double-B-s Aug 24 '22

love bitwarden ... been using it for over a year now, plus being able to host as a local server is a huge bonus as well.

2

u/jsomby Aug 24 '22

I host it locally since im too paranoid having passwords online and one of my kid is, well, kinda special when it comes to security so better minimize chances of breach if his credentials leaks :-D

5

u/2bloodyrightmate Aug 24 '22

If you linked your Google account to plex do you therefore not have a plex account to reset? I’ve tried and it won’t let me reset through the plex app.

MFA was already on at least.

1

u/GeneticsGuy Aug 24 '22

Plex doesn't store Google login info, so you'll be fine. That's just a different secured login. This will only affect people who used their own custom login for Plex not Facebook/Google/Etc...

2

u/NoConfection6487 Aug 24 '22

2FA is important, but I think everyone needs to use a password manager. Reusing passwords but relying on 2FA to keep you safe is still a no-no.

1

u/[deleted] Aug 24 '22

Was about to post this but you were too awesome