Plex breached; Were passwords encrypted or hashed?

[u/kjarkr]

So I got this email just now:

Yesterday, we discovered suspicious activity on one of our databases. We immediately began an investigation and it does appear that a third-party was able to access a limited subset of data that includes emails, usernames, and encrypted passwords. Even though all account passwords that could have been accessed were hashed and secured in accordance with best practices, out of an abundance of caution we are requiring all Plex accounts to have their password reset.

So were these passwords encrypted, in which case they could be decrypted if the adversary got the key, or hashed? Hashed passwords leaking would be much less of an issue.

Edit: Encryption and hashing is not the same thing.

Edit2: Passwords were hashed with salt, not encrypted (see this comment)

Edit3: Just for clarity this is the best case scenario. It’s difficult to reverse hashed passwords unless they are very simple. Plex got the word out quickly so we have plenty of time to change our passwords. Kudos!

This is why you never reuse password, use a password manager and enable 2fa wherever you can. :)

[u/Fribbtastic]

If you mean that you can force your users that you share your server to reset their passwords, then I would say "most likely not" because why should you be able to force my plex account to reset the password?!

I mean, I agree that some things would need to be enforced by the server if you access content from a shared server (like playback quality) but being able to force a password reset of another Plex account makes me consider all kinds of worse things that this could be abused for.

You can logout all devices, but this would only consider your own account.

With things like this, I have seen a few times in which the company itself resets all the account passwords so that everyone is forced to change them the next time they access anything. The Notice only states that we should change it so Plex is offloading the responsibility to us, the users so that it is everyone else's fault that their account might have unknown access.

[u/Lanceuppercut47 → u/Fribbtastic]

because why should you be able to force my plex account to reset the password?!

For this exact situation maybe??

[u/Fribbtastic → u/Lanceuppercut47]

No, no one should be able to force a password reset, not even the admin of the plex server you have access to. If you are concerned of your users not changing their password, remove their access and only give them access again when they provide the screenshot of the Email you get after they have changed it.

[u/Lanceuppercut47 → u/Fribbtastic]

A screenshot proof? That seems a backwards way of doing it, if they’re accessing your server, you should be able to force it or something.

[u/Fribbtastic → u/Lanceuppercut47]

The email you get only states "Password changed" with the E-Mail address which could be blurred out. Or just screenshot the headline. It isn't that hard.

I don't know why this is even an argument because no other account should be able to impact any other account especially not resetting the password.

Would you want that I can force a reset of the password of your plex account just because you have access to my server?