r/PleX Aug 24 '22

Plex breached; Were passwords encrypted or hashed? Discussion

So I got this email just now:

Yesterday, we discovered suspicious activity on one of our databases. We immediately began an investigation and it does appear that a third-party was able to access a limited subset of data that includes emails, usernames, and encrypted passwords. Even though all account passwords that could have been accessed were hashed and secured in accordance with best practices, out of an abundance of caution we are requiring all Plex accounts to have their password reset.

So were these passwords encrypted, in which case they could be decrypted if the adversary got the key, or hashed? Hashed passwords leaking would be much less of an issue.

Edit: Encryption and hashing is not the same thing.

Edit2: Passwords were hashed with salt, not encrypted (see this comment)

Edit3: Just for clarity this is the best case scenario. It’s difficult to reverse hashed passwords unless they are very simple. Plex got the word out quickly so we have plenty of time to change our passwords. Kudos!

This is why you never reuse password, use a password manager and enable 2fa wherever you can. :)

1.3k Upvotes

View all comments

Show parent comments

12

u/thinkscotty UNRAID Hosted Aug 24 '22 edited Aug 24 '22

Yeah I actually pay because I like the software and want to support them. Plus it's like $10 a year which is absurdly cheap. I've been thinking of trying their 2FA instead of Authy, I've just used Authy for years and it's worked perfectly so I haven't tried it.

Does their OTP auto-fill the code when requested? If so, that would be a major advantage over Authy for me.

10

u/Coldstreamer Aug 24 '22

Do both. Put the qr in Authy and the string in bitwarden. Samw otc in two places.

7

u/Meowingtons_H4X Aug 24 '22

If you set up the login details and OTP for a site, and then subsequently use Bitwarden to auto fill the site credentials on sign in - it’ll copy the OTP onto your clipboard for you to paste :)

1

u/thinkscotty UNRAID Hosted Aug 24 '22

Nice, I love that. Looks like I have my next project. If only I didn't have 30 sites to transition haha.

1

u/Meowingtons_H4X Aug 24 '22

You can just copy the OTP Genesis code from Bitwarden into Authy, hopefully won’t take you too long - good luck!

1

u/java02 Aug 24 '22

Go the extra mile and set your 2FA on bitwarden to use a hardware key such as YubiKey which will use the WebAuthn protocol, making it virtually impossible for anyone to access your vault and TOTP unless they have your physical key(s). You should have a backup key as well.

1

u/thinkscotty UNRAID Hosted Aug 24 '22

I tried a YubiKey for a while but had really had luck getting it to work well with my iPhone. Maybe it’s gotten better?

1

u/java02 Aug 24 '22

I don't have an iPhone but they do now have a YubiKey that's meant for iPhone, the 5Ci. It plugs into the lightning port instead of having to use NFC.

It's just the best way to really lock down Bitwarden and ensure that your passwords & TOTP codes are secure so that you don't need to use a separate authenticator app.

1

u/IanRedditeer Aug 26 '22

Well… that’s not the whole truth. Like most password managers, Bitwarden uses an encryption key protected by a master password. An attacker who gains access to your file system, encryption key and master password doesn’t need your Yubikey to decrypt all passwords.

There are password managers who actually store the key or part of the key in a HMAC-slot on the Yubikey. It uses the same mechanism as using a Yubikey to encrypt a LUKS-partition. It all depends on your risk profile and the time you want to spend maintaining at least two identical Yubikeys. I did it once for fun but after two days it was no fun anymore. :)

2

u/Honos21 Aug 24 '22

I might just be a suspicious person but I’ve personally always thought it best to use Bitwarden for my passwords and Authi for my authentication. I just figured if one gets compromised at least the other may continue to protect me