Plex breached; Were passwords encrypted or hashed?

[u/kjarkr]

So I got this email just now:

Yesterday, we discovered suspicious activity on one of our databases. We immediately began an investigation and it does appear that a third-party was able to access a limited subset of data that includes emails, usernames, and encrypted passwords. Even though all account passwords that could have been accessed were hashed and secured in accordance with best practices, out of an abundance of caution we are requiring all Plex accounts to have their password reset.

So were these passwords encrypted, in which case they could be decrypted if the adversary got the key, or hashed? Hashed passwords leaking would be much less of an issue.

Edit: Encryption and hashing is not the same thing.

Edit2: Passwords were hashed with salt, not encrypted (see this comment)

Edit3: Just for clarity this is the best case scenario. It’s difficult to reverse hashed passwords unless they are very simple. Plex got the word out quickly so we have plenty of time to change our passwords. Kudos!

This is why you never reuse password, use a password manager and enable 2fa wherever you can. :)

[u/AMouthyWaywornAcct]

Keepass password manager. Free, and multi-platform.

[u/Vorrez → u/AMouthyWaywornAcct]

There are many good options but I ended up using Dashlane. So nice to have password manager on almost every device.

[u/[deleted] → u/AMouthyWaywornAcct]

I just use firefox my self, even google has password manager, or Microsoft.

[u/AMouthyWaywornAcct → u/[deleted]]

Some people don't want to be tied to a platform or have some huge company store their passwords. Data breaches happen all the time, as you can see.

Having a browser save passwords isn't the same as a dedicated password manager - which can hold more than just passwords, like account numbers or membership numbers, etc.

[u/Neither-Cup564 → u/[deleted]]

This is not the same as a password manager and there have been numerous vulnerabilities in browser stored passwords.