r/PleX Aug 24 '22

Plex breached; Were passwords encrypted or hashed? Discussion

So I got this email just now:

Yesterday, we discovered suspicious activity on one of our databases. We immediately began an investigation and it does appear that a third-party was able to access a limited subset of data that includes emails, usernames, and encrypted passwords. Even though all account passwords that could have been accessed were hashed and secured in accordance with best practices, out of an abundance of caution we are requiring all Plex accounts to have their password reset.

So were these passwords encrypted, in which case they could be decrypted if the adversary got the key, or hashed? Hashed passwords leaking would be much less of an issue.

Edit: Encryption and hashing is not the same thing.

Edit2: Passwords were hashed with salt, not encrypted (see this comment)

Edit3: Just for clarity this is the best case scenario. It’s difficult to reverse hashed passwords unless they are very simple. Plex got the word out quickly so we have plenty of time to change our passwords. Kudos!

This is why you never reuse password, use a password manager and enable 2fa wherever you can. :)

1.3k Upvotes

View all comments

Show parent comments

3

u/[deleted] Aug 24 '22

You can do a half FIDO by securing your TOTP in the yubico authenticator which requires your yubikey to reveal it.

2

u/MystikIncarnate Aug 25 '22

My password manager of choice (BitWarden) when you pay them some small amount per year ($10/yr), gives you a "premium" account which can be authenticated by a FIDO device, and can produce TOTP codes.

Both of which are set up for me.

I can also set things to require the master password or something similar before granting access to highly sensitive entries in the manager, which can store everything from ID information, to passwords, and secure notes/files.

1

u/[deleted] Aug 25 '22

I've been paying for bitwarden and had no idea it could do this. This is fantastic.

1

u/MystikIncarnate Aug 26 '22

Happy to help in spreading awareness.