Live data from Hacker News

A security incident that may involve your Plex account information

forums.plex.tv

11–20 of 34 posts

Re: A security incident that may involve your Plex account information

#11

I made an account there to use my Home Assistant as a media server and it's already the second time they reported that they messed up something. I heard you can install VLC on the Apple TV and stream through that, so I'll definitely do that and skip these weird middle companies.

Why not use Jellyfin then? It's basically an open source alternative to Plex. You run Jellyfin on your server and in Apple TV use Swiftin (Jellyfin + Swift) for integration.

Re: A security incident that may involve your Plex account information

#13

use zymotv instead of plex or emby

Or better yet use Jellyfin.

I’ve been considering switching to Jellyfin.

I’m getting increasingly frustrated at just how badly Plex behaves for home set ups. Which is the entire point of installing something like Plex.

Most annoying still, I’ve even paid for their premium products in the hope that it would make things behave better and it did not.

The only reason these security incidents happen is because Plex try to extort home users. There isn’t any other compelling reason to have your details on their database with credentials to active installs.

Re: A security incident that may involve your Plex account information

#15

Once I saw Plex required an account even to self-host, it was a no-go for me. Stuff like this is why. (among other reasons, like "why should I go through a 3rd party for something I'm 100% hosting on my own hardware/network") I've been very happy with Jellyfin FWIW :)

The big selling point of Plex vs jellyfin is that their app is in all of the major stores.Samsung smart TVs for example

Re: A security incident that may involve your Plex account information

#16

Once I saw Plex required an account even to self-host, it was a no-go for me. Stuff like this is why. (among other reasons, like "why should I go through a 3rd party for something I'm 100% hosting on my own hardware/network") I've been very happy with Jellyfin FWIW :)

I switched to Jellyfin last year and never looked back. The only thing I find lacking is the Apple TV App, I tried Swiftfin but it stutters the whole time when playing high quality UHD content. I tried Infuse and it works much better

Re: A security incident that may involve your Plex account information

#17
I am a huge Plex power user; watching something at least once a day.

Unfortunately, Plex is a bit of a mess these days - constantly pushing Live TV on us, requiring internet access to access local media (this is a killer whenever internet goes down), overly complex, clunky remote access (altho this is much better these days). But it still isn't bad enough to make me try and migrate. I love my local setup (Sonarr and a custom app for movies as Radarr is OTT for the amount of movies we watch) and Plex is very polished (compared to the alternatives) but I do wonder how much longer it will be around.

Re: A security incident that may involve your Plex account information

#18

I am a huge Plex power user; watching something at least once a day. Unfortunately, Plex is a bit of a mess these days - constantly pushing Live TV on us, requiring internet access to access local media (this is a killer whenever internet goes down), overly complex, clunky remote access (altho this is much better these days). But it still isn't bad enough to make me try and migrate. I love my local setup (Sonarr and…

Conversely I love the plex tv channels as an alternative to regular australian free to air- same as the lg channels.

Easy way for me to turn my brain off and find a good documentary/educational show at the end of the day

Re: A security incident that may involve your Plex account information

#19
PSA: If you are the owner of your Plex server and follow the _Sign out connected devices after password change- as they suggest, your server claim will also be expired.

So you'll have to get a new claim from https://www.plex.tv/claim and set it on your server; through the PLEX_CLAIM env var if your setup involves Docker.

They talk vaguely about it under _Common Issues_ but it wasn't on the original email, so I lost 15 minutes of my day because of this...

Re: A security incident that may involve your Plex account information

#20

I appreciate the transparency, but the phrase securely hashed always makes me a little nervous. It's a huge spectrum, right? We talking bcrypt/scrypt with a proper salt, or something from the old days?

When they got hacked three years ago the notice included this:

> Even though all account passwords that could have been accessed were hashed (with bcrypt plus salted and peppered) and secured in accordance with best practices, out of an abundance of caution we are requiring all Plex accounts to have their password reset.

Whether that later changed for the worse is anyone's guess.

Post reply on HN