Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plex: Important notice of a potential data breach

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 194 posts

Re: Plex: Important notice of a potential data breach

#11

Post by onionisafruit »

KingOfCoders wrote: post #9

I personally wish companies would encrypt email addresses in their database, this would at least help against SQL injection attacks and some others (e.g. attacker has only DB system access and not app server access), so it's more difficult for attackers to aggregate data on me. To me it feels very casual waving away the leak of email addresses and just give the usual "passwords were encrypted". But YMMV.

The difference between email and password is you can validate a password with a hash, but you can’t send an email to a hashed address. Their db may be encrypted at rest, but a hacker could still compromise a system that has the key in memory.

Re: Plex: Important notice of a potential data breach

#13

Post by marcushill »

KingOfCoders wrote: post #9

I personally wish companies would encrypt email addresses in their database, this would at least help against SQL injection attacks and some others (e.g. attacker has only DB system access and not app server access), so it's more difficult for attackers to aggregate data on me. To me it feels very casual waving away the leak of email addresses and just give the usual "passwords were encrypted". But YMMV.

It seems to me that encrypting emails is either untenable or insufficient depending on how you do it. You could do a one-way operation like is used on passwords, but then you can't access the user's email address to send them emails. You could instead do a two-way encryption but that likely means using a hardcoded key to decrypt, and that key can't be considered secure if attackers have access to the system. There may be other more effective options but I'm no security expert and I haven't given much thought to other solutions.

Re: Plex: Important notice of a potential data breach

#14

Post by hddherman »

If true, then this will probably reignite discussions around Plex requiring that you authenticate with their servers when using the service to view content that you're hosting on your own hardware.

If anyone is curious, then alternatives like Jellyfin exist. It's a bit different and may not have all the features you need, but it works quite well in my experience.

Re: Plex: Important notice of a potential data breach

#15

Post by flexd »

I'm a long time Plex user, and I have not received this email. Not sure if I should be worried or if the breach has just affected a subset of users. I use random unique passwords for everything anyway, as long as no credit card details were taken it shouldn't be a big deal hopefully. I was able to log into the site now and no message was displayed at all.

Edit: Not sure why I would be getting down-voted for this. Security breaches are a big deal, but if the only result of this for the users is that we need to change our passwords that's a fairly good outcome, no? :-) The biggest hurdle ahead for Plex is to figure out exactly what these attackers did, if they were directly targeted and for how long they were in their network. A lot of the times a incident is discovered it's discovered a long time after the first breach (based on my own personal experience)

Re: Plex: Important notice of a potential data breach

#17

Post by mplewis »

flexd wrote: post #15

I'm a long time Plex user, and I have not received this email. Not sure if I should be worried or if the breach has just affected a subset of users. I use random unique passwords for everything anyway, as long as no credit card details were taken it shouldn't be a big deal hopefully. I was able to log into the site now and no message was displayed at all. Edit: Not sure why I would be getting down-voted for this. Sec…

I received this email 1.5 hours ago.

Re: Plex: Important notice of a potential data breach

#18

Post by vivegi »

KingOfCoders wrote: post #9

I personally wish companies would encrypt email addresses in their database, this would at least help against SQL injection attacks and some others (e.g. attacker has only DB system access and not app server access), so it's more difficult for attackers to aggregate data on me. To me it feels very casual waving away the leak of email addresses and just give the usual "passwords were encrypted". But YMMV.

In the healthcare industry in USA, Personal Identification Information (PII)/Personal Health Information (PHI) needs to be encrypted at rest and in transit and is mandated by law. So, they are required to encrypt PII/PHI data fields.

Some of those practices may be generally applied for non-healthcare settings as well.

Re: Plex: Important notice of a potential data breach

#19

Post by gkhartman »

Thanks for sharing this. I got the email, but found it here first. They let us know pretty fast, and gave clear instructions on how to secure our accounts moving forward. That can't be said for all companies that we trust with our info.

It sounds like payment data was stored in a separate database that had a different set of credentials (for this I am grateful).

Thanks to The Plex Security Team for providing details quickly.

Re: Plex: Important notice of a potential data breach

#20

Post by KingOfCoders »

vivegi wrote: post #18
KingOfCoders wrote: post #9

I personally wish companies would encrypt email addresses in their database, this would at least help against SQL injection attacks and some others (e.g. attacker has only DB system access and not app server access), so it's more difficult for attackers to aggregate data on me. To me it feels very casual waving away the leak of email addresses and just give the usual "passwords were encrypted". But YMMV.

In the healthcare industry in USA, Personal Identification Information (PII)/Personal Health Information (PHI) needs to be encrypted at rest and in transit and is mandated by law. So, they are required to encrypt PII/PHI data fields. Some of those practices may be generally applied for non-healthcare settings as well.

Does at-rest mean: encrypted on storage so noone can physically steal a drive or encrypted in the database so noone can get the information with SQL without the key (e.g. Postgres column encryption)?
Post reply on HN