Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plex: Important notice of a potential data breach

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 194 posts

Re: Plex: Important notice of a potential data breach

#151

Post by doorsopen »

koheripbal wrote: post #144
owlbynight wrote: post #111

I like that they're up front about this. Solved the problem in a couple of minutes. I use a password manager with a very long randomly generated password for everything, so a hashed password leaking is essentially meaningless to me. Notifying me immediately so that I can change it ASAP is what matters. The burner e-mail I use for stuff like this is listed in 25 other data breeches, too. I don't really care. Plex is a…

You're being a bit generous with credit to them. We have no idea how long the malicious actors had access (not do they it seems), nor what depth of access they had. I turned off my server until they have had a chance to verify that no malicious software updates have been pushed. With regard to complex passwords, Plex is one of those accounts that using a random password is quite cumbersome since my kids and I are oft…

I've switched to using jellyfin and i've never looked back.

Re: Plex: Important notice of a potential data breach

#152

Post by drewg123 »

koheripbal wrote: post #149
drewg123 wrote: post #137

I noticed last week that my plex server was using a lot of CPU when I was not watching plex. Since I almost never use it, I just killed the server process thinking that it was running amok because of some bug. It all became clear when I got this email last night. I was suspicious, but now I'm pretty certain that my account was exploited, and my local media was being streamed by a 3rd party.

My big fear isn't malicious library access, but that the bad actors pushed a malicious update to Plex itself and that my server is now running malicious code doing God knows what on my network.

Excellent point. Control of plex servers would make a pretty good DOS cannon..

Re: Plex: Important notice of a potential data breach

#153

Post by mikewhy »

koheripbal wrote: post #144
owlbynight wrote: post #111

I like that they're up front about this. Solved the problem in a couple of minutes. I use a password manager with a very long randomly generated password for everything, so a hashed password leaking is essentially meaningless to me. Notifying me immediately so that I can change it ASAP is what matters. The burner e-mail I use for stuff like this is listed in 25 other data breeches, too. I don't really care. Plex is a…

You're being a bit generous with credit to them. We have no idea how long the malicious actors had access (not do they it seems), nor what depth of access they had. I turned off my server until they have had a chance to verify that no malicious software updates have been pushed. With regard to complex passwords, Plex is one of those accounts that using a random password is quite cumbersome since my kids and I are oft…

> often connecting new devices that don't access the password manager

Isn't that what plex.tv/link is for?

Re: Plex: Important notice of a potential data breach

#154

Post by Thews »

koheripbal wrote: post #144
owlbynight wrote: post #111

I like that they're up front about this. Solved the problem in a couple of minutes. I use a password manager with a very long randomly generated password for everything, so a hashed password leaking is essentially meaningless to me. Notifying me immediately so that I can change it ASAP is what matters. The burner e-mail I use for stuff like this is listed in 25 other data breeches, too. I don't really care. Plex is a…

You're being a bit generous with credit to them. We have no idea how long the malicious actors had access (not do they it seems), nor what depth of access they had. I turned off my server until they have had a chance to verify that no malicious software updates have been pushed. With regard to complex passwords, Plex is one of those accounts that using a random password is quite cumbersome since my kids and I are oft…

There is no need for a "complex password" just use a passphrase and don't reuse it.

Re: Plex: Important notice of a potential data breach

#155

Post by shepherdjerred »

paxys wrote: post #135
shepherdjerred wrote: post #123

Earlier quoted context omitted.

That's like saying torrents are only used for piracy, TOR only for buying drugs, and crypto only for laundering money.

What percentage of torrent use or Plex use is not for piracy?

I use torrents frequently for downloading Linux distros. Last weekend I downloaded Debian[0].

Plex has many legitimate use cases. More recently they've pushed into streaming by licensing free content[1], and adding a UI to show where to watch a given show given a set of streaming services that you subscribe to[2].

Aside from that they have their streaming Live TV/DVR[3] feature where you plug a TV tuner into your computer to stream your TV from anywhere, and record it to disk. I have this setup, and it can be useful when watching sports with friends because nobody I know has cable setup 24/7 -- they usually plug an antenna in when they want to watch a game.

The more common Plex features of managing a TV, movie, and music library have legitimate use cases of providing a way to stream media that you have purchased and copied to disk.

Lastly, just yesterday I uploaded all of the lecture videos of a course I'm taking to my Plex instance which allows me to stream them from anywhere or download them for offline viewing using a reliable app instead of the Canvas UI.

Out of honesty I'll admit that I do use Plex for piracy. I previously had subscriptions to Netflix and HBO, and I'll often purchase a subscription when there's a new show that I want to watch (e.g. the new Game of Thrones series). I'm not going to subscribe to 10 different streaming services to watch what I want (which is often just background noise while I work), which is what the industry is moving to.

[0]: https://www.debian.org/CD/torrent-cd/

[1]: https://watch.plex.tv/live-tv

[2]: https://www.plex.tv/blog/end-the-streaming-struggle-with-ple...

[3]: https://support.plex.tv/articles/225877347-live-tv-dvr/

Re: Plex: Important notice of a potential data breach

#156

Post by gregmac »

TedDoesntTalk wrote: post #28
onionisafruit wrote: post #11

Earlier quoted context omitted.

The difference between email and password is you can validate a password with a hash, but you can’t send an email to a hashed address. Their db may be encrypted at rest, but a hacker could still compromise a system that has the key in memory.

> a hacker could still compromise a system that has the key in memory. Security is about layers. Simply because a hacker “could” do something, does not mean it’s a bad idea. Getting the encryption key when it’s not stored in the database requires the hacker to now have access not to just the database but to another system as well.

This is an excellent point, but there's nuance to it.

This seems like an acceptable solution for email and a lot of other PII. However, if you were to propose the same thing for passwords, with the same argument, I'd be dead against it -- even beyond the total lack of need for the system to ever have the actual password. I'm not quite sure how to explain this, though.

Re: Plex: Important notice of a potential data breach

#157

Post by Jaepa »

nerdjon wrote: post #107

Ugh, I feel like this is being a regular thing I need to look at with Plex... Has anyone tried any alternatives that have a decent Apple TV client? I have tried looking a couple times over the last couple years and that is always my blocking point. Ideally not a third party one, I know Jellyfin has a third party option but it always seems to have issues on my library and needs to update its cache (or something) and m…

There is a first party Apple TV Client, but its still in development. They do have a public test flight for it:

https://github.com/jellyfin/Swiftfin

Re: Plex: Important notice of a potential data breach

#158

Post by waz0wski »

koheripbal wrote: post #149
drewg123 wrote: post #137

I noticed last week that my plex server was using a lot of CPU when I was not watching plex. Since I almost never use it, I just killed the server process thinking that it was running amok because of some bug. It all became clear when I got this email last night. I was suspicious, but now I'm pretty certain that my account was exploited, and my local media was being streamed by a 3rd party.

My big fear isn't malicious library access, but that the bad actors pushed a malicious update to Plex itself and that my server is now running malicious code doing God knows what on my network.

Don't let "media manager" apps have direct read-write access to files - they tend to spew metadata all over files, and if there's a bug in the software it can corrupt your data. Doubly-so for an internet-facing dependency dumpsterfire like Plex. It's also worth having at-least a DMZ with ingress/egress filtering for any internet-facing services such as Plex - only allow them to connect to what they need.

A filesystem which supports snapshots and rollbacks is good to have underlying your media collection as well (ZFS, BTRFS, etc)

Re: Plex: Important notice of a potential data breach

#159

Post by msh »

nerdjon wrote: post #112
msh wrote: post #108

Earlier quoted context omitted.

If you only have apple clients (iOS, ipadOS, tvOS and macOS) you can try infuse. Its only a client, so you need to store your files somewhere (icloud, gdrive, you NAS) but it can then play all kinds of files and sync progress between different instances of it self. If you dont want transcoding on the server and only uses apple devices for playback it IMHO works much much better than real plex. It can also play at bei…

Maybe infuse is different if not pointed at jellyfin but that was the client that would have issues with my library. It would loose its cache or something, I don't remember now, all the time.

I have run infuse for a few years first against Plex and then files on GDrive. I have not encountered that problem.

Re: Plex: Important notice of a potential data breach

#160

Post by smileybarry »

arrakeen wrote: post #127
koheripbal wrote: post #61

Earlier quoted context omitted.

This is not correct. I've tried the LAN no-login settings and it does not work for many devices (Roku/smart tv/phones). They also fail if you're not on the same subnet as Plex. For this infuriating reason, moving off of Plex is on my to-do list.

yup--the weekend my internet went out was a real eye-opener and a number of things in my house got the axe including plex. i use kodi now and while its UX is nowhere near as good as plex, at least it works with a LAN-only connection

Oh definitely, once you connect it to an account it nearly refuses to work locally. I tried to set up a cloud-based Plex instance once and I connected it too early, breaking it because UPNP/port forwarding didn't work (yet) and local access was auto-disabled. Even enabled it only half-worked.
Post reply on HN