Live data from Hacker News

Plex: Important notice of a potential data breach

news.ycombinator.com

51–60 of 194 posts

Re: Plex: Important notice of a potential data breach

#51

If true, then this will probably reignite discussions around Plex requiring that you authenticate with their servers when using the service to view content that you're hosting on your own hardware. If anyone is curious, then alternatives like Jellyfin exist. It's a bit different and may not have all the features you need, but it works quite well in my experience.

Kodi's pretty good too, and doesn't insist on showing unrelated online content you don't care about like Plex seems to.

Re: Plex: Important notice of a potential data breach

#52
post #31

Earlier quoted context omitted.

Likewise, I haven't got anything.

I haven't received anything either, and was able to log in without having to set a new password.

I have received the email. They are not forcing you to reset password on login, you need to go into your account and reset it normally.

Re: Plex: Important notice of a potential data breach

#54
post #33

Earlier quoted context omitted.

The difference between email and password is you can validate a password with a hash, but you can’t send an email to a hashed address. Their db may be encrypted at rest, but a hacker could still compromise a system that has the key in memory.

Encrypt the email in column, add hashed email in separated column. Email Sending would then be covered by a separated and "airgapped" system that holds the decryption key, if you need to send mail, you send the encrypted email address plus what you want to send there. Now an attacker cannot get a hold of email addresses easily.

That's a simple and brilliant idea. I'm running with it.

Re: Plex: Important notice of a potential data breach

#59
post #27

Earlier quoted context omitted.

Perhaps the most important thing about Jellyfin is that it's open source. I really wish the project received a little bit more love.

I also want to bring into light that Jellyfin is not very secure either [1], its sadly not in a great place to replace Plex still. 1: https://github.com/jellyfin/jellyfin/issues/5415

Most of these issues require a malicious user, right? I think none of them really are a problem for a friends-and-family instance (as long as they don't get their creds stolen obv). For a single-user usage, none of these really are issues, are they?

Re: Plex: Important notice of a potential data breach

#60

If true, then this will probably reignite discussions around Plex requiring that you authenticate with their servers when using the service to view content that you're hosting on your own hardware. If anyone is curious, then alternatives like Jellyfin exist. It's a bit different and may not have all the features you need, but it works quite well in my experience.

Plex doesn't require account linking IIRC, it's heavily suggested but you can just access Plex locally without an account.[1] But otherwise I've switched to Infuse[2] since then, it indexes sources reliably on its own (no manual editing though) and saves the entire need for a server if you use it with some cloud storage. Basically replaced my Plex server, with the added bonus of out-of-home streaming without needing…

With infuse plus cloud storage any transcoding happens locally though which is a problem with weaker devices
Post reply on HN