Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plex: Important notice of a potential data breach

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 194 posts

Re: Plex: Important notice of a potential data breach

#61

Post by koheripbal »

smileybarry wrote: post #48
hddherman wrote: post #14

If true, then this will probably reignite discussions around Plex requiring that you authenticate with their servers when using the service to view content that you're hosting on your own hardware. If anyone is curious, then alternatives like Jellyfin exist. It's a bit different and may not have all the features you need, but it works quite well in my experience.

Plex doesn't require account linking IIRC, it's heavily suggested but you can just access Plex locally without an account.[1] But otherwise I've switched to Infuse[2] since then, it indexes sources reliably on its own (no manual editing though) and saves the entire need for a server if you use it with some cloud storage. Basically replaced my Plex server, with the added bonus of out-of-home streaming without needing…

This is not correct. I've tried the LAN no-login settings and it does not work for many devices (Roku/smart tv/phones). They also fail if you're not on the same subnet as Plex.

For this infuriating reason, moving off of Plex is on my to-do list.

Re: Plex: Important notice of a potential data breach

#62

Post by Retr0id »

zaarn wrote: post #33
onionisafruit wrote: post #11

Earlier quoted context omitted.

The difference between email and password is you can validate a password with a hash, but you can’t send an email to a hashed address. Their db may be encrypted at rest, but a hacker could still compromise a system that has the key in memory.

Encrypt the email in column, add hashed email in separated column. Email Sending would then be covered by a separated and "airgapped" system that holds the decryption key, if you need to send mail, you send the encrypted email address plus what you want to send there. Now an attacker cannot get a hold of email addresses easily.

This is a great idea. You could use public key cryptography too, so that the system adding emails to the db doesn't need the private key.

3rd party mail sending services could support this by generating a keypair on their systems, and only giving you the public half. When you make an API request to send an email, you provide only the encrypted version of the address.

Edit: The hashing is an issue. It's too easy to build a wordlist of possible addresses, to crack the hash. I think this can only work if you drop the hash column, and instead require users to log in using a username.

Re: Plex: Important notice of a potential data breach

#63

Post by unixhero »

nicoco wrote: post #59
wallmountedtv wrote: post #39

Earlier quoted context omitted.

I also want to bring into light that Jellyfin is not very secure either [1], its sadly not in a great place to replace Plex still. 1: https://github.com/jellyfin/jellyfin/issues/5415

Most of these issues require a malicious user, right? I think none of them really are a problem for a friends-and-family instance (as long as they don't get their creds stolen obv). For a single-user usage, none of these really are issues, are they?

Driveby scans happen all the time. Mass scan take 15 minutes to scan the entire internet, for instance.

Re: Plex: Important notice of a potential data breach

#64

Post by cipherboy »

nicoco wrote: post #59
wallmountedtv wrote: post #39

Earlier quoted context omitted.

I also want to bring into light that Jellyfin is not very secure either [1], its sadly not in a great place to replace Plex still. 1: https://github.com/jellyfin/jellyfin/issues/5415

Most of these issues require a malicious user, right? I think none of them really are a problem for a friends-and-family instance (as long as they don't get their creds stolen obv). For a single-user usage, none of these really are issues, are they?

The middle of the list had a media disclosure without any auth via the image API.

That would mean running a publicly accessible instance would be ill advised if you can about the privacy of what you host. Plex on the other hand somewhat encourages publicly accessible instances, so you can listen/watch while not at home.

(The caveat being, certain plugins disclose media to Plex but arguably that's a first or second party not some rando on the internet scraping stuff)

Re: Plex: Important notice of a potential data breach

#65

Post by deadbunny »

nicoco wrote: post #59
wallmountedtv wrote: post #39

Earlier quoted context omitted.

I also want to bring into light that Jellyfin is not very secure either [1], its sadly not in a great place to replace Plex still. 1: https://github.com/jellyfin/jellyfin/issues/5415

Most of these issues require a malicious user, right? I think none of them really are a problem for a friends-and-family instance (as long as they don't get their creds stolen obv). For a single-user usage, none of these really are issues, are they?

As long as you're not opening JF up to the internet none of these are a real issue, so you're fine with a single person/house/network with trusted users.

Re: Plex: Important notice of a potential data breach

#66

Post by colechristensen »

koheripbal wrote: post #61
smileybarry wrote: post #48

Earlier quoted context omitted.

Plex doesn't require account linking IIRC, it's heavily suggested but you can just access Plex locally without an account.[1] But otherwise I've switched to Infuse[2] since then, it indexes sources reliably on its own (no manual editing though) and saves the entire need for a server if you use it with some cloud storage. Basically replaced my Plex server, with the added bonus of out-of-home streaming without needing…

This is not correct. I've tried the LAN no-login settings and it does not work for many devices (Roku/smart tv/phones). They also fail if you're not on the same subnet as Plex. For this infuriating reason, moving off of Plex is on my to-do list.

Are there alternatives with smart tv apps?

Re: Plex: Important notice of a potential data breach

#67

Post by dannyw »

rstuart4133 wrote: post #50

And now the sender sending the "reset password" email is blacklisted by spamcop, I presume because they are sending so many emails from a server that normally doesn't much. They are not having a good day. http://www.spamcop.net/w3m?action=checkblock&ip=192.254.122....

> Causes of listing

> System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

Sounds like their spam trap is broken.

Re: Plex: Important notice of a potential data breach

#68

Post by zaarn »

Retr0id wrote: post #62
zaarn wrote: post #33

Earlier quoted context omitted.

Encrypt the email in column, add hashed email in separated column. Email Sending would then be covered by a separated and "airgapped" system that holds the decryption key, if you need to send mail, you send the encrypted email address plus what you want to send there. Now an attacker cannot get a hold of email addresses easily.

This is a great idea. You could use public key cryptography too, so that the system adding emails to the db doesn't need the private key. 3rd party mail sending services could support this by generating a keypair on their systems, and only giving you the public half. When you make an API request to send an email, you provide only the encrypted version of the address. Edit: The hashing is an issue. It's too easy to bu…

The hashing is an issue but you need to identify the user somehow when you do things like password resets.

The alternative is to handle everything by a username and password resets also use the username (which would be fine, worst case you get spammed by PW reset mails).

Though of course you can also combat this by making the hash particularly expensive and salt it. Simply take a SHA3-512 of the email address a few thousand times, take the first 12 bits and use that to identify a set of 4096 records. Now the full email is simply an application of Blake2sp, which you calculate in parallel for all 4000 records.

Adjust the 12-bit barrier so that it represents a decent sized chunk of users, lower would mean less load on the login service, higher would mean better anonymity. Instead of SHA3-512 you could also use a bloom filter to find out if a set of records contains the email or not, with the added bonus of being probabilistic.

You could also ditch Blake2sp for a simple round of salted SHA3-512. The fact that you salted it makes dictionary search insanely annoying already.

Re: Plex: Important notice of a potential data breach

#69

Post by bluesquared »

flexd wrote: post #15

I'm a long time Plex user, and I have not received this email. Not sure if I should be worried or if the breach has just affected a subset of users. I use random unique passwords for everything anyway, as long as no credit card details were taken it shouldn't be a big deal hopefully. I was able to log into the site now and no message was displayed at all. Edit: Not sure why I would be getting down-voted for this. Sec…

I got mine roughly 3.5 hours ago, so after this post was made. Looks like they're trickling out.

Re: Plex: Important notice of a potential data breach

#70

Post by yots »

colechristensen wrote: post #66
koheripbal wrote: post #61

Earlier quoted context omitted.

This is not correct. I've tried the LAN no-login settings and it does not work for many devices (Roku/smart tv/phones). They also fail if you're not on the same subnet as Plex. For this infuriating reason, moving off of Plex is on my to-do list.

Are there alternatives with smart tv apps?

Emby is close, it missed some video features last I checked but it may be good enough for you.
Post reply on HN