Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plex Security Incident

links.plex.tv

Post reply on HN
Print view View original

61–70 of 94 posts

Re: Plex Security Incident

#61

Post by fluidcruft »

OkayPhysicist wrote: post #49
jcgl wrote: post #43

Earlier quoted context omitted.

As long as the salt is secret from the attackers (which is not a given, of course), the length of the passwords shouldn't matter all too much; the input to the hash (i.e. password + hash) would still have enough entropy to not be brute-force-able.

If you have the hashed password, in most systems you have the salt. Salt+hash is for preventing the attackers from getting to try all your passwords in parallel.

You can also have a system salt(s) that are not stored with the database, so that if someone accesses the database they have to guess password and two salts, one of which they hopefully do not have via the same penetration.

Re: Plex Security Incident

#62

Post by squishington »

BowBun wrote: post #23
whiterook6 wrote: post #14

I am a faithful Plex lifetime user and have never had problems. That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share - how easy is it to administer for clients outside of my network or possibly even outside my country? - how good is the app support? I transcode all of my media to AAC and h264 for compatibility -what about for streaming music? I really like Plex am…

I'll fill in what I can - >- how easy is it to administer for clients outside of my network or possibly even outside my country? Jellyfin is just the software, not a hosted solution. I use a simple server/seedbox, with sane configs (good providers have automated this), which results in a secure public-facing admin console with a username/password. They have basic user management features to include other users in you…

The official jellyfin android app also provides 'remote' functionality (skip episodes, browse library, change volume etc.). It works well for me most of the time, but occasionally it can't find the remote session until I restart the jellyfin instance.

Re: Plex Security Incident

#63

Post by solid_fuel »

OkayPhysicist wrote: post #49
jcgl wrote: post #43

Earlier quoted context omitted.

As long as the salt is secret from the attackers (which is not a given, of course), the length of the passwords shouldn't matter all too much; the input to the hash (i.e. password + hash) would still have enough entropy to not be brute-force-able.

If you have the hashed password, in most systems you have the salt. Salt+hash is for preventing the attackers from getting to try all your passwords in parallel.

Maybe this is what you're saying, I'm not sure - my understanding was that the salt prevents reused passwords from resulting in the same hash. So, if I use 'password' and you use 'password' the salt+hash will be different. That way attackers can't just hash all the common passwords once and immediately associate them with different accounts.

Re: Plex Security Incident

#65

Post by gchamonlive »

vachina wrote: post #29
gchamonlive wrote: post #4

Earlier quoted context omitted.

Do I still need to mess with filenames in order to have jellyfin pick them up to create the library?

If you categorize your libraries into their correct directories (i.e. TV into TV, movies into movies), then no. Their metadata lookup is quite solid.

Will give it a try, thanks

Re: Plex Security Incident

#66

Post by Someone1234 »

aeonik wrote: post #54
Someone1234 wrote: post #9

> Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. I am glad they were hashed, but that's a misleading statement. The point of hashing is to slow an attacker down, even with full best security practices (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when , not i…

This is misleading, if the password is a certain length, then it might as well be considered secure. You could safely release hashes. I'll pay you $10k if you can crack this sha512 hash. I'd offer a million, but I don't have that kind of money. 5a55b7b0e1f9452f925b1aa43cf148081da58c66c735961d9a7cb699b2fd5b08bee6b24ec47fce0b93ba49df83641a30c7843dece49e0a0db5a7c50901492fdd It's technically true that all cryptography is…

The weakpoint is, has, and will always be people. They're cryptographic hashes of people's chosen passwords. You aren't attacking hypothetical mathematical entropy, you're attacking human imagination and laziness.

It isn't academic either. I have broken tons of cryptographic hashes in my career. Most of my colleagues have too. From DES through bcrypt over tens of years. The cost/performance has slowed, but the techniques haven't changed one bit because PEOPLE haven't changed one bit.

Obviously nobody can crack a sha512 hash likely containing a randomly generated cryptographic number. But that's irrelevant, because we're discussing the Plex security incident where humans created passwords, and humans today, tomorrow, and ten years ago are just as incapable of creating good passwords.

So their claim that these hashes "cannot be read" is inaccurate. If you have a modest budget and want to target a handful of accounts, there are multiple CHEAP cloud services that will happily sell you compute to do so.

Re: Plex Security Incident

#67

Post by daveidol »

Someone1234 wrote: post #66
aeonik wrote: post #54

Earlier quoted context omitted.

This is misleading, if the password is a certain length, then it might as well be considered secure. You could safely release hashes. I'll pay you $10k if you can crack this sha512 hash. I'd offer a million, but I don't have that kind of money. 5a55b7b0e1f9452f925b1aa43cf148081da58c66c735961d9a7cb699b2fd5b08bee6b24ec47fce0b93ba49df83641a30c7843dece49e0a0db5a7c50901492fdd It's technically true that all cryptography is…

The weakpoint is, has, and will always be people. They're cryptographic hashes of people's chosen passwords. You aren't attacking hypothetical mathematical entropy, you're attacking human imagination and laziness. It isn't academic either. I have broken tons of cryptographic hashes in my career. Most of my colleagues have too. From DES through bcrypt over tens of years. The cost/performance has slowed, but the techni…

Some humans use password generators though, so those should be safe

Re: Plex Security Incident

#68

Post by ajdude »

ewenjo wrote: post #53
hamdingers wrote: post #31

Earlier quoted context omitted.

> but I haven’t actually seen any stripped functionality Plugins, the watch later list, the up next/playback queue, Plex Cloud/Cloud Sync, photo backup (this one hurt), privacy preferences were badly nerfed. Those are just the ones I miss, I'm sure there are more (like the short lived arcade thing).

Watch Together is also being removed

Which got a lot of people (including me, also a lifetime subscriber) in this thread absolutely livid: https://forums.plex.tv/t/allow-watch-together-for-tv-shows-m...

(We were begging for them to fix the functionality of watch together for almost 5 years)

Re: Plex Security Incident

#69

Post by internetter »

Urist-Green wrote: post #36
Someone1234 wrote: post #9

> Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. I am glad they were hashed, but that's a misleading statement. The point of hashing is to slow an attacker down, even with full best security practices (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when , not i…

One of the aspects of MtGox's database leak that I found most fascinating to watch was the public effort to figure out users' passwords from the hashes. Checking common passwords, patterns, and people's public interests on Twitter was all shockingly effective.

This sounds fascinating. Has there been any literature produced on this specific incident and unfolding attempts?

Re: Plex Security Incident

#70

Post by bingo-bongo »

aaomidi wrote: post #48
whiterook6 wrote: post #14

I am a faithful Plex lifetime user and have never had problems. That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share - how easy is it to administer for clients outside of my network or possibly even outside my country? - how good is the app support? I transcode all of my media to AAC and h264 for compatibility -what about for streaming music? I really like Plex am…

Plex works on chromecast etc, not for jellyfin

Huh? I’ve used jellyfin on my chromecast for years
Post reply on HN