Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plex Security Incident

links.plex.tv

Post reply on HN
Print view View original

81–90 of 94 posts

Re: Plex Security Incident

#81

Post by gchamonlive »

0points wrote: post #78
gchamonlive wrote: post #4

Earlier quoted context omitted.

Do I still need to mess with filenames in order to have jellyfin pick them up to create the library?

You need to sometimes suffix the folder/file name with {imdb-tt1234} to make it match the correct movie/show. This is the same deal with Plex tho, although I found plex internal metadata engine to auto-match better than jellyfin currently does. You can help here though. Just come to https://www.themoviedb.org/ and help us add metadata.

Changing files isn't really an option for me because my media stays in an off-site server and the mount point is readonly.

I'll setup jellyfin and see which titles I'm unable to add and try to collaborate on metadata. It's always important to favor opensource. I can always have both services running side by side.

Re: Plex Security Incident

#83

Post by aeonik »

0points wrote: post #75
aeonik wrote: post #54

Earlier quoted context omitted.

This is misleading, if the password is a certain length, then it might as well be considered secure. You could safely release hashes. I'll pay you $10k if you can crack this sha512 hash. I'd offer a million, but I don't have that kind of money. 5a55b7b0e1f9452f925b1aa43cf148081da58c66c735961d9a7cb699b2fd5b08bee6b24ec47fce0b93ba49df83641a30c7843dece49e0a0db5a7c50901492fdd It's technically true that all cryptography is…

sha* is a horrible choice for storing passwords. It's intended use is for verifying data integrity. You should be using the solutions readily available instead of trying to reinventing the wheel, or avoid this subject altogether if you can't be bothered to educate yourself as to why. This has been a decades-long issue, and it blows my mind how people in IT still didn't get the memo. Use argon2, scrypt or even bcrypt…

I agree, but the entropy of the string that produced that hash will nullify any such disadvantage.

Re: Plex Security Incident

#84

Post by blactuary »

0points wrote: post #79
blactuary wrote: post #60

Earlier quoted context omitted.

I have never had any of their streaming content pushed onto my homepage nor had my own media hidden in submenus. I don't see anything but my own media

Then you must either: a) be running an ancient plex version, before they rolled all of that crap out. b) edited your home screen to remove all of those "plex offers".

Yes, it was a one time process that took 2-3 clicks

Re: Plex Security Incident

#85

Post by IAmBroom »

daveidol wrote: post #67
Someone1234 wrote: post #66

Earlier quoted context omitted.

The weakpoint is, has, and will always be people. They're cryptographic hashes of people's chosen passwords. You aren't attacking hypothetical mathematical entropy, you're attacking human imagination and laziness. It isn't academic either. I have broken tons of cryptographic hashes in my career. Most of my colleagues have too. From DES through bcrypt over tens of years. The cost/performance has slowed, but the techni…

Some humans use password generators though, so those should be safe

Some people eat mostly fresh fruits, vegetables, and whole grains.

The other 99.9% enjoy junk food, and don't use password generators.

Re: Plex Security Incident

#86

Post by IAmBroom »

Someone1234 wrote: post #56
mvdtnz wrote: post #20

Earlier quoted context omitted.

For all practical purposes what you're saying is just wrong.

I've done so within the last year, successfully. Cost $7 for a single password in just compute and took about 17 hours (lowest, cheapest priority). So please explain your reply further. Also recall their claim for context of what I was replying to, and what you're here defending now. If their claim is credible what I did and what you're reiterating wasn't possible.

Your story lacks important context. Was the password "password"? "123456"? Or a 12-character mix of cases, numbers, and special characters?

Re: Plex Security Incident

#87

Post by OkayPhysicist »

solid_fuel wrote: post #63
OkayPhysicist wrote: post #49

Earlier quoted context omitted.

If you have the hashed password, in most systems you have the salt. Salt+hash is for preventing the attackers from getting to try all your passwords in parallel.

Maybe this is what you're saying, I'm not sure - my understanding was that the salt prevents reused passwords from resulting in the same hash. So, if I use 'password' and you use 'password' the salt+hash will be different. That way attackers can't just hash all the common passwords once and immediately associate them with different accounts.

Yeah, exactly. Commonly, the salts are stored right next to the hashes in the DB, because they serve their purpose even if the attacker knows what the salts are. By using a different salt for every password, the attacker needs execute a full "guess, hash, compare, repeat" attack on each user, as opposed to "guess, hash, compare against all user passwords, repeat" on the entire database.

Re: Plex Security Incident

#88

Post by IAmBroom »

whiterook6 wrote: post #14

I am a faithful Plex lifetime user and have never had problems. That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share - how easy is it to administer for clients outside of my network or possibly even outside my country? - how good is the app support? I transcode all of my media to AAC and h264 for compatibility -what about for streaming music? I really like Plex am…

Plex mysteriously began refusing remote connections, so I couldn't share with my friend outside my home LAN. Manually port forwarding didn't solve anything, and my firewall isn't the problem. That's as far as Plex help goes...

I went to Jellyfin (plus Tailscale VPN). Some things are really nice, but others... well, it's an open-source project, and people only fix what they see as broken. So, I've tried restarting, only to lose every single customization I did. It's not worth my time to fill out their tickets and play that lottery, so I just accept the UI issues.

Then, mysteriously, Jellyfin also quit broadcasting remotely. A month later, its server wasn't even visible on my own LAN to my TV.

So I uninstalled BOTH Plex and Jellyfin, and reinstalled both. Jellyfin still doesn't connect right. And Plex works... until suddenly it doesn't, and I have to cycle through Off/On with "Allow remote connections", until it works again, mysteriously.

PRO'S OF EACH:

Plex: Much better support in TV libraries. No need for a VPN. Simpler UI.

Jellyfin: Ability to create Collections, which are basically filter-defined libraries. Without rearranging any files, you can build a Collection of Star Wars movies, or all movies directed by Scorsese, or any arbitrary bunch of media files at all, really. Optionally, you can reduce your library clutter with these Collections: a library named Science Fiction can have all of your Star Wars movies listed as a single item (that Collection). Basically, sub-libraries, but they aren't restricted to one library's contents (Star Wars might contain a documentary on "The Making Of" that isn't actually stored in Science Fiction).

Re: Plex Security Incident

#90

Post by rstuart4133 »

IAmBroom wrote: post #88
whiterook6 wrote: post #14

I am a faithful Plex lifetime user and have never had problems. That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share - how easy is it to administer for clients outside of my network or possibly even outside my country? - how good is the app support? I transcode all of my media to AAC and h264 for compatibility -what about for streaming music? I really like Plex am…

Plex mysteriously began refusing remote connections, so I couldn't share with my friend outside my home LAN. Manually port forwarding didn't solve anything, and my firewall isn't the problem. That's as far as Plex help goes... I went to Jellyfin (plus Tailscale VPN). Some things are really nice, but others... well, it's an open-source project, and people only fix what they see as broken. So, I've tried restarting, on…

> Plex mysteriously began refusing remote connections, so I couldn't share with my friend outside my home LAN.

Same issue for me. The client app used to have a "remote servers" configuration option. You had to manually set up port forwarding and get the configuration perfect, which I suspect was beyond your average Joe. But once you did it was rock solid.

They now have some automagic arrangement based on uPnP which anybody can use, when it works. But it doesn't always work and because they've removed the old manual option when it doesn't work, there is no remote access for you. You would hope they would add some debugging and doco to give you some visibility into what it depends on so you can isolate the problem, but no, they provide nothing.

Post reply on HN