Data breach and passwords

General Discussions
1

I’ll preface this by saying: When I was notified of the data breach via email, I of course immediately changed my password. I have no evidence my account was accessed by a third party.

Yesterday I got a notification from Apple that my account password was included in a dataset found online. When I looked at the password Apple said was in the data set, it was… confusing.

I give every website a unique password. I follow something more akin to xkcd: Password Strength with multiple words, in addition to several numbers. For the sake of example, I’ll say my Plex password was (it wasn’t, and there is no connection between the two words in my real password):

Happy485Campers

The password found in the dataset and notified by Apple was Happy.

Obviously the dataset did not include my full password - only the Happy part. But if the passwords were properly salted and peppered, how was even the Happy part extracted?

I guess I’m looking to make sure the password security Plex claimed is used was used, find out how even the first word of the password could be established if the password was salted and peppered, and find out if anyone else has had a similar notification from Apple.

Since the breach I have transitioned to an even more complicated and secure password system, so this is more me wanting to learn about passwords and how they’re encypted than me making any kind of fuss.

Apologies if there is already a topic for this, I did look but didn’t find one.

2

In your source, was the data breach positively identified as the one that affected plex.tv recently?
Is it possible that you used only the first word of the password a few years before and only appended the other stuff later (to make it more complex and secure)?

3

The password is unqiue to Plex and has never been used as anything other than the full password.

I cannot speak to which breach it was taken in, but it was taken from Plex and taken in the full form.

4

Additionally, Apple say the password is “Compromised, easily guess password” - but the password has only ever been used in the Happy485Campers full form. They just only compromised the Happy part, or only included that part in their dataset.

5

I haven’t found any report that a password of yours has been leaked on https://haveibeenpwned.com/

I am not sure what data sources Apple claims to have.

6

Can’t speak to that but the word they’re talling me my password is was a word in my password at the time of the most recent breach.

7

It’d be most helpful if Apple would be forthcoming with details.

side question: did you consider activating 2FA? https://support.plex.tv/articles/two-factor-authentication/

8

My password being unique and complicated made me not bother, but I guess I should. Edit: Seems to require access to my phone and installation of an app I don’t really want on my phone so probably not. It’s not uncommon I need to log in to Plex when I haven’t got my phone on me.

9

It doesn’t have to be a phone. There is also software available which can be used on a laptop or a tablet. It is definitely a method which is supported by several apps from different vendors.

10

Okay will definitely check it out then. Ta.