There is a concerning lack of clarity in the email Plex sent out today about yesterday’s security breach. The email claims:
a third-party was able to access a limited subset of data that includes […] encrypted passwords. Even though all account passwords that could have been accessed were hashed and secured in accordance with best practices[…]
(my bold)
These two sentences contradict each other. If Plex stored encrypted passwords - and that’s not best practice - they can be decrypted by anyone with the key. If they were hashed (and salted. Please say they were salted) they cannot. So which is it - encrypted or hashed?
It’s worrying that Plex can’t even get their security disclosures right; makes you wonder what else is broken about their security practices.
I’m still trying to confirm if this applies to Plex thats accessed with a third party authenticator such as Google or Apple, that information is completely missing from the email and as far as I can tell has yet to be answered by the Plex powers that be.
Would be nice to get better information. as i agree with OP, I raised an eyebrow reading the email too, which is it encrypted or hashed out, did the breach also result in a leak of any keys that can reverse the encryption. This brings into question how and why we need to Authenticate to their service first before we are authenticated on a service that is running on our hardware… if it is for licensing there are better ways of doing that these days anyways.
I agree it’s dumb this info is missing from the email, but if you authenticate via third party Plex never has your actual login details so you shouldn’t worry, this works via OAuth which is def secure.
I think they used the word “encrypted” because the general public just hears that and knows “secure”. I’m taking a class right now in encryption, so I’m understanding the different kinds of encryption, and now I appreciate that when they say hash, that is what they really use. (A definite +1 on hoping they salted them too)
Near as I hear about google auth, is that your account still HAS a regular account password to log in. So authenticating using google allows you to login without using the regular password. This means your account is still possibly compromised like everyone else, but your google info is 100% secure (unless you made the common mistake of using the same email/password combo for google as you did for the base Plex account.)
