top | item 45174707

Plex Security Incident

104 points| andyexeter | 5 months ago |links.plex.tv

92 comments

order

whiterook6|5 months ago

I am a faithful Plex lifetime user and have never had problems.

That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share

- how easy is it to administer for clients outside of my network or possibly even outside my country?

- how good is the app support? I transcode all of my media to AAC and h264 for compatibility

-what about for streaming music? I really like Plex amp

- what do you like the most about jellyfin

- what do you miss most about Plex?

Thank you.

BowBun|5 months ago

I'll fill in what I can -

>- how easy is it to administer for clients outside of my network or possibly even outside my country?

Jellyfin is just the software, not a hosted solution. I use a simple server/seedbox, with sane configs (good providers have automated this), which results in a secure public-facing admin console with a username/password. They have basic user management features to include other users in your server.

> - how good is the app support? I transcode all of my media to AAC and h264 for compatibility

Jellyfin has a broad ecosystem of apps on a bunch of platforms, each with their pros and cons. I recommend poking around. When figuring my setup out, I downloaded 3 or 4 different Android apps to pick the one I liked (support for multiple servers which isn't a given in all the apps)

> -what about for streaming music? I really like Plex amp IMO Plex has always been substandard here since they hoisted the music interface into the same one they use for everything else, so it's really lacking in filters/administration features I depend on. That said Jellyfin supports music and has the same simple feature set.

> - what do you like the most about jellyfin

It's free and untethered to a company's whims. It also does a lot less of the social/DVR stuff that I have no interest in.

>- what do you miss most about Plex?

Their app experience was a bit more premium, and their support for multiple servers is better than Jellyfin since they own the servers/hosting to do it. I also really used to enjoy the 'remote' functionality where I could skip episodes by clicking next on the Plex app in my phone. This hasn't worked for a few years for me despite heavy troubleshooting.

seabass|5 months ago

> how easy is it to administer for clients outside of my network or possibly even outside my country?

You can run Jellyfin in any docker container. If you want to run it on a NAS in your home office and put it on the internet through ngrok or tailscale, you totally can. But you can host it pretty much wherever.

> how good is the app support? I transcode all of my media to AAC and h264 for compatibility

The official clients are just ok. They'll support all the file types you'd expect, but they're fairly slow and not great at streaming 4K. I pay for a client (Infuse Pro) that addresses a lot of those pain points, but it's been relatively poor at auto-detecting tv show metadata, so I'm still in the market for an app I'm happy with. Ideally an open source one.

> - what about for streaming music?

Technically works, but whether it's a good experience depends on the client you're using.

> - what do you like the most about jellyfin

Easy to set up. Great plugins for finding subtitles/artwork/metadata. Open source with good docs. Works with lots of clients. Easy to create and share accounts, and has fun features like synced remote viewing parties.

- what do you miss most about Plex?

The ads. jk never used it.

ktm5j|5 months ago

Not sure about jellyfin, but I really dig Emby. Just as convenient as Plex. I can't even remember why I switched to Emby over Plex, but I never looked back.

0points|5 months ago

> what do you like the most about jellyfin

- Not selling off my watching history to third parties. This is a privacy disaster still about to blow up. Expect holders of large plex libraries with pirated content to be lined up in court in the near future.

- Decentralized.

- Not parasiting on FOSS such as ffmpeg. Plex famously took everything from ffmpeg and gave nothing back, while making lots of money in the process.

unsnap_biceps|5 months ago

I ran plex for years but gave up once they started tracking all activity.

Jellyfin is way to administer. Clients are rough and often crash. Influx is often the best choice for IOS but has its own... weird decisions on how to handle libraries.

The main thing I miss is being able to download transcoded media for mobile devices so I can watch on a plane.

IAmBroom|5 months ago

Plex mysteriously began refusing remote connections, so I couldn't share with my friend outside my home LAN. Manually port forwarding didn't solve anything, and my firewall isn't the problem. That's as far as Plex help goes...

I went to Jellyfin (plus Tailscale VPN). Some things are really nice, but others... well, it's an open-source project, and people only fix what they see as broken. So, I've tried restarting, only to lose every single customization I did. It's not worth my time to fill out their tickets and play that lottery, so I just accept the UI issues.

Then, mysteriously, Jellyfin also quit broadcasting remotely. A month later, its server wasn't even visible on my own LAN to my TV.

So I uninstalled BOTH Plex and Jellyfin, and reinstalled both. Jellyfin still doesn't connect right. And Plex works... until suddenly it doesn't, and I have to cycle through Off/On with "Allow remote connections", until it works again, mysteriously.

PRO'S OF EACH:

Plex: Much better support in TV libraries. No need for a VPN. Simpler UI.

Jellyfin: Ability to create Collections, which are basically filter-defined libraries. Without rearranging any files, you can build a Collection of Star Wars movies, or all movies directed by Scorsese, or any arbitrary bunch of media files at all, really. Optionally, you can reduce your library clutter with these Collections: a library named Science Fiction can have all of your Star Wars movies listed as a single item (that Collection). Basically, sub-libraries, but they aren't restricted to one library's contents (Star Wars might contain a documentary on "The Making Of" that isn't actually stored in Science Fiction).

hamdingers|5 months ago

- just like any web service, reverse proxy with SSL, it has internal user management

- there are a variety of apps to choose from on ios/android, smart TVs might be limited or nonexistent (LG has a good one though)

- consider a separate dedicated tool for music, like Navidrome

- it's open source, its developers respect me and my users and do not abuse their access to them using dark patterns to extract revenue

- features that they have removed anyway (plugins, photo sync, plex cloud)

onehair|5 months ago

> what do you like the most about jellyfin

I own the instance that's running on my own homeserver. It does what I want it to do. Stream my media for me, other directly in the same network, or transcodes when I'm away.

aaomidi|5 months ago

Plex works on chromecast etc, not for jellyfin

benoau|5 months ago

Always disliked Plex for them imposing themselves as a middleman to using the software locally, which is ultimately the root cause for this incident.

imglorp|5 months ago

> An unauthorized third party accessed a limited subset of customer data from one of our databases

How could only a subset be affected? Any architecture other than a "users" db table wouldn't make sense.

nimih|5 months ago

I have no idea how Plex runs their servers, but I've worked at companies where new systems are rolled out for new users/accounts, but old users/accounts are left on the "legacy" system (usually with the plan to migrate once the new system has been deployed and there is bandwidth available to handle the complexity of migrating users between systems). In particular, if you have a long-running service where some very old accounts might have special billing/pricing logic that you want to continue honoring but is difficult to implement in the new system, such a setup might make sense to continue long-term for a small subset of accounts.

Alternatively, maybe they mean that the limited subset of data was specifically the "email" and "password_hash" columns of the database ;P

reassess_blind|5 months ago

Could be technically true in that they didn’t access every last bit of “user data” like support chat logs or whatever stored elsewhere, but they have phrased it that way to make it seem like less of a big deal. Just a guess.

supportengineer|5 months ago

Sharding the data across DB's, separate credentials for each DB.

kingnothing|5 months ago

It's easy to imagine Plex has some db sharding going on at their scale, or that they host in multiple geographic regions for regional compliance, or on multiple cloud providers.

reactordev|5 months ago

Rows 1-200,000 instead of 1-1,000,000 I would presume.

Someone1234|5 months ago

> Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party.

I am glad they were hashed, but that's a misleading statement. The point of hashing is to slow an attacker down, even with full best security practices (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when, not if.

aeonik|5 months ago

This is misleading, if the password is a certain length, then it might as well be considered secure. You could safely release hashes.

I'll pay you $10k if you can crack this sha512 hash.

I'd offer a million, but I don't have that kind of money.

5a55b7b0e1f9452f925b1aa43cf148081da58c66c735961d9a7cb699b2fd5b08bee6b24ec47fce0b93ba49df83641a30c7843dece49e0a0db5a7c50901492fdd

It's technically true that all cryptography is just slowing things down, but we are talking about heat death of the universe lengths of time for most crypto algorithms.

*assuming quantum computing doesn't take off or a fundamental flaw isn't found in the crypto.

Urist-Green|5 months ago

One of the aspects of MtGox's database leak that I found most fascinating to watch was the public effort to figure out users' passwords from the hashes. Checking common passwords, patterns, and people's public interests on Twitter was all shockingly effective.

pixl97|5 months ago

Technically you may have to burn more entropy than exists in the visible universe, so its a possible if in the case of the right hash and luck.

mr90210|5 months ago

> (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when, not if

How much compute/gpu and hard dollars would hackers need in order to reverse engineers those stollen passwords?

Dedime|5 months ago

Maybe this is naive, but in a good crypto system, I would hope "when" is measured in millions or billions of years given current hardware capabilities.

mvdtnz|5 months ago

For all practical purposes what you're saying is just wrong.

OptionOfT|5 months ago

What about the TOTP setup code? Has that one leaked? Is that recoverable?

e40|5 months ago

Disappointed this was not mentioned!

drewbitt|5 months ago

They had this same thing happen in 2022, too. "a third-party was able to access a limited subset of data that includes emails, usernames, and encrypted passwords"

estimator7292|5 months ago

This is the exact reason you shouldn't use a "self-hosted" service that insists on phoning home before you can access media on your own damn server.

bronco21016|5 months ago

Edit: disregard. Just received the email.

What’s the date of this release? There was a similar release a few months ago and I’m curious if I need to again reset my account.

ycombinatrix|5 months ago

I switched to Emby already. Much better experience imo. External player support is great.

BowBun|5 months ago

Not necessarily related, but I'll take the opportunity to share my dislike of this company. Like others, they built a loyal following around a set of features provided, no questions asked, to stream your content to your own devices.

Over the last couple of years, Plex has continued to strip functionality, add paywalls, make deals with publishing companies, and take other actions that firmly put them in the 'enshittifaction' phase. They've capitalized on the community that gave them their success, so I've cashed out as well.

At this point there is little need for those of us with some technical ability to use this software and all the bloat that comes with it. Jellyfin[1] is an excellent alternative that I've fully switched over to this last year. I will not let a company take ownership of my media library, ever.

[1] https://jellyfin.org/

johnbellone|5 months ago

I have a “lifetime pass”. I’ve noticed some of these “features” creeping into the ecosystem (bloat), but I haven’t actually seen any stripped functionality. For the most part, it works as advertised.

That being said, a lot of my mates are moving to Jellyfin. Nothing but good things from them.

magicalhippo|5 months ago

I like Jellyfin, but I keep using Plex for two reasons.

First is subtitle support is quite limited in comparison. It fails more often than it works for me.

Second is the lack of skipping.

This is with the Android TV client, haven't really tried the others.

vlovich123|5 months ago

One thing I'll note is that while I've found every device surface I've come across has a Plex app, that isn't true of Jellyfin. YMMV.

vachina|5 months ago

They removed mobile device playback rights from users who paid for this feature specifically. Nobody in their right mind will do business with Plex.

gchamonlive|5 months ago

Do I still need to mess with filenames in order to have jellyfin pick them up to create the library?

vladmk|5 months ago

unfortunately things like this happen a lot more than they should

princevegeta89|5 months ago

I have been using Jellyfin for two years now. I am yet another happy user with no issues. I am happy that all my data is secure and there is nothing shady to happen.

It was not surprising when Plex had a huge investment coming from VCs who might as well just be connected to the movie industry and Hollywood as a whole, when they committed the act of banning Hetzner and all of their data centers.

They also had slowly become just another low quality streaming service like Tubi or IMDb with really low quality content being pushed down onto the homepage and actually keeping your own media hidden somewhere in the submenus. With their updates they threw the entire UX upside down.

Plex has the most mature platform to be frank. But I am happy I jumped ship as soon as I saw their predatory practices. They are not going to stop.

blactuary|5 months ago

I have never had any of their streaming content pushed onto my homepage nor had my own media hidden in submenus. I don't see anything but my own media

draxter65|5 months ago

You have to be a fool to use Plex, not only you are pirating, but also relying on a 3rd party company to handle your authentication. They already got hacked multiple times, only a matter of time till there is some copyright law enforcement event too.

If you really have to do it, use Emby or Jellyfin. At least those options are fully self hosted.

paulryanrogers|5 months ago

Plex has their own streaming-with-ads. And one can load it with whatever you want, including home movies or DVD backups.