←back to thread

Plex Security Incident

(links.plex.tv)
104 points andyexeter | 3 comments | | HN request time: 0s | source
Show context
Someone1234 ◴[] No.45175111[source]
> Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party.

I am glad they were hashed, but that's a misleading statement. The point of hashing is to slow an attacker down, even with full best security practices (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when, not if.

replies(6): >>45175194 #>>45175199 #>>45175211 #>>45175220 #>>45175316 #>>45175644 #
1. mr90210 ◴[] No.45175194[source]
> (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when, not if

How much compute/gpu and hard dollars would hackers need in order to reverse engineers those stollen passwords?

replies(2): >>45175294 #>>45175342 #
2. kstrauser ◴[] No.45175294[source]
Approximately “infinite”.
3. reactordev ◴[] No.45175342[source]
They borrow unsecured k8s clusters on AWS. That’s not redis running…