Does this mean my Facebook and/or Google login details have been compromised?
If you use Facebook or Google to log into Canva, rest assured those credentials are also encrypted and unreadable by external parties, so you do not have to change your password on Facebook or Google.
I find this advice stupid, I know many hackers maintain and run through databases of password+hashes they can fetch original passwords from the hash. Also, Canva hasn't accepted nor denied if their salt was compromised, so without confirming these, I think it's just stupid to falsely assure "Don't change your passwords".
Were my designs accessed?
There have been no indications that any user designs have been accessed.
Translation: "We don't know"
I mean I'm just supposed to believe you at face value and not change my passwords? You just lost my password..
> I know many hackers maintain and run through databases of password+hashes they can fetch original passwords from the hash.
Exactly the point of a salt, to make it so rainbow tables need to be computed with a salt which ideally is different for every user. The salt being exposed doesn't change that.
Edit: For Google/Facebook sign-in, which I presume is OAuth, it works differently and they're correct in saying your Google or Facebook password is not at risk.
So usually, I'd agree, but in this case it's fairly reasonable to say it's unlikely anything was accessed. Cracking bcrypt takes time. If the hackers wanted to target an individual, they'd just phish them.
Also, they literally say:
> As a precaution, we recommend changing your Canva password.
If you login with Facebook or Google then you log in using the OAuth2 protocol and the only thing Canva gets is a token signed by Facebook/Google saying you are who you say you are.
There are benefits & drawbacks; it does greatly improve security, but Google & Facebook get data on what services you use. It would be nice to have a privacy-focused nonprofit identity provider, but it's very hard to build up that network - both in users, who won't sign up unless sites accept it, and in sites, who won't accept it until there are users.
Microsoft (disclaimer: I work there, but not on this product) is trying to get a decentralized identity thing off the ground[0]. It uses the blockchain, so I was pretty skeptical at first but it's actually pretty well-though-out (including the "unhappy path" where users are unable to identify themselves after losing a key or whatever).
> Also, Canva hasn't accepted nor denied if their salt was compromised
AFAIK, it's assumed that the salt is compromised with the hash - it's stored alongside the hash. The point of the salt is to prevent lookups.
Telling you to change your Facebook/google password _is_ pointless, as they don't have those.
> Translation: "We don't know"
I'm not sure what else they are supposed to say - saying they have could cause unnecessary panic and is probably misleading, but they can't conclusively say no as the evidence may have been hidden.
I mean I'm just supposed to believe you at face value and not change my passwords? You just lost my password..