7 ms·

Canva security breach: hacker claims to have stolen the data of 139M users

open-source-ux 7y ago
FAQ on the security breach on the Canva site: https://support.canva.com/contact/customer-support/may-24-security-incident-faqs/ https://support.canva.com/contact/customer-support/may-24-se...
- guitarbill 7y ago
  That's a pretty decent page. It doesn't seem so bad: > Passwords in their encrypted form were also obtained (for technical people: all passwords were salted and hashed with bcrypt); this means that all Canva user passwords remain unreadable by external parties. So while I hate the phrasing, this statement seems reasonable for once, if lacking in details how they came to the conclusion: > There have been no indications that any user designs have been accessed. Yet again though, bad practical password advice: > Passwords should be changed frequently (at least every 90 days). Why exactly? What does rotating passwords "at least every 90 days" buy me, against what threat model? Much better advice would be not to reuse passwords across sites, with links to password managers. Oh, and from what I could see, they don't offer any kind of 2FA. As a reminder, NIST 800-63 [0] has some decent guidelines, which they seem roughly to be advocating with the rest of the password advice. [0] https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret
  - JeremyBanks 7y ago
    Their breach notification email was awful: https://twitter.com/skwashd/status/1132258055767281664 https://twitter.com/skwashd/status/1132258055767281664
  - jeromegv 7y ago
    Crazy that a company of that size still doesn't use 2FA.
  - techslave 7y ago
    rotating your password protects you against sites that store passwords poorly. you can’t know what any site’s actual practices are. even when stated, the implementation may differ and be much weaker.
Phillipharryt 7y ago
Am I the only one shocked that a website just within the top 200 sites in the world has 139 million users? That's phenomenal (and potentially more if not all user details were hacked)
vijaybritto 7y ago
How is a design website having 189M users? This is astonishing more than the hack!
- r3bl 7y ago
  Because it made it easy to create inspirational posters and social media posts/avatars/covers. Its simplicity of creating a "good enough" design is what got non-designers registered, myself included.
  - rhizome 7y ago
    Sounds like Print Shop Pro 30 years ago! https://en.wikipedia.org/wiki/The_Print_Shop https://en.wikipedia.org/wiki/The_Print_Shop
- lm28469 7y ago
  You can sign up with facebook + there is a free 30 days trial. I wouldn't be surprised if a lot of people just signed up to check it out and if a lot of other users registered multiple times with different emails to have access to the free trial.
  - jeromegv 7y ago
    Hmm there is an entirely free version and has quite a lot of features, it's more than a trial. This is popular not just because of people re-creating accounts on different emails. https://about.canva.com/pricing/ https://about.canva.com/pricing/
- jslabovitz 7y ago
  It's also a common tool for non-designers who maintain their own websites. I heard about Canva through my girlfriend who used it on her Android phone to build banners, buttons, and other graphics for her Wordpress site.
- tyingq 7y ago
  Guessing, but maybe because a site that allows for somewhat discrete link spamming attracts spammers. Facebook says ~17 million fake account creation attempts per day[1] (that they catch after the fact), so it doesn't seem that unusual. [1] https://news.ycombinator.com/item?id=20000235 https://news.ycombinator.com/item?id=20000235 (3B/6 months == ~17M/day)
mtgx 7y ago
> Three days ago, the company announced it raised $70 million in a Series-D funding round, and is now valued at a whopping $2.5 billion. Were the investors made aware of the hack? I also wonder for how long they've known about it, but decided to keep it secret until they get new investment money.
- neya 7y ago
  Is there any way legally someone could trigger an investigation to validate if they had actually known about this before taking money?
  - ga-vu 7y ago
    The article clearly states the hack took place that morning. So no, the owners didn't know.
  - techslave 7y ago
    what’s the difference? this will blow over in a month, if not a week.
- gdhbcc 7y ago
  Given that the hack only occurred after the breach I would say no
neya 7y ago
Does this mean my Facebook and/or Google login details have been compromised? If you use Facebook or Google to log into Canva, rest assured those credentials are also encrypted and unreadable by external parties, so you do not have to change your password on Facebook or Google. I find this advice stupid, I know many hackers maintain and run through databases of password+hashes they can fetch original passwords from the hash. Also, Canva hasn't accepted nor denied if their salt was compromised, so without confirming these, I think it's just stupid to falsely assure "Don't change your passwords". Were my designs accessed? There have been no indications that any user designs have been accessed. Translation: "We don't know" I mean I'm just supposed to believe you at face value and not change my passwords? You just lost my password..
- guitarbill 7y ago
  > I know many hackers maintain and run through databases of password+hashes they can fetch original passwords from the hash. Exactly the point of a salt, to make it so rainbow tables need to be computed with a salt which ideally is different for every user. The salt being exposed doesn't change that. Edit: For Google/Facebook sign-in, which I presume is OAuth, it works differently and they're correct in saying your Google or Facebook password is not at risk. So usually, I'd agree, but in this case it's fairly reasonable to say it's unlikely anything was accessed. Cracking bcrypt takes time. If the hackers wanted to target an individual, they'd just phish them. Also, they literally say: > As a precaution, we recommend changing your Canva password. https://support.canva.com/contact/customer-support/may-24-security-incident-faqs/ https://support.canva.com/contact/customer-support/may-24-se...
  - deleted 7y ago
    [deleted]
- ahelwer 7y ago
  If you login with Facebook or Google then you log in using the OAuth2 protocol and the only thing Canva gets is a token signed by Facebook/Google saying you are who you say you are.
deleted 7y ago
[deleted]
willbw 7y ago
It seems as though these breaches have limited effect on user behaviour. Perhaps I'm just being cynical but if you are aren't getting access and you are just getting hashed passwords, do people even care? Does it even matter? Of course names and contact details are not great. I get that. But will this even effect Canva?

FAQ on the security breach on the Canva site: https://support.canva.com/contact/customer-support/may-24-security-incident-faqs/ https://support.canva.com/contact/customer-support/may-24-se...

guitarbill 7y ago
That's a pretty decent page. It doesn't seem so bad: > Passwords in their encrypted form were also obtained (for technical people: all passwords were salted and hashed with bcrypt); this means that all Canva user passwords remain unreadable by external parties. So while I hate the phrasing, this statement seems reasonable for once, if lacking in details how they came to the conclusion: > There have been no indications that any user designs have been accessed. Yet again though, bad practical password advice: > Passwords should be changed frequently (at least every 90 days). Why exactly? What does rotating passwords "at least every 90 days" buy me, against what threat model? Much better advice would be not to reuse passwords across sites, with links to password managers. Oh, and from what I could see, they don't offer any kind of 2FA. As a reminder, NIST 800-63 [0] has some decent guidelines, which they seem roughly to be advocating with the rest of the password advice. [0] https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret
- JeremyBanks 7y ago
  Their breach notification email was awful: https://twitter.com/skwashd/status/1132258055767281664 https://twitter.com/skwashd/status/1132258055767281664
- jeromegv 7y ago
  Crazy that a company of that size still doesn't use 2FA.
- techslave 7y ago
  rotating your password protects you against sites that store passwords poorly. you can’t know what any site’s actual practices are. even when stated, the implementation may differ and be much weaker.

Phillipharryt 7y ago

Am I the only one shocked that a website just within the top 200 sites in the world has 139 million users? That's phenomenal (and potentially more if not all user details were hacked)

vijaybritto 7y ago

How is a design website having 189M users? This is astonishing more than the hack!

r3bl 7y ago
Because it made it easy to create inspirational posters and social media posts/avatars/covers. Its simplicity of creating a "good enough" design is what got non-designers registered, myself included.
- rhizome 7y ago
  Sounds like Print Shop Pro 30 years ago! https://en.wikipedia.org/wiki/The_Print_Shop https://en.wikipedia.org/wiki/The_Print_Shop
lm28469 7y ago
You can sign up with facebook + there is a free 30 days trial. I wouldn't be surprised if a lot of people just signed up to check it out and if a lot of other users registered multiple times with different emails to have access to the free trial.
- jeromegv 7y ago
  Hmm there is an entirely free version and has quite a lot of features, it's more than a trial. This is popular not just because of people re-creating accounts on different emails. https://about.canva.com/pricing/ https://about.canva.com/pricing/
jslabovitz 7y ago
It's also a common tool for non-designers who maintain their own websites. I heard about Canva through my girlfriend who used it on her Android phone to build banners, buttons, and other graphics for her Wordpress site.
tyingq 7y ago
Guessing, but maybe because a site that allows for somewhat discrete link spamming attracts spammers. Facebook says ~17 million fake account creation attempts per day[1] (that they catch after the fact), so it doesn't seem that unusual. [1] https://news.ycombinator.com/item?id=20000235 https://news.ycombinator.com/item?id=20000235 (3B/6 months == ~17M/day)

mtgx 7y ago

> Three days ago, the company announced it raised $70 million in a Series-D funding round, and is now valued at a whopping $2.5 billion. Were the investors made aware of the hack? I also wonder for how long they've known about it, but decided to keep it secret until they get new investment money.

neya 7y ago
Is there any way legally someone could trigger an investigation to validate if they had actually known about this before taking money?
- ga-vu 7y ago
  The article clearly states the hack took place that morning. So no, the owners didn't know.
- techslave 7y ago
  what’s the difference? this will blow over in a month, if not a week.
gdhbcc 7y ago
Given that the hack only occurred after the breach I would say no

neya 7y ago

Does this mean my Facebook and/or Google login details have been compromised? If you use Facebook or Google to log into Canva, rest assured those credentials are also encrypted and unreadable by external parties, so you do not have to change your password on Facebook or Google. I find this advice stupid, I know many hackers maintain and run through databases of password+hashes they can fetch original passwords from the hash. Also, Canva hasn't accepted nor denied if their salt was compromised, so without confirming these, I think it's just stupid to falsely assure "Don't change your passwords". Were my designs accessed? There have been no indications that any user designs have been accessed. Translation: "We don't know" I mean I'm just supposed to believe you at face value and not change my passwords? You just lost my password..

guitarbill 7y ago
> I know many hackers maintain and run through databases of password+hashes they can fetch original passwords from the hash. Exactly the point of a salt, to make it so rainbow tables need to be computed with a salt which ideally is different for every user. The salt being exposed doesn't change that. Edit: For Google/Facebook sign-in, which I presume is OAuth, it works differently and they're correct in saying your Google or Facebook password is not at risk. So usually, I'd agree, but in this case it's fairly reasonable to say it's unlikely anything was accessed. Cracking bcrypt takes time. If the hackers wanted to target an individual, they'd just phish them. Also, they literally say: > As a precaution, we recommend changing your Canva password. https://support.canva.com/contact/customer-support/may-24-security-incident-faqs/ https://support.canva.com/contact/customer-support/may-24-se...
- deleted 7y ago
  [deleted]
ahelwer 7y ago
If you login with Facebook or Google then you log in using the OAuth2 protocol and the only thing Canva gets is a token signed by Facebook/Google saying you are who you say you are.

deleted 7y ago

[deleted]

willbw 7y ago

It seems as though these breaches have limited effect on user behaviour. Perhaps I'm just being cynical but if you are aren't getting access and you are just getting hashed passwords, do people even care? Does it even matter? Of course names and contact details are not great. I get that. But will this even effect Canva?