That's a pretty decent page. It doesn't seem so bad: > Passwords in their encrypted form were also obtained (for technical people: all passwords were salted an

That's a pretty decent page. It doesn't seem so bad: > Passwords in their encrypted form were also obtained (for technical people: all passwords were salted and hashed with bcrypt); this means that all Canva user passwords remain unreadable by external parties. So while I hate the phrasing, this statement seems reasonable for once, if lacking in details how they came to the conclusion: > There have been no indications that any user designs have been accessed. Yet again though, bad practical password advice: > Passwords should be changed frequently (at least every 90 days). Why exactly? What does rotating passwords "at least every 90 days" buy me, against what threat model? Much better advice would be not to reuse passwords across sites, with links to password managers. Oh, and from what I could see, they don't offer any kind of 2FA. As a reminder, NIST 800-63 [0] has some decent guidelines, which they seem roughly to be advocating with the rest of the password advice. [0] https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret