kraken safest crypto exchange

The crypto world has a hacking problem.

Specifically, cryptocurrency exchanges have a hacking problem. In 2018 alone, we’ve seen at least four major exchange hacks with more than $750 million stolen (not to mention a few smaller exchange hacks).

Security and protection from hackers have become paramount when using a crypto exchange, but how do you assess the security threat?

Luckily, a prominent cybersecurity firm, Group-IB, has done it for us. In a new report, published in partnership with CryptoIns, every major crypto exchange is ranked based on a variety of security features.

Kraken is the Most Secure Cryptocurrency Exchange

Founded in 2011, Kraken is one of the oldest crypto exchanges out there. In that time, they have developed one of the most impenetrable exchanges.

Kraken was the first exchange to pass a verified proof-of-reserves audit and is integrated with BitGo, one of the leading cryptocurrency security companies.

The Group-IB report cites Kraken as the most secure exchange as a result. Further, Kraken is the only name in the report’s top-tier group, considered the least risky.

Further reading: 8 Cryptocurrency Best Practices (Keep Your Crypto Safe)

The Four-Tier Ranking

Group-IB divides the major cryptocurrency exchanges into four groups based on their security features. Below are the results:

Group A – Kraken.

Group B – Bittrex, Coinbase Pro

Group C – Binance, Bitifinex, Bitmex, Bithumb, Poloniex, Localbitcoins, MyEtherWallet.

Group D – OKEx, Huobi Pro, Coincheck, Bitstamp, Bit-Z, Zaif

OKEx: “Completely Uninsurable”

Group-IB considered the last pool “completely uninsurable” due to the security risk involved. That should come as a warning sign to anyone trading or storing their cryptocurrencies on these exchanges.

Perhaps the most surprising name in this group is OKEx. The exchange is now the second-largest in the world by 24-hour volume and was named the “Crypto Exchange of the Year” at the recent Malta Blockchain Awards.

How Were the Crypto Exchanges Ranked?

Group-IB compiled the rankings based on a number of security features including:

  • Technical security levels.
  • The reliability of private key storage.
  • Password requirements and 2FA options.
  • Protection of customer data.
  • Risk management.
  • Know your customer (KYC) and anti-money laundering (AML) procedures.

The exchanges were also submitted to penetration testing and finally ranked according to the relative cost of insuring them.

The exact scores in each of the categories were not released publicly for confidentiality reasons.

Caution: Don’t Keep Your Money on an Exchange for Longer Than You Need To

These rankings are vital for anyone looking to buy or sell cryptocurrencies. However, it doesn’t change the fact that keeping your cryptocurrency on an exchange is incredibly risky.

Hackers deliberately target exchanges and, as you can see above, not all institutions are secure.

The best course of action is to keep your cryptocurrency off the exchange and in a cold-storage wallet (i.e. not connected to the internet).

Exchanges are great for buying, selling, and trading, but don’t keep store your money there for a long period of time. If you don’t have 100% control of your private keys, you don’t have 100% control of your crypto.

Learned something new in this article? Subscribe to the Block Explorer newsletter.

Included in the original Lightning Network specification is a proposal to use Onion routing for transactions. Onion routing, the same technology that powers the Tor network, would increase both security and privacy on the Lightning Network.

What this means for privacy

Currently, when sending transactions that cross multiple channels over the Lightning Network, each node in the chain knows everything about the transaction. Information such as who it came from, where it is going, and how much is being transferred is exposed. Having this information exposed is a privacy issue, as anyone can see who you are sending a transaction to. Onion routing intends to solve this issue. The content of the transaction is hidden to all but those involved when using Onion routing. Every other node in the chain simply knows enough to pass it along.

How Onion routing works

With Onion routing, each node is only told enough information to pass the transaction along to the next node on the route. This means that no-one can snoop on your transactions, but they will still get to their destination. Onion routing works by wrapping a packet (in this case a transaction) in more and more data. One piece of data for each node on the route. When passing through a node, the outermost data is decrypted and used to identify the next node. Before sending the packet, the node destroys the data that it used to figure out where the packet goes next and puts the data the next node will use in its place.

In the case of the Lightning Network, the node does the same process mentioned before but also collects its fee. The origin node calculates and adds each node’s fee during the creation of the transaction.

QuadrigaCX is a Vancouver, Canada based cryptocurrency exchange that hosts ten trading pairs. It finds itself at number 20 on BlockExplorer’s top 25 cryptocurrency exchanges of 2017 list.

QuadrigaCX is well equipped for any traders looking to trade with CAD. There are a large number of options for both CAD and USD deposit and withdrawal. QuadrigaCX offers an API for programmatic trading. As such, it is recommended for any level of Canadian trader looking for a local exchange.

QuadrigaCX

quadrigacx cryptoURL: www.quadrigacx.com
Launched: 2013
Trading pairs: 10
Deposit Fees: Yes (Not for crypto)
Withdrawal Fees: Yes (Not for crypto)
Trading fees: Yes 0.2% – 0.5%
Verification: Yes, two levels
Margin Trading: No

Registration

Registering on QuadrigaCX is a single step process that requires an email address, your first and last name, and a PIN that will be used when making transactions.

Verification

There are two methods of acquiring verification on QuadrigaCX. It is recommended you complete both, as some of the fiat funding methods available require you to have completed a specific verification method.

The first verification method is to upload a copy of your ID and a proof of residence. And the second asks you questions about your credit information, provided by Equifax.

Fees

QuadrigaCX does not use the usual maker/taker scheme for its fees. Instead, QuadrigaCX has flat fees for trading pairs. Specifically, 0.5% for BTC/CAD, BTC/USD, ETH/CAD, LTC/CAD, BCH/CAD and BTG/CAD, and 0.2% for ETH/BTC, LTC/BTC, BCH/BTC and BTG/BTC.

For deposits and withdrawals, QuadrigaCX charges no fees for crypto or most fiat, with only CAD having fees for some methods. You can see an overview of the fees on QuadrigaCX’s funding page. There are very small minimum limits on crypto deposit and withdrawal, while fiat has both minimums and maximums that change depending on the deposit or withdrawal method used.

Interface

The interface QuadrigaCX provides is an off-white with muted colors. While there is, unfortunately, no dark mode available, the off-white background with muted colors is not as overly bright as some other exchanges.

At the top of the page, you will find information about the currently selected trading pair, a place to select trading pairs and your current balances.

The trading interface is broken into tabs, and unfortunately, there is no way to get a chart, an order book, and an order submission form on the same page. All of the tabs have a vertical design, which leaves a substantial amount of dead space on either side of the interface. Overall, while the trading interface does provide enough information, it could be laid out more efficiently.

Security

QuadrigaCX has excellent security practices. When making any transaction, you are required to enter an additional pin for confirmation. The login page is protected from replay attacks by way of a timeout. You can secure your account with Two Factor Authentication, which can be either email based or Google Authenticator based. And to top it all off, you can have all email sent to you from QuadrigaCX encrypted with your PGP key.

Some ambiguous wording during the registration process implies that you will be emailed both your password and transaction pin. The resulting email does not contain any sensitive information other than your client ID.

One of the most powerful aspects of blockchain technology is that it is generic, and not limited to a few vertical applications. Recent examples reported here on Block Explorer News from widely-differing fields include using a blockchain to store publications, to manage real-time drone flight data, and as the basis of a mobile voting platform. To that growing list can be added the important domain of personal genomics – the sequencing and analysis of an individual’s DNA – thanks to a new service from the company Nebula Genomics:

We will spur genomic data growth by significantly reducing the costs of personal genome sequencing, enhancing genomic data protection, enabling buyers to efficiently acquire genomic data, and addressing the challenges of genomic big data. We will accomplish this through decentralization, cryptography, and utilization of the blockchain.

The potential of personal genomics has been clear for some time. By sequencing the DNA of many individuals, the hope is that the diagnosis and treatment of existing diseases will be improved, along with finding ways to prevent future health problems. Personal genomics potentially allows personalized therapies, tailored precisely to individuals on the basis of their DNA. And by combining millions of genomes it will be possible to understand diseases better, and come up with new drugs to treat them.

Current approaches have significant problems. The cost of sequencing an individual’s complete DNA has dropped significantly in recent years to around $1000, and is expected to fall below $100 in the near future. However, the equipment required to do so is still expensive, which means that sequencing is typically carried out by a few large organizations. They not only store the results in a central database, which represents a security risk for such sensitive information, but they typically retain ownership of that sequence data. Financial benefits from discoveries made using the genomic data also generally stay with the organizations or companies that hold the DNA. Nebula Genomics hopes to address all those problems using blockchain technology.

The central idea of the company’s approach is that individuals retain ownership and control of their sequenced genomic data, but sell access to it in a secure way. All data-sharing records are stored immutably in the Nebula blockchain, which is based on Ethereum, and plays a key role in mediating transactions between the individual and the companies that wish to use the genomic data. These will typically be pharmaceutical and biotech companies. Currently, they are buying DNA data in bulk from existing genomics companies, or are setting up their own sequencing programs.

Using the Nebula network, individuals would be paid by companies for access to their DNA using tokens purchased by the latter from Nebula Genomics, with fiat money. While sharing data and receiving payments, individuals remain pseudo-anonymous. Nebula network addresses are cryptographic identifiers that are not associated with any personal information. Individuals would in turn use the tokens to pay Nebula Genomics for the genome sequencing. In addition, companies could pay individuals tokens for completing surveys that provided health information to be used alongside their genomic data. The use of Ethereum smart contracts allows companies to create customized surveys:

data buyers may choose to pay all survey participants an equal amount of Nebula tokens or alternatively define different token amounts that will be awarded for different combinations of responses. For example, if a survey participant is found to be affected by a condition that is of interest to the data buyer, the highest token reward will be automatically paid out. Responses that suggest that the survey participant is not affected by the condition in question will trigger a lower token payment. Contradictory responses indicating dishonesty will not be rewarded.

The main Nebula network is built on top of the Blockstack framework: “an open-source effort to re-decentralize the internet; it builds a new internet for decentralized applications and enables users to own their application data directly.” It, too, depends on blockchain technology for critical aspects:

Identity is user-controlled and utilizes the blockchain for secure management of keys, devices and usernames. When users login with apps, they are anonymous by default and use an app-specific key, but their full identity can be revealed and proven at any time. Keys are for signing and encryption and can be changed as devices need to be added or removed.

Under the hood, Blockstack provides a decentralized domain name system (DNS), decentralized public key distribution system, and registry for apps and user identities.

The user-centric approach of Blockstack fits well with the philosophy behind Nebula Genomics. As a result, individuals not only retain control of their sequence data but are free to store it on any service that supports the Blockstack storage system. This portability ensures that users of the Nebula platform are not locked into the company, and can use their data outside the Nebula network. Nebula’s DNA software will be available as a Blockstack distributed app that is executed locally on a user’s personal data, allowing individuals to analyze their own DNA.

When other companies are granted permission by individuals to use personal genomic data within the Nebula Genomics framework, there are additional privacy safeguards. Once access to an individual’s DNA sequence has been purchased and recorded in the Nebula blockchain, the data is sent in an encrypted form to special compute nodes, which use two advanced technologies to protect sensitive personal data: Intel’s Software Guard Extensions (SGX) and homomorphic encryption.

SGX operates by allocating hardware-protected memory where code and data reside, called an enclave. By restricting processing of genomic data to enclaves on compute nodes, the risk of privacy loss is reduced. SGX can be combined with homomorphic encryption of DNA sequences to speed up certain operations. Homomorphic encryption allows data to be pre-processed without needing to decrypt it. It is then passed to an enclave for decryption and analysis. The Blockstack underpinning means that secure compute nodes can be operated by Nebula Genomics; on the servers of companies that have bought access to an individual’s genomic data; or through any third party that complies with the overall architecture.

As the above indicates, Nebula Genomic’s platform addresses several key challenges involving the storage and processing of highly personal data in a way that leaves the individual in control. Since similar problems exist across most industries, this suggests that these kinds of blockchain-based frameworks could be applicable far beyond the world of DNA sequencing and analysis.

Featured image by Nebula Genomics.

Monero (XMR) is a privacy-oriented cryptocurrency that aims to keep all transactions on its blockchain private from others. It does this in two ways, stealth addresses, and ring-CT. Monero uses the CryptoNote algorithm, first used in the now infamous ByteCoin. CryptoNote is an ASIC resistant algorithm, intending to make mining long-term feasible on consumer computers, thus helping to decentralize the network. GPUs still have somewhat of an advantage, but the gap is nowhere near that in Scrypt (Litecoin) or SHA256 (Bitcoin) coins.

Mining

Any computer can mine Monero, though the newer the better. Older CPUs may not have the required AES instruction set. There are various options for mining software, including the infamous CoinHive javascript based miner. XMR-Stak is recommended by the community for simultaneous mining on a CPU and one or more GPUs. Please note that the mining software MinerGate is a scam, it lies about your current hash rate, thereby skimming your profits. You can find a list of other scams on the Monero subreddit

ASIC Resistance

Monero’s algorithm, CryptoNote, is ASIC (Application Specific Integrated Circut) resistant, this is due to its use of large amounts of processor cache. Cache is expensive to manufacture compared to other parts of an integrated circuit, making developing an ASIC to mine CrytoNote difficult. Monero also has a bi-annually scheduled hard fork that could be used to change the algorithm, thereby staying ahead of  ASIC designers.

Scheduled hard forks

The developers of Monero execute a bi-annual hard fork. Changes to the algorithm and other internal parts of the cryptocurrency require hard forks. The next hard fork is scheduled for sometime in March 2018, the exact date will be decided later in the year.

Privacy and security

Monero users have always-on privacy – Transactions that are not private cannot be sent over the blockchain. When sending a transaction on the Monero blockchain, a ring signature is created that hides the true transaction in a list of others. All of them using stealth addresses to hide the target of the transaction. The only available information on the blockchain is that a transaction happened. The sender can decrypt the transaction using the transaction key and the target address, either with the GUI wallet or an online tool such as xmrchain or other block explorers. Though this does require you sharing your private keys for that transaction with the block explorer service.

There are only two ways to view the balance of a Monero address; owning the address or getting a view key from the owner of the address. A view key allows anyone to view the content of a Monero address without being able to spend said contents.

Wallets

Currently, the recommended desktop wallet is the official wallet, which supports both running a local node and connecting to a remote one. The MyMonero wallet is another, more convenient option, though you sacrifice some privacy for convenience, as your private keys are stored on MyMonero’s servers. This means that you must trust MyMonero with your money.