Quote from: mathgal23 on June 07, 2015, 09:10:55 AM

Quote from: entertheabyss on June 06, 2015, 07:57:58 PM

screenshot:

This looks great! Will multi sig be used or will the exchange have to be trusted by its users?

At this moment MutliSig is not implemented as it is not practical and really only good for buyer/seller/escrow type marketplaces. If a trader feels anxious about holding funds on the exchange the most secure option would be to hold them in a privately owned wallet on their computer and only deposit the minimum required for trading. One of the security features that is being implemented is call TimeVault. When a trader stores funds in a time vault the funds are sent to a secure cold storage wallet and the user received a Txid so they can monitor this cold wallet on the block chain themselves. All withdrawals from the TimeVault are delayed for ~ 7 days so if a hacked gained access to your account you would have 7 days to before they could steal your funds where you could freeze your account. Similarly funds in cold storage cannot be accessed if we get hacked.

Security is a priority and we have the following security measures among many others:

Database:
    Atomic Request based Transactions
    ACID complient
Wallets:
   Store the majority of customer funds in a cold storage wallet
   Double check withdrawal submissitions for overdrawing
Authenication:
   Passwords are stored as salted hashes
   Secure session based authentication
Input:
   Regex to sanitize input strings
   Limit post and get requests to minimize Denial of Service attacks and prevent cracking account passwords and other malacious activity.
   Protect against Cross-site request forgery using csfr tokens
Operating Environment:
   Hosted on Gentoo Hardened OS
   SELinux
   GRsecurity