Quote from: TheSecObserver on March 19, 2014, 02:40:03 AM

Quote from: dbt1033 on March 18, 2014, 11:29:46 PM

I reallly liked coinex.pw... It's a shame this happened. At least they aren't giving you guys the runaround, takes a lot of balls to come out and be honest.

In the meantime, you guys should check out ATOMIC-TRADE

Here's a excerpt from an article about the site:

"Atomic-Trade is integrated with a high speed distributed cache and microsoft sql server enterprise which enables it to host a virtually unlimited user capacity. It also assures that users will have no interruption as changes and updates are made on a multi-tiered system. User capacity is virtually unlimited since servers can be deployed on demand within minutes. Having a multi tier redundant system also means changes and updates can be deployed with little or no user interruption. If a server goes offline more will spool up to take its place or scale back during times of low usage.

Security is tight on this exchange platform as it is hack proof. The password storage system does not store passwords, instead it utilizes a unique hash key that is generated for each users password.

In addition, with this extraordinary multi-tier system the actual coin wallets, database, and trade engine are only accessible by designated servers in the same private network. Only the final tier is accessible to the internet via a secure connection. A 2fa option will also be available provided by Authy ensuring users the utmost in security."

The owner also paid a web security firm to audit the site.

Here's the report:

Really sorry for your losses. Give Atomic a chance if you are willing to trust another exchange. They are as secure as it gets.

I use Coinex, I got scared, I started closely following this thread. I decided not to post, too much speculation. But as of a few hours ago I have enough assurance to hold off on drawing conclusions for a few more days. That said...

A few things wrong with your post, nobody, I mean *nobody* worth their salt that works in the security industry respects these claims.

Let me break down the security-relevant problems I have with this blurb:

"Hack proof" - really?! Do I need to point out the problems with that statement? Hack proof from what? A kiddie with no funding? A well-funded nation state? Someone slightly between the two? A statement like that reflects marketing, not security. State your threat model, identify your risks, characterize the attack vectors, tell us how they are mitigated. "Hack proof" is marketing bull shit.

"The password storage system does not store passwords, instead it utilizes a unique hash key that is generated for each users password." - WTF. That is called "hashing passwords." Congrats on security innovation. Let me guess, the next press release will state a second innovation has been introduced called salting, to mitigate magical rainbow table attacks. And that claim alone backs up "hack proof". Pfft.

Multi-tier systems are SOP these days. Guess what, information flows between them out of necessity. That information may be malicious in nature. Multi-tier systems do not necessarily mitigate vulnerabilities nor do they enhance the security posture of the overall solution.

As we all know at this point TFA is not work the bits it takes to store the salt if the guts have not been thoughtfully architected with security in mind from the get-go. And I'm not getting that feeling from this blurb.

The image shows security measurement based on a relatively static set of tests, easily defeatable using countless tools, and only for the perimeter systems. But images of security pies make people feel good. Pies taste good. Therefore, through correlation, security is good.

Moving forward, a real, external third-party producing an exhaustive security analysis including information of non-perimeter systems would be more assuring than the current information provided.

And before the trolls jump down my throat, yes I realize this is my first post. I've never had to participate until now as lurking was sufficient. Now, I feel obligated to chime in to save people from marketing jargon. Security is my day job, I hate seeing marketing crap being used to trick those that aren't experts in the field into trusting some organization. Pick your poisons carefully, my money remains in wallets, not exchanges spamming a thread where there is a lynch mob in-progress.

QFT