Kraken Blog

as far as i know, we do not store fingerprints but i kind of hash of the fingerprint. so if this hash is stolen, it should not be possible to reconstruct the fingerprint "curve points" to use it on your device. but if someone does gain access to your device, i'd say that device is fucked anyway.

if your device is locked with fingerprint, it will be FAR easier to grab your fingerprint from something you touched. and creating a fingerprint impression from this will be VERY easy. it takes simple glue and it is very low-cost. you use cyanolate and a gummy bear. the gummy bear will hold the fingerprint while you apply it to the sensor :)

here are a few links : https://blog.kraken.com/product/security/your-fingerprint-can-be-hacked-for-5-heres-how https://blog.talosintelligence.com/fingerprint-research/ https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid

fingerprints are a conveniance. they will work at home where you want that phone to be protected from your kid you don't want to be accessing internet too easily.

as a security measure, it's stupid because it is very easy to grab fingerprints : you leave those all around. it is also very easy to just create an impression from a picture with a good quality camera. and once it's compromised, you CANNOT change your fingerprint for another one.

do. not. use. fingerprints. for. security.

Kraken Digital Asset Exchange | Engineering Managers | Remote | https://www.kraken.com/en-us/careers

Kraken was founded in 2011, being a pioneer exchange in the crypto market. Kraken is in rapid expansion of its engineering teams. At Kraken we have a remote global workforce, allowing our employees to have more freedom in choosing how to organize their routine and balance work and personal life.

April Highlights:

Engineering Managers - Core Backend - Rust

Engineering Manager - Kraken Futures - Rust

We’re also hiring software engineers with the following skillsets:

Backend (Rust/Go/Typescript/PHP),

Frontend (ReactJS/ReactNative/Flux/Typescript/Sass/Less/NextJS).

Further information on our Engineering Blog: https://blog.kraken.com/engineering/

Please apply directly on our Lever careers page at https://jobs.lever.co/kraken.

"The results of our most recent audit were once again verified by top-25 global accounting firm, Armanino LLP. " (1)

So from this I read that Kraken has done audit themselves and then some other firm has verified it. This (if true) is called attestation, and not audit. Attestations are an empty claim with no proof in the tokenbro industry.

And second issue I see (directly related to the first) - they list some tokens they are auditing. Auditing on chain. But what if the Kraken company has a completely off the chain liabilities? Like a contract where they loan money/btc to some shady person and get some worthless tokens as a collateral in return. You can't see this on chain, only a real independent audit can uncover such things.

(1) https://blog.kraken.com/post/15002/kraken-proof-of-reserves-...

This is a follow-up of the 2021 post: https://blog.kraken.com/product/engineering/oxidizing-kraken-improving-kraken-infrastructure-using-rust

We originally introduced Rust (back in 2018) as a small experiment alongside existing systems, mostly to validate safety and performance assumptions under real production load.

Over time, the reduction in memory-related incidents and clearer failure modes led us to expand its use into increasingly critical paths. This post focuses less on “Rust is great” and more on the tradeoffs, mistakes, and organizational changes required to make that transition work in practice.

Happy to answer questions about what did not work, where Rust was a poor fit, or how we handled interop with existing systems.

In regards to the hardware wallets, I'd buy 2 Trezors and store them in separate locations

If you're going bitcoin-only, you should consider Coldcard, which is the hardware wallet the hardcore bitcoiners love [1].

Cobo Vault is fairly new on the scene but is also getting rave reviews [2].

If you're going multisig, you should buy hardware wallets from different vendors to guard against a flaw or security vulnerability from any one vendor. For example, Trezor has some issues recently [3].

[1] https://coldcardwallet.com

[2] https://cobo.com/hardware-wallet

[3] https://blog.kraken.com/post/3662/kraken-identifies-critical-flaw-in-trezor-hardware-wallets/

Coinbase is technologically kind of a joke. Their matching engine is crap. They haven't even adopted bech32. They just do the bare minimum to keep things working for 99% of users, and for the unlucky 1% they follow the same customer support strategy as Google (aka automated emails but no actual humans). Unfortunately Coinbase is YC and they do a lot of marketing, so people who are just getting started tend to think they're a frontrunner.

If you want an exchange that keeps up with the ecosystem you should use someone else. Kraken qualifies: https://blog.kraken.com/post/13502/kraken-now-supports-instant-lightning-network-btc-transactions/