Topic: [ANN] KRAKEN.COM - Exchange with USD EUR GBP JPY CAD BTC LTC XRP NMC XDG STR ETH - page 262. (Read 628818 times)

thanks for update, good to know you did not forget about it.

kind of new error occurs during the last hour:
using cURL library, even if ssl verify is turned off.
It is working ok since the last few minutes. Hope it was temporary issue, maybe something related to cloudflare ssl cert update.

Not yet. I won't be able to say what happened (and won't know myself) until we have a fully tested fix in place. So far as I know, the incident you mention above is the only example of it in the wild, so it seems to be triggered by a pretty rare set of circumstances.

Dargo, any update on this issue? we still don't know what happened.

it'll be great if different currency can be used to trade with coins. i have krw account but i can only trade in krw but i cannot trade in euros or usd. so far the most active market is euros but the krw market & vol is pretty low. i hope kraken can consider looking into this.

Not a stupid question - you're more secure with 2FA, but Heartbleed might still pose a vulnerability. If you have 2FA and your password is leaked, then your OTP could be leaked at the same time. Since it's just a one-time password, though, the leaked OTP couldn't be used again to gain access to your account.

However, if the key used to set up your 2FA is leaked, then an attacker might be able to appropriate your 2FA. Google Authenticator TOTP uses the key + current time to generate the OTP, so if someone obtains your key it'd be pretty easy to generate OTPs. GA HOTP would be harder because it uses the key + a counter to generate the OTP, so an attacker would need to know both the key and where the counter is at. (HOTP is a bit more secure for this reason, but also harder to recover if it goes out of sync, since you'd have to sync counters rather than just doing a time sync). Yubikey is also counter-based, so it'd be similar to GA HOTP.

Your 2FA is less likely to be affected than your password, but it's probably a good idea to re-do your 2FA after our SSL certificates are reissued.

"stupid" question...: is the two factor key also affected? Or is it still save with 2FA even if someone got the password?

Update on the "Heartbleed" SSL vulnerability:

We now know that is was in fact possible to obtain Cloudflare's private keys for SSL certificates via the Heartbleed vulnerability. Cloudflare issued a challenge for this and it was solved about 9 hours later. You can read the update from Cloudflare here:

http://blog.cloudflare.com/answering-the-critical-question-can-you-get-private-ssl-keys-using-heartbleed

It's still unlikely that any private keys were actually leaked. But as I said before, users should create a new password after we have new certificates issued (we'll let you know when this happens). Cloudflare is stepping up their efforts to get new certificates issued as soon as possible.

Hi cyber_hulk - I'd be happy to take a look at your case, but to do so I'll need your ticket number (please send it by PM).

It was just coincidence. We happened to be updating our front end before the announcement and OpenSSL showed up as needing an update. Cloudflare claims to have known in advance, though it seems they weren't fully patched yet until a little while after the announcement.

Hello,

i would like to share my experience with kraken so far. i do like their website, trading features and security.

however i had serious problems doing withdraws to my bank account which were delayed for 4-6 weeks.

i made a withdraw (international bank wire) to my thailand bank account on March 19th with ID: ACB4AOQ

Until today i havent received my money. i already contacted the support but they said they cant do much and the bank is investigating and it can take another 4 weeks or so.

the point is that i need my money right now, i have done nothing wrong.

on a previous withdraw to the same bank account i had a similar delay where it took 6 weeks until i got my money credited to my bank account ( ID: ACB5Z34 ).

i contacted the support and they told me that the bank is a bit behind for whatever reason and that they catched up with all bank wires and 2 days later after i contacted the support i finally got my money in my account.

so please advise what we can do because i'm a little bit stuck and i certainly dont want and cant wait another 4-6 weeks.

even though i really like kraken as an exchange with all its features and good security those delays in withdrawing money to bank account are not acceptable.


regards

cyber_hulk

How had you managed to find out about the bug before the news hit the front pages? From what I know even big corporations like Yahoo were not aware.

Update on the "Heartbleed" SSL vulnerability:

As I said before, our site isn't vulnerable. We already had the patch in place before news of the bug went public. There are no signs our site was actually compromised by this vulnerability, but it nonetheless is possible that passwords were leaked prior to the patch. So as a precaution, you should change your password, and the same goes for passwords to other sites.

However, even if you've already changed your password, there's still a remote possibility that the new password isn't safe. This is because Cloudflare, which we use, hasn't yet revoked and reissued their SSL certificates. If any of the private keys for the certificates were leaked prior to the time that Cloudflare had the patch in place, this would still leave a vulnerability. Cloudflare thinks it's most likely impossible that any of the private keys were leaked. But as a precaution they're going to revoke and reissue certificates. We'll let you know when they do this, because you probably should change your password again after the new certificates are in place. See the link below for more information from Cloudflare.

http://blog.cloudflare.com/answering-the-critical-question-can-you-get-private-ssl-keys-using-heartbleed

Please note that even if it turns out to be impossible that any of Cloudflare's private keys were leaked, this doesn't mean that private keys for other non-Cloudflare certificates couldn't be leaked. For other sites that you use, you may want to find out where their SSL certificates come from and find out when new certificates will be issued so you can change your password again.

shardymop - The funds have been credited to your account. It shouldn't take 4 months obviously and I'm trying to figure out why it took so long. The earliest ticket I can find for your issue is from March 28th. If that's the earliest ticket, then we couldn't have done anything about your deposit prior to receiving that ticket. Using Azimo means that your money follows this path:

Your bank --> Azimo --> The Currency Cloud (partner with Azimo) --> Barclays Bank --> Our bank

Unfortunately by the time your deposit reached us, none of your personal information that would allow us to link your deposit with your account survived. All we got from our bank was that it was a deposit from Barclays from an account under the name "The Currency Cloud." We really can't support payments through a processor like Azimo (except as a one-time thing if the customer didn't know and can prove the deposit originated from them) because they arrive on our end as third party deposits, which we generally don't accept. We require that the name on the bank account matches the name on the Kraken account.

You actually contacted us before you sent the deposit, asking if a deposit from Azimo would be OK. Unfortunately it took us 3 weeks to respond to that ticket, so I understand why you would go ahead and try it anyway. That was back in December though, when our support was in much worse shape than it is now.

I'm very sorry about the long delay in processing your deposit. But I want to emphasize for everyone that we can't take third party bank deposits. If you send us a third party deposit (i.e. any deposit where the name on the bank account doesn't match the name on your account), the deposit will almost certainly be held up. In many cases of these third party deposits, we can't even match the deposit with a Kraken account, so we don't know who to contact about it. This means you need to contact us right away to sort out the issue.

+1

also please do not forget about this issue: https://bitcointalksearch.org/topic/m.6034937

Hi Dargo,

yes the site is up and running again.

Please strongly consider informing your customers more frequently and in more detail.
We are living in a digital age and proper communication is easier than ever.

I don't feel your exchange is working very reliable atm.
All the troubles about bitcoin during the recent months don't make it look better.
You still have a good reputation. Although it's constantly declining due to the recent performance and lack of information.
Don't mess it up.

Thx
W

Hi all - we think the issue is fixed, so please post feedback if you are still having an issue.

Same story here, I can't trade and site is behaving strangly. Got this message "This data is not currently available. Please try again later." on most of the pages.

Some Twitter update (or any message en website itself) would be appreciated.

EDIT : seems to be working properly now.

#2

Not only trading: now i am trying to withdraw some Btc and kraken tells me that my verification level (tier 2) is not enought to do that. Btw, i withdrew without problems in the past....

This is freaking me out