Stronger Security, Weaker Privacy Protections

All the exchange apps support multifactor authentication, which supplements a password with verification via a text message, biometric information such as fingerprints or facial recognition, or an authenticator app. However, Kraken didn’t prompt users to set up multifactor authentication during onboarding in CR’s evaluation. All exchanges required complex passwords except Crypto.com, which required only a six-digit PIN, which doesn’t meet CR’s standards for password strength.

To test for security notifications, CR’s evaluators changed the password or other critical account information for all five apps. All five sent…