Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CBS's Showtime caught mining crypto-coins in viewers' web browsers

go.theregister.com

Post reply on HN
Print view View original

201–210 of 220 posts

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#201

Post by pdkl95 »

pdkl95 wrote: post #157
hellbanner wrote: post #4

The web seriously sucks. One thing I admire, at least in theory, about Xbox 360 games or iOS apps is the limited access a specific program can run. https://www.youtube.com/watch?v=CiqioE1zGCw talks about this Why is the overwhelming majority of networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long as attackers can craft its inputs? Why is it the cas…

> "The Science of Insecurity" The langsec approach of using formal recognizers that validate the validity of input before processing it in any way (stop creating weird machines!), and designing network protocols that are actually decidable without solving the halting problem (network input must be no more complex than deterministic context-free) should be considered the bare minimum for all network-associated softwar…

Correction: the URL for [2] should be http://geer.tinho.net/geer.source.27iv17.txt

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#202

Post by qbrass »

rdlecler1 wrote: post #141
csomar wrote: post #121

Earlier quoted context omitted.

The problem is that mining through the browser is very inefficient. I don't have numbers but it'd probably cost an order of magnitude more, at least, to mine on the browser. And I'm talking about CPU cryptos, forget about bitcoin.

If this became mainstream I’m sure we would find more efficient solutions.

Someone will just package a mining ASIC with an API that lets advertisers use it directly and market it as a way to speed up web browsing.

Maybe Intel will throw it on their chips as a processor extension.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#203

Post by jandrese »

iamgopal wrote: post #106
jakeogh wrote: post #84

as if I needed another reason to browse with JS disabled. https://github.com/jakeogh/glide (dont use the recent commits)

The other day someone was ranting about web app technologies. This is actually nice idea. A browser without javascript. For all the fun interaction, browser may add extensions of widgets. Let all richness be supplied by browser.

A web where every site has its own extension? That sounds like a nightmare.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#204

Post by hellbanner »

kentonv wrote: post #12
hellbanner wrote: post #4

The web seriously sucks. One thing I admire, at least in theory, about Xbox 360 games or iOS apps is the limited access a specific program can run. https://www.youtube.com/watch?v=CiqioE1zGCw talks about this Why is the overwhelming majority of networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long as attackers can craft its inputs? Why is it the cas…

> EDIT: Sandstorm was looking to fix user permissions for individual programs on computers (they went defunct/bankrupt/no-longer-developing last I heard). I'm still developing, just not full-time.

I'm glad to hear this! Thank you for working on Sandstorm.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#205

Post by hellbanner »

cocktailpeanuts wrote: post #77
hellbanner wrote: post #4

The web seriously sucks. One thing I admire, at least in theory, about Xbox 360 games or iOS apps is the limited access a specific program can run. https://www.youtube.com/watch?v=CiqioE1zGCw talks about this Why is the overwhelming majority of networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long as attackers can craft its inputs? Why is it the cas…

> Why is the overwhelming majority of networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long as attackers can craft its inputs? Why is it the case that no amount of effort seems enough to fix software that must speak certain protocols? This is a super naive view of the world. Nowadays most hacking incidents are based on social engineering, meaning it…

Social engineering is responsible for in part or entirety many hacks. I'm not arguing that technical solutions will "fix everything". Technical stability is on aspect of secure systems.

The video is arguing: why should a doorbell have the ability to set your house on fire? (Metaphorically).

Heartbleed was an issue of exactly this

"The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software"

Architecturally, this should never have been possible.

http://www.pl-enthusiast.net/2014/07/01/how-did-heartbleed-r...

http://heartbleed.com/

Obviously attackers are going to look for the weakest point, but your agument sounds like "social engineering should happen, so don't bother locking your doors at all".

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#206

Post by cocktailpeanuts »

hellbanner wrote: post #205
cocktailpeanuts wrote: post #77

Earlier quoted context omitted.

> Why is the overwhelming majority of networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long as attackers can craft its inputs? Why is it the case that no amount of effort seems enough to fix software that must speak certain protocols? This is a super naive view of the world. Nowadays most hacking incidents are based on social engineering, meaning it…

Social engineering is responsible for in part or entirety many hacks. I'm not arguing that technical solutions will "fix everything". Technical stability is on aspect of secure systems. The video is arguing: why should a doorbell have the ability to set your house on fire? (Metaphorically). Heartbleed was an issue of exactly this "The Heartbleed bug allows anyone on the Internet to read the memory of the systems prot…

No i was only arguing it's not as easy as you think. Just like your solution you suggested can easily be hacked, any technological solution a human being comes up with is vulnerable to hacks.

The only thing I was criticizing was you seem to think it's easy to simply create a secure system. It's not. That's why there are tons of smart people in security but hacks still happen.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#207

Post by Lev1a »

reinhardt1053 wrote: post #170
Lev1a wrote: post #110

Earlier quoted context omitted.

Does running ads multiply your electricity costs (run your battery dry) and/or burn up your CPU? No. Does cryptocurrency mining do that? Yes. Do you see the difference now?

Running ads also dry your battery.

Do ads make your CPU run at 100% load? Most likely not. Yet mining scripts will do just that.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#208

Post by brailsafe »

brailsafe wrote: post #69
kentonv wrote: post #12

Earlier quoted context omitted.

> EDIT: Sandstorm was looking to fix user permissions for individual programs on computers (they went defunct/bankrupt/no-longer-developing last I heard). I'm still developing, just not full-time.

Nice job on that house you have there. Looks like you might even be able to play Warcraft 3 over LAN without spending the entire party trying to get it set up.

Edit: Though irrelevant to the thread, this is not intended to be backhanded. Check out the house. It's pretty cool.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#209

Post by brailsafe »

mattmanser wrote: post #135
brailsafe wrote: post #68

I bet some clever person on the marketing team just went ahead and inserted the tag. My first experience on a large corporate dev team was eye-opening. While the core product code was version controlled and reviewed, the marketing team had the power to insert any kind of scripts onto the page without clearance. In theory, anything new on the page would require many ridiculous meetings. In practice, they could and did…

Google Tag Manager! So flexible, so innovative! Google Tag Manager is a serious game-changer that provides the kind of competitive edge our clients need. - Caleb Whitmore, Founder & Chairman, Analytics Pros You want to let Marketing add script tags on the fly? Are you fucking insane? - Anonymous Developer

That's the one :)

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#210

Post by thephyber »

schwede wrote: post #57
thephyber wrote: post #24

Earlier quoted context omitted.

I'm not a lawyer, so my opinion is worth what you paid for it, but... Without an authentication bypass, I don't think the CFAA applies (last I perused it). The end user probably doesn't have standing under CFAA unless the website's ToS suggested they would not act this way. If you, as a web visitor, visit a website you are largely at the mercy of whatever plugins they load onto your browser during that session. In ex…

But when I go to a website I expect to get the content. I don't expect the owner to use my computer for mining. That seems like unauthorized use to me.

While I don't think that's actually how the law can be interpreted, it does get at the central issue most computer users/researchers have with the law. It allows different standards for what "unauthorized" means, hence it is very elastic and can easily be abused, especially when combined with the plea bargain process (@see Aaron Schwartz).
Post reply on HN