Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Salon magazine mines crypto-cash with readers' PCs

bbc.com

Post reply on HN
Print view View original

71–80 of 112 posts

Re: Salon magazine mines crypto-cash with readers' PCs

#71

Post by sudhirj »

abusoufiyan wrote: post #56
sudhirj wrote: post #48

Earlier quoted context omitted.

That's really disingenuous. The software does exactly what it says on the cover and the documentation, no more and no less. And it causes no harm of any sort, but uses lots of power as designed. The malware classification comes because some sites used it without user's permission, which CoinHive fixed via the authedmine.com domain - that only allows the miner to be use with explicit and temporary user consent.

But the software is clearly a hot avenue for hackers. And trying to legitimize this kind of thing also makes the foray into "cryptojacking" more enticing. If legit sites start doing this, users will get used to it and hackers will bring in more cash. CoinHive didn't fix this, as far as I understand. They simply published an alternative miner. As recently as a week ago, many UK and US gov sites were cryptojacked using…

CoinHive has assumed that all instances of sites directly using the CoinHive software have been or are going to be blocked, and so have deprecated direct use of the CoinHive JS. Authedmine.com is now the official way to do things, and it operates only with consent.

Re: Salon magazine mines crypto-cash with readers' PCs

#72

Post by abusoufiyan »

CaliforniaKarl wrote: post #64

I am completely fine with this. The entire question of "How does a web site providing content 'for free' make money?" still seems to be in flux. Yes, people might push for some sort of micropayments thing, and The Guardian is making their method work, but I don't know if that's the exception or the rule. At least, not right now. Given the choice, I prefer a background miner over ads. Even on a laptop that's running o…

I'd be okay with it if choosing to do this on your website wasn't going to obviously incentivize hackers to inject this software maliciously on unsuspecting websites to steal money from unsuspecting users.

The more legit websites do this, the more cryptojacking will wreak havoc on the web.

And for those who say they ask for consent so it's okay, why do the CoinHive people still pay out for versions of the software that don't ask for consent?

Re: Salon magazine mines crypto-cash with readers' PCs

#73

Post by [deleted] »

CaliforniaKarl wrote: post #64

I am completely fine with this. The entire question of "How does a web site providing content 'for free' make money?" still seems to be in flux. Yes, people might push for some sort of micropayments thing, and The Guardian is making their method work, but I don't know if that's the exception or the rule. At least, not right now. Given the choice, I prefer a background miner over ads. Even on a laptop that's running o…

[deleted]

Re: Salon magazine mines crypto-cash with readers' PCs

#74

Post by abusoufiyan »

staticassertion wrote: post #63
MereInterest wrote: post #41

Earlier quoted context omitted.

Absolutely not. Wasting battery power to let somebody else buy into a pyramid scheme is not my idea of a solution.

You're reading an article that they provide... you're paying for a service. Ads promote tracking, third parties, uncontrolled CPU usage. A coin being mined is controlled, handled entirely by first party, provides no incentive for tracking, etc. This seems like a huge win.

>A coin being mined is controlled, handled entirely by first party, provides no incentive for tracking, etc.

Yeah, also a haven for hackers and malicious actors...

EDIT: I guess you weren't aware. CoinHive doesn't track the users who sign up for the service. It doesn't collect any information except email address. So malicious actors can easily sign up for the service and deliver the javascript through an XSS vulnerability for example. I thought that's what you meant by "no incentive for tracking".

Re: Salon magazine mines crypto-cash with readers' PCs

#75

Post by kbenson »

abusoufiyan wrote: post #62
sudhirj wrote: post #45

Earlier quoted context omitted.

It's a perfectly reasonable solution for those who are okay with it. You need to pay with something - either with your privacy, your attention, your money, or your electricity/idle CPU cycles. Ad blockers eliminate paying with attention, and put a big squeeze on paying with privacy. Which makes the leftover choices of money or power quite reasonable. What site uses the money or power for is nobody's business. Would y…

It's not though because the effects on the rest of the web are negative. Cryptojacking will become more common the more legit websites use it as a source of revenue. And this specific company / team of developers have been doing very little to stop the malicious use of their javascript. Why support them? EDIT: By "why support them" I obviously mean, why should a publisher support a team with such wanton disregard for…

> Why support them?

If you object, then by all means, don't support them.

The appropriate way to do that is to not read the article. There's no mining if you don't visit.

Re: Salon magazine mines crypto-cash with readers' PCs

#76

Post by abusoufiyan »

NKCSS wrote: post #59
abusoufiyan wrote: post #44

Earlier quoted context omitted.

Because your site showing up in other news outlets under a title like "Salon Magazine running cryptojacking malware on users" is terrible publicity. I get that they are using the version which asks for consent, but why even take the risk of associating yourself with such a shady piece of software? If you make money of ads, you'd think you wouldn't want to do things that might scare away your users.

The software (script) itself is not malicious, it's the way it's used in a lot of cases. It's similar to how torrents are usually used for piracy, but has some legitimate uses.

Yes, I know that. But public perception doesn't really see it this way. It's more like torrent == bad && malware == bad

Re: Salon magazine mines crypto-cash with readers' PCs

#77

Post by staticassertion »

abusoufiyan wrote: post #74
staticassertion wrote: post #63

Earlier quoted context omitted.

You're reading an article that they provide... you're paying for a service. Ads promote tracking, third parties, uncontrolled CPU usage. A coin being mined is controlled, handled entirely by first party, provides no incentive for tracking, etc. This seems like a huge win.

>A coin being mined is controlled, handled entirely by first party, provides no incentive for tracking, etc. Yeah, also a haven for hackers and malicious actors... EDIT: I guess you weren't aware. CoinHive doesn't track the users who sign up for the service. It doesn't collect any information except email address. So malicious actors can easily sign up for the service and deliver the javascript through an XSS vulnera…

In what way? I consider this a security win. Instead of a third party delivering unknown, unscreened content (ads), I get a mining script directly from the site that I'm visiting.

Re: Salon magazine mines crypto-cash with readers' PCs

#78

Post by TeMPOraL »

darawk wrote: post #57
MereInterest wrote: post #41

Earlier quoted context omitted.

Absolutely not. Wasting battery power to let somebody else buy into a pyramid scheme is not my idea of a solution.

Using that battery power does not 'let' anyone buy into the pyramid scheme. People buying monero or not is orthogonal to Salon mining it in your browser. Salon mining it does not in any way facilitate people buying it.

Monero itself is worthless for Salon until they exchange it to USD, either directly or through a chain of other cryptocurrencies. Either way, for them to get the USD, some schmuck somewhere needs to buy the coin.

Re: Salon magazine mines crypto-cash with readers' PCs

#79

Post by icebraining »

abusoufiyan wrote: post #72
CaliforniaKarl wrote: post #64

I am completely fine with this. The entire question of "How does a web site providing content 'for free' make money?" still seems to be in flux. Yes, people might push for some sort of micropayments thing, and The Guardian is making their method work, but I don't know if that's the exception or the rule. At least, not right now. Given the choice, I prefer a background miner over ads. Even on a laptop that's running o…

I'd be okay with it if choosing to do this on your website wasn't going to obviously incentivize hackers to inject this software maliciously on unsuspecting websites to steal money from unsuspecting users. The more legit websites do this, the more cryptojacking will wreak havoc on the web. And for those who say they ask for consent so it's okay, why do the CoinHive people still pay out for versions of the software th…

choosing to do this on your website wasn't going to obviously incentivize hackers

How does this work? Why would hackers needs this "incentive"?

Re: Salon magazine mines crypto-cash with readers' PCs

#80

Post by abusoufiyan »

sudhirj wrote: post #70
abusoufiyan wrote: post #62

Earlier quoted context omitted.

It's not though because the effects on the rest of the web are negative. Cryptojacking will become more common the more legit websites use it as a source of revenue. And this specific company / team of developers have been doing very little to stop the malicious use of their javascript. Why support them? EDIT: By "why support them" I obviously mean, why should a publisher support a team with such wanton disregard for…

Because adblockers can (and do) block all scripts and sites that mine without consent. Specific legal and consent-only domains will need to be whitelisted, which is what CoinHive is trying to with authedmine.com

So people who don't run adblockers should just suck it up and get gut-punched because CoinHive doesn't want to lose money? CoinHive has the ability to just not pay out any versions of the software which aren't authmine. Again, what a bad look to partner with such a crap team of people. There are surely other providers of the exact same service.
Post reply on HN