They've been doing shady shit with JS for years like auto-reloading their home page and other shady practices. The only solution to sites running bad JS like Salon is to block the JS. uBlock origin, NoScript, etc. The only downside is that none of these tools is user-friendly enough to run without any user input. The idea that other entities should be able to run their code on my computer was a bad one to begin with and still is. I think people are slowly coming to that realization as this default begins to show just how dangerous it is.
Salon magazine mines crypto-cash with readers' PCs
81–90 of 112 posts
Re: Salon magazine mines crypto-cash with readers' PCs
#82The best way to prevent this in firefox:
1. Run Noscript extension
2. Run RequestPolicy extension
3. Keep your adblock/ublock rules updated as they block miners
4. Don't ever visit Salon
The first three also work on most other websites that have miners or were hacked and had a miner injected.
Re: Salon magazine mines crypto-cash with readers' PCs
#83Earlier quoted context omitted.
But the software is clearly a hot avenue for hackers. And trying to legitimize this kind of thing also makes the foray into "cryptojacking" more enticing. If legit sites start doing this, users will get used to it and hackers will bring in more cash. CoinHive didn't fix this, as far as I understand. They simply published an alternative miner. As recently as a week ago, many UK and US gov sites were cryptojacked using…
CoinHive has assumed that all instances of sites directly using the CoinHive software have been or are going to be blocked, and so have deprecated direct use of the CoinHive JS. Authedmine.com is now the official way to do things, and it operates only with consent.
Why make that assumption and leave users without blockers out to dry?
Why not just halt all payouts to the old software and only pay out to versions which are using the Authedmine.com version?
Why not do KYC on people who have a very high likelihood of using your software to violate the law?
Salon is the kind of magazine which will call (justly) for corporate responsibility in all sorts of industries, but when it comes to software makers just totally not doing the basic, easy things when it comes to respecting web security, they'll pay them.
Re: Salon magazine mines crypto-cash with readers' PCs
#84Re: Salon magazine mines crypto-cash with readers' PCs
#85I am completely fine with this. The entire question of "How does a web site providing content 'for free' make money?" still seems to be in flux. Yes, people might push for some sort of micropayments thing, and The Guardian is making their method work, but I don't know if that's the exception or the rule. At least, not right now. Given the choice, I prefer a background miner over ads. Even on a laptop that's running o…
It wouldn't be so bad if Salon were using 5 or 10% of your CPU, but they are pushing it to 100%. Check out the discussion on r/BATProject[0] which is apart of the Brave browser. Brave is actually fighting the mining situation whilst also trying to help publishers and creators gain money.
Brave are actively blocking ads and background miners, but they offer verified publishers and creators to be donated Basic Attention Tokens (their own cryptocurrency). Users of Brave will be able to gain tokens either by purchasing them or by viewing ads within the browser rather than on the websites. If you're interested, I would recommend you check out their browser which is based on Chromium.[1]
[0] https://www.reddit.com/r/BATProject/comments/7y7tvy/bat_comm... [1] https://brave.com/
Re: Salon magazine mines crypto-cash with readers' PCs
#86The best way to prevent this in firefox: 1. Run Noscript extension 2. Run RequestPolicy extension 3. Keep your adblock/ublock rules updated as they block miners 4. Don't ever visit Salon The first three also work on most other websites that have miners or were hacked and had a miner injected.
"users must do special stuff" doesn't scale, which is why Chrome has had to roll out default blocking for egregious ads.
But using user resources to mine fadcoin? That's borderline Computer Misuse Act, in the UK, I reckon.
Re: Salon magazine mines crypto-cash with readers' PCs
#87Earlier quoted context omitted.
Using that battery power does not 'let' anyone buy into the pyramid scheme. People buying monero or not is orthogonal to Salon mining it in your browser. Salon mining it does not in any way facilitate people buying it.
Monero itself is worthless for Salon until they exchange it to USD, either directly or through a chain of other cryptocurrencies. Either way, for them to get the USD, some schmuck somewhere needs to buy the coin.
Like any coin, if the others dont see value on it, it's worthless.
Re: Salon magazine mines crypto-cash with readers' PCs
#88Earlier quoted context omitted.
I'd be okay with it if choosing to do this on your website wasn't going to obviously incentivize hackers to inject this software maliciously on unsuspecting websites to steal money from unsuspecting users. The more legit websites do this, the more cryptojacking will wreak havoc on the web. And for those who say they ask for consent so it's okay, why do the CoinHive people still pay out for versions of the software th…
choosing to do this on your website wasn't going to obviously incentivize hackers How does this work? Why would hackers needs this "incentive"?
The less legit it is for a website to mine crypto, the easier it is for adblockers and security to block all such scripts without inconveniencing the user (less tradeoff of usability for security).
But when some sites use it and others doesn't, it makes security complicated and hacks are able to slip through easier.
Also, the more users get used to sites mining on their browsers, the less likely they will be perturbed by and reporting CPU usage spikes (which are used to determine which sites have been hacked by cryptojackers) because they are used to seeing legitimate such spikes from sites they frequent.
Re: Salon magazine mines crypto-cash with readers' PCs
#89Earlier quoted context omitted.
You are right. However, CoinHive seems to care about this (at least superficially). Check out their AuthedMiner.
According to this, they don't seem to care at all: https://motherboard.vice.com/en_us/article/vbpbz4/creators-o... >The team don’t specifically track domains, so if a user’s email address is not, for example, “contact@website.com,” Coinhive often don’t know where or how the service is being used, though. So they don't keep track of who uses the software (perfect for malicious users), and yes they offer an AuthedMiner…
I agree. There's probably room for an actor and competitor to CoinHive who takes this very seriously.
Re: Salon magazine mines crypto-cash with readers' PCs
#90I am completely fine with this. The entire question of "How does a web site providing content 'for free' make money?" still seems to be in flux. Yes, people might push for some sort of micropayments thing, and The Guardian is making their method work, but I don't know if that's the exception or the rule. At least, not right now. Given the choice, I prefer a background miner over ads. Even on a laptop that's running o…
The steam of newsletter never came to be.