Adguard found 220 sites that launch mining when a user opens their main page

I saw an addon for Firefox that does that a couple days ago. I think you can do the same thing with filters in uBlock Origin though, but if you don't use an adblocker, it might be useful.

https://addons.mozilla.org/en-US/firefox/addon/nominer-block...

tyingq2• 9 years ago

It just blocks urls by pattern. That's easily subverted.

swinglock• 9 years ago

Make sure the “resource abusive” filter is enabled in uBlock.

https://raw.githubusercontent.com/uBlockOrigin/uAssets/maste...

nasredin• 9 years ago

No.

You'd always be one step behind. Reacting rather than acting.

I recommend

Firefox

NoScript

RequestPolicy

And if you want:

Ublock Origin

Umatrix

amelius2• 9 years ago

How would such a plugin work? Say you're visiting a webpage with lots of graphical effects that require lots of computation. How would the blocker distinguish those computations from mining?

ryanmerket• 9 years ago

Making a signature of certain libraries?

jt2190• 9 years ago

Interesting that they've considered whether the mining itself is bad, or if it's just bad form to mine without asking.

The ethical way for a website to earn money by mining through its audience’s computers is to ask the audience for permission first, and to allow them the possibility to opt out. Actually, such a practice could make mining even more ethical than ads. After all, nobody asks us if we would like to see ads on a website. Mining parasitizes the user’s CPU, where ads parasitize the user’s attention, emotions, bandwidth, and often, their laptop or smartphone battery, and supports an industry of personal data harvesting that is a big headache in of itself.

kibwen2• 9 years ago

Any alternative to advertising is a good thing.

If only. This isn't an alternative, it's a supplement. Sites have absolutely no incentive to stop advertising; they will simply continue to show the user ads while also discreetly wasting your electricity calculating hashes.

nwah1• 9 years ago

Yep, was thinking the same thing. It's a supplement. They sell your data and waste your electricity. But you forgot another part, which is the wear on your hardware.

curiousgal• 9 years ago

Some of the ones I came across are transparent about it and will tell you that once a certain threshold is reached, you'll stop seeing ads.

kibwen2• 9 years ago

Yes, that I'm okay with. If users are properly informed, then they can make an informed decision for themselves whether or not to use the service. And a responsible version of this would place an upper bound on the amount of mining done, so that I don't leave a tab open overnight and come back in the morning to find that my laptop has melted a hole through the floor.

PhasmaFelis• 9 years ago

Indeed. Half the reason I use an adblocker is to stop every random website from maxing the processor on my poor old MacBook.

aequitas2• 9 years ago

I would accept this as an alternative to ads. Ads can easily be blocked and have a high tendency to be blocked as they can be quite intrusive and a risk. So publishers will get less incentive to server them if everyone is just blocking them.

Cryptominer scripts can just as easily be blocked. So bad ones (long running) can easily be punished and I can have miners be blocked when running on battery power. This might nudge the market into the right direction where people allow miners and pay for content with computer power as a proxy.

I might even see a framework for browsers emerging to facilitate this market and provide better more efficient API's (GPU access) and better control (no mining on battery). Since this way of paying for content does already carry a lot of overhead in terms of total cost for all parties involved :(.

Feniks• 9 years ago

Yep I like the idea. One of the reasons why I block ads is because I don't want to aid and abet the marketing parasite.

Trouble is that capitalism and greed will take any good initiative and defile it. And then we're back to square one.

seveibar2• 9 years ago

Cryptominer scripts can just as easily be blocked.

Unfortunately this isn't true- it's pretty easy to proxy the request to coinhive through the web server of the main site. e.g. https://github.com/cazala/coin-hive-proxy

Site owners have incentive to run this proxy so they're not marked as a mining site OR to circumvent the 30% fee that coinhive collects. I don't think it will be possible to block mining in the future without blocking javascript completely.

Fnoord2• 9 years ago

Electricity is very expensive in my country (The Netherlands) compared to other countries around us. I don't wanna pay for inefficient mining.

Blacklisting isn't the solution. A website shouldn't be allowed to continuously use 100% of all CPU/GPU resources. Of course, the reaction will be so sit right under the limit, but I suppose the limit shouldn't be static.

gtrubetskoy• 9 years ago

At least it helps strengthen the crypto-currencies, which is a good thing.

I'd be curious how much CPU is wasted rendering billions of ads, especially video, I suspect it's a lot more than the crypto hashing, and three orders of magnitude more money is made by this "borrowing" of your CPU in exchange for letting you read the site you're looking at.

kobeya• 9 years ago

It does no such thing. If the miner is not paying for the electricity, then they can costlessly use it to attack the main chain. This lowers security.

benjaminjackman• 9 years ago

but not opportunity costlessly

yborg• 9 years ago

I don't know how associating cryptocurrency with malware in the minds of millions of people is a good thing. It reinforces the idea that this is a medium of exchange used by criminals.

userbinator• 9 years ago

I'd be curious how much CPU is wasted rendering billions of ads, especially video, I suspect it's a lot more than the crypto hashing

The exact opposite. Video decoding is done quite efficiently in hardware now, and displaying ad images is not much worse than any other image or video. There is certainly an impact, but it's not continuous 100% client processor usage. On the contrary, mining is basically going to push the processor to 100% and keep it there just by virtue of how it works.

ec1096852• 9 years ago

That isn’t true. Most Video ads on sites use a ton of cpu.

cooper12• 9 years ago

Most video (excepting more modern codecs) is hardware accelerated, which if I understand correctly, uses the video card and is more efficient.

baron816• 9 years ago

Mine me. Please.

If I’m on your site, that means you’re doing something for me, and I want you to continue to do it for me. I don’t expect anyone to give me things of value for free, so if you want to to take my unused computer resources as payment for your services, go ahead.

ISL• 9 years ago

It will be both inefficient relative to bitcoin miners and un-free for you. You'll pay for it in both your power bill and battery life.

mitchty• 9 years ago

My laptop battery disagrees with this idea.

psyc• 9 years ago

The players in our tragedy of the commons haven't shown any restraint in polluting the Web and bringing my browser to its knees. They won't show any restraint with mining either.

fjsolwmv2• 9 years ago

So far it's only deployed on piracy sites, so, dog eat dog

userpass• 9 years ago

A phone battery only has around 10 watthours. That's less than 1 cent worth of electricity if you wait hours until it's mined empty. It's more effective to just donate a single cent than to let them mine on your phone.

tree_of_item• 9 years ago

How exactly does this kind of secret mining work? Is it effective at all? Don't you need to race to create blocks? How is the average consumer CPU going to win a single block like this?

aidenn0• 9 years ago

It's all probabalistic; you could in theory mine a block by hand if you got absurdly lucky. Think of a machine with 8 GPUs being like dropping a million balls into the bingo jar, and coinhive like dropping 1 or two balls in for each visitor. If you get enough visitors, some of your balls will get drawn occasionally, making you money.

The reason GPUs and ASICs are used isn't because they have a better chance per se, but because they are more power efficient. With coinhive, the person who benefits is not the person who pays for the power, so that's not at issue.

Franciscouzo• 9 years ago

It's repeated over and over that GPUs and ASICs give you a pretty big advantage over CPUs, but that's not true at all for cryptocoins such as Monero that use CryptoNight, that is why it's one of the only coins that makes sense to mine with a botnet or JavaScript.

Larrikin• 9 years ago

It's extremely rare for mining to not not contribute to a pool nowadays.

sp332• 9 years ago

You "race" by computing lots and lots of hashes until you get a low number. (Exactly how low it has to be depends on the current "difficulty".) So you distribute hashing code in the JS, and you get sent back a ton of hashes. The more hashes you get, the better your chances of winning the next block.

isalmon• 9 years ago

Here's the list of websites that have Coinhive JS installed: https://www.datanyze.com/datanyze-coinhive.csv

dawnerd• 9 years ago

That's... a lot more than I expected TBH. Looks more like a list of sites to straight up block since most look like scam domains.

philfrasty• 9 years ago

There are some public German schools in this document. No way they would install that miner on their own. Looks like a portion of the sites are hacked to run the scripts.

Edit: reading through all .de domains at least 80% (or more) have no intention or technical ability to install this on their own, e.g. schools, craftsmen, small businesses, etc.

mizaru• 9 years ago

A lot of them probably run an outdated Joomla.

mikenew2• 9 years ago

It would be cool if it evolved into something mutual between content providers and users. You have a bitcoin/ethereum/whatever wallet associated with your browser, and when you're on a website it spins up a mining process where you take a cut and they take a cut. It could be built on a platform kind of like AdSense where there's a basic agreement between parties on how things should work.

I make most of my living off of the donation economy. There are a lot of people out there who want to support good content. They just really don't like ads.

fjsolwmv2• 9 years ago

How about you just mine or work whenever you want for currency, and then pay for access with currency?

Karunamon• 9 years ago

Doesn’t seem to work in the real world. Most orgs over-value their content and don’t seem to realize that more effort put in does not translate to higher value (or real/perceived utility to the reader).

Hence the passive revenue generation of advertising. Once people have to put a number of resource they’re willing to pay next to the article they clicked on out of curiosity, they decide it’s not worth bothering.

derefr• 9 years ago

With pools of GPU- and FPGA- and ASIC-miners in play in a blockchain, raising the block difficulty, any individual user just doing CPU mining has a negligible chance of ever generating any money for themselves; and will only make negligible amounts by being a member of a mining pool.

These mining scripts are worth money to their owners only because they get to make all the dividends from the covert mining pool they've created.

There is a reason that "immediately join a Bitcoin mining pool" isn't commonly-heard advice; that it's not something everyone does for their aunt. The average computer just isn't going to make enough money to be worth it—even just to pay for microtransactions.

SilasX2• 9 years ago

That's definitely more economically efficient, but then people just pirate the content.

The caveat is taxation, though. If I earn the money and buy with it, I have to pay with after-tax dollars, but if I mine in browser, the money/cryptocurrency units never passed through me. Depending on personal income tax rates, that's as much as a 50% cost difference (for the income that would be earned by mining, though, not labor I have a comparative advantage in, of course).

TylerE• 9 years ago

Half of $0.000000001 is $0

CalChris• 9 years ago

Mining is incredibly inefficient and mining this way is insanely inefficient.

The energy cost of a single Bitcoin transaction could power 1.5 American homes for a day. That was in 2015. ASICs are more efficient than GPUs which are orders of magnitude more efficient than your browser. This is an unbelievably stupid idea.

https://motherboard.vice.com/en_us/article/ae3p7e/bitcoin-is...

Edit: yes, this uses Monero rather than Bitcoin. The work required is less and the price is also less. The argument is the same. This is inherently inefficient because if you could remove this inefficiency, the price would drop.

mrb• 9 years ago

You seem confused. They aren't mining bitcoins, but Monero which is relatively efficient to mine on CPU, and another new one called JSEcoin which appears to have been designed specifically for efficient mining in javascript.

seveibar2• 9 years ago

As I understand it, coinhive uses Monero, a crytocurrency that is hard to mine on GPUs.

From coinhive.com: Monero is different. To mine Monero, you have to calculate hashes with an algorithm called Cryptonight. This algorithm is very compute heavy and – while overall pretty slow – was designed to run well on consumer CPUs.

There are solutions to run the Cryptonight algorithm on a GPU instead, but the benefit is about 2x, not 10000x like for other algorithms used by Bitcoin or Ethereum. This makes Cryptonight a nice target for JavaScript and the Browser.

Of course, when running through JavaScript performance still takes a bit of a toll, but it's not that bad. Our miner uses WebAssembly and runs with about 65% of the performance of a native Miner. For an Intel i7 CPU (one of the fastest desktop CPUs) you should see a hashrate of about 90h/s. A native miner would get to 140h/s.

KGIII2• 9 years ago

I doubt efficiency is their primary concern. It seems that it is more likely to be efficacy that concerns them most. Namely, does it generate more income than it would without it?

The answer to that is probably yes. After all, it isn't their resources. They are simply adding a line of code to their markup and calling it a day.

I see no problem with this so long as they get consent and, ideally, allow a method to opt out, though the back button is opting out. I'd also mention that it should be informed consent. In plain language, the user should be aware of what is happening.

ryanmarsh• 9 years ago

What if I’m on an official ISIS web site (bear with me here) and I mine a block for them. Have I provided material support to a terrorist organization?

mikenew2• 9 years ago

No more than viewing an ad on their site brought them revenue.

KGIII2• 9 years ago

Technically, yes. Legally? I'd assume mens rea still applies.

I am not a lawyer, this is not legal advice. If you wish to provide material support to ISIS, consult a qualified legal professional in the appropriate jurisdiction.

hedora• 9 years ago

I wonder how hard it is to subvert the mining process (!= the cryptocurrency) by sending back fake completion data.

ashark• 9 years ago

Assuming they check your results before passing them along, it’d be noticed immediately. Hard to discover, easy to verify. Not much different than just blocking them.

lightedman• 9 years ago

Who is the person ultimately responsible for creating this junkware known as CoinhiveJS? That is the entity we should be focusing on, not these sites.

Animats• 9 years ago

How much money have these websites made? We estimate their joint profit at over US $43,000.

Why are they even bothering? The headaches involved in doing this aren't justified by the dinky revenue.

folli• 9 years ago

Is there a reliable estimation on how much they make per visit?

The article states $43k for approx. 500M visits, so that's below 0.01 cents per visit; this in turn corresponds to a 'Cost per Mille Impressions' (CPM) of around 10 cents. So it seems that traditional ads would still make more money.

Can someone comment on how they came up with the $43k?

ec1096852• 9 years ago

It does seem like a small number, but regardless of what it is, I doubt they are removing ads, so it is just additive.

tzs• 9 years ago

Do these things keep running as long as you are on the page? If so then in effect people who read slower will pay more to view the site.

That seems shady to me, at least for sites where the costs to the site are the same regardless of how long it takes the reader to read. If it takes me 5 minutes to read an article, and it takes some stay-at-home parent 20 minutes because they had to pause to deal with the kids, they pay 4 times as much as I do.

tentaTherapist• 9 years ago

This is such a ridiculously inefficient means of raising money, for everyone involved. What would it take to just get people to pay for the services that they use, out of gratitude?

m-p-3• 9 years ago

I think the idea would be accepted more if the websites using this were more transparent and would give some kind of warning before actually mining using your own resources.

Adguard found 220 sites that launch mining when a user opens their main page

Related Stories