It's both good general advice and complete nonsense, because people wouldn't see anything suspicious here. That, or public wifi is always suspicious anyway.
*Ad-Free Content
Run your site without ads
Coinhive offers a JavaScript miner for the Monero Blockchain
that you can embed in your website. Your users run the miner
directly in their Browser and mine XMR for you in turn for
an ad-free experience, in-game currency or whatever
incentives you can come up with.*
I do agree that Starbucks share responsibility but would you really say that 0% of the responsibility is with the person or people who actually set up the mining?
So you're saying never to trust 3rd party providers? It's one for the legal team I'd say; in this case Starbucks probably didn't provision for abuse or time spent in the wifi portal in the contracts. Might have a case for causing reputation damage.
If it were my business I'd absolutely say that. Doesn't mean you shouldn't USE 3rd party providers but you should be very careful. That's obviously not saying anything about legal responsibilities, of which I know nothing about.
Users may bitch and moan now, but they'll come groveling back in no time. Their outrage is no match for their lack of attention span and need for free content. Soon enough background mining will be as un-newsworthy as banner ads.
I agree. Mining seems to hit the sweet spot, especially if it's only for a short period of time or a minimal amount of system resources.
You want to have free content and who likes ads? Mining instead of ads is a good idea. I mean many websites have video ads with autoplay that takes both resources AND bandwidth. The issue is that I believe many will do both.
Except that majority of PC users are on laptops, and mining in the background WILL make your fan go nuts, which is not what you want as a user. On my desktop - sure, I won't even notice. But on a laptop, where the fan stays off/low rpm when just browsing? Nope.
Battery life is an even bigger issue. I don't want to see ads, but I also don't want my phone or laptop's battery being drained so the site owner can get a few fractions of a penny.
This wasn't injected though. It's a splash screen that pretends to load for 10 seconds (whilst mining) before forwarding the user on to some starbucks rewards site.
If you look at the screenshot of the code it isn't an injection. It's a deliberate redirect page put in to delay you for 10 seconds whilst they mine bitcoin.
I use my PC fan as a detector for nefarious scripts. If opening a site causes a fan to run at its peak for more than few seconds, I close it immediately or at least disable JS on it.
It's funny because if your computer is plugged in at a Starbucks, they're mining with their own electricity. Whoever did this wasn't stealing from their customers nearly so much as they were stealing from Starbucks themselves.
39 comments
[ 0.22 ms ] story [ 73.4 ms ] threadIt mines Monero using JavaScript. Best suited for sites where you sit on one page for a long time, and where there's lots of visitors.
Often, it turns out that it isn't the site owner doing it, but rather, they were hacked, and someone injected the JavaScript.
https://www.wired.com/story/cryptojacking-cryptocurrency-min...
https://gist.github.com/PaulSec/029d198a1e049acead74c31db0de...
https://twitter.com/paulwebsec/status/913055079112036352?lan...
I'll take background mining over ads any day.
Users may bitch and moan now, but they'll come groveling back in no time. Their outrage is no match for their lack of attention span and need for free content. Soon enough background mining will be as un-newsworthy as banner ads.
You want to have free content and who likes ads? Mining instead of ads is a good idea. I mean many websites have video ads with autoplay that takes both resources AND bandwidth. The issue is that I believe many will do both.
https://www.ragingmenace.com/software/menumeters/
https://twitter.com/imnoah/status/941050946100097024