FaucetBOX.com Discussion

[knowhow]

Hi there can anyone tell me where i find these antibots codes ?  http://www.lotobitcoin.com/ i need them to install at mine faucets thanks.

[ElCoqui]

Hi there can anyone tell me where i find these antibots codes ?  http://www.lotobitcoin.com/ i need them to install at mine faucets thanks.

You can find how to install the antibot link here https://bitcointalk.org/index.php?topic=1200700.0

[shadabahmed]

i am facing too much problem today in faucetbox

[Kazuldur]

i am facing too much problem today in faucetbox

What problems do you have?

[rkandrades]

Hello, Kazuldur.

I have found this honeypot code into /templates/default/index.php:

<input type="checkbox" name="honeypot" style="position: absolute; left: -999px">

Is it working? What function is handling with this honeypot?

[Kazuldur]

Hello, Kazuldur.

I have found this honeypot code into /templates/default/index.php:

<input type="checkbox" name="honeypot" style="position: absolute; left: -999px">

Is it working? What function is handling with this honeypot?

https://bitcointalk.org/index.php?topic=1094930.msg12422131#msg12422131

It works, but it doesn't block immediately, it only reports this information to NastyHosts.com and then we use this data to identify networks that bots use.

[misterbit]

Hello, Kazuldur.

I have found this honeypot code into /templates/default/index.php:

<input type="checkbox" name="honeypot" style="position: absolute; left: -999px">

Is it working? What function is handling with this honeypot?

https://bitcointalk.org/index.php?topic=1094930.msg12422131#msg12422131

It works, but it doesn't block immediately, it only reports this information to NastyHosts.com and then we use this data to identify networks that bots use.

Hello Kazuldur, you can check my website http://fortuna.online/ I made a new account on FaucetBox to control expenses.

Thanks friend

[dhavin]

I implemented faucet in a box, as a proof of concept test using faucet in a box. Initially, rewards were high for a few days and then i noticed a very high percentage of visitors weren't triggering analytics. Or using javascript, cookies, etc.

I reduced the reward to the minimum (1 satoshi). My analytics reports scanthebox referred 17 users today, no other referrals. Despite that I have all security features on, I'm still seeing 3-5 transactions per minute. Why can't you guys stop these bots?

[BitBustah]

I implemented faucet in a box, as a proof of concept test using faucet in a box. Initially, rewards were high for a few days and then i noticed a very high percentage of visitors weren't triggering analytics. Or using javascript, cookies, etc.

I reduced the reward to the minimum (1 satoshi). My analytics reports scanthebox referred 17 users today, no other referrals. Despite that I have all security features on, I'm still seeing 3-5 transactions per minute. Why can't you guys stop these bots?

FaucetBOX is a micro-wallet service.. Security and anti-bit protection should be done on your end.


Edited to add: A lot of people think it's easy to set up and run a faucet. It's really really hard work.

[dhavin]

I implemented faucet in a box, as a proof of concept test using faucet in a box. Initially, rewards were high for a few days and then i noticed a very high percentage of visitors weren't triggering analytics. Or using javascript, cookies, etc.

I reduced the reward to the minimum (1 satoshi). My analytics reports scanthebox referred 17 users today, no other referrals. Despite that I have all security features on, I'm still seeing 3-5 transactions per minute. Why can't you guys stop these bots?

FaucetBOX is a micro-wallet service.. Security and anti-bit protection should be done on your end.


Edited to add: A lot of people think it's easy to set up and run a faucet. It's really really hard work.

No, you're missing the point. With the faucet in the box "free" script, it is absolutely worthless to set up a faucet and MOST PEOPLE NEW TO IMPLEMENTING FAUCETS don't realize that their meager bitcoin balance to start their little project will be devoured by bots before they even hope to earn 10% back via adverts. Absolutely NO ONE should start by implementing faucetbox with their script. It would be like opening a franchise chain only to find a month later all of your burgers went out the back door instead of sold to customers because everyone had the passcode to the alarm system because it was posted on the outside of the building.

I think what you meant to write is, opening a FAUCETBOX faucet is very, very hard work. I wrote a faucet from scratch and it was in fact, not really that hard.. but I bet there have been hundreds of people turned off of bitcoin altogether by implementing this embarrassing code. How does that help the community? So I'm asking, when are these guys going to harden their project so that they stop producing people who are absolutely disgusted by the thought of bitcoin? If it were up to you to put basic locks in a car you bought or have it stolen, you would be turned off of that brand of car quickly and everyone would buy the car that had the best security system. This is why today modern vehicles COME with security systems by default. Faucetbox has a poorly implemented security system at best. I mean seriously, you CANNOT NAME your honeypot input field HONEYPOT!

I've had only bots chipping away at the little faucetbox faucet I've implemented as a test, for over 4 days and no one from faucetbox has bothered to ask me to help identify them. I could easily give them the IPs of valid traffic hitting the site, because I can easily find those IPs. The bot IPs I have to go digging through apache logs for.

It is so blatantly bad, I'm starting to think that Faucetbox is actually responsible for the bot traffic to their sites.

 

[BitcoinFuture99]

I already suggested faucet box owner to provide some thing to owner to check before the faucet box payouts to users to supervise if there is any bot attack from some IPs addresses to avoid sending payout to those.

But from reply of faucet box owner made me realise that actually users are important for faucet box not the owner.

[Holdaaja]

I already suggested faucet box owner to provide some thing to owner to check before the faucet box payouts to users to supervise if there is any bot attack from some IPs addresses to avoid sending payout to those.

But from reply of faucet box owner made me realise that actually users are important for faucet box not the owner.

More bots = more money in the faucets = more 2.5% commission for Faucetbox.com

[Kazuldur]

I already suggested faucet box owner to provide some thing to owner to check before the faucet box payouts to users to supervise if there is any bot attack from some IPs addresses to avoid sending payout to those.

But from reply of faucet box owner made me realise that actually users are important for faucet box not the owner.

More bots = more money in the faucets = more 2.5% commission for Faucetbox.com

We're not that short-sighted .

Bots were discussed many and many times here already. It's easy to say that security of our script suck, but hey, that's a market for you right here right now. Make something better and start selling it.

The real problem is that it's the CAPTCHA job to keep bots out. When CAPTCHA fails there's not much we can do. You can say that naming honeypot field as "honeypot" is wrong, but that doesn't change anything. Even if it would be a random field name every time, bots can work this around. It's just a matter of what's profitable for them.

Your custom faucets may not be affected by bots, but that's not because your security is much better. It's just that your faucets are different and it's not profitable for bots to implement support for things you do differently. But if we change something in Faucet in a BOX, hundreds of faucets have that change and then it's worth for bots to invest some time in working around this.

We truly believe that the best way is:

1. encouraging people to do their own scripts. Not only diversity will help with bots, but also it will make it more pleasant to users.
2. automatic identification of networks with services like http://getipintel.net/ . We're working on making NastyHosts.com competitive here (right now it only stops a small fraction of bots, mainly Tor and AWS)

If you want to verify users by email, by phone number or you want to manually review each payout, no problem, you can easily implement that in your script and make it better for everyone.

EDIT:
As for reviewing IP addresses by FaucetBOX.com team, we tried that via NastyHosts.com. Unfortunately thousands of addresses per hour is too much for a manual review.

[minifrij]

I wrote a faucet from scratch and it was in fact, not really that hard..

It isn't, providing you know PHP, HTML, CSS and SQL. If you don't know all of those, it will be somewhat more difficult.

but I bet there have been hundreds of people turned off of bitcoin altogether by implementing this embarrassing code.

...

Faucetbox has a poorly implemented security system at best. I mean seriously, you CANNOT NAME your honeypot input field HONEYPOT!

Have you looked at the code, or are you basing this opinion off of one checkbox you saw in this thread? If you look at other faucet scripts available to download and use, I believe FaucetBox easily has the best security of them all.

I've had only bots chipping away at the little faucetbox faucet I've implemented as a test, for over 4 days and no one from faucetbox has bothered to ask me to help identify them.

How would the people at FaucetBox know that bots were attacking your faucet? Requests to the FaucetBox API look the same, regardless of whether the person triggering the request is a bot or not.
Also, there are threads on the forum for you to help with identifying bot IPs, such as this one.

I could easily give them the IPs of valid traffic hitting the site, because I can easily find those IPs. The bot IPs I have to go digging through apache logs for.

IPs aren't a good way of identifying users or bots, as it is extremely easy to change an IP. Trying to block bots through IPs would be like playing wack-a-mole in a 100 acre field.

It is so blatantly bad, I'm starting to think that Faucetbox is actually responsible for the bot traffic to their sites.

Looks to me like you're looking for a scapegoat.

As said before, it is very easy to bot a lot of sites when every single site is the same in the way it operates. It is one of the downsides of scripts such as FaucetInABox. It did not happen to a faucet you coded personally as, unless your rewards are insanely high, it would not be worth a bot maker's time to create a bot for your site. Compare this to FaucetInABox, where there are hundreds of sites running the exact same script, it would be absolutely worth a bot creator's time to create something for it. It's common sense.

[misterbit]

Greetings, this is going to pique Kazuldur, websites are being denounced in Adsense have little content, navigation etc.

[dhavin]

Looks to me like you're looking for a scapegoat.

As said before, it is very easy to bot a lot of sites when every single site is the same in the way it operates. It is one of the downsides of scripts such as FaucetInABox. It did not happen to a faucet you coded personally as, unless your rewards are insanely high, it would not be worth a bot maker's time to create a bot for your site. Compare this to FaucetInABox, where there are hundreds of sites running the exact same script, it would be absolutely worth a bot creator's time to create something for it. It's common sense.

Not at all, I'm trying to preserve interest in running faucets. Faucetbox should have a giant disclaimer on their FaucetInABox site stating that there is an almost guaranteed likelihood that all of the operators bitcoins will be lost to bots before they can earn any revenue, if they use that script.

Yes, I've looked at the code. The problem is that if I can look at the code, so can anyone with the intention of writing a bot. If you're going to have a honeypot input field(s) and publish the code, it should at minimum allow the operator to easily modify them without knowing PHP (in the admin section) and move them around the page randomly. You shouldn't be able to search index.php for "honeypot" and call it a day. There are many security improvements that should be made and ones that could be suggested to the potential faucet operator, that aren't. If you're going to have a 'professional' service, you should offer a professional product.

I've been running a faucet for over two years, I know what drives bots makers to make bots. Again, the point of my post was to draw attention to the fact that this script should no longer be offered without a huge, glaring warning that it's base deployment is under enormous bot pressure and that no-one should use it as-is. Faucetbox has not done this because they seem to be more interested in the short term 2.5% gain, than putting faucet operators in business for the long term.

For any potential faucet operators reading this, my professional (25+ years in IT) opinion is that until faucetbox improves security or offers a bot warranty, this script should not be used without massive modification and at that point you are much safer just writing your own site.

[videogamecreative]

Hey guys! I hate my first post to be a post for help, but I keep getting hit by bots. They've taken half of my faucets coins, andI keep banning IP's and BTC addresses. I was wondering if anyone could make me an extra checkbox that says that they are human. Something pre-made bots wouldn't be able to do.

[dhavin]

Hey guys! I hate my first post to be a post for help, but I keep getting hit by bots. They've taken half of my faucets coins, andI keep banning IP's and BTC addresses. I was wondering if anyone could make me an extra checkbox that says that they are human. Something pre-made bots wouldn't be able to do.

For the time being, I'd recommend changing your rewards to 1 satoshi, if you have not already. It will take you a while to implement the changes that will be necessary to mitigate the bots, a single checkbox won't really suffice. I've got a crying baby in arms right now but I'll share what I've done to minimize the damage in a PM when I can.

[Gifted]

Xapo Faucets have no problem with bots  !!!

[minifrij]

Yes, I've looked at the code. The problem is that if I can look at the code, so can anyone with the intention of writing a bot.

Which is a problem every open source script faces. There is no real fix for this.

Faucetbox should have a giant disclaimer on their FaucetInABox site stating that there is an almost guaranteed likelihood that all of the operators bitcoins will be lost to bots before they can earn any revenue, if they use that script.

So what would happen if they added this? People would maybe move to another open source faucet script, where (if enough of a transition happened) the exact same thing would happen with that script. Would the blame then be pushed on that script/service?
The best way to minimize this would be for micro-transaction services to stop offering faucet scripts and force everyone to code their own. There would be significantly less faucets, but next to no bots for any that aren't the highest paying. However, this would stop anyone who didn't have knowledge in coding or the money to hire someone that did from making a faucet. Would this be a good thing?

If you're going to have a honeypot input field(s) and publish the code, it should at minimum allow the operator to easily modify them without knowing PHP (in the admin section) [1] and move them around the page randomly. [2]

1 - Perhaps, though any then bot creator could look at the page, find the element that looked out of place and bam, there's the honeypot. Granted, more could be done to prevent this and make it very difficult for bots, but there will always be some sort of identifiable feature that bots could use to get around this.
2 - Let me show you why this would do nothing:

Code:

document.getElementById('honeypot').selected = true;

Okay, so now the honeypot is selected no matter where on the page it is. Want to deselect it and show that you're not a bot? Change the true to false. A bot looks like a human requests wise, but it doesn't have to act like one.