[2017-09-27]Showtime websites secretly mined user CPU for cryptocurrency

[bbc.reporter]

After the Piratebay and the Chrome extension Safebrowse, now we have Showtime's website using the script. I reckon that this will not be the end of it and we should expect more websites to follow this course as an alternative to banner ads.

I really will not mind of they use my CPU for mining but they should ask of permission and share the profits. Will websites become the new mining pool?



This past weekend, Showtime websites were found to be running a script that allows the sites to mine visitors’ extra CPU power for cryptocurrency, as pointed out by users on Twitter. The afflicted sites included showtime.com and showtimeanytime.com, but the script has since been removed following reports from Gizmodo and other sites.

The crypto mining Javascript is called Coinhive, and according to the site, it was made as an alternative to banner ads as a way for website owners to get around pesky ad-blockers. Ironically, some ad-blockers have now included Coinhive on the list of the banned.

The script mines the cryptocurrency known as Monero. Launched in April 2014, Monero is meant to be a more anonymous version of Bitcoin because you can purchase it offline with cash. Thirty percent of the proceeds go to Coinhive, while sites using the service, like Showtime and The Pirate Bay, keep the rest. For its part, The Pirate Bay has apologized for secretly running the script and then asked its users if they preferred ads or CPU mining. Surprisingly, many of the comments indicate a positive reception towards the idea.

Read the whole article https://www.theverge.com/2017/9/26/16367620/showtime-cpu-cryptocurrency-monero-coinhive

[cr1776]

It seems surprising (to me) that showtime would knowingly use this script.  I wonder if we’ll ever know the truth about whether it was planned, a rogue employee or malware.

[Kemarit]

It seems surprising (to me) that showtime would knowingly use this script.  I wonder if we’ll ever know the truth about whether it was planned, a rogue employee or malware.

Yes, quite surprising to hear it as well. Showtime has earn billions already so I doubt that the company would really take advantage of people visiting their website. Intentionally or not, Showtime should make an official announcement to somewhat do a damage control. This could be the trend on the next coming years, but I think anti-virus could detect this malicious malware or trojan. If you feel that your PC or Laptop is slowing down, its time to do some checking just to make sure that you are not being taken advantage. We need to be vigilant.

[d5000]

I remember the times, in 2013, when similar scripts were already around, and mined Bitcoin   In those times full of buzz, some experts even predicted that this could replace ads on websites in the future as a "legit" revenue model ... (Unfortunately I now didn't find any of these over-optimistic blog posts).

But I think the current trends in web design are going against that model - we have almost defeated Flash, Silverlight and other plugins that slowed down our computers and smartphones for almost two decades - and that's not exactly bad. So like others already said, these scripts would be simply considered malware and killed by adblocking plugins or even virus scanners.

[bbc.reporter]

@d5000. Not if the websites share the profits with the visitors. I reckon this will be the start of a new trend in cryptocoin mining. Websites will become the new mining pools. It will also add more hits to those websites making it an attractive form of revenue model.

But they have to let the users choose if they want to opt in or not.

[d5000]

@d5000. Not if the websites share the profits with the visitors. I reckon this will be the start of a new trend in cryptocoin mining. Websites will become the new mining pools. It will also add more hits to those websites making it an attractive form of revenue model.

But they have to let the users choose if they want to opt in or not.

I seriously doubt this "mining model" will become a serious business. Why should a website visitor mine coins for the website owner if he simply could run a "mining-script blocker script"? With another simple to use mining software (or even a self-hosted website) he could mine for a regular pool and he would get much more.

The only way I think that such a model could be a success is if the website offers exclusive content (content that normally one would have to pay for) for free if the visitor accepts the mining script. That model would be indeed interesting - it would be a kind of "payment without money".

[veleten]

I seriously doubt this could bring any profit,five minutes of your CPU power on a site mining Monero?
how much will the site earn? 1/100 of a cent? probably less than that
would love to see the stats,but there is no chance to mine secretly now since Hive script will be asking for user's permission before running the script

[richardsNY]

The only way I think that such a model could be a success is if the website offers exclusive content (content that normally one would have to pay for) for free if the visitor accepts the mining script. That model would be indeed interesting - it would be a kind of "payment without money".

It would require people to leave their browser running for an insane amount of time considering that the mining rewards are nothing more than dust. People will be better off farming their way through faucets since they offer far higher returns than a script using your resources inefficiently -- only an utter noob would agree to something like this. This form of mining is only viable when a large botnet is doing it, because the entity in control of this botnet doesn't have to pay a single penny to keep it running.

[d5000]

It would require people to leave their browser running for an insane amount of time considering that the mining rewards are nothing more than dust. People will be better off farming their way through faucets since they offer far higher returns than a script using your resources inefficiently -- only an utter noob would agree to something like this. This form of mining is only viable when a large botnet is doing it, because the entity in control of this botnet doesn't have to pay a single penny to keep it running.

From the point of view of the website provider it's different - if he has a really popular website, he would have access to a decent "botnet" (although participation would be voluntarily) to mine with. And if the content offered is good and would otherwise - let's say - cost $0.20, then I would be tempted to click on a button where I agree to mine Monero inside my browser for 5 or 10 minutes or so. And the website owner would also have no transaction costs, even if the income I generated was only $0,03 it may be profitable for the owner.

From the point of view of the website visitor it would make no sense, that's true, and I have highlighted that also in my response - I think you referred to @bbc.reporter's proposal.

[darkangel11]

I wonder if this is actually able to mine a lot. Even if I left the browser on with that site displayed, the process would become a secondary thing, running in the background. So if I go play a game or whatever, all my cpu power will be diverted to that game and the miner will get what's left. Even if I had a top notch i7, that wouldn't leave them with a lot of mining power. I'd like to see their stats to satisfy my nerdy curiosity.

[bbc.reporter]

@d5000. Not if the websites share the profits with the visitors. I reckon this will be the start of a new trend in cryptocoin mining. Websites will become the new mining pools. It will also add more hits to those websites making it an attractive form of revenue model.

But they have to let the users choose if they want to opt in or not.

I seriously doubt this "mining model" will become a serious business. Why should a website visitor mine coins for the website owner if he simply could run a "mining-script blocker script"? With another simple to use mining software (or even a self-hosted website) he could mine for a regular pool and he would get much more.

The only way I think that such a model could be a success is if the website offers exclusive content (content that normally one would have to pay for) for free if the visitor accepts the mining script. That model would be indeed interesting - it would be a kind of "payment without money".

Besides exclusive content, what about cryptocoin forums like bitcointalk? If Theymos had the script on the site but with an opt in button and the choice to have the coins sent to your wallet or to a donation address, would that be a good solution for the mining model? We are here in the forum all the time anyway, why not mine coins at the same time.

[d5000]

Besides exclusive content, what about cryptocoin forums like bitcointalk? If Theymos had the script on the site but with an opt in button and the choice to have the coins sent to your wallet or to a donation address, would that be a good solution for the mining model? We are here in the forum all the time anyway, why not mine coins at the same time.

I don't think that would work. The reward you could earn - as a website user - with this model is simply too small, and would be more so if everyone was doing it for longer times (e.g. BCT users surfing this forum all the day) because hashrate/difficulty would go up, while rewards would stay the same and the demand for the coin - e.g. Monero - reflected in its price would not increase necessarily.

Only for some big websites the model could result in profits, but they must give the "miners" a good reason to mine, or directly hide the mining function like Showtime appears to have done.

[Samarkand]

... So like others already said, these scripts would be simply considered malware and killed by adblocking plugins or even virus scanners.

Coinhive is already banned by several ad-block plugins.
The high CPU load during a visit to these websites is simply too noticeable (due to the
increased noise of the CPU fan).

The developers of Coinhive have therefore announced plans to
only allow the Monero miner if the user has signalled
his consent to mining by opting-in.

Nevertheless, the technology behind this is quite interesting.