Freebitco.in openly posting user data

[savetheFORUM]

I was reading this thread: https://bitcointalk.org/index.php?topic=5323816.0

I don't know who is right and who is wrong here but this thread lead me to Adriano2010 trust page: https://bitcointalk.org/index.php?action=profile;u=514126

I saw the negative feedback from the support of freebitco.in TheQuin that reads "Faucet abuser." which might or might not be true.

But the link shared in the reference is: Deleted for privacy.

Now I am not saying whether that guy is a faucet abuser or not but why is freebitco.in publicly posting the IP addresses of the users that are accused of being controlled by the same owner?

Does this mean that if I am suspected of multiple accounts some day, they will publicly dox me and give out my IP address and email addresses? That just doesn't look right to me. Would like the community to please share their views.

[1714918413]

1714918413

[1714918413]

1714918413

[hugeblack]

I don't think they publish personal user data, many of these IP addresses seem to come from VPN but I agree with you. they have to hide IP and parts of the e-mail instead of posting them.

anyway we have this board --> https://bitcointalk.org/index.php?board=227.0 Some personal data is posted to help identify of scammers.
Again, each scam case differs from the other and on the purpose of disseminating the information.

[savetheFORUM]

Nobody got the guts to speak up against something that is clearly wrong?

[LTU_btc]

Is it all these people in referral list are abusers? Even if they are abusers, I don't think it's ok. Email addresses shouldn't be posted in public. I think they should hide it.
I don't agree with @ETFbitcoin, it's nowhere near to Ledger leak, there is less sensitive data. While on Ledger leaker there was full names, home addresses leaked, what is much worse.

[TheQuin]

Is it all these people in referral list are abusers? Even if they are abusers,

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal and might be useful to other services doing free giveaways to help them prevent theft and fraud by the same person.

I deliberately did not disclose the individual's real email or IP used on their master referrer account.

[LTU_btc]

Is it all these people in referral list are abusers? Even if they are abusers,

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal and might be useful to other services doing free giveaways to help them prevent theft and fraud by the same person.

I deliberately did not disclose the individual's real email or IP used on their master referrer account.

Well, that makes sense. Because initially for me it looked these  emails might be of real people. Often abusers are using very similar emails, like user1@gmail.com, user2@gmail.com and so on.
And as said above, sometimes posting personal data is needed to identify scammers and prevent them to continue their activity.

[TheQuin]

Well, that makes sense. Because initially for me it looked these  emails might be of real people. Often abusers are using very similar emails, like user1@gmail.com, user2@gmail.com and so on.

That is very common from amateur abusers and a couple of years ago even sophisticated bots running 50,000+ accounts would use a name dictionary and randomise them with 2 names and 2 numbers like nameA15486nameB452@anemail.com
Using a large name dictionary and 8 digits prevented them from creating duplicates. But they are easy to spot and block them from withdrawing so now they use emails that look more natural.

And as said above, sometimes posting personal data is needed to identify scammers and prevent them to continue their activity.

I would like to post the users real details but that probably isn't the done thing on this forum.

As an aside, I do believe that anyone abusing the service forfeits the right to privacy. We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

[savetheFORUM]

Thank you for giving me a retaliatory feedback.

"Wants to suppress information that might help others combat theft and fraud. I did not post data of users, they were email addresses and fingerprints of a bot designed to steal from free giveaways."

How would I or anyone know that they are not real emails? Now that you answered I am removing my feedback but you should have more partience

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal and might be useful to other services doing free giveaways to help them prevent theft and fraud by the same person.

I deliberately did not disclose the individual's real email or IP used on their master referrer account.

Good job if that is true but I believe there is no way to find out whether an IP address belongs to a VPN or not. That said, I am now satisfied that you have taken care of the user and only published their VPN's IP address. Feedback removed. As a public forum, I think I had the right to ask you questions regarding doubts I had, I didn't like the retaliatory feedback, everything else was professional from your side though.

[DaveF]

...
Good job if that is true but I believe there is no way to find out whether an IP address belongs to a VPN or not. ...

There are several public lists out there that list known VPNs such as:
https://github.com/ejrv/VPNs
https://udger.com/resources/ip-list/anonymizing_vpn_service

There are also paid for services that have a lot of API back end automation:
https://www.ipqualityscore.com/vpn-ip-address-check
https://www.maxmind.com/en/solutions/geoip2-enterprise-product-suite/anonymous-ip-database

All using a VPN does is hide who you are, it does not hide that fact that you are using a VPN.
And since many of the services are on known IPs it does not even hide which VPN service you are using.

-Dave

[actmyname]

All using a VPN does is hide who you are, it does not hide that fact that you are using a VPN.

Moreover, your browser fingerprint can still be matched to your previously-tracked information... and, boom! Nice VPN, Steve Macdonald!

Staying private online requires multiple steps - it's not just a single point of failure, it's a damned minefield.

[suchmoon]

As an aside, I do believe that anyone abusing the service forfeits the right to privacy. We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

And if wrongly accuse someone, will you be able to scrub their dox from the internet?

I don't see what this could possibly achieve against actual cheaters who like you said use VPN and fake e-mails.

[AB de Royse777]

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal

Still this is not good practice imo to put any kind of email address or IP in public. I would recommend removing those data. The type of action will create mess to individual users.

I deliberately did not disclose the individual's real email or IP used on their master referrer account.

We don't know, the users in the public web do not know because they do not have available tools to verify such things.

When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

What if it was not an intentional bad doing from the users. How are you going to ensure it 100%. No company publish sensitive data publically, and you need to ensure that it does not conflict with the law.

On a side note: I would not like such things. Indirectly you are threatening your users holding their online fingerprints.

[Myleschetty]

All using a VPN does is hide who you are, it does not hide that fact that you are using a VPN.

Moreover, your browser fingerprint can still be matched to your previously-tracked information... and, boom! Nice VPN, Steve Macdonald!

Staying private online requires multiple steps - it's not just a single point of failure, it's a damned minefield.

Some people never understand browsing privately requires more than just using a good VPN (WebRTC IP handling policy etc need to be put in check) but what I understand is that is the information of the user provided not against the doxing rules?

[savetheFORUM]

I might avoid speaking in public against anything wrong I see from now, because there is nothing wrong I did but still have negative feedback on my profile. I guess it's the fortune of the members they have to suffer if they use freebitco.in. I have never seen any support or staff member being as rude and dominating as TheQuin.

I hoped someone will counter that feedback but looks like freebitco.in has deep roots in the DT as well.

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal

Still this is not good practice imo to put any kind of email address or IP in public. I would recommend removing those data. The type of action will create mess to individual users.

I deliberately did not disclose the individual's real email or IP used on their master referrer account.

We don't know, the users in the public web do not know because they do not have available tools to verify such things.

When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

What if it was not an intentional bad doing from the users. How are you going to ensure it 100%. No company publish sensitive data publically, and you need to ensure that it does not conflict with the law.

On a side note: I would not like such things. Indirectly you are threatening your users holding their online fingerprints.

Get ready for negative feedback for expressing your feelings now.

[LeGaulois]

I might avoid speaking in public against anything wrong I see from now, because there is nothing wrong I did but still have negative feedback on my profile. I guess it's the fortune of the members they have to suffer if they use freebitco.in. I have never seen any support or staff member being as rude and dominating as TheQuin.

I hoped someone will counter that feedback but looks like freebitco.in has deep roots in the DT as well.

Don't.
The feedbacks you received are perfect examples of the misconception of the trust system

TheQuin's feedback is invalid to me. it doesn't mean I'm at risk of getting scammed if I deal with you. By the way, email address are also considered as personal data, no matter if it was used to use a bot on a site

The 2 others are also incorrect. There is nothing wrong with creating an alt account (whatever it's true or not I don't care much), and spreading hate is a subjective term but still not suitable for negative feedback. Otherwise, we could also red tag the trolls

I believe everyone has the right to say what he thinks, if I agree or disagree doesn't matter. If we all agree in this world, life will become boring

[savetheFORUM]

Don't.
The feedbacks you received are perfect examples of the misconception of the trust system

But at the end of the day, it is me who got the worst by creating this thread. It takes time and efforts to gather and report something wrong. You speak against someone who is part of DT - immediate negative trust.

I don't know if theymos is involved in the abuse of power or not but right now it is near impossible for someone new to the forum to speak against old members. This idea of making the trust system decentralized is actually making it worst than some of the centralized forum. At least with centralization comes more honesty.

Make some friends and become DT, then just abuse the power. Good luck everyone with the way this forum is heading, we might soon see corruption in the forum and scammers tagging victims.

TheQuin's feedback is invalid to me. it doesn't mean I'm at risk of getting scammed if I deal with you. By the way, email address are also considered as personal data, no matter if it was used to use a bot on a site

You know that because you have read the whole thread but if I try to offer some services now, do you really think the buyer/customer has time to visit my profile and read this whole thread? I don't think so.

The 2 others are also incorrect. There is nothing wrong with creating an alt account (whatever it's true or not I don't care much), and spreading hate is a subjective term but still not suitable for negative feedback. Otherwise, we could also red tag the trolls

Good to see that at least you had the courage to speak up but I suggest don't do it, you might be tagged by the gang members soon. I might not visit the forum again unless Theymos can clear the mess he has created.

I believe everyone has the right to say what he thinks, if I agree or disagree doesn't matter. If we all agree in this world, life will become boring

No one has the right to say anything unless they have some friends in the DT to back them up.

This is my last post on the forum unless the feedback is countered or removed, and hopefully, peace follows here from now.

@theymos, if you cannot ensure honesty in a decentralized trust system, just better remove it completely or centralize it.

[AB de Royse777]

Let's not make it a big issue. I am sure TheQuin will read the responses and will reconsider the tag they left. Sorry I missed the tag (your part) on my last post. The tag do not seem valid to me too.

[savetheFORUM]

Let's not make it a big issue. I am sure TheQuin will read the responses and will reconsider the tag they left. Sorry I missed the tag (your part) on my last post. The tag do not seem valid to me too.

Let's see but all this drama does nothing but just suppresses users who dare to raise their voice when they see a known website doing something wrong. I don't know how emails are not private data, if even they are created to abuse faucet, unless you hide some alphabets, I don't think you can publicly dox them.

As an aside, I do believe that anyone abusing the service forfeits the right to privacy.

I don't agree with this thought either because faucet abuse is not like leaking your country's private information to the enemy. A lot of users abused the primedice faucet back in the day when they launched, doesn't mean primedice doxed them publicly or lynched them to death.

Still if you think like that, at least mention that somewhere in the terms and conditions. If you abuse our faucet, we will dox you on a public forum.

[DireWolfM14]

We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

So, if my kid opens an account on your site, refers me and other family members, and we all access the site from our home IP...

Anyway, thanks for the warning!  

Anyway, I think it's wrong for you to post email addresses and IPs in public.  If you have to do so to provide evidence for your reviews, create a thread in the Investigations Board for that.  At the very least the data won't be scraped by search engines, and newbies won't have access to it.  There's always the possibility that you could be wrong, and if I were the one being doxxed due to an error I wouldn't take that lying down.

[NotATether]

And if wrongly accuse someone, will you be able to scrub their dox from the internet?

That can be prevented by only posting if the IPs belong to data centers. No cheater with a brain runs a large farm from their residential IP address.

I don't see what this could possibly achieve against actual cheaters who like you said use VPN and fake e-mails.

Or just prevent registration from all domain names used by fake email generators. It's easy to get a list of those the more popular ones are using.

It's better to just share the info with other casinos' abuse teams instead of dumping it on a pastebin that almost nobody will read (let alone take action on).

Or even better just close the accounts of cheaters like all other casinos do.


For the record I do feel that TheQuin's red on savetheforum and suchmoon's red on TheQuin should be neutrals. The chance of somebody having a fingerprint the same as a bunch of Chrome scripts is near zero (these aren't browser fingerprints we're talking about: these presumably also take registration date and IP addresses into account as well).

[BitcoinGirl.Club]

This is not good.
Leaving negative feedback because user had their opinion is straight forward an abuse of feedback system. This seize the right of freedom of speech. When you are on DT you need to be very careful about others reputation.   

I would suggest TheQuin:

1. to remove the negative on savetheFORUM
2. Remove all these information on pastebin
3. Don't even think about this 👇👇👇 kind of terms.

if they are caught cheating they can be publically identified by us.

You have built up a business over the years, please do not ruin it very fast.

I am not very quick to leave red tags but if it needed then I too will have the same as suchmoon after few days. It's very risky to be with Freebitco if TheQuin do not chance his/her mind.

[savetheFORUM]

That can be prevented by only posting if the IPs belong to data centers. No cheater with a brain runs a large farm from their residential IP address.

Whether someone uses the same email anywhere or not, whether their IP is real or not, it should NOT be published on a public forum.

We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

So, if my kid opens an account on your site, refers me and other family members, and we all access the site from our home IP...

Anyway, thanks for the warning!  

Then your kid, you and your family will be doxed on the forum because as per theQuin "anyone abusing the service forfeits the right to privacy" and since your kid made a mistake, you will pay for it by getting your identity known to everyone and tagged as a criminal. Some even say that the country might take away all the passports from you guys and you lose the right to vote, because you abused a faucet. lmao

This is not good.
Leaving negative feedback because user had their opinion is straight forward an abuse of feedback system. This seize the right of freedom of speech. When you are on DT you need to be very careful about others reputation.  

That is right and the negative trust sounds like "how dare you speak against us, we have deep roots in the DT"

very nice to see others stepping up for something clearly wrong.

I didn't even call them scammer or something like that while they directly left me negative feedback and didn't bother clearing the situation.


For the record, everyone should know that I messaged their campaign manager Hampuz and asked him to comment, he has just ignored it unfortunately maybe because he is busy. This is something everyone must know, so I am sharing.

[suchmoon]

For the record I do feel that TheQuin's red on savetheforum and suchmoon's red on TheQuin should be neutrals. The chance of somebody having a fingerprint the same as a bunch of Chrome scripts is near zero (these aren't browser fingerprints we're talking about: these presumably also take registration date and IP addresses into account as well).

How about the lawyers and TOS bit? That's gotta be one of the most absurd pseudo-legal threats we've seen here, and that's considering all the shitty casinos with their KYC nonsense etc. I have a feeling it might be against the law in some countries too.

Even though I strongly believe that savethewhatsit is a useless sockpuppet who should be posting from their main account, I also strongly believe that red trust for opinions, criticism, and even trolling is a big no no. Normally it's worth just a tilde but a business using this kind of DT abuse "strategy" combined with disregard for privacy is worth a red (well, mildly orange really) rating. You may disagree that this constitutes "high risk" and tilde me instead, which is perfectly fine too.

[savetheFORUM]

Even though I strongly believe that savethewhatsit is a useless sockpuppet who should be posting from their main account.

This is my only account, either I should remain quiet or I had to wait for years to rank up and post the thread? I don't like either of them.

A newbie talking sense is better than a legendary member talking bullshit. Don't you think so?

[suchmoon]

This is my only account

Bullshit.

I made a new account to at least safeguard main account.

[savetheFORUM]

This is my only account

Bullshit.

I made a new account to at least safeguard main account.

Yes at that time my main account was Jr member and didn't wanted to risk it, now this account itself is a junior so doesn't make sense to post from that or this.

I can assure you, I have not posted from that account anywhere close to what I have posted with this one since then.

[BitcoinGirl.Club]

This is my only account

Bullshit.

I made a new account to at least safeguard main account.

That was quick LOL but of course that does not matter. Theymos gave us this option and it is perfectly fine to have an alt if anyone wants to hide their identity aka their main account.

For the record, everyone should know that I messaged their campaign manager Hampuz and asked him to comment, he has just ignored it unfortunately maybe because he is busy. This is something everyone must know, so I am sharing.

I do not think he has anything to do here. If he feels to give an opinion that's up to him but if he don't then no one can enforce him and start judging him.

Freebitco has years of reputation and it's hard to imagine that they will scam. I am confident that this is something TheQuin did not realize before. Let him/her give time to reconsider the matter.

[LeGaulois]

But at the end of the day, it is me who got the worst by creating this thread. It takes time and efforts to gather and report something wrong. You speak against someone who is part of DT - immediate negative trust.

Not fair to be honest, but I believe it's their last card when they don't have arguments anymore.
At the same time, why should you care? I mean the account you're currently using is not your main account

I don't know if theymos is involved in the abuse of power or not but right now it is near impossible for someone new to the forum to speak against old members. This idea of making the trust system decentralized is actually making it worst than some of the centralized forum. At least with centralization comes more honesty.

Nah, Theymos is certainly not involved in any way and the trust system isn't really the problem. The problem is the mentality around

Make some friends and become DT, then just abuse the power. Good luck everyone with the way this forum is heading, we might soon see corruption in the forum and scammers tagging victims.

I see what you mean and it's probably true regarding some persons, but members outside the DT network have also the possibility to cast their vote by excluding members

You know that because you have read the whole thread but if I try to offer some services now, do you really think the buyer/customer has time to visit my profile and read this whole thread? I don't think so.

Even without reading.
Firstly because I don't consider seriously any feedback given without a reference link or sometimes don't even read it, or take in with a grain of salt.
Now imagine you're selling something and I'm interested in and I see your feedback. Then what? I don't give a fuck because I'm not concerned and not at risk of losing money more than with another member.
However, I would ask to use an escrow but it's only about your rank nothing related to the feedbacks received.

The misuse of the trust system creates a lot of tensions that are not at all necessary. It remembers me some time ago I have seen a user receiving red tags for simply a misunderstood joke. Can you believe it?

[DireWolfM14]

Freebitco has years of reputation and it's hard to imagine that they will scam. I am confident that this is something TheQuin did not realize before. Let him/her give time to reconsider the matter.

Doxing people poses a risk to their safety and security.  Maybe he won't scam anyone but he has admitted that if he suspects you of cheating his site he'll dox you.  That makes using his service "High Risk" which is exactly what a red-tag is designed for.

Not to mention, almost all of TheQuin's reviews since October 2019 are for the abuse of of his service (real or perceived, I won't judge.)  There seems to be a conflict of interest for someone on DT2.  And, as suchmoon already mentioned, what's the point?  They're all throwaway newbie accounts, so it's not like those reviews are preventing the abuse of his service.

[LTU_btc]

Or just prevent registration from all domain names used by fake email generators. It's easy to get a list of those the more popular ones are using.

I don't think it's solution. If you check list of abusers, you'll see that most are using major email providers like Gmail, Yahoo, Yandex and so on. I saw some sites don't allow to signup using certain email providers, such as throwaway Yopmail, maybe Freebitco.in are doing same.

As an aside, I do believe that anyone abusing the service forfeits the right to privacy. We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

I'm against all these abusers, but this thing doesn't sounds good. With all privacy stuff and things like GDPR, I don't think that it can work. And what if someone will be accused incorrectly? You will be responsible for doxed private data.

[TheQuin]

Thank you for giving me a retaliatory feedback.

"Wants to suppress information that might help others combat theft and fraud. I did not post data of users, they were email addresses and fingerprints of a bot designed to steal from free giveaways."

How would I or anyone know that they are not real emails? Now that you answered I am removing my feedback but you should have more partience

The term "retaliatory feedback" has always baffled me. If someone leaves feedback then their trust wall is the only place most people will see a repudiation. You could have also had more patience and waited for my answer before tagging me.

As an aside, I do believe that anyone abusing the service forfeits the right to privacy. We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

And if wrongly accuse someone, will you be able to scrub their dox from the internet?

I don't see what this could possibly achieve against actual cheaters who like you said use VPN and fake e-mails.

I think you are missing the context here. Someone first contacted me by PM about not being able to access their account. When I replied to them and showed them proof that it was one of 409 abusive accounts they had used over a number of years to steal from us they responded by posting a scam accusation against me.

Even under that pressure I deliberately did not dox them and have not revealed their real email and IP address which I know. What I actually published was the proof I needed to rebut their false allegation. The account they claimed was theirs was one of 36 accounts with the same fingerprint and the same referrer that have all played 24 free rolls everyday since they were signed up. Nobody can stay awake 24/7 for 5 months. The IP addresses listed all belong to Amazon Web Services. (You can buy IP databases that categorise and identify owns the addresses).

I am not making any threat to dox people. I am trying to ensure that I have the right of reply to show that I have evidence of theft that makes it fact beyond all reasonable doubt.

Freebitco has years of reputation and it's hard to imagine that they will scam. I am confident that this is something TheQuin did not realize before. Let him/her give time to reconsider the matter.

Doxing people poses a risk to their safety and security.  Maybe he won't scam anyone but he has admitted that if he suspects you of cheating his site he'll dox you.  That makes using his service "High Risk" which is exactly what a red-tag is designed for.

Not to mention, almost all of TheQuin's reviews since October 2019 are for the abuse of of his service (real or perceived, I won't judge.)  There seems to be a conflict of interest for someone on DT2.  And, as suchmoon already mentioned, what's the point?  They're all throwaway newbie accounts, so it's not like those reviews are preventing the abuse of his service.

Again that is unfair. I didn't say if I suspect someone I will dox them. If I am 100% certain that cheating has occurred and I am publically challenged to prove it I might need to reveal some information as evidence.

The reason I started tagging abusers when they post allegations is for my personal use. A surprising number of them come back and post something else in our thread and the feedback is there to remind me who I am talking to. I started doing that a long time before I somehow got included in DT.

For the record I do feel that TheQuin's red on savetheforum and suchmoon's red on TheQuin should be neutrals. The chance of somebody having a fingerprint the same as a bunch of Chrome scripts is near zero (these aren't browser fingerprints we're talking about: these presumably also take registration date and IP addresses into account as well).

Also for the record, I left feedback on savetheforum before I found this thread because it seemed like my only right of reply. The misunderstanding has now been cleared up and as they are no longer falsely stating that I revealed personal information. Both feedbacks are now gone.

I'm not going to say exactly what we fingerprint but the chances of 2 accounts generating the same one are roughly 400000:1 so the chances of 36 accounts with the same referrer are next to zero. In that referral list you'll also see a number of other repeating fingerprints of old bots that are no longer active.
eg There are 159 instances of 44d5c6bcd5946838f0519b64ead39187 and 111 instances of 24928d04ea98d617286d922a5422afa3

The feedbacks you received are perfect examples of the misconception of the trust system

TheQuin's feedback is invalid to me. it doesn't mean I'm at risk of getting scammed if I deal with you. By the way, email address are also considered as personal data, no matter if it was used to use a bot on a site

The 2 others are also incorrect. There is nothing wrong with creating an alt account (whatever it's true or not I don't care much), and spreading hate is a subjective term but still not suitable for negative feedback. Otherwise, we could also red tag the trolls

There is something wrong with creating alt accounts for the purpose of cheating free giveaways in Games and Rounds which is what I have shown they have done in the reference link. I think that anyone running a free giveaway is in danger of being scammed by these accounts.

I disagree about the email addresses. If someone signs up a load of email accounts for the purpose of pretending to be multiple people that don't exist that can't be personal information.

I believe everyone has the right to say what he thinks, if I agree or disagree doesn't matter. If we all agree in this world, life will become boring

That I can agree with.

[savetheFORUM]

You could have also had more patience and waited for my answer before tagging me.

Like I also replied in PM, I left you feedback based on the proofs I had collected, and it was neutral, not negative. Added to that, I am not part of DT and you know being part of the Default Trust brings more responsibility. If I leave feedback it hardly matters but if you do the same, the person in question loses his reputation. Suchmoon's negative on you is an example of how it must hurt you while so many others left for you, you won't be concerned about them. Right?

I understand the situation and have no problems as long as you understand that posting even fake puppet emails which belong to a user on your website, is not the right choice. If someone accuses you and the community asks you, then you can maybe PM some trusted member with all the details.

@suchmoon, I don't know if I have any credibility but I suggest and rather request you to remove the feedback because after a small discussion TheQuin seems like a very understanding and reasonable person. they made the information public just to clear their part.

[suchmoon]

The reason I started tagging abusers when they post allegations is for my personal use. A surprising number of them come back and post something else in our thread and the feedback is there to remind me who I am talking to. I started doing that a long time before I somehow got included in DT.

I'm seriously baffled by this. This is the second presumably otherwise reputable and sane person within the last couple of weeks saying that they use red trust as their own personal notebook. Do you really not see an issue with this? Neutral is there for this exact use case.

Anyway, I replaced my neg with a neutral now that half of the reason for it is no longer valid.

[savetheFORUM]

Thank you to everyone for getting involved, may I please lock the thread? I will wait for 24 hours and if there is no further discussion, I would like to lock the thread as all the doubts are cleared but I agree with suchmoon that feedbacks from DT should be given more sincerely.

[TheQuin]

The reason I started tagging abusers when they post allegations is for my personal use. A surprising number of them come back and post something else in our thread and the feedback is there to remind me who I am talking to. I started doing that a long time before I somehow got included in DT.

I'm seriously baffled by this. This is the second presumably otherwise reputable and sane person within the last couple of weeks saying that they use red trust as their own personal notebook. Do you really not see an issue with this? Neutral is there for this exact use case.

Maybe I didn't explain it fully. I only tag people who I am 100% certain have stolen from us. I think that theft is a valid reason to distrust someone.

The part I expressed above is simply that a long time ago I didn't bother doing it and an account came back complaining about being banned many months later I didn't realise it was the same abuser I had caught before.

Anyway, I replaced my neg with a neutral now that half of the reason for it is no longer valid.

Maybe we could discuss it in PM so savetheFORUM can lock the thread.

@savetheFORUM I didn't realise I was currently in DT. Ironically, I used to bounce in and out depending on suchmoon winning the DT1 lottery but they removed me from their list some time ago. I have my own trust list so I don't really pay to much attention to DT anymore.

[savetheFORUM]

I am in no rush to lock the topic, please proceed with any discussions you may want. Having it publicly helps everyone actually for future reference. I will lock it once I see that there is no discussion going on for sometime.

[TheQuin]

Anyway, I replaced my neg with a neutral now that half of the reason for it is no longer valid.

Which half are you still concerned about?

[savetheFORUM]

Anyway, I replaced my neg with a neutral now that half of the reason for it is no longer valid.

Which half are you still concerned about?

I guess I know it.

1st half was the negative feedback you left for me, which I believe is solved.

2nd half is your approach towards the privacy of users, which he is still concerned about.

I am just stating my own understanding though.

[zanezane]

I'm seriously baffled by this. This is the second presumably otherwise reputable and sane person within the last couple of weeks saying that they use red trust as their own personal notebook. Do you really not see an issue with this? Neutral is there for this exact use case.

Pretty scary for average users like me that some people can just put up some flags on you because "personal". With this thing continuously happening in this forum, we will eventually look like China where everyone we dislike, we censor by making them flagged.

[TheQuin]

2nd half is your approach towards the privacy of users, which he is still concerned about.

I am just stating my own understanding though.

If it is that I really don't see how publishing what is effectively a list of fake IDs used for fraudulent purposes poses any threat to anyone's privacy.

[NotATether]

That can be prevented by only posting if the IPs belong to data centers. No cheater with a brain runs a large farm from their residential IP address.

Whether someone uses the same email anywhere or not, whether their IP is real or not, it should NOT be published on a public forum.

Don't quote me out of context. I also said:

It's better to just share the info with other casinos' abuse teams instead of dumping it on a pastebin that almost nobody will read (let alone take action on).

Do you think any company is going to take a list of IPs from a public forum and place them in their blacklist?  Nobody, because they have data security and authenticity policies that preclude using public data from pseudonymous places like a forum in the first place.

In other words, it's useless to post this stuff on a forum.

For the record I do feel that TheQuin's red on savetheforum and suchmoon's red on TheQuin should be neutrals. The chance of somebody having a fingerprint the same as a bunch of Chrome scripts is near zero (these aren't browser fingerprints we're talking about: these presumably also take registration date and IP addresses into account as well).

How about the lawyers and TOS bit? That's gotta be one of the most absurd pseudo-legal threats we've seen here, and that's considering all the shitty casinos with their KYC nonsense etc. I have a feeling it might be against the law in some countries too.

I agree with you that posting IP and email doxes in public is a stupid idea, hence why I said it's better to share this stuff (well, sell actually, as these are businesses), with other competing casinos since chances are if a multiaccounter is abusing faucets with bots chances are they're doing the same for others also.

And then on their own side just close the offending accounts, which they seem to already do. People who come here to appeal just PM them the evidence instead of making a public post about it. If they continue to whine about it just block their messages.

Freebitcoin's obviously the biggest target of these abusers (just look at their name) so naturally they most likely have the biggest database of bot email and IP info. And then they actually make [back potentially lost] money from selling this, other casinos can weed out their abusers all while preserving the privacy of abusers.

This is my only account

Bullshit.

I made a new account to at least safeguard main account.

LOL! 😂  busted.

2nd half is your approach towards the privacy of users, which he is still concerned about.

I am just stating my own understanding though.

If it is that I really don't see how publishing what is effectively a list of fake IDs used for fraudulent purposes poses any threat to anyone's privacy.

The problem is they're just going to stop leasing the AWS IPs and then you have a list of IPs that point to nowhere or worse, someone's private proxy (you need to hold a certain balance to be allowed to play from one anyway though).

I don't see why you don't simply block fake email addresses from registering though, wouldn't that solve 90% of the problems with fake accounts since they then need a bunch of phone numbers to make equivalent Gmail or Yahoo addresses?

[LoyceV]

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal and might be useful to other services doing free giveaways to help them prevent theft and fraud by the same person.

I don't think this will hold up in court.

As an aside, I do believe that anyone abusing the service forfeits the right to privacy. We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

I'm pretty sure this is illegal in at least all EU member states, and I'm pretty sure that's valid for websites that offer their services in EU countries.

Your ToS is not above the law (and even criminals have rights).

I'm not going to say exactly what we fingerprint but the chances of 2 accounts generating the same one are roughly 400000:1 so the chances of 36 accounts with the same referrer are next to zero.

I just checked FreeBitco.in:

REGISTERED USERS
41,670,054

Given a 400000:1 chance, that leaves an average of 104 users for each "unique" fingerprint. Chances are some of them will use the same referrer too (although 36 indeed seems unlikely).

I disagree about the email addresses. If someone signs up a load of email accounts for the purpose of pretending to be multiple people that don't exist that can't be personal information.

Interesting (cognitivelaw.co.uk:

If you are able to identify an individual either directly or indirectly (even in a professional capacity), then GDPR will apply.

You might be able to link an email address to another account or person online, so chances are some of them fit the category "personal data".

Not to mention, almost all of TheQuin's reviews since October 2019 are for the abuse of of his service (real or perceived, I won't judge.)  There seems to be a conflict of interest for someone on DT2.

Talking about conflicts of interest, I'm still curious why TheQuin didn't respond in Freebitco.in provably cheating:

Interesting. It would be interesting to hear statement from wetsuit or TheQuin.

I find it interesting that for years they haven't responded here. I still believe the accusations are plausible.

Let me quote my post from years ago:

I've often wondered if they're legit, based on the average cost per faucet claim:
1 number pays $200
2 numbers pay $20
4 numbers pay $2
8 numbers pay $0.20
100 numbers pay $0.02
9886 numbers pay $0.002

I've always wanted to know if they really pay $271.37 on average for 10000 rolls. And if so, why don't they just pay $0.027 for each roll? They'd have the highest paying faucet, while it would cost them the same amount in total.
Because they choose not to pay the average amount for each roll, but made it a jackpot system, cheating would be possible and largely go unnoticed. Especially if they only cheat once every few thousand rolls.

Based on the odds, I would expect one $200 winner for every 2 $20 winners.
I did a (manual) count on pages 5, 10, 15, 20, 25, 30, 35, 40, 45, and 50 on Big wins at FreeBitco.in:
I just won $20 at FreeBitco.in! 116 times
I just won $200 at FreeBitco.in! 2 times
I probably miscounted a bit, but let's round it down: winning $200 is 50 times less likely than winning $20, and that makes the difference 25 12.5 times larger than it should be.

There's no hard evidence, and I don't want to do 30,000+ faucet rolls myself to create circumstantial empirical evidence, but I sure as hell don't trust the site! The fact that this plausible accusation gets ignored makes me believe it even more.

[TheQuin]

There's no hard evidence, and I don't want to do 30,000+ faucet rolls myself to create circumstantial empirical evidence, but I sure as hell don't trust the site! The fact that this plausible accusation gets ignored makes me believe it even more.

Maybe you nailed it in the first 4 words. It is an accusation that I have responded to before but it seems pointless to keep repeating it when no real evidence is produced. Someone said it happened or stats isn't proof.

Your ToS is not above the law (and even criminals have rights).

Our ToS is only subject to the laws of the country we are registered in.

edit: for clarity

I think this is often the source of confusion

and I'm pretty sure that's valid for websites that offer their services in EU countries.

the definition of "offer their services in".

[BitcoinGirl.Club]

But the link shared in the reference is: https://pastebin.com/CtWXAcpp

You have not removed the pastebin data yet. It does not matter what's in there (bot or no bot), you should be removing the data from there. We can argue about the rest and spend days about what is right and what is wrong but this should be removed. At least on this forum I am sure you know that no one is going to encourage you to keep it as it is.

[NotATether]

But the link shared in the reference is: https://pastebin.com/CtWXAcpp

You have not removed the pastebin data yet. It does not matter what's in there (bot or no bot), you should be removing the data from there. We can argue about the rest and spend days about what is right and what is wrong but this should be removed.

That pastehin was posted as a guest so it's impossible to remove it now.

[mu_enrico]

I think you are missing the context here. Someone first contacted me by PM about not being able to access their account. When I replied to them and showed them proof that it was one of 409 abusive accounts they had used over a number of years to steal from us they responded by posting a scam accusation against me.

Even under that pressure I deliberately did not dox them and have not revealed their real email and IP address which I know. What I actually published was the proof I needed to rebut their false allegation. The account they claimed was theirs was one of 36 accounts with the same fingerprint and the same referrer that have all played 24 free rolls everyday since they were signed up. Nobody can stay awake 24/7 for 5 months. The IP addresses listed all belong to Amazon Web Services. (You can buy IP databases that categorise and identify owns the addresses).

I am not making any threat to dox people. I am trying to ensure that I have the right of reply to show that I have evidence of theft that makes it fact beyond all reasonable doubt.

A clown reported my statement, so I make it again, no worries.
The context was about publishing proofs for this thread (Freebitco.in scam me 0.004 bitcoin), and he did not reveal real email and IP address.

Have a nice day.

[TheQuin]

But the link shared in the reference is: https://pastebin.com/CtWXAcpp

You have not removed the pastebin data yet. It does not matter what's in there (bot or no bot), you should be removing the data from there. We can argue about the rest and spend days about what is right and what is wrong but this should be removed. At least on this forum I am sure you know that no one is going to encourage you to keep it as it is.

How can you say in all seriousness "It does not matter what's in there"? That's the only thing that does matter.

I did not publish any personal information.

~I really don't see how publishing what is effectively a list of fake IDs used for fraudulent purposes poses any threat to anyone's privacy.

[BitcoinGirl.Club]

How can you say in all seriousness "It does not matter what's in there"? That's the only thing that does matter.

I meant if it's really not personal information or bot for sure that does not matter. If this is bot still there are no way to verify as mentioned by other users. One mistake can expose someone's privacy. Most importantly this kind of practice is very risky for the clients in your platform. They know that their personal information are at risk.

[TheQuin]

How can you say in all seriousness "It does not matter what's in there"? That's the only thing that does matter.

I meant if it's really not personal information or bot for sure that does not matter. If this is bot still there are no way to verify as mentioned by other users. One mistake can expose someone's privacy. Most importantly this kind of practice is very risky for the clients in your platform. They know that their personal information are at risk.

The whole point of me publishing it was to prove beyond all reasonable doubt that they were not real people and were in fact fraudulent accounts of a bot. I really don't know how I'm supposed to defend myself against the botter's accusations without showing the evidence.

[savetheFORUM]

How can you say in all seriousness "It does not matter what's in there"? That's the only thing that does matter.

I meant if it's really not personal information or bot for sure that does not matter. If this is bot still there are no way to verify as mentioned by other users. One mistake can expose someone's privacy. Most importantly this kind of practice is very risky for the clients in your platform. They know that their personal information are at risk.

The whole point of me publishing it was to prove beyond all reasonable doubt that they were not real people and were in fact fraudulent accounts of a bot. I really don't know how I'm supposed to defend myself against the botter's accusations without showing the evidence.

You're not getting the point here. If I purchase a product from amazon and make a complaint while no matter how dissatisfied and unhappy amazon are with my complaint, they will not publish my personal data without my written approval.

There are so many accusations against so many trusted websites here almost daily, but there is a manner in which they must be handled. Check accusations against sportsbet.io for example, they answer with proofs while still keeping the user details confidential.

For example, check this: https://bitcointalk.org/index.php?topic=5266626.0

You need to counter accusations made against you professionally, you cannot act angry and do things in rage without being concerned about someone else's privacy. I know you made a mistake wasn't intentional, but at least realize the mistake now and remove the pastebin content.

if you posted as a guest, you made a blunder to be honest because even if you wanted to publish some proofs, you should have uploaded at freebitco.in on some page.. Now at least realize the mistake and promise members that you won't be doing it again, is your best case here seriously.

[TheQuin]

There are so many accusations against so many trusted websites here almost daily, but there is a manner in which they must be handled. Check accusations against sportsbet.io for example, they answer with proofs while still keeping the user details confidential.

I will have a look to see how they do that and if there is any way I can do things better.

My point is that I did keep the user's details confidential. The thief here is the account that referred all those bots. If you look at what I published the first 300+ are not even email addresses. They are just random letters like someone punched the keyboard and added an email domain. Those accounts can only make a few rolls before they get blocked at the email verification stage but with hundreds of them significant referral income is stolen.
For the last 38 the thief came back 2 years later and got themself a bot capable of signing up the emails accounts.
The fingerprinting gives a probability in line with a Bitcoin collision that they are different people and the usage pattern is also impossible:

The fingerprint evidence itself is absolutely damning but there is so much more.

There is zero chance that on 2020-09-25 someone signed up to a referral link using a proxy server hosted by AWS and started making 24 free rolls every day. Then a few days later someone else came along and did exactly the same thing. That pattern then repeated every few days until the 38th and last one signed up on 2021-03-12. (there would have been many more if I hadn't banned him).

If it had been a more sophisticated bot that was capable of faking unique fingerprints it still would have been a 100% certainty to be a bot. That pattern of usage is not natural human behaviour.
The 2 accounts with another fingerprint 096aaa29ef6e2a25cd2f4ab4cf3ef793 in that 38 follow the same patterns using the same AWS proxies and are with absolute certainty the same bot. I guess he just logged in on another device like his mobile phone to check the balance or something.

This is one of the most obvious bots you will ever see. Nobody has 38 active referrals all rolling 24 times a day all from AWS. Making the schoolboy error with the fingerprints as well just makes it even easier to prove.

[savetheFORUM]

There are so many accusations against so many trusted websites here almost daily, but there is a manner in which they must be handled. Check accusations against sportsbet.io for example, they answer with proofs while still keeping the user details confidential.

I will have a look to see how they do that and if there is any way I can do things better.

My point is that I did keep the user's details confidential. The thief here is the account that referred all those bots. If you look at what I published the first 300+ are not even email addresses. They are just random letters like someone punched the keyboard and added an email domain. Those accounts can only make a few rolls before they get blocked at the email verification stage but with hundreds of them significant referral income is stolen.
For the last 38 the thief came back 2 years later and got themself a bot capable of signing up the emails accounts.
The fingerprinting gives a probability in line with a Bitcoin collision that they are different people and the usage pattern is also impossible:

The fingerprint evidence itself is absolutely damning but there is so much more.

There is zero chance that on 2020-09-25 someone signed up to a referral link using a proxy server hosted by AWS and started making 24 free rolls every day. Then a few days later someone else came along and did exactly the same thing. That pattern then repeated every few days until the 38th and last one signed up on 2021-03-12. (there would have been many more if I hadn't banned him).

If it had been a more sophisticated bot that was capable of faking unique fingerprints it still would have been a 100% certainty to be a bot. That pattern of usage is not natural human behaviour.
The 2 accounts with another fingerprint 096aaa29ef6e2a25cd2f4ab4cf3ef793 in that 38 follow the same patterns using the same AWS proxies and are with absolute certainty the same bot. I guess he just logged in on another device like his mobile phone to check the balance or something.

This is one of the most obvious bots you will ever see. Nobody has 38 active referrals all rolling 24 times a day all from AWS. Making the schoolboy error with the fingerprints as well just makes it even easier to prove.

That is why I stopped discussing because after I understand your part, I agreed that you were not completely wrong. I guess everything is good now but the community just demands a little bit more privacy promise. Maybe you need to mention in terms and conditions, if it's legal, that abusing our services might lead to legal investigation.

[TheQuin]

That is why I stopped discussing because after I understand your part, I agreed that you were not completely wrong. I guess everything is good now but the community just demands a little bit more privacy promise. Maybe you need to mention in terms and conditions, if it's legal, that abusing our services might lead to legal investigation.

The bit I'm struggling with here is how I can prove multi-accounting if I can't show the account details.

I did mention earlier in the thread that we are in the process of getting our lawyers to draft a more professional ToS. I kind of like the old one because it is short enough and to the point that nobody has an excuse for not reading it but times have moved on from it just being a hobby site.

[suchmoon]

How can you say in all seriousness "It does not matter what's in there"? That's the only thing that does matter.

I meant if it's really not personal information or bot for sure that does not matter. If this is bot still there are no way to verify as mentioned by other users. One mistake can expose someone's privacy. Most importantly this kind of practice is very risky for the clients in your platform. They know that their personal information are at risk.

The whole point of me publishing it was to prove beyond all reasonable doubt that they were not real people and were in fact fraudulent accounts of a bot. I really don't know how I'm supposed to defend myself against the botter's accusations without showing the evidence.

This evidence is mostly meaningless unless you can be trusted to provide truthful information, in which case you could just say "auto-generated e-mail addresses" and "same AWS subnet" instead of posting actual e-mail addresses and IPs. Or post them hashed. Or ask a third party to verify.

Another thing that stood out in one your debates with a supposed abuser is that you're saying it's obviously a bot if they run it 24/7... if it's obvious why are you allowing it? Why not limit to 16 claims per day or whatever is "human". Or at least ban them after a week instead of letting the whole farm run for months and then get to the point where you feel you have to post e-mails etc to defend yourself.

I understand that this business attracts all sorts of shitheaded freeloaders but you're not going to scare them away by posting e-mails publicly. You might scare away good customers though.

[TheQuin]

This evidence is mostly meaningless unless you can be trusted to provide truthful information, in which case you could just say "auto-generated e-mail addresses" and "same AWS subnet" instead of posting actual e-mail addresses and IPs. Or post them hashed. Or ask a third party to verify.

Thanks for the suggestion. I'll try to incorporate that in future. It's too late to change it this time as it all republished automatically elsewhere.

Another thing that stood out in one your debates with a supposed abuser is that you're saying it's obviously a bot if they run it 24/7... if it's obvious why are you allowing it? Why not limit to 16 claims per day or whatever is "human". Or at least ban them after a week instead of letting the whole farm run for months and then get to the point where you feel you have to post e-mails etc to defend yourself.

We did previously have a system in place that automatically blocked bots that made an infeasible number of rolls over a period of 5 days. The problem is that they soon work out the limit and stay below it. Why not run 3x the number of bots 8 times a day?
The same goes for every detection system I have been able to come up with. The one idea that I had that has drastically reduced abuse is to leave them to waste several months getting a balance they can withdraw and then blocking the withdrawal for a manual review. That way they then have to spend several more months to find out if they correctly guessed how I caught them.

I understand that this business attracts all sorts of shitheaded freeloaders but you're not going to scare them away by posting e-mails publicly. You might scare away good customers though.

The intention was never to scare them away, just to refute their claim that I scammed them.

I know I got angry and overreacted to some things here and I'll try to do better in future. I don't want to scare anyone away.

[BitcoinGirl.Club]

Thanks for the suggestion. I'll try to incorporate that in future. It's too late to change it this time as it all republished automatically elsewhere.

If the pastebin data can not be removed then at least remove the reference link on the feedback you left for Adriano2010. I think this will cool down the entire issue a bit since there will be less trace for the data reference. Good to hear about the promise of future incorporation.

I hope you will have no confusion of understanding that publishing such data is not correct by any means.

[savetheFORUM]

Thanks for the suggestion. I'll try to incorporate that in future. It's too late to change it this time as it all republished automatically elsewhere.

If the pastebin data can not be removed then at least remove the reference link on the feedback you left for Adriano2010. I think this will cool down the entire issue a bit since there will be less trace for the data reference. Good to hear about the promise of future incorporation.

I hope you will have no confusion of understanding that publishing such data is not correct by any means.

I will edit the OP as well, just please message me @TheQuin once you remove that link.