Freebitco.in openly posting user data

[NotATether]

That can be prevented by only posting if the IPs belong to data centers. No cheater with a brain runs a large farm from their residential IP address.

Whether someone uses the same email anywhere or not, whether their IP is real or not, it should NOT be published on a public forum.

Don't quote me out of context. I also said:

It's better to just share the info with other casinos' abuse teams instead of dumping it on a pastebin that almost nobody will read (let alone take action on).

Do you think any company is going to take a list of IPs from a public forum and place them in their blacklist?  Nobody, because they have data security and authenticity policies that preclude using public data from pseudonymous places like a forum in the first place.

In other words, it's useless to post this stuff on a forum.

For the record I do feel that TheQuin's red on savetheforum and suchmoon's red on TheQuin should be neutrals. The chance of somebody having a fingerprint the same as a bunch of Chrome scripts is near zero (these aren't browser fingerprints we're talking about: these presumably also take registration date and IP addresses into account as well).

How about the lawyers and TOS bit? That's gotta be one of the most absurd pseudo-legal threats we've seen here, and that's considering all the shitty casinos with their KYC nonsense etc. I have a feeling it might be against the law in some countries too.

I agree with you that posting IP and email doxes in public is a stupid idea, hence why I said it's better to share this stuff (well, sell actually, as these are businesses), with other competing casinos since chances are if a multiaccounter is abusing faucets with bots chances are they're doing the same for others also.

And then on their own side just close the offending accounts, which they seem to already do. People who come here to appeal just PM them the evidence instead of making a public post about it. If they continue to whine about it just block their messages.

Freebitcoin's obviously the biggest target of these abusers (just look at their name) so naturally they most likely have the biggest database of bot email and IP info. And then they actually make [back potentially lost] money from selling this, other casinos can weed out their abusers all while preserving the privacy of abusers.

This is my only account

Bullshit.

I made a new account to at least safeguard main account.

LOL! 😂  busted.

2nd half is your approach towards the privacy of users, which he is still concerned about.

I am just stating my own understanding though.

If it is that I really don't see how publishing what is effectively a list of fake IDs used for fraudulent purposes poses any threat to anyone's privacy.

The problem is they're just going to stop leasing the AWS IPs and then you have a list of IPs that point to nowhere or worse, someone's private proxy (you need to hold a certain balance to be allowed to play from one anyway though).

I don't see why you don't simply block fake email addresses from registering though, wouldn't that solve 90% of the problems with fake accounts since they then need a bunch of phone numbers to make equivalent Gmail or Yahoo addresses?

[1714911238]

1714911238

[1714911238]

1714911238

[1714911238]

1714911238

[1714911238]

1714911238

[LoyceV]

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal and might be useful to other services doing free giveaways to help them prevent theft and fraud by the same person.

I don't think this will hold up in court.

As an aside, I do believe that anyone abusing the service forfeits the right to privacy. We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

I'm pretty sure this is illegal in at least all EU member states, and I'm pretty sure that's valid for websites that offer their services in EU countries.

Your ToS is not above the law (and even criminals have rights).

I'm not going to say exactly what we fingerprint but the chances of 2 accounts generating the same one are roughly 400000:1 so the chances of 36 accounts with the same referrer are next to zero.

I just checked FreeBitco.in:

REGISTERED USERS
41,670,054

Given a 400000:1 chance, that leaves an average of 104 users for each "unique" fingerprint. Chances are some of them will use the same referrer too (although 36 indeed seems unlikely).

I disagree about the email addresses. If someone signs up a load of email accounts for the purpose of pretending to be multiple people that don't exist that can't be personal information.

Interesting (cognitivelaw.co.uk:

If you are able to identify an individual either directly or indirectly (even in a professional capacity), then GDPR will apply.

You might be able to link an email address to another account or person online, so chances are some of them fit the category "personal data".

Not to mention, almost all of TheQuin's reviews since October 2019 are for the abuse of of his service (real or perceived, I won't judge.)  There seems to be a conflict of interest for someone on DT2.

Talking about conflicts of interest, I'm still curious why TheQuin didn't respond in Freebitco.in provably cheating:

Interesting. It would be interesting to hear statement from wetsuit or TheQuin.

I find it interesting that for years they haven't responded here. I still believe the accusations are plausible.

Let me quote my post from years ago:

I've often wondered if they're legit, based on the average cost per faucet claim:
1 number pays $200
2 numbers pay $20
4 numbers pay $2
8 numbers pay $0.20
100 numbers pay $0.02
9886 numbers pay $0.002

I've always wanted to know if they really pay $271.37 on average for 10000 rolls. And if so, why don't they just pay $0.027 for each roll? They'd have the highest paying faucet, while it would cost them the same amount in total.
Because they choose not to pay the average amount for each roll, but made it a jackpot system, cheating would be possible and largely go unnoticed. Especially if they only cheat once every few thousand rolls.

Based on the odds, I would expect one $200 winner for every 2 $20 winners.
I did a (manual) count on pages 5, 10, 15, 20, 25, 30, 35, 40, 45, and 50 on Big wins at FreeBitco.in:
I just won $20 at FreeBitco.in! 116 times
I just won $200 at FreeBitco.in! 2 times
I probably miscounted a bit, but let's round it down: winning $200 is 50 times less likely than winning $20, and that makes the difference 25 12.5 times larger than it should be.

There's no hard evidence, and I don't want to do 30,000+ faucet rolls myself to create circumstantial empirical evidence, but I sure as hell don't trust the site! The fact that this plausible accusation gets ignored makes me believe it even more.

[TheQuin]

There's no hard evidence, and I don't want to do 30,000+ faucet rolls myself to create circumstantial empirical evidence, but I sure as hell don't trust the site! The fact that this plausible accusation gets ignored makes me believe it even more.

Maybe you nailed it in the first 4 words. It is an accusation that I have responded to before but it seems pointless to keep repeating it when no real evidence is produced. Someone said it happened or stats isn't proof.

Your ToS is not above the law (and even criminals have rights).

Our ToS is only subject to the laws of the country we are registered in.

edit: for clarity

I think this is often the source of confusion

and I'm pretty sure that's valid for websites that offer their services in EU countries.

the definition of "offer their services in".

[BitcoinGirl.Club]

But the link shared in the reference is: https://pastebin.com/CtWXAcpp

You have not removed the pastebin data yet. It does not matter what's in there (bot or no bot), you should be removing the data from there. We can argue about the rest and spend days about what is right and what is wrong but this should be removed. At least on this forum I am sure you know that no one is going to encourage you to keep it as it is.

[NotATether]

But the link shared in the reference is: https://pastebin.com/CtWXAcpp

You have not removed the pastebin data yet. It does not matter what's in there (bot or no bot), you should be removing the data from there. We can argue about the rest and spend days about what is right and what is wrong but this should be removed.

That pastehin was posted as a guest so it's impossible to remove it now.

[mu_enrico]

I think you are missing the context here. Someone first contacted me by PM about not being able to access their account. When I replied to them and showed them proof that it was one of 409 abusive accounts they had used over a number of years to steal from us they responded by posting a scam accusation against me.

Even under that pressure I deliberately did not dox them and have not revealed their real email and IP address which I know. What I actually published was the proof I needed to rebut their false allegation. The account they claimed was theirs was one of 36 accounts with the same fingerprint and the same referrer that have all played 24 free rolls everyday since they were signed up. Nobody can stay awake 24/7 for 5 months. The IP addresses listed all belong to Amazon Web Services. (You can buy IP databases that categorise and identify owns the addresses).

I am not making any threat to dox people. I am trying to ensure that I have the right of reply to show that I have evidence of theft that makes it fact beyond all reasonable doubt.

A clown reported my statement, so I make it again, no worries.
The context was about publishing proofs for this thread (Freebitco.in scam me 0.004 bitcoin), and he did not reveal real email and IP address.

Have a nice day.

[TheQuin]

But the link shared in the reference is: https://pastebin.com/CtWXAcpp

You have not removed the pastebin data yet. It does not matter what's in there (bot or no bot), you should be removing the data from there. We can argue about the rest and spend days about what is right and what is wrong but this should be removed. At least on this forum I am sure you know that no one is going to encourage you to keep it as it is.

How can you say in all seriousness "It does not matter what's in there"? That's the only thing that does matter.

I did not publish any personal information.

~I really don't see how publishing what is effectively a list of fake IDs used for fraudulent purposes poses any threat to anyone's privacy.

[BitcoinGirl.Club]

How can you say in all seriousness "It does not matter what's in there"? That's the only thing that does matter.

I meant if it's really not personal information or bot for sure that does not matter. If this is bot still there are no way to verify as mentioned by other users. One mistake can expose someone's privacy. Most importantly this kind of practice is very risky for the clients in your platform. They know that their personal information are at risk.

[TheQuin]

How can you say in all seriousness "It does not matter what's in there"? That's the only thing that does matter.

I meant if it's really not personal information or bot for sure that does not matter. If this is bot still there are no way to verify as mentioned by other users. One mistake can expose someone's privacy. Most importantly this kind of practice is very risky for the clients in your platform. They know that their personal information are at risk.

The whole point of me publishing it was to prove beyond all reasonable doubt that they were not real people and were in fact fraudulent accounts of a bot. I really don't know how I'm supposed to defend myself against the botter's accusations without showing the evidence.

[savetheFORUM]

How can you say in all seriousness "It does not matter what's in there"? That's the only thing that does matter.

I meant if it's really not personal information or bot for sure that does not matter. If this is bot still there are no way to verify as mentioned by other users. One mistake can expose someone's privacy. Most importantly this kind of practice is very risky for the clients in your platform. They know that their personal information are at risk.

The whole point of me publishing it was to prove beyond all reasonable doubt that they were not real people and were in fact fraudulent accounts of a bot. I really don't know how I'm supposed to defend myself against the botter's accusations without showing the evidence.

You're not getting the point here. If I purchase a product from amazon and make a complaint while no matter how dissatisfied and unhappy amazon are with my complaint, they will not publish my personal data without my written approval.

There are so many accusations against so many trusted websites here almost daily, but there is a manner in which they must be handled. Check accusations against sportsbet.io for example, they answer with proofs while still keeping the user details confidential.

For example, check this: https://bitcointalk.org/index.php?topic=5266626.0

You need to counter accusations made against you professionally, you cannot act angry and do things in rage without being concerned about someone else's privacy. I know you made a mistake wasn't intentional, but at least realize the mistake now and remove the pastebin content.

if you posted as a guest, you made a blunder to be honest because even if you wanted to publish some proofs, you should have uploaded at freebitco.in on some page.. Now at least realize the mistake and promise members that you won't be doing it again, is your best case here seriously.

[TheQuin]

There are so many accusations against so many trusted websites here almost daily, but there is a manner in which they must be handled. Check accusations against sportsbet.io for example, they answer with proofs while still keeping the user details confidential.

I will have a look to see how they do that and if there is any way I can do things better.

My point is that I did keep the user's details confidential. The thief here is the account that referred all those bots. If you look at what I published the first 300+ are not even email addresses. They are just random letters like someone punched the keyboard and added an email domain. Those accounts can only make a few rolls before they get blocked at the email verification stage but with hundreds of them significant referral income is stolen.
For the last 38 the thief came back 2 years later and got themself a bot capable of signing up the emails accounts.
The fingerprinting gives a probability in line with a Bitcoin collision that they are different people and the usage pattern is also impossible:

The fingerprint evidence itself is absolutely damning but there is so much more.

There is zero chance that on 2020-09-25 someone signed up to a referral link using a proxy server hosted by AWS and started making 24 free rolls every day. Then a few days later someone else came along and did exactly the same thing. That pattern then repeated every few days until the 38th and last one signed up on 2021-03-12. (there would have been many more if I hadn't banned him).

If it had been a more sophisticated bot that was capable of faking unique fingerprints it still would have been a 100% certainty to be a bot. That pattern of usage is not natural human behaviour.
The 2 accounts with another fingerprint 096aaa29ef6e2a25cd2f4ab4cf3ef793 in that 38 follow the same patterns using the same AWS proxies and are with absolute certainty the same bot. I guess he just logged in on another device like his mobile phone to check the balance or something.

This is one of the most obvious bots you will ever see. Nobody has 38 active referrals all rolling 24 times a day all from AWS. Making the schoolboy error with the fingerprints as well just makes it even easier to prove.

[savetheFORUM]

There are so many accusations against so many trusted websites here almost daily, but there is a manner in which they must be handled. Check accusations against sportsbet.io for example, they answer with proofs while still keeping the user details confidential.

I will have a look to see how they do that and if there is any way I can do things better.

My point is that I did keep the user's details confidential. The thief here is the account that referred all those bots. If you look at what I published the first 300+ are not even email addresses. They are just random letters like someone punched the keyboard and added an email domain. Those accounts can only make a few rolls before they get blocked at the email verification stage but with hundreds of them significant referral income is stolen.
For the last 38 the thief came back 2 years later and got themself a bot capable of signing up the emails accounts.
The fingerprinting gives a probability in line with a Bitcoin collision that they are different people and the usage pattern is also impossible:

The fingerprint evidence itself is absolutely damning but there is so much more.

There is zero chance that on 2020-09-25 someone signed up to a referral link using a proxy server hosted by AWS and started making 24 free rolls every day. Then a few days later someone else came along and did exactly the same thing. That pattern then repeated every few days until the 38th and last one signed up on 2021-03-12. (there would have been many more if I hadn't banned him).

If it had been a more sophisticated bot that was capable of faking unique fingerprints it still would have been a 100% certainty to be a bot. That pattern of usage is not natural human behaviour.
The 2 accounts with another fingerprint 096aaa29ef6e2a25cd2f4ab4cf3ef793 in that 38 follow the same patterns using the same AWS proxies and are with absolute certainty the same bot. I guess he just logged in on another device like his mobile phone to check the balance or something.

This is one of the most obvious bots you will ever see. Nobody has 38 active referrals all rolling 24 times a day all from AWS. Making the schoolboy error with the fingerprints as well just makes it even easier to prove.

That is why I stopped discussing because after I understand your part, I agreed that you were not completely wrong. I guess everything is good now but the community just demands a little bit more privacy promise. Maybe you need to mention in terms and conditions, if it's legal, that abusing our services might lead to legal investigation.

[TheQuin]

That is why I stopped discussing because after I understand your part, I agreed that you were not completely wrong. I guess everything is good now but the community just demands a little bit more privacy promise. Maybe you need to mention in terms and conditions, if it's legal, that abusing our services might lead to legal investigation.

The bit I'm struggling with here is how I can prove multi-accounting if I can't show the account details.

I did mention earlier in the thread that we are in the process of getting our lawyers to draft a more professional ToS. I kind of like the old one because it is short enough and to the point that nobody has an excuse for not reading it but times have moved on from it just being a hobby site.

[suchmoon]

How can you say in all seriousness "It does not matter what's in there"? That's the only thing that does matter.

I meant if it's really not personal information or bot for sure that does not matter. If this is bot still there are no way to verify as mentioned by other users. One mistake can expose someone's privacy. Most importantly this kind of practice is very risky for the clients in your platform. They know that their personal information are at risk.

The whole point of me publishing it was to prove beyond all reasonable doubt that they were not real people and were in fact fraudulent accounts of a bot. I really don't know how I'm supposed to defend myself against the botter's accusations without showing the evidence.

This evidence is mostly meaningless unless you can be trusted to provide truthful information, in which case you could just say "auto-generated e-mail addresses" and "same AWS subnet" instead of posting actual e-mail addresses and IPs. Or post them hashed. Or ask a third party to verify.

Another thing that stood out in one your debates with a supposed abuser is that you're saying it's obviously a bot if they run it 24/7... if it's obvious why are you allowing it? Why not limit to 16 claims per day or whatever is "human". Or at least ban them after a week instead of letting the whole farm run for months and then get to the point where you feel you have to post e-mails etc to defend yourself.

I understand that this business attracts all sorts of shitheaded freeloaders but you're not going to scare them away by posting e-mails publicly. You might scare away good customers though.

[TheQuin]

This evidence is mostly meaningless unless you can be trusted to provide truthful information, in which case you could just say "auto-generated e-mail addresses" and "same AWS subnet" instead of posting actual e-mail addresses and IPs. Or post them hashed. Or ask a third party to verify.

Thanks for the suggestion. I'll try to incorporate that in future. It's too late to change it this time as it all republished automatically elsewhere.

Another thing that stood out in one your debates with a supposed abuser is that you're saying it's obviously a bot if they run it 24/7... if it's obvious why are you allowing it? Why not limit to 16 claims per day or whatever is "human". Or at least ban them after a week instead of letting the whole farm run for months and then get to the point where you feel you have to post e-mails etc to defend yourself.

We did previously have a system in place that automatically blocked bots that made an infeasible number of rolls over a period of 5 days. The problem is that they soon work out the limit and stay below it. Why not run 3x the number of bots 8 times a day?
The same goes for every detection system I have been able to come up with. The one idea that I had that has drastically reduced abuse is to leave them to waste several months getting a balance they can withdraw and then blocking the withdrawal for a manual review. That way they then have to spend several more months to find out if they correctly guessed how I caught them.

I understand that this business attracts all sorts of shitheaded freeloaders but you're not going to scare them away by posting e-mails publicly. You might scare away good customers though.

The intention was never to scare them away, just to refute their claim that I scammed them.

I know I got angry and overreacted to some things here and I'll try to do better in future. I don't want to scare anyone away.

[BitcoinGirl.Club]

Thanks for the suggestion. I'll try to incorporate that in future. It's too late to change it this time as it all republished automatically elsewhere.

If the pastebin data can not be removed then at least remove the reference link on the feedback you left for Adriano2010. I think this will cool down the entire issue a bit since there will be less trace for the data reference. Good to hear about the promise of future incorporation.

I hope you will have no confusion of understanding that publishing such data is not correct by any means.

[savetheFORUM]

Thanks for the suggestion. I'll try to incorporate that in future. It's too late to change it this time as it all republished automatically elsewhere.

If the pastebin data can not be removed then at least remove the reference link on the feedback you left for Adriano2010. I think this will cool down the entire issue a bit since there will be less trace for the data reference. Good to hear about the promise of future incorporation.

I hope you will have no confusion of understanding that publishing such data is not correct by any means.

I will edit the OP as well, just please message me @TheQuin once you remove that link.