Freebitco.in openly posting user data

[savetheFORUM]

I was reading this thread: https://bitcointalk.org/index.php?topic=5323816.0

I don't know who is right and who is wrong here but this thread lead me to Adriano2010 trust page: https://bitcointalk.org/index.php?action=profile;u=514126

I saw the negative feedback from the support of freebitco.in TheQuin that reads "Faucet abuser." which might or might not be true.

But the link shared in the reference is: Deleted for privacy.

Now I am not saying whether that guy is a faucet abuser or not but why is freebitco.in publicly posting the IP addresses of the users that are accused of being controlled by the same owner?

Does this mean that if I am suspected of multiple accounts some day, they will publicly dox me and give out my IP address and email addresses? That just doesn't look right to me. Would like the community to please share their views.

[1714134072]

1714134072

[1714134072]

1714134072

[1714134072]

1714134072

[1714134072]

1714134072

[1714134072]

1714134072

[1714134072]

1714134072

[hugeblack]

I don't think they publish personal user data, many of these IP addresses seem to come from VPN but I agree with you. they have to hide IP and parts of the e-mail instead of posting them.

anyway we have this board --> https://bitcointalk.org/index.php?board=227.0 Some personal data is posted to help identify of scammers.
Again, each scam case differs from the other and on the purpose of disseminating the information.

[savetheFORUM]

Nobody got the guts to speak up against something that is clearly wrong?

[LTU_btc]

Is it all these people in referral list are abusers? Even if they are abusers, I don't think it's ok. Email addresses shouldn't be posted in public. I think they should hide it.
I don't agree with @ETFbitcoin, it's nowhere near to Ledger leak, there is less sensitive data. While on Ledger leaker there was full names, home addresses leaked, what is much worse.

[TheQuin]

Is it all these people in referral list are abusers? Even if they are abusers,

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal and might be useful to other services doing free giveaways to help them prevent theft and fraud by the same person.

I deliberately did not disclose the individual's real email or IP used on their master referrer account.

[LTU_btc]

Is it all these people in referral list are abusers? Even if they are abusers,

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal and might be useful to other services doing free giveaways to help them prevent theft and fraud by the same person.

I deliberately did not disclose the individual's real email or IP used on their master referrer account.

Well, that makes sense. Because initially for me it looked these  emails might be of real people. Often abusers are using very similar emails, like user1@gmail.com, user2@gmail.com and so on.
And as said above, sometimes posting personal data is needed to identify scammers and prevent them to continue their activity.

[TheQuin]

Well, that makes sense. Because initially for me it looked these  emails might be of real people. Often abusers are using very similar emails, like user1@gmail.com, user2@gmail.com and so on.

That is very common from amateur abusers and a couple of years ago even sophisticated bots running 50,000+ accounts would use a name dictionary and randomise them with 2 names and 2 numbers like nameA15486nameB452@anemail.com
Using a large name dictionary and 8 digits prevented them from creating duplicates. But they are easy to spot and block them from withdrawing so now they use emails that look more natural.

And as said above, sometimes posting personal data is needed to identify scammers and prevent them to continue their activity.

I would like to post the users real details but that probably isn't the done thing on this forum.

As an aside, I do believe that anyone abusing the service forfeits the right to privacy. We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

[savetheFORUM]

Thank you for giving me a retaliatory feedback.

"Wants to suppress information that might help others combat theft and fraud. I did not post data of users, they were email addresses and fingerprints of a bot designed to steal from free giveaways."

How would I or anyone know that they are not real emails? Now that you answered I am removing my feedback but you should have more partience

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal and might be useful to other services doing free giveaways to help them prevent theft and fraud by the same person.

I deliberately did not disclose the individual's real email or IP used on their master referrer account.

Good job if that is true but I believe there is no way to find out whether an IP address belongs to a VPN or not. That said, I am now satisfied that you have taken care of the user and only published their VPN's IP address. Feedback removed. As a public forum, I think I had the right to ask you questions regarding doubts I had, I didn't like the retaliatory feedback, everything else was professional from your side though.

[DaveF]

...
Good job if that is true but I believe there is no way to find out whether an IP address belongs to a VPN or not. ...

There are several public lists out there that list known VPNs such as:
https://github.com/ejrv/VPNs
https://udger.com/resources/ip-list/anonymizing_vpn_service

There are also paid for services that have a lot of API back end automation:
https://www.ipqualityscore.com/vpn-ip-address-check
https://www.maxmind.com/en/solutions/geoip2-enterprise-product-suite/anonymous-ip-database

All using a VPN does is hide who you are, it does not hide that fact that you are using a VPN.
And since many of the services are on known IPs it does not even hide which VPN service you are using.

-Dave

[actmyname]

All using a VPN does is hide who you are, it does not hide that fact that you are using a VPN.

Moreover, your browser fingerprint can still be matched to your previously-tracked information... and, boom! Nice VPN, Steve Macdonald!

Staying private online requires multiple steps - it's not just a single point of failure, it's a damned minefield.

[suchmoon]

As an aside, I do believe that anyone abusing the service forfeits the right to privacy. We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

And if wrongly accuse someone, will you be able to scrub their dox from the internet?

I don't see what this could possibly achieve against actual cheaters who like you said use VPN and fake e-mails.

[AB de Royse777]

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal

Still this is not good practice imo to put any kind of email address or IP in public. I would recommend removing those data. The type of action will create mess to individual users.

I deliberately did not disclose the individual's real email or IP used on their master referrer account.

We don't know, the users in the public web do not know because they do not have available tools to verify such things.

When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

What if it was not an intentional bad doing from the users. How are you going to ensure it 100%. No company publish sensitive data publically, and you need to ensure that it does not conflict with the law.

On a side note: I would not like such things. Indirectly you are threatening your users holding their online fingerprints.

[Myleschetty]

All using a VPN does is hide who you are, it does not hide that fact that you are using a VPN.

Moreover, your browser fingerprint can still be matched to your previously-tracked information... and, boom! Nice VPN, Steve Macdonald!

Staying private online requires multiple steps - it's not just a single point of failure, it's a damned minefield.

Some people never understand browsing privately requires more than just using a good VPN (WebRTC IP handling policy etc need to be put in check) but what I understand is that is the information of the user provided not against the doxing rules?

[savetheFORUM]

I might avoid speaking in public against anything wrong I see from now, because there is nothing wrong I did but still have negative feedback on my profile. I guess it's the fortune of the members they have to suffer if they use freebitco.in. I have never seen any support or staff member being as rude and dominating as TheQuin.

I hoped someone will counter that feedback but looks like freebitco.in has deep roots in the DT as well.

They are not even people. They are email addresses, fingerprints and VPN IP addresses used by a bot. The information is in no way personal

Still this is not good practice imo to put any kind of email address or IP in public. I would recommend removing those data. The type of action will create mess to individual users.

I deliberately did not disclose the individual's real email or IP used on their master referrer account.

We don't know, the users in the public web do not know because they do not have available tools to verify such things.

When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

What if it was not an intentional bad doing from the users. How are you going to ensure it 100%. No company publish sensitive data publically, and you need to ensure that it does not conflict with the law.

On a side note: I would not like such things. Indirectly you are threatening your users holding their online fingerprints.

Get ready for negative feedback for expressing your feelings now.

[LeGaulois]

I might avoid speaking in public against anything wrong I see from now, because there is nothing wrong I did but still have negative feedback on my profile. I guess it's the fortune of the members they have to suffer if they use freebitco.in. I have never seen any support or staff member being as rude and dominating as TheQuin.

I hoped someone will counter that feedback but looks like freebitco.in has deep roots in the DT as well.

Don't.
The feedbacks you received are perfect examples of the misconception of the trust system

TheQuin's feedback is invalid to me. it doesn't mean I'm at risk of getting scammed if I deal with you. By the way, email address are also considered as personal data, no matter if it was used to use a bot on a site

The 2 others are also incorrect. There is nothing wrong with creating an alt account (whatever it's true or not I don't care much), and spreading hate is a subjective term but still not suitable for negative feedback. Otherwise, we could also red tag the trolls

I believe everyone has the right to say what he thinks, if I agree or disagree doesn't matter. If we all agree in this world, life will become boring

[savetheFORUM]

Don't.
The feedbacks you received are perfect examples of the misconception of the trust system

But at the end of the day, it is me who got the worst by creating this thread. It takes time and efforts to gather and report something wrong. You speak against someone who is part of DT - immediate negative trust.

I don't know if theymos is involved in the abuse of power or not but right now it is near impossible for someone new to the forum to speak against old members. This idea of making the trust system decentralized is actually making it worst than some of the centralized forum. At least with centralization comes more honesty.

Make some friends and become DT, then just abuse the power. Good luck everyone with the way this forum is heading, we might soon see corruption in the forum and scammers tagging victims.

TheQuin's feedback is invalid to me. it doesn't mean I'm at risk of getting scammed if I deal with you. By the way, email address are also considered as personal data, no matter if it was used to use a bot on a site

You know that because you have read the whole thread but if I try to offer some services now, do you really think the buyer/customer has time to visit my profile and read this whole thread? I don't think so.

The 2 others are also incorrect. There is nothing wrong with creating an alt account (whatever it's true or not I don't care much), and spreading hate is a subjective term but still not suitable for negative feedback. Otherwise, we could also red tag the trolls

Good to see that at least you had the courage to speak up but I suggest don't do it, you might be tagged by the gang members soon. I might not visit the forum again unless Theymos can clear the mess he has created.

I believe everyone has the right to say what he thinks, if I agree or disagree doesn't matter. If we all agree in this world, life will become boring

No one has the right to say anything unless they have some friends in the DT to back them up.

This is my last post on the forum unless the feedback is countered or removed, and hopefully, peace follows here from now.

@theymos, if you cannot ensure honesty in a decentralized trust system, just better remove it completely or centralize it.

[AB de Royse777]

Let's not make it a big issue. I am sure TheQuin will read the responses and will reconsider the tag they left. Sorry I missed the tag (your part) on my last post. The tag do not seem valid to me too.

[savetheFORUM]

Let's not make it a big issue. I am sure TheQuin will read the responses and will reconsider the tag they left. Sorry I missed the tag (your part) on my last post. The tag do not seem valid to me too.

Let's see but all this drama does nothing but just suppresses users who dare to raise their voice when they see a known website doing something wrong. I don't know how emails are not private data, if even they are created to abuse faucet, unless you hide some alphabets, I don't think you can publicly dox them.

As an aside, I do believe that anyone abusing the service forfeits the right to privacy.

I don't agree with this thought either because faucet abuse is not like leaking your country's private information to the enemy. A lot of users abused the primedice faucet back in the day when they launched, doesn't mean primedice doxed them publicly or lynched them to death.

Still if you think like that, at least mention that somewhere in the terms and conditions. If you abuse our faucet, we will dox you on a public forum.

[DireWolfM14]

We plan to update our ToS soon and the draft our lawyers have written includes that provision. When it is introduced everyone using the service will have to explicitly accept that if they are caught cheating they can be publically identified by us.

So, if my kid opens an account on your site, refers me and other family members, and we all access the site from our home IP...

Anyway, thanks for the warning!  

Anyway, I think it's wrong for you to post email addresses and IPs in public.  If you have to do so to provide evidence for your reviews, create a thread in the Investigations Board for that.  At the very least the data won't be scraped by search engines, and newbies won't have access to it.  There's always the possibility that you could be wrong, and if I were the one being doxxed due to an error I wouldn't take that lying down.

[NotATether]

And if wrongly accuse someone, will you be able to scrub their dox from the internet?

That can be prevented by only posting if the IPs belong to data centers. No cheater with a brain runs a large farm from their residential IP address.

I don't see what this could possibly achieve against actual cheaters who like you said use VPN and fake e-mails.

Or just prevent registration from all domain names used by fake email generators. It's easy to get a list of those the more popular ones are using.

It's better to just share the info with other casinos' abuse teams instead of dumping it on a pastebin that almost nobody will read (let alone take action on).

Or even better just close the accounts of cheaters like all other casinos do.


For the record I do feel that TheQuin's red on savetheforum and suchmoon's red on TheQuin should be neutrals. The chance of somebody having a fingerprint the same as a bunch of Chrome scripts is near zero (these aren't browser fingerprints we're talking about: these presumably also take registration date and IP addresses into account as well).