13

"Bitcoin Plus" is one example of a javascript bitcoin mining client that can CPU mine bitcoins through a browser when viewing a website. Here is a screenshot from 4bitcoins dot com which automatically starts the miner when you load the page: Bitcoin Plus running on 4bitcoins dot com

It could be considered a form of theft for a website to profit from the extra electricity used by a viewer of the page, and definitely isn't environmentally friendly as CPU mining through javascript is hugely inefficient and any revenue earned doesn't even come close to covering the cost of the electricity consumed (and besides, in this case the benefit is to the website, and the cost is to the user).

Doing some quick maths I'd estimate that the mining would earn the website owner around 0.12 US cents per 24hrs running, at a cost of around 17 cents to the user in power (assumed 1BTC=$5US, difficulty around 1.8m, power 14c/kWh).

In short, it's desirable to block such functionality from running without the user's consent.

How could such integrated mining be disabled without blanket-disabling javascript on all websites? Bear in mind that even though the miner is visible on 4bitcoins dot com, it doesn't need to be visible to work.

ps: I didn't use standard syntax for the website name, as that will only encourage search engines to send more traffic there!

Improve this question
9
  • The JS doesnt actually mine Bitcoins. It's just for research purposes.
    – Mascarpone
    Commented Oct 5, 2011 at 12:27
  • 3
    I wouldn't accuse JavaScript miners of theft. Flash ads use a fair amount of CPU to display the wares of advertisers, and far more bandwidth than mining. If this is theft then so is all advertising of any kind, rickrolling or any unwanted use of any of your computing resources. I would reword the question to that end. You retain the right to control what does and does not run on your computer, but you can't accuse these folks of a crime.
    – David Perry
    Commented Oct 5, 2011 at 23:07
  • Actually, the "What's this?" link says: "Your computer fan turned on because generating bitcoin takes computer power. It's essentially generating money to help support the website you came from." That doesn't sound like research to me.
    – Highly Irregular
    Commented Oct 5, 2011 at 23:41
  • 2
    Can you provide some evidence please?
    – Highly Irregular
    Commented Oct 6, 2011 at 8:41
  • 2
    bitcointalk.org/index.php?topic=9042.0 --- After a more careful reading, I think I have to apologize. Probably I confused this project with the original bitp.it
    – Mascarpone
    Commented Oct 6, 2011 at 12:38

6 Answers 6

Reset to default
12

You can use Adblock Plus to block the miner script. In this case it would be:

http://www.bitcoinplus.com/js/miner.js
Improve this answer
1
6

You would need some kind of browser plug-in that monitors the CPU consumption of JavaScript and alerts you if you see excessive usage for an extended period of time.

Improve this answer
3
  • 2
    Very good idea. Even better would be integrating it into an existing popular extension like say adblock plus having an option to "warn against high CPU code which may be malicious".
    – DeathAndTaxes
    Commented Oct 5, 2011 at 5:38
  • I agree. I did some searches to find some examples of such plug-ins, expecting to find them easily, and was quite surprised that I couldn't find any. If nothing else, they're useful for making sure your own JavaScript doesn't spin out.
    – David Schwartz
    Commented Oct 5, 2011 at 11:49
  • For how JavaScript is handled memory-wise it is very difficult to profile it. In a real situation your readings will be most definitively tainted by a lot of noise.
    – Mascarpone
    Commented Oct 5, 2011 at 12:26
4

It isn't really theft if you're broadcasting your availability to run javascripts. There are blockers that allow you to selectively block javascript files - check your browser's extensions (Chrome and FF both have many options).

Improve this answer
2
  • Does a browser really "broadcast" that it will run javascript, or does it just respond to a custom-written request which allows the server to detect a response? In my view, automatic CPU mining isn't very different to the trojan viruses that run a miner on your PC - you just need to have the website page open for the javascript version (and your PC isn't infected). Maybe such websites will start to be blacklisted as malicious?
    – Highly Irregular
    Commented Oct 5, 2011 at 9:23
  • 3
    Yes, you broadcast your willingness to use JS with the user agent...
    – Mascarpone
    Commented Oct 5, 2011 at 12:17
2

Using a selective JavaScript blocker is basic good practice from a system security point of view, and will prevent websites from using your CPU to mine for bitcoins.

  • The NoScript Firefox extension allows you to disable JavaScript on a per-site or per-page basis. I like to set it to default to denying JavaScript on every page, and then add an exception for each page on which I want to allow JavaScript to run.

  • If you're using Chromium or Chrome then there's a built in Javascript blocker. Go to the 'wrench' menu, select "Preferences", then "Under the bonnet" (or 'hood' if you speak American?) then click "Content Settings" in the "Privacy" section and select "Do not allow any site to run JavaScript". Then whenever you're on a site which needs JavaScript to run, you'll see a red X at the right hand end of the address bar which you can click to allow JavaScript on just that site.

  • If you're using Internet Explorer you're probably not too concerned about what random strangers run on your computer. Enjoy.

Improve this answer
1
  • From memory, I think there is also a "YesScript" Firefox extension which by default allows you to turn on scripts on just the pages you want.
    – Highly Irregular
    Commented Feb 13, 2012 at 18:59
0

For the latest browsers, I would suggest implementing CSP(Content Security Policy), specifically defining the script-src

This will work if you own the site and CSP will prevent it from being XSS with bitcoin javascript.

Improve this answer
2
  • You should add some details to your answer. As it stands, this is pretty much a "link-only" answer.
    – Hannah Vernon ♦
    Commented Dec 14, 2017 at 20:07
  • can I earn bitcoin from onesoftwares.net
    – NomanJaved
    Commented May 15, 2018 at 18:42
-1

Browsers could limit the amount of CPU capacity a website is allowed to use to something as low as 1 %.

Improve this answer
2
  • They could, but that would also make the website horribly unresponsive.
    – Nick ODell
    Commented Jan 27, 2016 at 23:08
  • I wonder if a non-badly programmed website really needs more than that in Javascript.
    – user3284699
    Commented Jan 28, 2016 at 0:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.