5

I'm working on a project involving mining Bitcoins for charity. I'm writing my own miner, and though I may eventually set up my own pool for this purpose, for now I'm planning on using existing pools.

My question is: how can I set up the miner so that people can use it to mine toward my organization's Bitcoin address (if having a single address is even the right approach to take), without exposing this address to theft from anyone who reads the credentials from the miner's getwork requests? My understanding is that the HTTP Basic Auth used in getwork requests doesn't pass values in a safe way.

As is probably evident from this question, I'm generally pretty fuzzy on how wallets interact with payouts from mining pools and/or Bitcoins stored in accounts with said pools, so any explanation there would also be greatly appreciated.

Improve this question
7
  • 1
    I'm going to leave the work of answering to folks who know more about getwork requests and unsafe value passing, but I'll mention that there are plenty of pools (Eligius being the largest I'm aware of) that accept an address as the username and don't parse passwords at all, then pay out via generated transactions to those addresses. It would be easy to have others mine for a charity at such a pool - you could even mine coins for someone else's address without their permission or intervention as an odd form of tipping, no privkey necessary.
    – David Perry
    Commented Nov 26, 2012 at 5:55
  • I'm currently using Eligius in testing for just this reason, but I guess I don't quite understand what allows me to have access to the Bitcoins at a given address. Do I have to have a wallet for that address somewhere? Does that wallet have to be connected to the Internet? Currently I'm using the "to add Bitcoins, send to this address" address for my Mt.Gox account, but that address auto-changes each transaction.
    – ConstableJoe
    Commented Nov 26, 2012 at 13:40
  • Bitcoin is built around digital signing with split encryption keys. The address is just a hash of the public key, the private key is what allows you to spend coins at a given address. Mining is just doing work in exchange for coins sent to an address you specify and you can specify any address, even ones you don't control the private key for. If someone wanted to grab the donation address from my web site and mine on my behalf, they can do so without my permission or knowledge and the fact that only I have that private key means the account isn't compromised.
    – David Perry
    Commented Nov 26, 2012 at 17:55
  • This might interest you. Code is in Github.
    – luchonacho
    Commented Nov 15, 2017 at 22:45
  • Very cool, @luchonacho! My own project, Compute for Humanity, never really got enough interest to be viable.
    – ConstableJoe
    Commented Nov 16, 2017 at 13:39

1 Answer 1

Reset to default
2

You can give someone the necessary credentials to mine on your behalf without them gaining access to the bitcoins. Pools don't use the worker passwords sent with getwork for logging into the website and controlling where coins are sent. They are used only for fetching work and delivering the results.

As you say, basic auth over unencrypted HTTP is already unsafe handling of the worker passwords. You have to assume that those passwords are compromised anyway.

I think the most damage someone can do is to overload a pool server using your worker credentials. I suppose this could get your account temporarily banned, but I'm sure a pool operator would be understanding in this case. I've never heard of anything like that happening either.

Improve this answer
1
  • Ah, didn't realize that worker passwords != login passwords, as it's been awhile since I've used a login-based pool.
    – ConstableJoe
    Commented Nov 27, 2012 at 19:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.