I think Faucetbox should introduce new restriction for Suspicious faucet payouts. for amount more than 0.001 BTC there must be a verification withdrawal email sent to owner of the faucet.
If the owner verify that then he/she can approve it. Ahmad lost allot of amount.
I think more than 0.001 BTC faucetbox payouts are rarely seen so for huge amount there must be verification. Now who will recover the amount stolen from Ahmad
It wouldn't help. The attacker could just withdraw the same amount in hundreds smaller payouts. What helps is a limit how much can be withdrawn in a given timeframe and it's already implemented as a safety limit in faucet's dashboard. So necessary protections are already there, owners just have to use them responsibly. Soon we'll also add optional email notifications and a panic mode that'll disable API access completely if these limits are reached.
Ya it could be done through small transactions also. But also changed IP access of API should also be verified by faucet owner through email.
Also faucetbox API is just like key to bank account. Hosting provider can easily access it. There must be some security feature for protection from hosting provider