Quote from: mexicantarget on November 29, 2016, 03:21:28 PM

I'll say this once and most likely only once, so that people are clear on my views about this "account" vs "no account/anon" thing. Hopefully by the end you'll understand exactly where I'm coming from and why I chose this route.

Let's look at anon accounts for a moment
First of all I would like to thank FaucetBox for their project and what they brought to the community over these past years. Thanks to them my faucets are better off. I really respect what theys stood for up until now, but I have to talk about the concept and it's flaws for a little bit.

FaucetBox uses anon accounts. That is, any user with a crypto currency address can go to any faucet or website which uses faucetbox and request a claim. That user does not need an account, and they will get the coins without needing any kind of second step or hassle in between the faucet and them receiving the payment. This is how everyone (users and owners) is used to the way the current "faucet industry" works. On the surface there's nothing wrong with this and it's pretty convinient, but convinience comes at a price.

There's a lot of good things about anon accounts:

Is it easy for users? yes
Is it easy for new users? yes
Is it easy for faucet owners users? yes

You might think the above points are all you need to swing towards keeping the "anon" accounts side of this, but these points are exactly why it's so dangerous for th faucet industry.

But mex, my users need it easy
Do they really? Let's take a look at this: if it's easy for users it's easy for bots too.

Many people are trying to setup a new faucet today using faucetbox's "faucet in a box" script, and many of them will fail and have their faucet emptied quick. Others may have a bigger budget and can afford to stick at it a bit longer. All of these sites suffer from bot attacks. And of course what happens is they go and moan to faucetbox about their script and bots, and how they need better anti bot etc. They seem to expect that faucetbox will release a magic update which contains the best anti-bot they ever saw, that their balance can be protected and reserves for the rightful users and claimers.

Everyone by now knows the problem which bots cause. They look like regular users, they drain the faucet owners balance faster, they don't contribute to advertisement revenue, they dirty the faucet with bad IP, they give the site a bad traffic rating, they impact globally on analytics and google adsense's view of the site, and many more problems.

Captchas? - can be bypassed
IP addresses block? - bypass by VPNs and proxies 1000 times over
User agent? - can be faked
HTTP request headers? - can be faked/forged
Bitcoin address blacklist? - it takes 1 second or less for bots to generate another 1000 addresses

I've been running my faucets for almost a year now. I have a a lot of anti-bot mechinisms, honey pots and traps all set up to try and catch bots. In addition to automated methods I can spot bots on my sites through social engineering, looking through and chatting with users to know if they are botting or not from their behaviour and how they talk. Not every faucet owner can do this or has the time for it. There is one thing I learned the hard way: there is no real antibot.

The fight against bots is an on-going struggle which will go on forever. Especially in this day and age where it's possible to hide your IP and completely automate your entire web browser session to manipulate a site, bypass a captcha and appear exactly like a regular user.

For the above reasons the typical "faucet in a box" faucets will fail very quickly without advanced knowledge of bot detection or a custom script.

Having said all of the above, that's no reason to give up. It's better to act in a preventative way than not to act at all on the problem.

It's all about incentive
This brings me back to the original point that if its easy for users its easy for bots. If there is an incentive, however big or small, and its a quick and easy method, they will exploit it on a mass scale. "Faucet in a box" script and other similar scripts are widely used, making them an easy target. Someone can make a bot for 1 site, and it would work on all sites using the same script. They don't even need an account, it's just rinse and repeat.

So... how do accounts solve the problem?
I'll come straight out and say that they don't solve the problem, they greatly reduce the problem. Here's why: making an account on faucethub is pretty easy, but it requires a valid email address. Before they make any withdraw they have to click the link in the email and activate. This is one extra step in the process that all bots need to take before they can exploit a FaucetHub faucet. This is not a particularly hard task for a bot to do, however it does take away some incentive from a lot of botters to try doing it on a mass scale.

Having user accounts allows for a lot of other protection to be built into the platform to have the inner workings tie together multiple users, weed out shared IP addresses, find malicious user-agents, mass ban the use of one-time email addresses and bad providers, and mass ban the use of multi-wallets and all sorts of other mechanisms that are not possible without an account.

Ok, I understand why you offer accounts, but why are they forced upon every user?
If they were not forced (like other providers who have accounts as an optional thing), then we might as well not have them at all. Simply becuase botters wont make an account if they don't have to.

Is it slightly annoying for users? Yes. Is it slightly annoying for new users? Yes. Is it slightly annoying for faucet owners? Not really.

You might think that a faucet needs to be easily accessible to all users and they should be able to get their claim in 1 click with nothing else needed. Name any other site which lets you do anything useful without an account? Bank account, paypal, ebay, even this forum. They all require accounts and valid verification to use the service.

Users don't understand "magic"
A lot of faucet owners think its easy for users to use a faucet "without knowing they are using faucetbox". They are worried about user adoption and adding more steps into the processes. I think this statement is false. With all the users I've come across with my faucets there's seen so many who contact me with these questions, and I'm sure I'm not the only faucet owner who deals with this.

"How do I make an account on faucetbox?"
"Can you send direct to my wallet, I don't have an account on faucetbox"
"I did a withdraw and my coins are not in my wallet its been 12 hours!!!"
"I made an account but my balance is 0 at faucetbox where are my coins!"
"I did a withdraw to faucetbox, but I dont have an account there? Huh

??"

The service that faucetbox provided is truly "magic" in the eyes of some users. They don't understand what the need or purpose for faucetbox is. They don't understand that an account does not exist on faucetbox for users, despite the site being covered with info stating they don't need it. They don't know where their coins have gone despite reading that they went to faucetbox.com.

What they do understand, whether they are new or not to bitcoin is something like this: "You got $5 on PayPal". Why do they understand this? Because they know they have an account at PayPal, and therefore they are instantly aware of where their money is and how to manage it. They won't need to ask those questions above to faucet owners OR to faucethub.

---

That's a pretty long take on the situation, and I hope that people are clear on why I chose the "must have an account" route for FaucetHub. If anyone has any suggestions for the system I'm still open to hear it and discuss it, but don't expect the same kind of response in future when I've already made the above post.

This reply is aimed at everyone who PMd me trying to convince me that faucethub should be a carbon copy of faucetBOX.
Get over it. Faucet industry is going to change when FH launches.

Sorry for the long post, I don't have any potatos.

This is why i chose Xapo in the beginning but even now they still get through. The problem with Xapo scripts was they were no management and updates to security . I have tried myself to patch security But in the end The only way to stop bots was to manual blacklist emails, ip's and BTC address. very big pain in the ass because they have to steal from you to ban them. I have shut down my Xapo Faucet until i see another option to fighting bots.