Quote from: drhu00 on January 31, 2014, 01:16:03 AM

From
https://blockchain.info/blocks/BitMinter
Height   Time   Hash
283288 (Main Chain)   2014-01-31 00:27:50   0000000000000000bb5065872fc539ab55535075694dd0c03865e57fd15a4770
283115 (Main Chain)   2014-01-30 01:52:50   0000000000000000683416145bd86823e872d4942a1963ea94b8ec806d6b2a5f
283064 (Main Chain)   2014-01-29 16:03:33   000000000000000083ca532b367ee439f40ce23375f9827cd15e7daf1062869e
283018 (Main Chain)   2014-01-29 09:09:01   000000000000000009f317d0adf42fa145abee56c18a9d26b0e1e97bf2992d54
282833 (Main Chain)   2014-01-28 04:48:49   0000000000000000a47045f624df60c7a88c64dec0c230ef64b782147be2839d

We only get paid for 282833, 283018 and 283288, missing payment for block 283115 and 283288

Someone got paid for those "missing" blocks. The people mining in the pool where they were made.

It's not easy to detect with 100% certainty which pool a block is coming from, but blockchain.info does a really bad job, it's like they are not even trying. I contacted them about this, but they didn't bother to reply. Of course it makes Bitminter look bad when they identify so many blocks from other pools as ours. But there's not much I can do about it. I guess I could remove all links to blockchain.info from bitminter.com. It's just a shame blockchain.info is so much more user-friendly than blockexplorer.com.

If you want to know where a block is coming from, forget blockchain.info and instead use http://blockorigin.pfoe.be/

Quote from: SgtMoth on January 31, 2014, 03:51:40 AM

i know exactly what happened. i clicked on an email from bitcoinnews.com and it took me to a video, told me i needed to update flash player and downloaded a trojan. he got my google login and went into bitminter and manually sent coins out. btc/nmc addresses need passwords and the manual payout needs a password. once someone gets into your account, if you have coins, its easy to take.

I'm sorry to hear this. Sad

It is possible to enable 2-factor authentication for logging in, if you use an OpenID identity provider that supports it. I know Google supports this, and I believe Verisign does as well - perhaps also others. This has to be enabled at google.com, verisign.com, etc. not at Bitminter. This is also very useful if you use Gmail. I saw someone recently lost their coins on an exchange after an attacker got into their Gmail account. The attacker used the "password reset" feature on the exchange, which sent a password reset link to the Gmail address. Enabling Google 2FA makes this attack much more difficult.

I'll be adding 2-factor auth directly to bitminter.com, requiring 2FA for "send coins" and for changing auto cash out settings. If your PC is compromised by a trojan they could still abuse the one-time password (OTP) as soon as you type one in - but at least this would require some work on the part of the attacker.

I'm also considering daily withdrawal limits or something similar. Perhaps a limit per transaction would also be helpful. This could limit the damage if you are using the website from a compromised PC and the attacker is grabbing your OTPs as soon as you type them in, and using them to send coins to the attacker. But I suppose it would also generate a lot of angry complaints if the BTC/NMC market was crashing and people couldn't move all their coins quickly to exchanges to sell.

Is bitcoinnews.com a scam site, or was the mail just pretending to come from them?