New website version coming
Posted: Sat Jun 17, 2017 3:58 pm
There's a new version of the website being released right now.
There are a few changes to this version. First, we are preparing for the next mining server release. This version prepares for removal of some data from the website that is rarely used, and which increases system load by requiring copying strings and uses up disk space. Examples include share start times (end times are still retained) and block hashes of each share.
Second, while I was looking for bugs to fix this morning, I discovered that there were many errors in the Tomcat logs caused by IP addresses that repeatedly trying passwords for many accounts. After brainstorming how to reduce the number of password trials, we decided on a new invalid_password_attempts table, which limits the number of invalid password attempts to 100 per day per IP address. We can't limit password attempts by user, because then these IP addresses could just lock out users for the day.
We'll see if that reduces the number of E-Mails Chris is receiving about changed payout addresses. This, combined with the use of two-factor authentication unique passwords, should make it nearly impossible for criminals to access an account that takes these basic precautions. Criminals continue to steal money from users who reuse passwords previously used at other sites, and they have made off with nearly $10,000 so far.
The site will be down for a few minutes while it reloads. Normal users should not notice any difference from these changes.
The next security feature will be "Block Tor Access," which I assigned to Michael, and hopefully he'll be willing to do it next weekend. We'll enable this by default. When enabled, Tor users won't be able to login to your account, preventing thieves from retaining their anonymity behind exit nodes and making it easier for the police to follow up on these reports.
There are a few changes to this version. First, we are preparing for the next mining server release. This version prepares for removal of some data from the website that is rarely used, and which increases system load by requiring copying strings and uses up disk space. Examples include share start times (end times are still retained) and block hashes of each share.
Second, while I was looking for bugs to fix this morning, I discovered that there were many errors in the Tomcat logs caused by IP addresses that repeatedly trying passwords for many accounts. After brainstorming how to reduce the number of password trials, we decided on a new invalid_password_attempts table, which limits the number of invalid password attempts to 100 per day per IP address. We can't limit password attempts by user, because then these IP addresses could just lock out users for the day.
We'll see if that reduces the number of E-Mails Chris is receiving about changed payout addresses. This, combined with the use of two-factor authentication unique passwords, should make it nearly impossible for criminals to access an account that takes these basic precautions. Criminals continue to steal money from users who reuse passwords previously used at other sites, and they have made off with nearly $10,000 so far.
The site will be down for a few minutes while it reloads. Normal users should not notice any difference from these changes.
The next security feature will be "Block Tor Access," which I assigned to Michael, and hopefully he'll be willing to do it next weekend. We'll enable this by default. When enabled, Tor users won't be able to login to your account, preventing thieves from retaining their anonymity behind exit nodes and making it easier for the police to follow up on these reports.
