<p>You can give someone the necessary credentials to mine on your behalf without them gaining access to the bitcoins. Pools don't use the worker passwords sent with <code>getwork</code> for logging into the website and controlling where coins are sent. They are used only for fetching work and delivering the results.</p>

<p>As you say, basic auth over unencrypted HTTP is already unsafe handling of the worker passwords. You have to assume that those passwords are compromised anyway.</p>

<p>I think the most damage someone can do is to overload a pool server using your worker credentials. I suppose this could get your account temporarily banned, but I'm sure a pool operator would be understanding in this case. I've never heard of anything like that happening either.</p>

CC BY-SA 3.0
2012-11-27T19:20:02.930Z
Ah, didn't realize that worker passwords != login passwords, as it's been awhile since I've used a login-based pool.
ConstableJoe
CC BY-SA 3.0
2012-11-27T18:31:58.017Z
2012-11-27T18:31:58.017Z
Dr.Haribo
<p>I'm working on a project involving mining Bitcoins for charity. I'm writing my own miner, and though I may eventually set up my own pool for this purpose, for now I'm planning on using existing pools.</p>

<p>My question is: how can I set up the miner so that people can use it to mine toward my organization's Bitcoin address (if having a single address is even the right approach to take), without exposing this address to theft from anyone who reads the credentials from the miner's <code>getwork</code> requests? My understanding is that the <code>HTTP Basic Auth</code> used in <code>getwork</code> requests <a href="http://en.wikipedia.org/wiki/Basic_access_authentication#Disadvantages" rel="nofollow">doesn't pass values in a safe way</a>.</p>

<p>As is probably evident from this question, I'm generally pretty fuzzy on how wallets interact with payouts from mining pools and/or Bitcoins stored in accounts with said pools, so any explanation there would also be greatly appreciated.</p>

CC BY-SA 3.0
2012-11-26T05:55:15.163Z
I'm going to leave the work of answering to folks who know more about `getwork` requests and unsafe value passing, but I'll mention that there are plenty of pools (Eligius being the largest I'm aware of) that accept an address as the username and don't parse passwords at all, then pay out via generated transactions to those addresses. It would be easy to have others mine for a charity at such a pool - you could even mine coins for someone else's address without their permission or intervention as an odd form of tipping, no privkey necessary.
David Perry
CC BY-SA 3.0
2012-11-26T13:40:19.643Z
I'm currently using Eligius in testing for just this reason, but I guess I don't quite understand what allows me to have access to the Bitcoins at a given address.

Do I have to have a wallet for that address somewhere? Does that wallet have to be connected to the Internet? Currently I'm using the "to add Bitcoins, send to this address" address for my Mt.Gox account, but that address auto-changes each transaction.
ConstableJoe
CC BY-SA 3.0
2012-11-26T17:55:44.943Z
Bitcoin is built around digital signing with split encryption keys. The address is just a hash of the public key, the private key is what allows you to spend coins at a given address. Mining is just doing work in exchange for coins sent to an address you specify and you can specify any address, even ones you don't control the private key for. If someone wanted to grab the donation address from my web site and mine on my behalf, they can do so without my permission or knowledge and the fact that only I have that private key means the account isn't compromised.
David Perry
CC BY-SA 3.0
2017-11-15T22:45:06.150Z
[This](https://bailbloc.thenewinquiry.com/) might interest you. Code is in Github.
luchonacho
CC BY-SA 3.0
2017-11-16T13:39:22.337Z
Very cool, @luchonacho! My own project, [Compute for Humanity](https://www.computeforhumanity.org), never really got enough interest to be viable.
ConstableJoe
CC BY-SA 3.0
2017-11-16T13:48:07.750Z
Looks interesting! Why did it not pick up?
luchonacho
CC BY-SA 3.0
2017-11-16T14:07:20.310Z
I think it was a combination of the fact that I was a bit too early for most people to have heard of Bitcoin, and at the time there weren't really any other examples of low-energy mining. So most people thought, "my computer can generate money? Seems like a scam," and people who understood cryptocurrencies thought, "mining uses up all your CPU and costs a ton in electrical bills, this isn't worth it," when neither of those were true.
ConstableJoe
<mining-pools><address><pool-payout-methods><charity><pool-operators>
How to structure a Bitcoin charity miner?
ConstableJoe
# How to structure a Bitcoin charity miner?

(Asked by: username_0 on 2012-11-26)

I'm working on a project involving mining Bitcoins for charity. I'm writing my own miner, and though I may eventually set up my own pool for this purpose, for now I'm planning on using existing pools.

My question is: how can I set up the miner so that people can use it to mine toward my organization's Bitcoin address (if having a single address is even the right approach to take), without exposing this address to theft from anyone who reads the credentials from the miner's `getwork` requests? My understanding is that the `HTTP Basic Auth` used in `getwork` requests [doesn't pass values in a safe way](http://en.wikipedia.org/wiki/Basic_access_authentication#Disadvantages).

As is probably evident from this question, I'm generally pretty fuzzy on how wallets interact with payouts from mining pools and/or Bitcoins stored in accounts with said pools, so any explanation there would also be greatly appreciated.

**Tags:** mining-pools, address, pool-payout-methods, charity, pool-operators

> **Comments:**
> **username_1**: I'm going to leave the work of answering to folks who know more about `getwork` requests and unsafe value passing, but I'll mention that there are plenty of pools (Eligius being the largest I'm aware of) that accept an address as the username and don't parse passwords at all, then pay out via generated transactions to those addresses. It would be easy to have others mine for a charity at such a pool - you could even mine coins for someone else's address without their permission or intervention as an odd form of tipping, no privkey necessary.  
> **username_0**: I'm currently using Eligius in testing for just this reason, but I guess I don't quite understand what allows me to have access to the Bitcoins at a given address.  Do I have to have a wallet for that address somewhere? Does that wallet have to be connected to the Internet? Currently I'm using the "to add Bitcoins, send to this address" address for my Mt.Gox account, but that address auto-changes each transaction.  
> **username_1**: Bitcoin is built around digital signing with split encryption keys. The address is just a hash of the public key, the private key is what allows you to spend coins at a given address. Mining is just doing work in exchange for coins sent to an address you specify and you can specify any address, even ones you don't control the private key for. If someone wanted to grab the donation address from my web site and mine on my behalf, they can do so without my permission or knowledge and the fact that only I have that private key means the account isn't compromised.  
> **username_2**: [This](https://bailbloc.thenewinquiry.com/) might interest you. Code is in Github.  
> **username_0**: Very cool, @username_2! My own project, [Compute for Humanity](https://www.computeforhumanity.org), never really got enough interest to be viable.  
> **username_2**: Looks interesting! Why did it not pick up?  
> **username_0**: I think it was a combination of the fact that I was a bit too early for most people to have heard of Bitcoin, and at the time there weren't really any other examples of low-energy mining. So most people thought, "my computer can generate money? Seems like a scam," and people who understood cryptocurrencies thought, "mining uses up all your CPU and costs a ton in electrical bills, this isn't worth it," when neither of those were true.  

---

## 1 answers

### Answer by username_3 on 2012-11-27. Score: 2 | Accepted answer

You can give someone the necessary credentials to mine on your behalf without them gaining access to the bitcoins. Pools don't use the worker passwords sent with `getwork` for logging into the website and controlling where coins are sent. They are used only for fetching work and delivering the results.

As you say, basic auth over unencrypted HTTP is already unsafe handling of the worker passwords. You have to assume that those passwords are compromised anyway.

I think the most damage someone can do is to overload a pool server using your worker credentials. I suppose this could get your account temporarily banned, but I'm sure a pool operator would be understanding in this case. I've never heard of anything like that happening either.

> **Comments:**
> **username_0**: Ah, didn't realize that worker passwords != login passwords, as it's been awhile since I've used a login-based pool.  

---

