<p>You would need some kind of browser plug-in that monitors the CPU consumption of JavaScript and alerts you if you see excessive usage for an extended period of time.</p>

CC BY-SA 3.0
2011-10-05T05:38:07.500Z
Very good idea.  Even better would be integrating it into an existing popular extension like say adblock plus having an option to "warn against high CPU code which may be malicious".
DeathAndTaxes
CC BY-SA 3.0
2011-10-05T11:49:32.797Z
I agree. I did some searches to find some examples of such plug-ins, expecting to find them easily, and was quite surprised that I couldn't find any. If nothing else, they're useful for making sure your own JavaScript doesn't spin out.
David Schwartz
CC BY-SA 3.0
2011-10-05T12:26:50.540Z
For how JavaScript is handled memory-wise it is very difficult to profile it. In a real situation your readings will be most definitively tainted by a lot of noise.
Mascarpone
CC BY-SA 3.0
2011-10-05T01:00:59.103Z
2011-10-05T01:00:59.103Z
David Schwartz
<p>It isn't really theft if you're broadcasting your availability to run javascripts. There are blockers that allow you to selectively block javascript files - check your browser's extensions (Chrome and FF both have many options).</p>

CC BY-SA 3.0
2011-10-05T09:23:52.670Z
Does a browser really "broadcast" that it will run javascript, or does it just respond to a custom-written request which allows the server to detect a response? In my view, automatic CPU mining isn't very different to the trojan viruses that run a miner on your PC - you just need to have the website page open for the javascript version (and your PC isn't infected). Maybe such websites will start to be blacklisted as malicious?
Highly Irregular
CC BY-SA 3.0
2011-10-05T12:17:23.483Z
Yes, you broadcast your willingness to use JS with the user agent...
Mascarpone
CC BY-SA 3.0
2011-10-05T03:43:20.157Z
2011-10-05T03:43:20.157Z
Alex Waters
<p>Using a selective JavaScript blocker is basic good practice from a system security point of view, and will prevent websites from using your CPU to mine for bitcoins.</p>

<ul>
<li><p>The <a href="http://noscript.net/" rel="nofollow">NoScript</a> <a href="http://www.mozilla.com/firefox/" rel="nofollow">Firefox</a> extension allows you to disable JavaScript on a per-site or per-page basis.  I like to set it to default to denying JavaScript on every page, and then add an exception for each page on which I want to allow JavaScript to run.</p></li>
<li><p>If you're using <a href="https://www.google.com/chrome" rel="nofollow">Chromium</a> or <a href="http://www.chromium.org/" rel="nofollow">Chrome</a> then there's a built in Javascript blocker.  Go to the 'wrench' menu, select "Preferences", then "Under the bonnet" (or 'hood' if you speak American?) then click "Content Settings" in the "Privacy" section and select "Do not allow any site to run JavaScript".  Then whenever you're on a site which needs JavaScript to run, you'll see a red X at the right hand end of the address bar which you can click to allow JavaScript on just that site.</p></li>
<li><p>If you're using Internet Explorer you're probably not too concerned about what random strangers run on your computer.  Enjoy.</p></li>
</ul>

CC BY-SA 3.0
2012-02-13T18:59:49.650Z
From memory, I think there is also a "YesScript" Firefox extension which by default allows you to turn on scripts on just the pages you want.
Highly Irregular
CC BY-SA 3.0
2012-02-13T11:18:17.080Z
2012-02-13T11:30:23.587Z
2012-02-13T11:30:23.587Z
Chris Moore
<p>For the latest browsers, I would suggest implementing CSP(<a href="https://content-security-policy.com/" rel="nofollow noreferrer" title="Content Security Policy">Content Security Policy</a>), specifically defining the <code>script-src</code></p>

<p>This will work if you own the site and CSP will prevent it from being XSS with bitcoin javascript.</p>

CC BY-SA 3.0
2017-12-14T20:07:49.387Z
You should add some details to your answer.  As it stands, this is pretty much a "link-only" answer.
Hannah Vernon
CC BY-SA 4.0
2018-05-15T18:42:10.703Z
can I earn bitcoin from http://onesoftwares.net/
NomanJaved
CC BY-SA 3.0
2017-12-14T07:25:14.143Z
2017-12-16T14:22:45.093Z
2017-12-16T14:22:45.093Z
Kok Wai Wong
<p>Browsers could limit the amount of CPU capacity a website is allowed to use to something as low as 1&nbsp;%.</p>

CC BY-SA 3.0
2016-01-27T23:08:06.080Z
They *could*, but that would also make the website horribly unresponsive.
Nick ODell
CC BY-SA 3.0
2016-01-28T00:53:28.507Z
I wonder if a non-badly programmed website really needs more than that in Javascript.
user3284699
CC BY-SA 3.0
2016-01-27T19:21:28.287Z
2016-01-27T19:21:28.287Z
user3284699
<p>You can use <a href="http://adblockplus.org/en/">Adblock Plus</a> to block the miner script.  In this case it would be:</p>

<pre><code>http://www.bitcoinplus.com/js/miner.js
</code></pre>

CC BY-SA 3.0
2011-10-06T08:39:34.070Z
I asked for some clarification in the Adblock Plus forums as to whether blocking javascript miners would ever be likely to be done by default, and the answer was no. https://adblockplus.org/forum/viewtopic.php?f=2&t=8466
Highly Irregular
CC BY-SA 3.0
2011-10-05T01:32:33.643Z
2011-10-05T01:32:33.643Z
xyz
<p>"Bitcoin Plus" is one example of a javascript bitcoin mining client that can CPU mine bitcoins through a browser when viewing a website. Here is a screenshot from 4bitcoins dot com which automatically starts the miner when you load the page:
<img src="https://i.sstatic.net/yHt6M.jpg" alt="Bitcoin Plus running on 4bitcoins dot com"></p>

<p>It could be considered a form of theft for a website to profit from the extra electricity used by a viewer of the page, and definitely isn't environmentally friendly as CPU mining through javascript is hugely inefficient and any revenue earned doesn't even come close to covering the cost of the electricity consumed (and besides, in this case the benefit is to the website, and the cost is to the user). </p>

<p>Doing some quick maths I'd estimate that the mining would earn the website owner around 0.12 US cents per 24hrs running, at a cost of around 17 cents to the user in power (assumed 1BTC=$5US, difficulty around 1.8m, power 14c/kWh). </p>

<p>In short, it's desirable to block such functionality from running without the user's consent.</p>

<p>How could such integrated mining be disabled without blanket-disabling javascript on all websites? Bear in mind that even though the miner is visible on 4bitcoins dot com, it doesn't need to be visible to work.</p>

<p>ps: I didn't use standard syntax for the website name, as that will only encourage search engines to send more traffic there!</p>

CC BY-SA 3.0
2011-10-05T12:27:54.503Z
The JS doesnt actually mine Bitcoins. It's just for research purposes.
Mascarpone
CC BY-SA 3.0
2011-10-05T23:07:52.020Z
I wouldn't accuse JavaScript miners of theft. Flash ads use a fair amount of CPU to display the wares of advertisers, and far more bandwidth than mining. If this is theft then so is all advertising of any kind, rickrolling or any unwanted use of any of your computing resources. I would reword the question to that end. You retain the right to control what does and does not run on your computer, but you can't accuse these folks of a crime.
David Perry
CC BY-SA 3.0
2011-10-05T23:41:25.503Z
Actually, the "What's this?" link says: "Your computer fan turned on because generating bitcoin takes computer power. It's essentially generating money to help support the website you came from." That doesn't sound like research to me.
Highly Irregular
CC BY-SA 3.0
2011-10-05T23:45:42.517Z
Whether or not it might be considered a theft comes down to legality; it's probably legal, but that doesn't make it ethical. I will reword it to allow users to decide for themselves. I also believe that the majority of users don't have the skills to take control of their computer to prevent use of a loophole like that - most people wouldn't allow it if they knew the details.
Highly Irregular
CC BY-SA 3.0
2011-10-05T23:50:44.680Z
I also disagree that it's similar to most Flash advertising. As an experiment I viewed a page with 3 embedded typical Flash ads, and the CPU usage was around 4% compared to 80% for the miner application.
Highly Irregular
CC BY-SA 3.0
2011-10-06T01:36:02.350Z
I repeat what I said: Even though the JS perform hashes, no actual coin is generated.
Mascarpone
CC BY-SA 3.0
2011-10-06T08:41:13.757Z
Can you provide some evidence please?
Highly Irregular
CC BY-SA 3.0
2011-10-06T12:38:28.687Z
https://bitcointalk.org/index.php?topic=9042.0
---
After a more careful reading, I think I have to apologize. Probably I confused this project with the original http://bitp.it/
Mascarpone
CC BY-SA 3.0
2013-04-01T08:26:26.663Z
I have to wonder whether you wasted more electricity asking this question than all the JS hashing in the world combined. Also, like David Perry said, it's really nothing compared to Flash...
JamesTheAwesomeDude
<security><javascript><cpu-mining>
How can I stop websites running an integrated Bitcoin miner without disabling javascript altogether?
Highly Irregular
# How can I stop websites running an integrated Bitcoin miner without disabling javascript altogether?

(Asked by: username_0 on 2011-10-05)

"Bitcoin Plus" is one example of a javascript bitcoin mining client that can CPU mine bitcoins through a browser when viewing a website. Here is a screenshot from 4bitcoins dot com which automatically starts the miner when you load the page:
![Bitcoin Plus running on 4bitcoins dot com](https://i.sstatic.net/yHt6M.jpg)

It could be considered a form of theft for a website to profit from the extra electricity used by a viewer of the page, and definitely isn't environmentally friendly as CPU mining through javascript is hugely inefficient and any revenue earned doesn't even come close to covering the cost of the electricity consumed (and besides, in this case the benefit is to the website, and the cost is to the user).

Doing some quick maths I'd estimate that the mining would earn the website owner around 0.12 US cents per 24hrs running, at a cost of around 17 cents to the user in power (assumed 1BTC=$5US, difficulty around 1.8m, power 14c/kWh).

In short, it's desirable to block such functionality from running without the user's consent.

How could such integrated mining be disabled without blanket-disabling javascript on all websites? Bear in mind that even though the miner is visible on 4bitcoins dot com, it doesn't need to be visible to work.

ps: I didn't use standard syntax for the website name, as that will only encourage search engines to send more traffic there!

**Tags:** security, javascript, cpu-mining

> **Comments:**
> **username_1**: The JS doesnt actually mine Bitcoins. It's just for research purposes.  
> **username_2**: I wouldn't accuse JavaScript miners of theft. Flash ads use a fair amount of CPU to display the wares of advertisers, and far more bandwidth than mining. If this is theft then so is all advertising of any kind, rickrolling or any unwanted use of any of your computing resources. I would reword the question to that end. You retain the right to control what does and does not run on your computer, but you can't accuse these folks of a crime.  
> **username_0**: Actually, the "What's this?" link says: "Your computer fan turned on because generating bitcoin takes computer power. It's essentially generating money to help support the website you came from." That doesn't sound like research to me.  
> **username_0**: Whether or not it might be considered a theft comes down to legality; it's probably legal, but that doesn't make it ethical. I will reword it to allow users to decide for themselves. I also believe that the majority of users don't have the skills to take control of their computer to prevent use of a loophole like that - most people wouldn't allow it if they knew the details.  
> **username_0**: I also disagree that it's similar to most Flash advertising. As an experiment I viewed a page with 3 embedded typical Flash ads, and the CPU usage was around 4% compared to 80% for the miner application.  
> **username_1**: I repeat what I said: Even though the JS perform hashes, no actual coin is generated.  
> **username_0**: Can you provide some evidence please?  
> **username_1**: https://bitcointalk.org/index.php?topic=9042.0 --- After a more careful reading, I think I have to apologize. Probably I confused this project with the original http://bitp.it/  
> **username_3**: I have to wonder whether you wasted more electricity asking this question than all the JS hashing in the world combined. Also, like username_2 username_2 said, it's really nothing compared to Flash...  

---

## 6 answers

### Answer by username_13 on 2011-10-05. Score: 12 | Accepted answer

You can use [Adblock Plus](http://adblockplus.org/en/) to block the miner script. In this case it would be:

```
http://www.bitcoinplus.com/js/miner.js

```

> **Comments:**
> **username_0**: I asked for some clarification in the Adblock Plus forums as to whether blocking javascript miners would ever be likely to be done by default, and the answer was no. https://adblockplus.org/forum/viewtopic.php?f=2&t=8466  

---

### Answer by username_4 on 2011-10-05. Score: 6

You would need some kind of browser plug-in that monitors the CPU consumption of JavaScript and alerts you if you see excessive usage for an extended period of time.

> **Comments:**
> **username_5**: Very good idea.  Even better would be integrating it into an existing popular extension like say adblock plus having an option to "warn against high CPU code which may be malicious".  
> **username_4**: I agree. I did some searches to find some examples of such plug-ins, expecting to find them easily, and was quite surprised that I couldn't find any. If nothing else, they're useful for making sure your own JavaScript doesn't spin out.  
> **username_1**: For how JavaScript is handled memory-wise it is very difficult to profile it. In a real situation your readings will be most definitively tainted by a lot of noise.  

---

### Answer by username_6 on 2011-10-05. Score: 4

It isn't really theft if you're broadcasting your availability to run javascripts. There are blockers that allow you to selectively block javascript files - check your browser's extensions (Chrome and FF both have many options).

> **Comments:**
> **username_0**: Does a browser really "broadcast" that it will run javascript, or does it just respond to a custom-written request which allows the server to detect a response? In my view, automatic CPU mining isn't very different to the trojan viruses that run a miner on your PC - you just need to have the website page open for the javascript version (and your PC isn't infected). Maybe such websites will start to be blacklisted as malicious?  
> **username_1**: Yes, you broadcast your willingness to use JS with the user agent...  

---

### Answer by username_7 on 2012-02-13. Score: 2

Using a selective JavaScript blocker is basic good practice from a system security point of view, and will prevent websites from using your CPU to mine for bitcoins.

* The [NoScript](http://noscript.net/) [Firefox](http://www.mozilla.com/firefox/) extension allows you to disable JavaScript on a per-site or per-page basis. I like to set it to default to denying JavaScript on every page, and then add an exception for each page on which I want to allow JavaScript to run.
* If you're using [Chromium](https://www.google.com/chrome) or [Chrome](http://www.chromium.org/) then there's a built in Javascript blocker. Go to the 'wrench' menu, select "Preferences", then "Under the bonnet" (or 'hood' if you speak American?) then click "Content Settings" in the "Privacy" section and select "Do not allow any site to run JavaScript". Then whenever you're on a site which needs JavaScript to run, you'll see a red X at the right hand end of the address bar which you can click to allow JavaScript on just that site.
* If you're using Internet Explorer you're probably not too concerned about what random strangers run on your computer. Enjoy.

> **Comments:**
> **username_0**: From memory, I think there is also a "YesScript" Firefox extension which by default allows you to turn on scripts on just the pages you want.  

---

### Answer by username_8 on 2017-12-14. Score: 0

For the latest browsers, I would suggest implementing CSP([Content Security Policy](https://content-security-policy.com/ "Content Security Policy")), specifically defining the `script-src`

This will work if you own the site and CSP will prevent it from being XSS with bitcoin javascript.

> **Comments:**
> **username_9**: You should add some details to your answer.  As it stands, this is pretty much a "link-only" answer.  
> **username_10**: can I earn bitcoin from http://onesoftwares.net/  

---

### Answer by username_11 on 2016-01-27. Score: -1

Browsers could limit the amount of CPU capacity a website is allowed to use to something as low as 1 %.

> **Comments:**
> **username_12**: They *could*, but that would also make the website horribly unresponsive.  
> **username_11**: I wonder if a non-badly programmed website really needs more than that in Javascript.  

---

