Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement cookies tied to a browser window? #68

Closed
dbolser opened this issue Mar 7, 2022 · 4 comments
Closed

Implement cookies tied to a browser window? #68

dbolser opened this issue Mar 7, 2022 · 4 comments
Labels
needs research More knowledge is needed in this issue
Milestone

Comments

@dbolser
Copy link

dbolser commented Mar 7, 2022

For privacy, you use one avatar per order.

This prevents people monitoring the site learning about your payment methods, locations, bitcoin holding etc.

To allow arbitrage, you can run multiple bots. e.g. one to trade in JPY, one to trade in USD.

To make arbitrage easier, you could have a separate cookie per tab.

However, because both connections will go via the same tor circuit, this still leaks to the site that you have a JPY and a USD bank account, which could be stored, hacked, exploited.

Describe alternatives you've considered
Keep accounts separate by 'burning' your tor connection whenever swapping account. Correlation analysis would still link the two (on the server side), but it raises the bar.

Additional context

Perhaps this is a bad idea afterall...

@Reckless-Satoshi
Copy link
Collaborator

This would be a nice feature to allow multiple robots in a single browser. Sort of a pro feature, but requested a few times already.

The way to implement tab specific session is not straight forward though. And you would certainly have problems to hide your shared Tor connection from the server.

Workarounds as of now to use multiple robots at once:

  1. Use different browsers e.g. Tor Browser and Brave w/ Tor would allow you two robots.
  2. Store your robot tokens and login into them as needed in the same tab. As a maker, you might miss the fact of someone taking an order of a robot that is not logged in. Here enabling telegram notifications becomes useful.
  3. Torify your own mozilla sessions. Possibilities are endless here. With a bit of craft you could manage to have N browsers with N tor circuits with N robots. I have never tried it though. If someone has experience, it would be great to create a guide.

If we go to implement a feature that allows one robot per browser tab, it would be extremely important that recovering sessions for not-pro users is still easy. Many users keep forgetting to back up the token!

@Reckless-Satoshi Reckless-Satoshi added the needs research More knowledge is needed in this issue label Mar 7, 2022
@Reckless-Satoshi Reckless-Satoshi added this to the Future milestone Mar 7, 2022
@dbolser
Copy link
Author

dbolser commented Mar 7, 2022

To be honest, I'd build multiple account support into the UX (assuming the privacy trade off is considered worth it).

e.g. pick an account from a drop down.

@Reckless-Satoshi
Copy link
Collaborator

To be honest, I'd build multiple account support into the UX (assuming the privacy trade off is considered worth it).

e.g. pick an account from a drop down.

Agree. This is the way to go for this feature.

@Reckless-Satoshi
Copy link
Collaborator

Rather than further complicate the current clean and easy UI. We are going to fork the UI into RoboSats basic and RoboSats PRO. See further details #177

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs research More knowledge is needed in this issue
Projects
None yet
Development

No branches or pull requests

2 participants