Letting my customers mine: Security issues?

Question

I am developing software for gamers and usually accept payments via paypal only. Since a majority of my customers are teenagers who have to count every penny, I got a great idea: I want to offer my customers to pay for my software by mining cryptocurrency. I am still in the planning phase. So far I created a Monero wallet, downloaded the XMRig miner for Monero, connected it to a mining pool (tested minexmr and nanopool) and let it run for a hour. The miner itself looks great and very easy to use.

However I have a security concern: If my customers start the miner they can find out the wallet address quite easily (since you need to specify it when starting the miner). They could visit the website of the pool and "login" to the dashboard, which only requires the monero adress and no password. Once "logged in" the dashboard, the user can start a payout and change the payout options. I wrote an email to the minexmr-support asking them if this is a problem. As a response they said everyone should keep their wallet-adress private and did not recommend to share it. Furthermore it is not possible to change the monero-adress, to which the payout goes (so at least nobody can "steal" my money, right?). However they said it is possible to change the payout options.

Since I am quite new to all this mining stuff I cannot really judge how big of a problem this is. What exactly are those "payout options"?. Are there any other problems lying ahead of me, if I implement this?

I would really appreciate, if someone who has experience with mining writes his opinion, especially about the security aspect of this idea.

Regards

Answer 1

You have multiple options but two that spring to mind are:

• Primo (more)
• Running your own pool (e.g.), and disabling payouts¹, so your pool wallet collects all the fees.

You could do as you detailed but to answer this:

Furthermore it is not possible to change the monero-adress, to which the payout goes (so at least nobody can "steal" my money, right?)

Correct. Pools which use only the address as the account "login" won't let you change the payout address to somewhere else. However, there are often other settings which can be changed (i.e. payout threshold) which may be able to be changed.

You have another issue with your proposal and that's tracking user submissions. Hence you're better off using one of the alternatives mentioned above.