First of all, some introduction: My name is Daniel, and I'm a web applications developer and cyber security consultant with more than 15 years of experience in web and mobile technologies.

Some time ago I decided to immerse myself in blockchain technologies, and new projects caught my attention, since usually they are buggy and not secure at early stages, making it easy targets for fraudsters and hackers.

Today, I would like to share with you my research of JSEcoin, a cryptocurrency built for people to mine with their browsers, with the goal to provide you with a better background in order for you to decide if it's safe enough to use their platform and to understand how profitable it can be.

https://www.jsecoin.com

I haven't seen any serious research on this platform, so I hope this information will be helpful for you today.

I am going to make a technical analysis of their platform, explain how it works to the detail and mention the pros and cons of the program, both for webmasters and self-miners.

What is JSECoin? (The basics)

JSECoin (JavaScript Embeded Cryptocurrency) is a new general purpose coin (beta platform was released on August 2017) that allows regular people and webmasters to become miners. Their main idea is to allow mining through CPU, as opposed to GPU or ASIC mining, which creates a trend for mining farms, such as the case with Bitcoin (enabling only people who are willing to make quite an investment to join the mining community)

With JSEcoin, it is as easy as opening your browser and start mining.

It is a great alternative to the classic advertisement model, as it does not disrupt the user experience, and it only takes a small amount of cpu from them (they claim mining takes less resources than running a video ad).

They offer two modes of mining: Self-Mining and Publisher Mining

Self-Mining

With self-mining mode, the affiliate can simply login to the platform and go to the mining page.
Within a few clicks, he will start mining.

Depending on the computer and browser you use, the amount of open applications and other factors , the hash-rate speed will vary. It basically will depend on how the browser distributes the resources (CPU in this case).

Publisher Mining

With the Publisher Mining, webmasters include a javascript code in their websites, which basically will load the same functionality as for self-mining but within the visitors browsers.

There are many differences between these two modes, both in how they manage the mining results and in how they reward miners for their work.

I tried both modes during my test period, with different results, but before jumping there, we need first to dive into some technical aspects of the platform:

JSECoin Platform: Geek talk

I'm not going to explain how the blockchain technology works. That's a topic that deserves an exclusive post.

I would like to mention some interesting technical aspects of the platform, to understand how it really works in the back-end, so you will have a good perspective on what happens when you mine -and what you can do to optimize profits ; )

About JSECoin blockchain technology

Hashing Algorithm: SHA256

Extracted from JSE's technical description page: https://jsecoin.com/technical/

Cryptography
We have secp256k1 elliptical curve ECDSA working both server side and client side in the browser. This allows users to digitally sign their transactions within the browser and verify them either server side or client side.

For hashing we use the standard SHA256 algorithm. When available we use the browsers Crypto.Subtle API as this offers near native performance. On older browsers there is a fallback SHA256 function. The SHA256 algorithm takes data of any length or size and produces a unique code string for it which is always the same length. When searching for hashes we change the data by just one digit and it calculates a completely different string of alphanumeric letters. Our miners do this calculation over and over again looking for the lowest possible value string which will have leading zeros. Below you can see some actual server console logging data which shows a completed hash being written to the blockchain.

Solved block 12212 Hash: 00000090ca96abe1b5b050eb23da924bfe435708afb2288f560b3eb8668d921b
Committing to blockchain (12212)
Verified Ledger and Block (12212) Writing Out

My first remark here is about the implementation of SHA256 hashing algorithm for finding a solution to a block (a hash that meets a specific criteria).
As you may know, SHA256 is quite a fast algorithm for hashing. It is used in many cryptocurrencies, including Bitcoin, which can be mined with GPUs and ASICs at hash-rates of millions per second.

If that's the case, why do we get only a few thousand hashes-per-second (as shown in the screenshot above)?

Well... first of all, the javascript code implemented for mining is using the CPU, in order to perform the calculations, so there's no parallelization in place. But ... who said the mining calculations need to be performed within the browser?

Let's say an affiliate would like to implement a self-mining custom code, not in the browser, but in a mining rig (with GPU capabilities). The fact that jsecoin uses SHA256, would theoretically enable him to multiply the hash-rate by millions, leaving other self-miners in complete disadvantage.

If you are familiar with Monero (XRM), which is also designed to mine with CPU , you know they implement the Cryptonight algorithm, which is super-slow in comparison to SHA256, allowing an estimated maximum hash-rate of of 100-120 hps (of high end CPUs).

My guess is that cryptonight was too slow for the JSEcoin project and, thus, the team decided to use SHA256 but "slowing down" the algorithm by implementing other "techniques", so mining would not be easy on GPU based miners.

In order to avoid these scenarios the JSEcoin team implemented some coding traps, such as the need to perform a string replacement before each hashing attempt, slowing down performance substantially.

Still, it doesn't rule out the possibility to increment the hash-rate: In my attempts to raise the hash-rate, I managed to optimize the code in order to obtain about 35.000 hps (running on CPU, single process). Running on multiple cores, one would multiply the hash-rate, and building a custom code for GPU processing would take it to between 100-300K hps, but its not an easy task.

There's even the possibility of implementing WebGL (javascript's API to use GPU) in order to perform publisher mining, optimizing the visitor's hash-rate by the thousands.

How about that? taking into consideration that the average hash-rate for website-mining would be about 500-1000hps, it's quite an advantage, right?

Anyway, don't dream about becoming a millionaire just yet:

Rewards System: Lottery

Extracted from JSE's technical description page: https://jsecoin.com/technical/

Mining Rewards

Publisher Mining: 1440 coins / day, lottery system, tickets are distributed for unique visitors, page views and hashes found.

Self-mining: 720 coins / day lottery system 1 ticket per hash found.

Note. Per block ticket limits are placed on the lottery to ensure a fair distribution and to combat mining-fraud.

This is the system in place to distribute rewards for mining. Basically, you participate in a lottery every 30 seconds (block time), and you get a ticket to participate if you find a hash (more about found hashes in Difficulty, below).

There are some limits though, to avoid fraud:

For Self-mining only 1 hash per block is granted. This means you participate in a lottery with only 1 ticket, even if you found 50 hashes

For publisher mining, one ticket per unique visitor per block is granted, meaning you will be granted as many tickets as unique visitors (that solved a hash) you will have for that block.

I did some additional digging and, as of today, there are between 500 and 1000 self-miners constantly mining, making it quite competitive with the current difficulty.

Difficulty

When we talk about mining and solving/finding hashes, we are talking about the Proof of work system, which is implemented in many blockchains.

This is the way blockchains create a consensus system, where only one miner gets to define which block is written onto the ledger after some hard work (mining), and where all the rest can easily validate the block. This is used to address some issues, such as the double-spending problem and other types of attacks on the blockchain.

The difficulty is used in order to set the estimated amount of time it should take to solve a block (to find a hash matching N amount of leading zeroes), as shown in the quoted text above.

There is a difference between the difficulty set for self-mining and for publisher mining.
It's easier for self-miners to find hashes for a block than for a visitor of a publisher's website, although the publisher will have more tickets if he has enough traffic in his website.

Also, the publishers have twice the amount of coins they can get as reward (1440 daily, as opposed to 720 for self-mining).

Mining process

When we start mining, either with self-mining or publisher-mining modes, the browser will load a javascript file that will follow these steps:

1. Get a new block (which is a list of transactions and some additional data, such as the previous hash)
2. Run hashing calculation to find solutions (hashes with N amount of leading zeroes)
3. Submit the found hash to the jsecoin server.

Most of the work load happens in step 2, as explained above, but I want to mention the importance of step 3, which is when we deliver the result that will grant us a ticket.

After submitting a found hash to JSE server, it will be processed and a loterry ticket will be granted.

Both the self-miners and publishers send the request to the same method, but they validate whether you are one or the other, and also they check if your hash matches the block consistently.

Conclusions

JSE Coin seems to be a promising way to monetize our websites.
Even if I'm being somewhat critical of the platform, I still think it's a nice way to make some profit, without the need to intrude the visitors with annoying ads.

Their system is very easy to use and their support is great. The project itself is very serious and I think they have a good potential of real growth.

Results of Mining Activities during my research:

Original JSE code

• Self-Mining (Average of 3500 hps): 3 to 4 JSE coins / day (mining 24hs a day).
• Publisher Mining (average of 600 hps): small size website with 500 uniques a day (average of 6 hours of mining a day) = 5 JSE coins / day

Optimized Code

• Self-Mining (Average of 70.000 hps): 3 to 4 JSE coins / day (SAME as original code, due to the limit of 1 ticket per block)
  Publisher Mining (average of 12.000 hps): 5- 7 JSE coins / day (apparently we need more traffic to make a real difference)

It's important to mention that, as self-miners, even if were to get 1 lottery ticket per block, the max daily reward would be 7.2 JSE (1440 blocks/day * 0.005 -reward/block-), although, with the current competition, is going to be hard to achieve.
It is anyway, easier and mcuh more profitable than other coins (given that 1JSE = 1USD)

Publishers with multiple websites and lots of traffic will probably be able to make much more.

I encourage you to try, since it's very easy and should not affect your website's user experience.
https://platform.jsecoin.com

Special requests

I hope you enjoyed and learned from my experience with this platform.
If you have any special requests, i.e., if you like me to perform a technical review or security analysis of any coin, please comment and I will do my best to help.

Also, feel free to ask any questions. I can expand in the comments section.

ETH Donations: 0x22D54de630C8e97137B701842C05D284b9Ea6469