BATgrowth / detect-bat-publishers

DEPRECATED: A npm package to detect Brave Browser / Basic Attention Token publishers
https://www.npmjs.com/package/detect-bat-publishers
MIT License
21 stars 3 forks source link

Detect .well-known verfiication #1

Closed da2x closed 6 years ago

da2x commented 6 years ago

Request and download: https://example.com/.well-known/brave-payments-verification.txt (also test www-subdomain if bare domain don’t yield the expected result.) You may need to uncompress the result even when not requesting it with Accept-Encoding because many web servers are misconfigured. Do follow up to ten redirects. HTTPS is required, so no need to test HTTP.

You can then assume it’s a Brave verified publisher if this file is one line (plus optional blank lines) which starts with the exact string brave-ledger-verification=.

maxenceC commented 6 years ago

I've written a script to do so, but I'm now using an even better way to detect Brave verified publishers : Using Brave's project API :

https://mercury-proxy.privateinternetaccess.com/v3/publisher/identity?publisher=[publisher_id]

With publisher_id being the website url (without www)

maxenceC commented 6 years ago

I just need to push the code and update this repository, but using Brave's API is what I am currently using for : https://batgrowth.com/publishers

The script is running right now

da2x commented 6 years ago

That is a way better method. However, you could actually keep the DNS and text-file verification to track the number of websites that have attempted to be verified but have either failed or been rejected!

da2x commented 6 years ago

https://mercury-proxy.privateinternetaccess.com/v3/publisher/identity?publisher=example.com

Do you happen to have a field definition for the return values?

maxenceC commented 6 years ago

Sure @da2x

{"SLD":"coinmarketcap.com","RLD":"","QLD":"","publisher":"coinmarketcap.com","properties":{"timestamp":"6530659526331334879","verified":true}}

You want to check the value for properties.verified boolean

maxenceC commented 6 years ago

However, you could actually keep the DNS and text-file verification to track the number of websites that have attempted to be verified but have either failed or been rejected!

True, this is how I discovered that imgur tried to get verified (https://imgur.com/.well-known/brave-payments-verification.txt), but failed/didn't finish the process.

I'll keep the 3 methods within the script in this repository:

Thanks for the insights

maxenceC commented 6 years ago

https://github.com/BATgrowth/detect-bat-publishers/commit/7b250abd3c7f8f3677aa6fec2be9bf36222c43fa