There is spam happening involving usage of this project/script

[Flyingmana]

I got this Mail.

Vincent highground.ou@gmail.com über sendgrid.net | Vincent highground.ou@gmail.com über sendgrid.net | 19:11 (vor 2 Stunden) |   |  

Vincent highground.ou@gmail.com [über](https://support.google.com/mail/answer/1311182?hl=de) sendgrid.net 19:11 (vor 2 Stunden) an mich

Hello,

I hope this message finds you well. I am reaching out to inquire about the possibility of purchasing a proof from you using your GitHub account: https://github.com/Flyingmana

I am willing to offer $500 in exchange for your assistance in generating the requested proof. It involves downloading a repo and running a simple python script that proves the ownership of your github account.The script is fully open sourced and the link is https://github.com/fluencelabs/dev-rewards

If you are not sure about receiving the money, I can pay you first for the half amount, which is $250. After you've sent me the proof I can send you the remaining half. The price is negotiable. I can do paypal, venmo, crypto or any other payment method you would like.

If you are interested in this proposal, please let me know, and we can discuss the details further. I believe this collaboration could be mutually beneficial.

Thank you for considering my offer. I look forward to your response.

Best regards,
Vincent
Vincent
1301 Terminal Pl, San Mateo, CA 94401

[Elara6331]

I also received an email like this and I've reported it to SendGrid, so they'll hopefully suspend the account that was used to send this, but the spammers will likely figure out a different way to send their emails in the future, so this project should definitely mention the spam somewhere in its README so that people don't fall for it.

[guriWiz]

I have also received this same spam email.

[ElvisKrop]

I also received an email like this and I've reported it to SendGrid, so they'll hopefully suspend the account that was used to send this, but the spammers will likely figure out a different way to send their emails in the future, so this project should definitely mention the spam somewhere in its README so that people don't fall for it.

Definitely a good idea!

[Fil]

I've been getting several of these emails, which are obviously scammers. However for "transparency" they redirect to this repo, which leaves me confused. If this project is legit, what does it do, and what is the scammers' plan.

[FDiskas]

No free energy and no free money 🤑
Report to github thous repositories

[fwdekker]

@Fil From my limited understanding, Fluence is launching a cryptocurrency token, so Fluence (randomly?) selected a bunch of GitHub accounts to give 5000 of those tokens to. Of course, using OAuth would be too easy and secure, so instead they created their own system, but they didn't add mutual authentication, so if a scammer intercepts the communication (or deceives you into communicating with them) they can pretend to be you and get your tokens.

Warning

Even if you don't care about these tokens and would be happy to sell them, don't give your bank account number or other payment details to random people on the Internet.

I think Fluence's authentication method works as follows. Fluence took the public SSH keys of the selected users and used those to encrypt some secret data, and uploaded those encrypted pieces of data to a public location. If (and only if) you have the corresponding SSH private key, you can decrypt the data, and with that you can create a proof validating your ownership. This repository is a tool that automates the user-side part of it and spits out a proof if you give it your SSH private key. You can then upload this proof at https://claim.fluence.network/ (don't sue me if that's the wrong link, verify it yourself) to claim the tokens into an Ethereum wallet of your choice. Of course, if you give your proof to a scammer, they'll take your tokens instead.

Apart from lacking mutual authentication, there's a few other security flaws in their design as well. Most notably, it requires access to your private SSH key. Of course, they promise they won't abuse that privilege (you do thoroughly read all scripts before running them, right?), but they do not consider supply chain attacks (e.g. by pinning package versions with hashes). They don't even have a security policy.

[Fil]

Thanks for the explanation. I have no plans to sue you nor to run any of these scripts :)

[guriWiz]

I replied back on this email saying that i need to know more about what this code does and here is the reply I received. Make sure you look out for this phone number:

Sure, so basically I need your GitHub account to generate the proof so that I can claim for the fluence dev rewards. The code is not written by me, but the fluence labs. I selected your account based on their list of GitHub users. 

Can we chat on telegram or WhatsApp or WeChat or any other chat media? That way we can communicate better and I will send you the first half once I start chatting with you. Zoom or Google Meet also works. 

My telegram handle is xiaomaogy and my WhatsApp username is +12026643450, my WeChat is xiaomaogy88. 

[fwdekker]

I replied back on this email saying that i need to know more about what this code does and here is the reply I received. Make sure you look out for this phone number:

Sure, so basically I need your GitHub account to generate the proof so that I can claim for the fluence dev rewards. The code is not written by me, but the fluence labs. I selected your account based on their list of GitHub users. 

Can we chat on telegram or WhatsApp or WeChat or any other chat media? That way we can communicate better and I will send you the first half once I start chatting with you. Zoom or Google Meet also works. 

My telegram handle is --- and my WhatsApp username is ---, my WeChat is ---. 

Their explanation is sound, but that's usually how they get ya. But $500 for just a bunch of tokens? Well, if it sounds too good to be true, it probably is.

[xiaomaogy]

So I was the one who batch sent this email. And I'm not a scam. I did purchase proof from some people. And I will deliver the money if they send me the proof. There is a lot of speculation around the FLT so some people are willing to sell the proof for a certain amount of money, also 500 dollars is negotiable and it is a fair market.

I don't intend to run away with other people's proof without paying, so I don't think it is a scam.

[fwdekker]

So I was the one who batch sent this email. And I'm not a scam. I did purchase proof from some people. And I will deliver the money if they send me the proof. There is a lot of speculation around the FLT so some people are willing to sell the proof for a certain amount of money, also 500 dollars is negotiable and it is a fair market.

I don't intend to run away with other people's proof without paying, so I don't think it is a scam.

Yes, in hindsight, I realised it might not be a scam, since it appears that the tokens are currently valued at $1 each (and eligible people receive 5000 tokens), which explains your interest much more. (Though I still disapprove of your email not sufficiently informing people of the impact of sharing such a proof.)

That said, though, unless I misunderstand something, how is the proof useful to you if you don't also have a corresponding signature containing the address of your own Ethereum wallet?

[xiaomaogy]

By the way, if anyone here is willing to sell their proof, you can reach out to me at highground.ou@gmail.com, also you can add my telegram：xiaomaogy. I'm willing to buy the github proof if you are qualified, and the price is negotiable.

[xiaomaogy]

So I was the one who batch sent this email. And I'm not a scam. I did purchase proof from some people. And I will deliver the money if they send me the proof. There is a lot of speculation around the FLT so some people are willing to sell the proof for a certain amount of money, also 500 dollars is negotiable and it is a fair market.
I don't intend to run away with other people's proof without paying, so I don't think it is a scam.

Yes, in hindsight, I realised it might not be a scam, since it appears that the tokens are currently valued at $1 each (and eligible people receive 5000 tokens), which explains your interest much more. (Though I still disapprove of your email not sufficiently informing people of the impact of sharing such a proof.)

That said, though, unless I misunderstand something, how is the proof useful to you if you don't also have a corresponding signature containing the address of your own Ethereum wallet?

So basically I can give them an address when they generate their proof.

So the token price fluctuates, and it's hard to tell how much it would worth when it gets unlocked. There is a two month unlocking period. Also a lot of people don't have the channel to sell the token. I'm just providing another channel for them to benefit from it.

Also I think I'm doing a good thing, because of my email more developers are aware of the dev reward, and if they don't want to sell at least they can claim it by themselves, and avoid the halfing later on.

If you are bothered by my email, I'm really sorry. I don't want to scam you, but this is the only way I can reach out to people, and see if they are interested.

Again add me on telegram if you are interested in selling, my telegram handle is: xiaomaogy

[cromatikap]

So I was the one who batch sent this email. And I'm not a scam. I did purchase proof from some people. And I will deliver the money if they send me the proof. There is a lot of speculation around the FLT so some people are willing to sell the proof for a certain amount of money, also 500 dollars is negotiable and it is a fair market.

I don't intend to run away with other people's proof without paying, so I don't think it is a scam.

You got some competition, I received an email offering $700 😄