NOTE: before reading
Since we are once again dealing with more phishing attempts, please reconsider my decentralized POP-UP warning solution for frontends to implement. Each frontend can decide its own warnings and rules, including which domains/URLs to filter and other customizations, while the core of the phishing flagging remains the same and permanent on-chain.
Another request is not to take this proposed solution as it is, but to take some ideas and inspiration from it and implement whatever works best in the long run. Maybe the HP system is broken, or maybe the reputation solution is broken.
But all phishing attempts involve links, and our HP/reputation system, or any other metrics, our technology can be used to flag them and even provide a system to counter false flags. Then, frontends can use this JSON data and use their centralized control to remove bad actors.
So, if @ world-travel-pro flags something, his on-chain data might show that he flagged it, but Ecency can simply decide to exclude this person's flags, even if he has HP/reputation.
The ideas and core concepts are clear. We just need to think about a long-term solution to this problem.
Currently, suspicious actors on Hive are growing in numbers, utilizing fake airdrop scams, memo transfers, and other deceptive methods to steal account keys from our userbase. Once they succeed, they immediately use those compromised accounts to spread the infection further. These attackers are also leaning heavily into identity theft, deception, and the use of AI to mimic trusted figures and trick users into handing over their keys. It is genuinely sad to see the hard-earned Hive of fellow hivers taken by scammers. It is time we stop being passive observers and start building a proactive, community-driven defense layer that protects every Hiver, from the whales to the newcomers.
The phishing problem on Hive is unique and significantly more dangerous than standard Web2 scams. We aren't just dealing with "fake emails" here. On Hive, the attack vectors are built into the social fabric of the chain itself.
Post, Comment and Memo Spam: Because Hive is an open ledger, scammers can "inject" malicious links directly into a user’s notification feed. This happens through 0.001 HIVE transfers with a phishing link memo, bot-generated comments on trending posts, or even creating entirely new posts and microblogs for the scam.
The Identity Trap: Scams like hive.blog.reward are designed to look identical to an "official Hive team". Even though Hive doesn't have a centralized team, that fact is unknown to many in our userbase who end up getting scammed. When a user clicks, they are prompted to "log in" or use other methods to claim a prize. This is the "kill shot" where scammers capture Active or Owner keys.
Irreversibility: Once an Owner key is compromised, the account recovery process is a race against time. If the scammer begins a power-down and transfers the HP out, the decentralized nature of the chain means there is no "undo" button. In worse cases, many users don't even know how to perform account recovery. They simply leave Hive with a bad taste in their mouth. Even if the loss was caused by their own lack of knowledge, it still damages Hive’s image because we are not doing anything at the frontend level to stop it.
Frontend Passivity: Currently, our amazing frontends like PeakD and Ecency act as silent windows. They display a malicious link with the same visual weight as a link to a high-quality blog post. There is no real-time warning, leaving the user 100% responsible for spotting sophisticated clones. The reputation system is not working here because rookie users often don't care about the negative reputation score of a fake airdrop scammer. Simply put, it isn't the same practice people are familiar with in the Web2 world.
We need a system that identifies "bad actors" and "malicious links" in real-time without violating the core principles of decentralization. My proposal is to implement a Stake-Weighted Reporting and Warning System based on three pillars:
Decentralized Reporting (The Signal)
Instead of a central "blacklist" managed by one person, we use the community. Any user can report a link as phishing. This report is broadcast as a custom JSON operation on the blockchain, making the data permanent, transparent, and accessible to everyone.
The HP-Weighted Threshold (The Filter)
To prevent "trolls" or malicious groups from flagging legitimate content, the warning only triggers based on Hive Power (HP). A warning label only appears once the sum of the reporters’ HP reaches a specific threshold (e.g., 150,000 HP). This ensures that it takes a significant, "vested" part of the community to trigger a global warning.
The Frontend Shield (The UI)
When a user clicks a link that has crossed the HP threshold, the frontend (PeakD, Ecency, etc.) intercepts the click with a firm but informative pop-up:
"Caution: Community Security Warning"
Users representing 185,000 HP have flagged this link as a potential scam. Engaging with this site may lead to account theft. Proceed with extreme caution.
The beauty of this solution is that it doesn't require a "hard fork" or a single centralized authority. It can be implemented with high flexibility:
Global vs. Local: Frontends can choose to use a shared API that aggregates these reports, or they can run their own nodes to pull the data directly from the chain.
User Choice (Opt-Out): To maintain the spirit of decentralization, this feature by default is opt-in to ensure protection, but with an opt-out option as well. If a user wants to browse without any "nanny" filters, they can simply toggle the protection off in their settings.
Dynamic Thresholds: The "150k HP" limit isn't set in stone. Much like a return proposal for the DHF, the community could vote to increase or decrease the sensitivity of the filter based on the current threat level.
Social Proof: To increase trust, the warning could display the names or profile pictures of the top 3-5 recognizable accounts who flagged the link based on their HP. If you see known security experts on the list, the signal is 100% clear.
Educating Reporters: In the event of a suspicious link, a guide can be provided to users and reporters so they can directly report the hosting provider as well, in case a website is being used to attempt phishing on our userbase.
Countering phishing is not against decentralization; it is an act of community preservation. If we can reduce the success rate of these attacks by even 30%, we save dozens of accounts and maintain the integrity of our ecosystem. This system turns our collective stake into a collective shield.
REBLOG IS APPRECIATED
