<p>No, all traffic is plaintext. The connections are hijackable and attacks against this have occurred in the past where ISPs redirected hashrate to themselves. </p>

CC BY-SA 3.0
2017-12-07T04:05:59.093Z
Really?  So there is no way to have username/password logins for the stratum miners either I guess (if it's all plaintext).
stone.212
CC BY-SA 3.0
2017-12-07T04:26:17.287Z
They have logins, but it’s all in plaintext so can be stolen by observers or redirected.
Claris
CC BY-SA 3.0
2017-12-07T05:01:44.483Z
Oh.  Do you know a more secure mining method for pools?  And how many miners can that method handle on one pool?
stone.212
CC BY-SA 3.0
2017-12-07T05:06:24.593Z
You can wrap a normal stratum socket (or any tcp connection) with SSL using `stunnel`, but this needs to be supported by the pool as well as the client. As far as I know nobody does this presently.
Claris
CC BY-SA 3.0
2017-12-07T08:04:47.843Z
Thank you but my question was if you know a more secure (than stratum) mining method for pools, and how many miners such pools can handle.  I worry about HTTP because I'm not sure if they handle https and I hear that they don't handle lots of miners at one time.
stone.212
CC BY-SA 3.0
2017-12-07T08:28:11.740Z
Stratum is JSON over raw TCP, there's no HTTP involved in it. There's no other protocols in use, 21.co had a binary protocol based on protobuf but there's nothing using that today. It also, was not encrypted or authenticated.
Claris
CC BY-SA 3.0
2017-12-08T07:32:25.767Z
I didn't say Stratum uses http.  But http mining is a thing that exists.  I am trying to decide if using it would be preferable from a security standpoint.
stone.212
CC BY-SA 3.0
2017-12-08T08:54:16.393Z
HTTP based mining hasn't existed since 2011 with `getwork` and `getblocktemplate` which never gained any adoption. For very latency sensitive things (i.e., mining) HTTP is a ridiculously bad choice.
Claris
CC BY-SA 3.0
2017-12-08T10:50:16.587Z
That's helpful.  Some mining pool software on Github offers HTTP so I thought it was a viable alternative.  I wonder why EthOS still requires you to specify stratum if stratum is all that's used?
stone.212
CC BY-SA 3.0
2017-12-06T08:28:22.177Z
2017-12-06T08:28:22.177Z
Claris
<p>Does stratum mining use something similar to "https" to secure traffic between the pool and the miners?</p>

<security><stratum>
How is a stratum connection secured?
stone.212
# How is a stratum connection secured?

(Asked by: username_0 on 2017-12-06)

Does stratum mining use something similar to "https" to secure traffic between the pool and the miners?

**Tags:** security, stratum


---

## 1 answers

### Answer by username_1 on 2017-12-06. Score: 3 | Accepted answer

No, all traffic is plaintext. The connections are hijackable and attacks against this have occurred in the past where ISPs redirected hashrate to themselves.

> **Comments:**
> **username_0**: Really?  So there is no way to have username/password logins for the stratum miners either I guess (if it's all plaintext).  
> **username_1**: They have logins, but it’s all in plaintext so can be stolen by observers or redirected.  
> **username_0**: Oh.  Do you know a more secure mining method for pools?  And how many miners can that method handle on one pool?  
> **username_1**: You can wrap a normal stratum socket (or any tcp connection) with SSL using `stunnel`, but this needs to be supported by the pool as well as the client. As far as I know nobody does this presently.  
> **username_0**: Thank you but my question was if you know a more secure (than stratum) mining method for pools, and how many miners such pools can handle.  I worry about HTTP because I'm not sure if they handle https and I hear that they don't handle lots of miners at one time.  
> **username_1**: Stratum is JSON over raw TCP, there's no HTTP involved in it. There's no other protocols in use, 21.co had a binary protocol based on protobuf but there's nothing using that today. It also, was not encrypted or authenticated.  
> **username_0**: I didn't say Stratum uses http.  But http mining is a thing that exists.  I am trying to decide if using it would be preferable from a security standpoint.  
> **username_1**: HTTP based mining hasn't existed since 2011 with `getwork` and `getblocktemplate` which never gained any adoption. For very latency sensitive things (i.e., mining) HTTP is a ridiculously bad choice.  
> **username_0**: That's helpful.  Some mining pool software on Github offers HTTP so I thought it was a viable alternative.  I wonder why EthOS still requires you to specify stratum if stratum is all that's used?  

---

