|
Title: I know how provably fair works but... Post by: mexxer-2 on December 06, 2015, 01:03:02 PM Hey there, well I suppose nearly everyone on this board has heard about provably fair and how it is user verifiable etc. The client seed is entered by user, nonce is "created" by adding 1 successively after every roll, but how is server seed created, which script/algorith does it use to create a random string of letters? Does it differ from site to site?
Title: Re: I know how provably fair works but... Post by: adaseb on December 06, 2015, 02:02:12 PM Hey there, well I suppose nearly everyone on this board has heard about provably fair and how it is user verifiable etc. The client seed is entered by user, nonce is "created" by adding 1 successively after every roll, but how is server seed created, which script/algorith does it use to create a random string of letters? Does it differ from site to site? I think its created from the machine time based on the nano/microsecond or put thru a rand function kind of like what you see in Microsoft Excel. Probably next to impossible to guess. Title: Re: I know how provably fair works but... Post by: mexxer-2 on December 06, 2015, 02:03:02 PM I think its created from the machine time based on the nano/microsecond or put thru a rand function kind of like what you see in Microsoft Excel. Both are exploitable so I'm going with no.Probably next to impossible to guess. Title: Re: I know how provably fair works but... Post by: JackpotRacer on December 06, 2015, 02:12:11 PM Hey there, well I suppose nearly everyone on this board has heard about provably fair and how it is user verifiable etc. The client seed is entered by user, nonce is "created" by adding 1 successively after every roll, but how is server seed created, which script/algorith does it use to create a random string of letters? Does it differ from site to site? I am very interested in the correct answer thank you for the question Title: Re: I know how provably fair works but... Post by: Lutpin on December 06, 2015, 02:18:33 PM Both are exploitable so I'm going with no. Are they? It doesn't matter how the server seed is created. That's the idea of provably fair. Why doesn't it matter? Because the combination of server and client seed are creating the result, not one of those independently. You can enter your client seed, basically anything you like, so the server seed can be exactly the same, anything they like. Title: Re: I know how provably fair works but... Post by: mexxer-2 on December 06, 2015, 02:19:39 PM Both are exploitable so I'm going with no. Are they? It doesn't matter how the server seed is created. That's the idea of provably fair. Why doesn't it matter? Because the combination of server and client seed are creating the result, not one of those independently. You can enter your client seed, basically anything you like, so the server seed can be exactly the same, anything they like. Title: Re: I know how provably fair works but... Post by: Lutpin on December 06, 2015, 02:25:12 PM They are exploitable by the player. Same thing as hufflepuff in a nutshell But only if you know how they are created. If you know how things work, if you find an exploit in one specific situation. So not knowing how exactly one site is creating their server seed is part of the process to prevent userside exploits, right? Further, it doesn't matter how the site does it, as explained above. That's probably why most people don't know it/don't care. Title: Re: I know how provably fair works but... Post by: Joel_Jantsen on December 06, 2015, 02:25:34 PM The scripts can be coded in any back end server side programming language like php or node.is . These languages have random function which generates the randon number based on conditions .Example : generate random().integers<100 .This will allow to generate the numbers less than 100 randomly .When most of the wsbsitss say they are provably fair I never believe it because they can choose what to show and have hiding functions scamming the fuck outta you.
Title: Re: I know how provably fair works but... Post by: mexxer-2 on December 06, 2015, 02:28:09 PM But only if you know how they are created. If you know how things work, if you find an exploit in one specific situation. @Me, you're not supposed to argue with yourself(insider joke)So not knowing how exactly one site is creating their server seed is part of the process to prevent userside exploits, right? Further, it doesn't matter how the site does it, as explained above. That's probably why most people don't know it/don't care. At any rate, my concern being, the numbers are random but the server seed can be exploitable if the function which creates them is weak(not secure) and known. P.S: That and I have to create an algorithm for provably fair. Title: Re: I know how provably fair works but... Post by: Lutpin on December 06, 2015, 02:28:35 PM When most of the wsbsitss say they are provably fair I never believe it because they can choose what to show and have hiding functions scamming the fuck outta you. thats funny. thanks for the laugh :D That the same for the "provably fair" casino in your sig? At any rate, my concern being, the numbers are random but the server seed can be exploitable if the function which creates them is weak(not secure) and known. P.S: That and I have to create an algorithm for provably fair. I'd suggest a "Don't Ask. Don't Tell." attitude. P.S.: Who the hell is crazy enough to let YOU take care of that. "(insider joke)" Title: Re: I know how provably fair works but... Post by: ranochigo on December 06, 2015, 02:32:05 PM Both are exploitable so I'm going with no. Are they? It doesn't matter how the server seed is created. That's the idea of provably fair. Why doesn't it matter? Because the combination of server and client seed are creating the result, not one of those independently. You can enter your client seed, basically anything you like, so the server seed can be exactly the same, anything they like. Title: Re: I know how provably fair works but... Post by: edmundduke on December 06, 2015, 02:35:24 PM Hey there, well I suppose nearly everyone on this board has heard about provably fair and how it is user verifiable etc. The client seed is entered by user, nonce is "created" by adding 1 successively after every roll, but how is server seed created, which script/algorith does it use to create a random string of letters? Does it differ from site to site? Unfortunately i cant really say how or which algorithm they use as i do not know but i can say that it does differ from site to site. Some sites have the same "basic formula" but some parts like secrets need to be different ect or one site could exploit the other. Title: Re: I know how provably fair works but... Post by: mexxer-2 on December 06, 2015, 02:37:08 PM Hufflepuff incident required the user to know the server seed beforehand and it wasn't due to a weak RNG for the server seed. Hufflepuff was able to get an active seed. The seed was used by multiple players and it was not guessed. I am aware of that, but considering no one has talked about how server seeds themselves are created, it got me curious(that and me having to create the algorithm). As for the hufflepuff incident, I meant, if someone knows/accurately guesses how server seeds are created and the algorithm is weak, say it creates variables like "1111111111a", then "111111111b" , or "ab" "al" "et" "eb"(XY, x is unchanged the first time, the second time increased by 4, Y changes by 8 variables) etc, they can know what the next/all server seeds will be.At any rate, to rephrase my question, how would you make the random variable generator such that the RN(Variable)G in itself is secure. Title: Re: I know how provably fair works but... Post by: RHavar on December 06, 2015, 10:00:30 PM how is server seed created, which script/algorith does it use to create a random string of letters? Does it differ from site to site? As a user, you don't really care. That's because the only real point of the server seed is for the gambling server to protect itself against players who wish to cheat. So even if the server seed was always 0, the game would still be provably fair for you (but the casino would get robbed blind). And yes, it does vary site to site. Some people even think using things based on the current time is a good idea. But the server seed is to protect the casino from gamblers, so it should be as unpredictable as possible. Using data from /dev/urandom is probably going to be your best bet most of the time, or you can look up some cryptographically random number generators which will also work fine. Title: Re: I know how provably fair works but... Post by: vit1988 on December 07, 2015, 08:02:13 PM We have an intern who moves the mouse all day to create enough entropy for the random generator. ;D
Title: Re: I know how provably fair works but... Post by: dooglus on December 07, 2015, 08:08:34 PM It doesn't matter how the server seed is created. That's the idea of provably fair. Why doesn't it matter? Because the combination of server and client seed are creating the result, not one of those independently. It very much matters. If the server seed is generated using a hash of the current time in millionths of a second then the player can easily cheat. He just needs to notice what the time is when the server seed is created, then hash a few million times in that neighbourhood until he gets the server seed hash that the site has shown him. Then he has the server seed and can predict all his future rolls. The server seeds should be entirely unpredictable, to prevent such attacks. Collect entropy from wherever you can to make your RNG unpredictable. Title: Re: I know how provably fair works but... Post by: mexxer-2 on December 16, 2015, 07:09:06 AM It very much matters. If the server seed is generated using a hash of the current time in millionths of a second then the player can easily cheat. He just needs to notice what the time is when the server seed is created, then hash a few million times in that neighbourhood until he gets the server seed hash that the site has shown him. Then he has the server seed and can predict all his future rolls. Quote The server seeds should be entirely unpredictable, to prevent such attacks. Collect entropy from wherever you can to make your RNG unpredictable. What source, as a dice site owner ,would you suggest for a "unpredictable RNG".Title: Re: I know how provably fair works but... Post by: diodio1 on December 16, 2015, 07:18:09 AM ---Snip--- Does it differ from site to site? Logically Its not necessary ;) , but practically it depends on the software.Every dice site is made DEVELOPERS , who develop codes , and person who invest or hold/own the bankroll make sure that the site uses unique software so that no person can cheat them. Ex: when you wanna attend a party function of someone special then you look for single piece dress so that you have only that copy and that's guarantee that none of people will wear the same cloths at the party. Title: Re: I know how provably fair works but... Post by: MillionsBTCdev on December 16, 2015, 08:58:38 AM To answer OP's question, There are different types/kinds of "scripts/algo" one can use to generate a random seed, and most of the time, it varies from site to site, depending on how it was programmed by their dev. But nowadays, devs stick to what is "common" therefor you might see different sites that uses same algo to generate a random seed. But ofcourse it doesn't mean both site will have the same server seed, (tho there is a very very slim chance it could happen).
You can program a computer to generate a random number, but that program is and will always be at the mercy of its programming. So you cannot actually say that it has given you a random number because the fact is, its just following the sequence of how it is programmed, it generally starts with something then follows a pattern. Tho the complexity of the result is enough to be called random, its never truly random since it is just ruled by a consistently repeating algorithm. This are called "pseudo-random number generators" (PRNG). And most of the site uses this kind of way to generate their seeds. So any script/algo programmed on a computer is always a PRNG? Answer is No.. One can generate a True Random Number Generator (TRNG) on a computer, this is by use of different kinds of entropy. Some uses a device that relies on thermal, noise or any unpredictable environmental elements that we as humans have no control over. And this can be called a true random number generator. Like ryan said, one can use /dev/random, which uses environmental noise. Another example is, Random.org, which they claim, uses atmospheric noise to generate a true randomness. So the fact is, most sites uses PRNG? Yes. So there is a possibility to crack it? YES and NO. If we talk of possibility, then yes there is always a possibility of something, but the probability of that happening is so low. Like i said above, the complexity of the results of a PRNG is enough to be called random, therefore the chance to crack a single seed is so low that if compared, you'd have better chance of winning the lottery than trying to crack it in a lifetime. -uni Title: Re: I know how provably fair works but... Post by: JackpotRacer on December 16, 2015, 09:18:10 AM To answer OP's question, There are different types/kinds of "scripts/algo" one can use to generate a random seed, and most of the time, it varies from site to site, depending on how it was programmed by their dev. But nowadays, devs stick to what is "common" therefor you might see different sites that uses same algo to generate a random seed. But ofcourse it doesn't mean both site will have the same server seed, (tho there is a very very slim chance it could happen). You can program a computer to generate a random number, but that program is and will always be at the mercy of its programming. So you cannot actually say that it has given you a random number because the fact is, its just following the sequence of how it is programmed, it generally starts with something then follows a pattern. Tho the complexity of the result is enough to be called random, its never truly random since it is just ruled by a consistently repeating algorithm. This are called "pseudo-random number generators" (PRNG). And most of the site uses this kind of way to generate their seeds. So any script/algo programmed on a computer is always a PRNG? Answer is No.. One can generate a True Random Number Generator (TRNG) on a computer, this is by use of different kinds of entropy. Some uses a device that relies on thermal, noise or any unpredictable environmental elements that we as humans have no control over. And this can be called a true random number generator. Like ryan said, one can use /dev/random, which uses environmental noise. Another example is, Random.org, which they claim, uses atmospheric noise to generate a true randomness. So the fact is, most sites uses PRNG? Yes. So there is a possibility to crack it? YES and NO. If we talk of possibility, then yes there is always a possibility of something, but the probability of that happening is so low. Like i said above, the complexity of the results of a PRNG is enough to be called random, therefore the chance to crack a single seed is so low that if compared, you'd have better chance of winning the lottery than trying to crack it in a lifetime. -uni thank you very much for taking the time to explain your knowledge in a more detailed way. as I know you are a coder so if all depends on you regarding the provably fair implementation nothing bad can happen to your bank roll. but you know what happened to Magical Dice :( how could they or any other non coder (like we) prevent this to happen? Title: Re: I know how provably fair works but... Post by: MillionsBTCdev on December 16, 2015, 09:31:43 AM To answer OP's question, There are different types/kinds of "scripts/algo" one can use to generate a random seed, and most of the time, it varies from site to site, depending on how it was programmed by their dev. But nowadays, devs stick to what is "common" therefor you might see different sites that uses same algo to generate a random seed. But ofcourse it doesn't mean both site will have the same server seed, (tho there is a very very slim chance it could happen). You can program a computer to generate a random number, but that program is and will always be at the mercy of its programming. So you cannot actually say that it has given you a random number because the fact is, its just following the sequence of how it is programmed, it generally starts with something then follows a pattern. Tho the complexity of the result is enough to be called random, its never truly random since it is just ruled by a consistently repeating algorithm. This are called "pseudo-random number generators" (PRNG). And most of the site uses this kind of way to generate their seeds. So any script/algo programmed on a computer is always a PRNG? Answer is No.. One can generate a True Random Number Generator (TRNG) on a computer, this is by use of different kinds of entropy. Some uses a device that relies on thermal, noise or any unpredictable environmental elements that we as humans have no control over. And this can be called a true random number generator. Like ryan said, one can use /dev/random, which uses environmental noise. Another example is, Random.org, which they claim, uses atmospheric noise to generate a true randomness. So the fact is, most sites uses PRNG? Yes. So there is a possibility to crack it? YES and NO. If we talk of possibility, then yes there is always a possibility of something, but the probability of that happening is so low. Like i said above, the complexity of the results of a PRNG is enough to be called random, therefore the chance to crack a single seed is so low that if compared, you'd have better chance of winning the lottery than trying to crack it in a lifetime. -uni thank you very much for taking the time to explain your knowledge in a more detailed way. as I know you are a coder so if all depends on you regarding the provably fair implementation nothing bad can happen to your bank roll. but you know what happened to Magical Dice :( how could they or any other non coder (like we) prevent this to happen? But personally, my opinion is, an owner "MUST" atleast know the basic logic of his own system, you don't have to know how to code, but know how your system works is a must. Trust is a big word when it comes to this "pixelized" online world, but with proper preparation and strategy, an owner wont need this to have a successful site. The issue with magicaldice is that, they hired a dev, and trusted the dev to run the site and have full access. When MD1 went live, the dev should no longer have access to their database, and only grant access to the dev on special occasions like fixing bugs etc..and then immediately revoke it once it is fixed. I know there maybe "holes" on my statement, but thats the basic. Owners already had this idea, what if their dev create an alt and play.. But they trusted their dev not to do it, which is totally wrong. -uni Title: Re: I know how provably fair works but... Post by: JackpotRacer on December 16, 2015, 09:52:55 AM To answer OP's question, There are different types/kinds of "scripts/algo" one can use to generate a random seed, and most of the time, it varies from site to site, depending on how it was programmed by their dev. But nowadays, devs stick to what is "common" therefor you might see different sites that uses same algo to generate a random seed. But ofcourse it doesn't mean both site will have the same server seed, (tho there is a very very slim chance it could happen). You can program a computer to generate a random number, but that program is and will always be at the mercy of its programming. So you cannot actually say that it has given you a random number because the fact is, its just following the sequence of how it is programmed, it generally starts with something then follows a pattern. Tho the complexity of the result is enough to be called random, its never truly random since it is just ruled by a consistently repeating algorithm. This are called "pseudo-random number generators" (PRNG). And most of the site uses this kind of way to generate their seeds. So any script/algo programmed on a computer is always a PRNG? Answer is No.. One can generate a True Random Number Generator (TRNG) on a computer, this is by use of different kinds of entropy. Some uses a device that relies on thermal, noise or any unpredictable environmental elements that we as humans have no control over. And this can be called a true random number generator. Like ryan said, one can use /dev/random, which uses environmental noise. Another example is, Random.org, which they claim, uses atmospheric noise to generate a true randomness. So the fact is, most sites uses PRNG? Yes. So there is a possibility to crack it? YES and NO. If we talk of possibility, then yes there is always a possibility of something, but the probability of that happening is so low. Like i said above, the complexity of the results of a PRNG is enough to be called random, therefore the chance to crack a single seed is so low that if compared, you'd have better chance of winning the lottery than trying to crack it in a lifetime. -uni thank you very much for taking the time to explain your knowledge in a more detailed way. as I know you are a coder so if all depends on you regarding the provably fair implementation nothing bad can happen to your bank roll. but you know what happened to Magical Dice :( how could they or any other non coder (like we) prevent this to happen? But personally, my opinion is, an owner "MUST" atleast know the basic logic of his own system, you don't have to know how to code, but know how your system works is a must. Trust is a big word when it comes to this "pixelized" online world, but with proper preparation and strategy, an owner wont need this to have a successful site. The issue with magicaldice is that, they hired a dev, and trusted the dev to run the site and have full access. When MD1 went live, the dev should no longer have access to their database, and only grant access to the dev on special occasions like fixing bugs etc..and then immediately revoke it once it is fixed. I know there maybe "holes" on my statement, but thats the basic. Owners already had this idea, what if their dev create an alt and play.. But they trusted their dev not to do it, which is totally wrong. -uni thank you again for the detailed answer very much appreciated please let me ask you if there is a way to let someone code and implement the provably fair option and then close it like a safe that no one will have access and in case the safe is damaged we will see it and stop the game. we can't code and don't have the provably fair knowledge to run a casino on our own we would always need coder. the sharks would eat us alive :) like it happened with MD that is mainly the reason why we are on moneypot thanks again Title: Re: I know how provably fair works but... Post by: Betwrong on December 16, 2015, 09:58:11 AM To answer OP's question, There are different types/kinds of "scripts/algo" one can use to generate a random seed, and most of the time, it varies from site to site, depending on how it was programmed by their dev. But nowadays, devs stick to what is "common" therefor you might see different sites that uses same algo to generate a random seed. But ofcourse it doesn't mean both site will have the same server seed, (tho there is a very very slim chance it could happen). You can program a computer to generate a random number, but that program is and will always be at the mercy of its programming. So you cannot actually say that it has given you a random number because the fact is, its just following the sequence of how it is programmed, it generally starts with something then follows a pattern. Tho the complexity of the result is enough to be called random, its never truly random since it is just ruled by a consistently repeating algorithm. This are called "pseudo-random number generators" (PRNG). And most of the site uses this kind of way to generate their seeds. So any script/algo programmed on a computer is always a PRNG? Answer is No.. One can generate a True Random Number Generator (TRNG) on a computer, this is by use of different kinds of entropy. Some uses a device that relies on thermal, noise or any unpredictable environmental elements that we as humans have no control over. And this can be called a true random number generator. Like ryan said, one can use /dev/random, which uses environmental noise. Another example is, Random.org, which they claim, uses atmospheric noise to generate a true randomness. So the fact is, most sites uses PRNG? Yes. So there is a possibility to crack it? YES and NO. If we talk of possibility, then yes there is always a possibility of something, but the probability of that happening is so low. Like i said above, the complexity of the results of a PRNG is enough to be called random, therefore the chance to crack a single seed is so low that if compared, you'd have better chance of winning the lottery than trying to crack it in a lifetime. -uni Thank you very much for your explanation! It is written in simple language and at the same time is shedding light on such complicated and incomprehensible things that I can say nothing but WOW! Man, you should write books. Title: Re: I know how provably fair works but... Post by: MillionsBTCdev on December 16, 2015, 11:29:56 AM Quote thank you again for the detailed answer very much appreciated please let me ask you if there is a way to let someone code and implement the provably fair option and then close it like a safe that no one will have access and in case the safe is damaged we will see it and stop the game. we can't code and don't have the provably fair knowledge to run a casino on our own we would always need coder. the sharks would eat us alive :) like it happened with MD that is mainly the reason why we are on moneypot thanks again Yes there is a way. One example is, if you hire a dev to create a website for you, have it done on a test server. once it is done, the dev will give you the full source with installation instructions to your own server. Before installing, have a 3rd party check the code for you. Again this is before you install it on your live server, meaning, database names, database password and other critical variables are not yet set. A good dev keeps notes, but a great dev gives detailed documentations. Have your dev give you a documentation, maybe a pdf or something that gives a detailed explanation on how the system works in a layman's term, documentation includes processes, every page's role, the logic on how the system works, the algorithm used, 3rd party scripts use if there are any, installation instructions, security modules or scripts used.. etc.. Once code has been checked, you then install it on your live server, and its the only time where you will be asked for database names, database passwords etc.. Doing this, you can be sure that only you knows the critical variables for your site..Some site open up a semi-production site which they call beta version of the site, which is open for public to check for bugs etc. And if ever bugs occurs, the original dev has the original source code, therefor, he can have it fixed on his end without accessing the live server itself, then he can just give you an updated source to fix the bug, you can have a 3rd party check it again..All this depends on what is the agreement between you and the dev. There are many ways on how one can prevent a dev from turning against the owner. Above is just one example i can think of. -uni Title: Re: I know how provably fair works but... Post by: JackpotRacer on December 16, 2015, 12:16:57 PM Quote thank you again for the detailed answer very much appreciated please let me ask you if there is a way to let someone code and implement the provably fair option and then close it like a safe that no one will have access and in case the safe is damaged we will see it and stop the game. we can't code and don't have the provably fair knowledge to run a casino on our own we would always need coder. the sharks would eat us alive :) like it happened with MD that is mainly the reason why we are on moneypot thanks again Yes there is a way. One example is, if you hire a dev to create a website for you, have it done on a test server. once it is done, the dev will give you the full source with installation instructions to your own server. Before installing, have a 3rd party check the code for you. Again this is before you install it on your live server, meaning, database names, database password and other critical variables are not yet set. A good dev keeps notes, but a great dev gives detailed documentations. Have your dev give you a documentation, maybe a pdf or something that gives a detailed explanation on how the system works in a layman's term, documentation includes processes, every page's role, the logic on how the system works, the algorithm used, 3rd party scripts use if there are any, installation instructions, security modules or scripts used.. etc.. Once code has been checked, you then install it on your live server, and its the only time where you will be asked for database names, database passwords etc.. Doing this, you can be sure that only you knows the critical variables for your site..Some site open up a semi-production site which they call beta version of the site, which is open for public to check for bugs etc. And if ever bugs occurs, the original dev has the original source code, therefor, he can have it fixed on his end without accessing the live server itself, then he can just give you an updated source to fix the bug, you can have a 3rd party check it again..All this depends on what is the agreement between you and the dev. There are many ways on how one can prevent a dev from turning against the owner. Above is just one example i can think of. -uni thank you very much again :) this was very helpful for us because this could be a solution for us old men who cannot code. btw I can't connect to your app :( Title: Re: I know how provably fair works but... Post by: MillionsBTCdev on December 16, 2015, 01:27:29 PM Quote thank you again for the detailed answer very much appreciated please let me ask you if there is a way to let someone code and implement the provably fair option and then close it like a safe that no one will have access and in case the safe is damaged we will see it and stop the game. we can't code and don't have the provably fair knowledge to run a casino on our own we would always need coder. the sharks would eat us alive :) like it happened with MD that is mainly the reason why we are on moneypot thanks again Yes there is a way. One example is, if you hire a dev to create a website for you, have it done on a test server. once it is done, the dev will give you the full source with installation instructions to your own server. Before installing, have a 3rd party check the code for you. Again this is before you install it on your live server, meaning, database names, database password and other critical variables are not yet set. A good dev keeps notes, but a great dev gives detailed documentations. Have your dev give you a documentation, maybe a pdf or something that gives a detailed explanation on how the system works in a layman's term, documentation includes processes, every page's role, the logic on how the system works, the algorithm used, 3rd party scripts use if there are any, installation instructions, security modules or scripts used.. etc.. Once code has been checked, you then install it on your live server, and its the only time where you will be asked for database names, database passwords etc.. Doing this, you can be sure that only you knows the critical variables for your site..Some site open up a semi-production site which they call beta version of the site, which is open for public to check for bugs etc. And if ever bugs occurs, the original dev has the original source code, therefor, he can have it fixed on his end without accessing the live server itself, then he can just give you an updated source to fix the bug, you can have a 3rd party check it again..All this depends on what is the agreement between you and the dev. There are many ways on how one can prevent a dev from turning against the owner. Above is just one example i can think of. -uni thank you very much again :) this was very helpful for us because this could be a solution for us old men who cannot code. btw I can't connect to your app :( |