I'm not doubting the provably fair system, I'm doubting its implementation.
I understand how hmac works. But what you don't understand is that "convert into a roll" isn't included in the provably fair bit.
You can take a game seed and server seed and nonce, and generate a completely random number. This is true, and provable.
I would recommend reading: https://dicesites.com/provably-fair it has a great overview But to answer your points: a) You don't need "trust the implementation", you just need to verify your rolls (.e.g. use an external trusted tool, like one I linked to in my previous post) b) "convert into a roll" must be included in the provably fair system, or it would make no sense at all c) You do not convert to a "completely random number", in fact it's provably it's not. But what's the output of the hmac-sha256 hash algorithm? It's a hexadecimal string of bytes.
Not really. The output is a 256 bit. It's most commonly represented in hex, but you can just as easily write in any way you want. It's really just a huge number. Or probably best thought of an ordered list of 256 "1s" and "0s". How do you turn this into a random number? By generating say a big int, or an int, or using the string into a pseudo-random generator, it doesn't matter really, because so far, the number is still random and reproductible in the future using the same server + client + nonce input.
You don't. But this is where you can't tell me there's any provably fair bit. How do you turn this random number, into a bet? You're not telling me that just-dice generates random numbers written as integers between 1 and 100. This is just not true. So you have to take the random number, and somehow convert it into a bet between a limited interval.
Did you even read the description on just-dice? It literally specifies *exactly* how this is done: We then take the first 5 characters of that hex string and convert them to a decimal integer (that will be in the range 0 through 1048575 (16^5-1)).
If it is less than 1 million, we divide it by 10,000 and use it as your dice roll. That is the case 96% of the time.
Otherwise we use the next five characters of the 128 character hex string, and repeat.
You will notice all the verifiers follow that exact procedure, to all arrive at the exact same rolls. |
|
|
|
Those all don't touch a point that very little people realize.
Provably fair means that you can re-create the seed using known hashes.
You're kind of mixing up terminology here, but you're also on the wrong track. Provably fair means you can prove the game was fair. End of story. If you can't do that, then it's not provably fair. I could stay here and talk about provably fair all day long, it works, and it stands for something. But the other element that people miss is how a random number is turned into a gambling number. For dice, for roulette, for god knows what kind of gambling system that uses random numbers to generate its bets.
This is all making no sense. Let's use Just-Dice.com provably fair system for reference (mainly just because it's the basically the scheme pretty much everyone uses): https://just-dice.com/ and click "fair?" There's no randomness employed. It's all based on cryptographic hashes ( hmac.sha512 ) in particular. The problem with randomness is that you can't prove that it's in fact random. That's why they use the output of a hash function. Although the site probably uses randomness itself to generate the original server seed, but it's irrelevant to the user. You see, the original number CAN be random, but the way it's converted into a bet would make all the difference, and makes me seriously doubt every gambling website out there.
It's simple :
You generate a true random number using server + client seeds + a nonce that gets incremented. So far so good. But once you do generate the random number, (let's say that has a range of 0 - 1.000.000), instead of having your algorithm use a normal distribution to convert the random number into a percentage, you lie in your odds.
Say every number between 0 and 50.000 will result in a losing bet of 1x, but everything else will increment into a nice exponential looking slope.
This effectively makes the house edge 5%, and goes completely undetected, and unprovable unless you have access to the code that turns a random number into a bet.
This makes absolutely zero sense. If you don't understand how it works, it's best to just ask or take a look instead of coming up with a random guess and then hypothesizing how it's broken. A proper provably fair scheme guarantees an exact house edge, because they encode the way to convert the output of a hash into a game result. From that you can derive an exact house edge. This is probably very common because rare are the websites that open-source, and fully client-side their bet verifiers. And even then, you'd need someone with knowledge to go into the source code, verify that there isn't a hidden range that benefits the house more than they should.
All decent provably fair sites have fully open source client side verification tools that are hosted externally. For just-dice: http://rgbkey.github.io/just-dice/http://jsfiddle.net/usrfyxn0/show/https://bitcointalk.org/index.php?topic=586751.msg10190283#msg10190283https://github.com/VolosStorm/JD-Roll-VerifierYou'll notice all of them convert into a roll, thus encode the house edge (1% in this case). |
|
|
|
I have a simple question in my mind. What are the possible ways in which any provably fair dice gambling website like Bitsler and Primedice can cheat players.
Excellent question. This is the exact sort of question that needs to be asked. So the very first, and most important thing that needs to be verified is if the provably fair algorithm itself makes sense. I can't remember the scheme bitsler uses (and the site doesn't appear to be working for me at the moment to take a quick look) but primedice uses the sort of "industry norm" scheme which I believe was originally made by just-dice.com (if memory serves..). I can't really offer proof it's sane, but I can assure you it is. There's been a lot of provably fair schemes from shitty sites that don't make any sense, like those incompetent enough to use md5 (wtf??) or those malicious-enough to insert information directly under their control (999dice did this with the "bet id") or produce a house edge larger than advertised. So let's just assume that PrimeDice's scheme is fair (which is is  ) we need to ask "how can they still cheat" and we can come up with a list: 1) They don't credit your deposit 2) They don't process your withdrawal 3) They don't properly adjust your balance according to the bets 4) They give you a maliciously picked client seed (or alter the code that generates them to do so) 5) The bet results don't match what they should (i.e. altered bet amounts / targets / outcome ) So 1) and 2) are the most obvious and easiest to verify (you're probably already doing this without paying much attention). 3) Is a little annoying to do, but pretty simple maths. 4) Is the hardest to verify, I personally would never even try bother. Just just always pick your own client seed, so you don't need to worry about if their generation is rigged or not. And 5) is the most annoying, you need to record all your bets, your client seed, and the server seed hash (before you started betting...) and then match them all. If you do all that, and it all checks out -- then you are guaranteed you weren't cheated. Hence the site is "provably fair". But if we're discussing weaknesses: The biggest weakness by far is that if you are cheated, you can't prove it (it's not non-repudiable). It would be 100% your word against theres, and people would tend to err on not believing you. The good news though is, none of the serious sites would even consider scamming you. I've been following the space closely (and a former casino operator) and haven't seen a single credible scam accusation against PD in the last ~4 years. From a business point of view it just wouldn't make much sense. |
|
|
|
As some of you know, I authored: bustapay (bip79) and published a reference implementation of it along with onboarded a major service. I believe that bustapay itself has the most potential to further the goal of "practical bitcoin privacy", where even the smallest penetration of bustapay payments results in outsized privacy gains for both participants and the bitcoin system at large. Unfortunately bustapay itself suffers from a pretty big "chicken and egg" problem: No one wants to implement support for receiving bustapayments when wallets don't support it. Wallets don't want to support it when no one supports receiving it. I also believe that the best way to incentivize development is offering by offering concrete rewards for concrete work. So I propose (some of) the coinjoin bounty fund is used to offer compensation to a bunch of wallets for implementing support. Something like offering 2 or 3 bitcoin to each "major" wallet that implements full support. (And to be clear, I'm not requesting/wanting/needing any of the bounty for myself.) |
|
|
|
Why are you allowing such a big leverage when investing? You are basically forcing people to be very leveraged to have decent returns. Your website says there are 6241.53 BTC as effective bankroll, while only 731.59 have been deposited. That's a 1:8.53 leverage ratio. You are making investments tremendously volatile in exchange of what? Does the casino really need such a big effective (but fake) bankroll to function? Are players really betting enough for that bankroll to be needed? I was considering investing when I saw that 1 year profits (129 BTC) were quite decent compared to the real bankroll, 731.59. However, they are very low compared to the effective one. And there's no way I invest using 1:10 leverage or anything near that. I'd have to be monitoring my investment constantly (reducing the "offsite" amount when losing and increasing it when winning), which isn't realistic in practice. Seeing how small volatility in profit is on your website ( https://dicesites.com/yolodice), I don't see why you need a 6241.53 bankroll and therefore you should drastically decrease the allowed leverage on your website (you should just remove leverage, as it doesn't benefit anyone but does harm investors). I agree. Another way to look at it: If the casino (consistently) needed the money (e.g. players are placing bets higher than a 1x kelly on the actual bankroll) then you'd actually have a higher expected return (EBG) by having no leverage. So the corollary is a leveraged investment is actually a bet that the casino doesn't need the money! I do definitely think that leveraged systems are a pretty great way to bootstrap a bankroll, but if I was running the site I'd aggressively phase it out as it became no longer required. That said, there's one thing that is hard to measure: Having a high max-profit is potentially a very good thing, even it's never utilized. It's a powerful marketing tool, and does give players some assurances that they can bet huge if they ever need (something that appeals to loss-chasers/martingalers). So even if no one is trying to win more than a 1 bitcoin a roll, it very well might be healthy to have a 10 bitcoin bankroll |
|
|
|
I also realized, you also copied bustabit's seeding event and then removed the protections it offers (either out of malice, or more likely incompetence ) By publishing it here, we are preventing our ability to pick an alternate SHA256 chain or modify parts of it from our side, causing change in results from the chain.
That only made sense on bustabit because the terminating hash was (well) published (and archived by numerous 3rd party sources) before a client seed was provably fairly (using a bitcoin block hash) picked. You on the other hand have removed the client seed (why?!!!) which removes protections for players that you picked a bad hash-chain. And in fact you promise to arbitrarily change it: The longer a chain is in use, the higher risk is that the originating seed is found by a malicious third party (though still extremely unlikely). Due to this fact, we like to periodically update the base seed to ensure that the lifetime of a chain is not too long and the risk is minimalised.
which betrays a real lack of understanding about security of reversing a cryptographic hash. But if you're worried about some sort of brute forcing, you could always just use sha512 which would take like millions of trillions of times longer to brute force  And I find it rather bizarre that you would create a hash-chain of 10M long (from bustabit's original design) and then claim it's insecure because it's too long. Why wouldn't you just create one that's 1M long, and do a reseeding event each 1M games? (or w/e you want....) That said, I can't imagine you are intentionally picking a bad hash-chain as the house edge is already so high that all chains are basically bad anyway. I just don't see how you expect to compete against bustabit when you've just massively jacked up the house edge, and massively wrecked the provably fair guarantees. |
|
|
|
From the provably fair: var INSTANT_CRASH_PERCENTAGE = 5;
if (divisible(hash, 100 / parseInt(INSTANT_CRASH_PERCENTAGE, 10)))
return 0;
5% instant crashes? It seems kind of crazy to try compete against the incumbent bustabit by 5-6x'ing the house edge. It's also slightly concerning that the only 2 modified lines of the provably fair code from bustabit is done so poorly. parseInt is for, parsing an integer. But here you're feeding in an integer and asking it to parse it  You probably meant: "if (divisible(hash, 100 / INSTANT_CRASH_PERCENTAGE))" That said, the rest of the site looks well done and nicely customized. Good luck with your project! |
|
|
|
It's worth noting that Dean renegged on the terms of his previous ICO majorly screwing investors. I can't for the life of me imagine why anyone would want in on his next venture. Not to mention, once again -- the terms of the ICO are kind of bizarre and doesn't seem like anyone spent any time reviewing it. For instance, it appears the value of the token is derived because bitsafe.io promises to use 40% of future profits to do token buy backs. Ok, fair enough. But that program only continues until 60% of the tokens are bought-back. So then what? The remaining 40%'s token's only utility is to get the 50% discount? How can such an important thing be so massively underspecified. And I suspect the business model in the "whitepaper" is fundamentally doomed: a rational fee-payer would buy X/2 btc worth of tokens instead of paying X btc worth of fees, and save (more than) 50%. Which not only leads to price instability, but as people do this, bitsafe.io doesn't make any money -- unless they get into the business of selling/creating tokens to sell on the market. And if they do that, it's a pretty convoluted way of just having lower fees. But if history is any indication -- the terms will just be arbitrarily changed in ways that are unfair to investors. |
|
|
|
What happened to the 10% buyback of BKB tokens every 3 months? It now says this: If you opt in to sell a percentage of your BKB balance will be traded for Bitcoin on November 1st 2018 at the BKB price and Bitcoin exchange rate on November 1st. Half of monthly site profit will be bought back in total. Everyone who has opted in gets equal percentage of total amount to be bought back. Prices shown above are estimates. I've Opted in, but I don't think anything happened on November 1st. Is the 10% buyback entirely off the table now? It is now: * Monthly buybacks where half of the site profit is used to buy BKB * Quarterly buybacks where the minimum bought back would total to 10% for the past 3 months Quarterly buybacks are now entirely gone. I received an email labeled " Latest news, rebranding and BKB changes". In short: Half the profit will be used to buy back BKB tokens each month, and BetKing will rebrand from gambling to a Bitcoin bank/exchange. And under the name BitSafe they'll launch another ICO  I'd like to add a link, but can't find the email online. I'll quote the full email in code tags: Latest news, rebranding and BKB changes
Latest BKB changes
We have tweaked the BKB buy back model.
Each month we will take the total profit BetKing makes from bankroll profit commission, trade fees on the exchange and 3rd party commission for licensing software.
Fifty percent of this profit will be used to buy back BKB at the current buy back price.
The tokens we buy back or earn in fees over the month will be burned.
The buy back price is determined by:
Previous months BKB price + (monthly site profit in $ / total BKB supply)
BKB was snapshotted at $0.099 on 2018-10-21 00:00 with 20 million of 100 million tokens burned, leaving 80 million.
What can BKB be used for?
The token can be used to get 50% discount on Bankroll profit commission when you invest BTC, ETH or LTC in our Dice game bankroll.
BKB can also be used to get 50% discount on trade fees on the BetKing exchange
BKB can be used to pay for withdrawl fees when withdrawing BTC, ETH or LTC to your wallet.
BKB can also be used to play Dice and get rakeback and prizes in our leaderboard contests
BKB can be traded on our exchange for Bitcoin
Future of BKB and BetKing
BetKing will be moving away from gambling and rebranding to become a Bitcoin bank, exchange and payment processor.
We have already began work on this and we will launch in q1 of 2019. See https://bitsafe.io for more details and a working demo of the app.
Once the new site is live BKB will be converted to BTSC (BitSafe Coin) automatically using the exchange rate of both tokens at the time.
BTSC has similar utility to BKB in that it can be used to pay trade fees, merchant fees and any other fees on the BitSafe platform.
BitSafe will also use 40% of it's quarterly profit to buy back BTSC on the BitSafe exchange.
We believe these changes are best for BKB token holders and our future success together. I recall from memory many promises around BetKing's ICO, and many of them have been broken (for instance not reselling BKB tokens after buying them back, the quarterly buy backs, the promises to add more games, and more). I didn't believe the math behind the (lack of) details in the whitepaper from the start, but all details are fragmented in many different topics on this forum, and I don't have the time to dig it all up now. If I look at betking.io now, the chat is gone, the site looks worse than it ever looked, and it doesn't look anywhere near what was promised in the BKB ICO. My guess: Bitcoin dropped so much that BetKing can't afford the buy backs anymore, since the BKB price is fixed in dollars. Spending half the profit on buy backs is a joke, the site barely has any players. I remember Dean wanted something new when he closed BetKing, because he was tired of dealing with it. The site was profitable and trusted when it closed. It looks like Dean finally found a new project to work on, but he's largely destroyed his reputation in the process. Sad. This marks Dean/betking.io moving into actual scam territory. The BKB token was an instrument that allow Dean to speculate in bitcoin price: He made a personal profit/loss from the buy back scheme depending on the current crypto prices compared to the ICO price. While I know people were a bit upset when the price of crypto (especially bitcoin) sky-rocketed but the token price was still fixed to USD -- however it was always defended as fair because had crypto prices dropped -- the tokens would still have the buy-back scheme and still priced in USD and Dean would be taking a personal loss. So he's been happy arbitrarily changing the terms, reaping the benefits when it was in his favor (even offering accelerated buybacks when bitcoin price was high) and now that BTC price is slightly lower ($4250 USD vs $4596) instead of taking a loss, he's just telling investors to fuck off. "Half the profit" thing is insulting, especially when he's pretty much sabotaged any potential for the site to make money and done ridiculous things like adding *another* investor-funded instead of using ICO funds like it was intended. (and the site is pretty much dead anyway) On a personal note, I kind of dodged a bullet here. Dean spent quite a lot of time recently giving me extremely attractive offers to buy a large amount of BKB. I never accepted it, as the terms were so much in my favor it didn't make sense (compared to he could've had the same exposure for a fraction of the price by going on bitmex) and when I asked him how low btc price would need to get before he could no longer do the the buybacks , and he insisted that it could never happen and even if bitcoin price went down to $1 he had systems in place to sell btc to ensure he could always make investors whole. Now it's pretty clear the whole thing was in bad-faith, and the second things turned against him he pulls the plug. Oh and to top it all off, this part really me laugh: Once the new site is live BKB will be converted to BTSC (BitSafe Coin) automatically using the exchange rate of both tokens at the time. ...which is currently significantly less than half its "buy back price"  Man, investors really got screwed here pretty badly. But if anyone feels left out from this reverse-gangbang at least he's offering a new ICO to get into. |
|
|
|
I don't really understand how that is possible. If there's a casino managing the funds, no matter how reputable it is, it is still centralized.
It's possible to build some a "decentralized" casino, in the sense you're interacting with a "smart contract" instead of a centralized party directly. It's not super practical without a (centralized) entity that manages the smart-contract (and profits from it!) but they can offer some pretty cool benefits to players. And that benefit is "trustlessness". In the sense that a normal bitcoin casino offers "provably fair" which means "it can cheat you, but you can detect if they do" while a trustless setup would mean that they can never even cheat you (if you trust the software, and there's no bugs, that is). But "decentralized" casinos also have a huge disadvantage: They have an absolutely horrible UX, and they are typically on-chain which means slow and expensive. So that raises the question: Can you offer trustless gambling, while not totally destroying the UX? And I think the answer to that is actually 'yes'. You can use a lightning-like system, where the balance is dependent on some auditable event that can be enforced by the blockchain. So you can keep gambling with the site (offchain!) and then only in a dispute (or when you're done) dumping the last state for the network to enforce. The only problem I really see is that it's *insanely* complex to implement, compared to a normal casino -- and players probably don't care that much. |
|
|
|
Our license is being applied, so I think we are not cheater and scam.
We are new to the line, so many places may not be done well, but also made some small mistakes. But by no means for fraud.As for copying duck or stake, we will obviously feel different when we experience it ourselves. We are multiplayer online games.
I can't believe you haven't removed those claims from your website. First of all you're obviously not a "Crypto Gambling Foundation" member (which is not a rubber-stamp type deal like a gaming license), so continuing to claim you are is extremely dishonest -- and ironically the sort of behavior that virtually guarantees you'd never become one. But this also goes to show you're not very smart either or you would've chalked it up to a mistake (something like: "oh whoops! I told our designer to make sure our site looks good with it. It was a mistake he pushed up a design with it!") and tried to salvage your reputation. So dishonest, and incompetent. You don't have a lot going for you  P.S. No one really cares if you have a Curacao gaming license or not. But people do care if you're lying about having one. So it's quite possibly the stupidest thing you could lie about. |
|
|
|
|
It's a nice idea, but I'm not really sure why a crypto player would do it. You're selling 900,000 EUR worth of tickets for a chance to win 650,000 EUR prize. While by itself, I'd say despite the huge house edge -- it's probably not terrible -- as you're just buying a bit of fun. However, the part that makes it really unappealing to me is there doesn't appear to be any effort to have a provably fair drawing. Which to me, seems like kind of an easy process: you publish a list of all the tickets, and then take a future bitcoin block hash % ticketNumber to determine the winner.
|
|
|
|
are you sure you sent to correct address ?? i don't see it here
I'm an idiot. I didn't do any testing, and my script sent money it to itself (whoops, wrong variable... ) Well, at least the transaction demonstrates that it was easy to create a transaction such that it's hash was a winner. |
|
|
|
I just created a dust transaction to you to prove it works, but seems like you realize that. Please don't return the money, it was just to show you it's easy to abuse =)
i don't see the tranx, can you send me screenshot ? yes this is why i was generating new address via xpub, but few people was not sure about that. so i had to resolve to simpler means. anyways i am pushing the update in next 10 minutes please do take a look and let me know. I sent it with crazy low fees, so it didn't propagate very well. Was just a demo =) |
|
|
|
|
I just created a dust transaction to you to prove it works, but seems like you realize that. Please don't return the money, it was just to show you it's easy to abuse =)
|
|
|
|
|
You're aware that this doesn't make any sense? You need to use the block hash (that the transaction gets included in), not the "transaction hash" .. as the user can trivially grind transactions until they find a winner and propagate it. That's not nearly as easy to do with block hashes, as it involves throwing away a valid block (which is worth 12.5+ bitcoin).
|
|
|
|
You should post all of your contact with the casino on AskGamblers and LCB in the complaint section. You should definitely get back your 1 BTC. It also states that 2 BTC is the MAX cash out for all the first, second and third deposit bonuses. Did they lock your account?
It's a good idea, but I wouldn't put too much hopes on it. The issue has been brought up repeatedly with AskGamblers and they have consistently sided with casinos, even when it's very obviously extremely predatory. It gives me the impression they don't actually care about players or fairness, and just their affiliate earnings. But definitely doesn't hurt to try. But the real uphill battle that the OP is going to have is that bitcoincasino.us is not a well known or reputable casino, so they have no real reputation to protect. But I really hope the OP is successful, casinos that prey on their customers really should just not exist. |
|
|
|
Yeah, this is the same trick that bitstarz used to do. It's highly abusive, and something I think most people would agree is pretty much is a scam. (After all, there are trivial software fixes to not allow people to accidentally bet higher than the max-bet). Unfortunately they don't seem to have a bitcointalk presence, so there's no way I can leave them negative trust or what not. I hate to say it, but your avenues of recourse are going to be very limited. Probably your best bet is to contact every site that links to them (although most of them won't care, as they are happy linking to scam sites/services as long as they get their affiliate money). You also have the potential for legal remedy, but it's not clear where they are operating from -- your best bet would be talking to a lawyer who specializes in this stuff. You can really go after their domain and hosting, which will force them to defend the case. (Which is pretty much indefensible, as the contract is clearly abusive). P.S. ignore the vultures like game-protect who go around scamming victims. I know it's a bit late, but if you gamble in the future -- I'd strongly encourage you to go to well known and reputable casinos. The https://cryptogambling.org/ has a bunch of "Verified operators" who would never pull bullshit like that. |
|
|
|
|
You really should close this thread, it's nonsense and detracts from any point you may have. Dean had a winnable jackpot, no one won it and he removed it. That's not scammy, that's business as usual.
That said, betking.io is probably on it's last legs. The homepage now defaults to an exchange where there are unfilled sell orders for betking's token at 50% of their face-value. If that's not a red-flag that spells trouble, I don't know what is.
|
|
|
|
|
Show Posts
