Primedice.com | Since 2013 | Longest Running Crypto Casino | 113 BTC Jackpot!

[Dondie]

-snip-
Was this resolved?

Yes it was resolved.
I think this post was from a long time ago.

[1714749055]

1714749055

[1714749055]

1714749055

[1714749055]

1714749055

[1714749055]

1714749055

[ranochigo]

I would find it hard to keep track of each server seed if I run an automatic bot. How do I verify each roll in that case?

Yes it's so hard to track server seed with auto-bet, we need to working on some API calls to solve this untrust.

Wait... So you guys could potentially observe the betting pattern of players and change the server seed to make them lose? Can't the server modify the result and show a server seed when the user requests for it via the API and gives the user the losing result when calculated?

[Dondie]

I would find it hard to keep track of each server seed if I run an automatic bot. How do I verify each roll in that case?

Yes it's so hard to track server seed with auto-bet, we need to working on some API calls to solve this untrust.

Wait... So you guys could potentially observe the betting pattern of players and change the server seed to make them lose? Can't the server modify the result and show a server seed when the user requests for it via the API and gives the user the losing result when calculated?

Does that mean you can interfere with the results?

[TheBomber999]

Wait... So you guys could potentially observe the betting pattern of players and change the server seed to make them lose?

Does that mean you can interfere with the results?

No, no.

We only working on a system to preserve players and investors

[finnile]

I would find it hard to keep track of each server seed if I run an automatic bot. How do I verify each roll in that case?

Yes it's so hard to track server seed with auto-bet, we need to working on some API calls to solve this untrust.

Wait... So you guys could potentially observe the betting pattern of players and change the server seed to make them lose? Can't the server modify the result and show a server seed when the user requests for it via the API and gives the user the losing result when calculated?

There is a possibility of that happening. It would be better for the user to change the client seed frequently, if thats the case.

[MICRO]

Jeezzz i just saw this. Im glad that he didn't get away with much more coins.

And btw unmuted u Associates .

[LainThirtyThree]

WARNING / UNRESOLVED WARNING / UNRESOLVED WARNING / UNRESOLVED WARNING / UNRESOLVED WARNING / UNRESOLVED WARNING / UNRESOLVED WARNING / UNRESOLVED

 I have been playing on PD for over 2 years and many hundreds of bitcoin wagered. Not a whale of anything of that nature but a liked to gamble some extra money in my spare time. Well, like most, my luck ran out and I ended up losing a bit in the end. Alright.

Recently it came to my attention that (quote) "it was found that the house edge was actually higher than 1% because of the rounding they placed on all rolls. At least 1 in 20,000 bets were marked as losing bets when they should of been a winning bet. All bets had a 1.05% to 50% house edge. It may seem small, but when there have been 781,000,000 bets for a total of 408,000B wagered, it is actually very meaningful."
ref to topic: https://bitcointalk.org/index.php?topic=208986.7880

So, out of pure interest I went to look at the published list of users affected and would you believe it, I happened to be on the list twice. Once for a .01btc bet and once for a .02 btc bet, both on 2x payout.
I had my 'strategy' figured out on primedice Wink I would pre-roll 5 reds then start to martingale at .01 hope to bloody hell it goes green soon Smiley I did pretty well in the beginning but eventually I hit that streak that we fear and we are in a loss. 'Those' streaks only happened about 2/3 times to me as I am not a millionaire and cannot afford to double up much at all from such a high base bet.

So I learn that I have been a 'victim' (for lack of a better word) of the flaw that was on PD and consequently lost my beloved .03 btc. Well, at least the site is being kind enough to publish the list of users effected. I personally am amazed that my luck was so bad that I am on that list but there you go. There is now a glimmer of hope however, lets see what PD support says. The guy who replied was super fast, glad to help you -after verifying that I was indeed the user claiming to be affected he said 'sure -what's new PD addy and I'll send you the .03btc now!' Nooooow, just hang on a wee moment there buddy, I BET .02 & .01 with a 2x payout -since it's now been 'proven' that I won, then I WON. You at LEAST owe me the wager + winnings. He/she/it said 'I will double check' and shortly came back to confirm that indeed I am right.

Secondly, and all along, I had been asking to see the subsequent bets after these affected bets, because, if I wagered .02 and lost, I would have doubled up and perhaps lost again, and again -it it might have been this streak that killed me. There were not too many so I have a damn good reason to think it's possible. I pointed this out again to support, who said although the do not agree with my theory they can look into the matter but it would take 'significant' time and I may end up getting nothing back. What he could do was offer me a few pennies worth of btc as a consultation. I told him I am not interested in a meager handout from his back pocket of a few satoshi - I bet hundreds of dollars and may have been duped from the ineptness of the sites ability to process a simple bet on 2x. IF I had won that 2x bet, instead of being a couple btc in arears, I would have been in profit. YOU'RE site FUCKED me out out my BTC. Sorry for the french but I am not some decrepit lowlife playing from faucet, I was/am a serious customer of PD. Even on PD3 I was excited and I am lv25 or something.

I did not have a answer now for 2 days from support. They said the dev's would have to find the results and they would get back to me. I am hoping they do as I still have faith in PD but it wears thin now. I don't know what to make of this error except that I am sad I fell victim to it. I hope PD steps up to the plate on this one, show the people they are a decent bunch and pay back a customer IN FULL when there has frankly been a heinous breach of trust.

Lain

Here is a list of users affected:

Sarah: 49.5 was 49.499 @ 0.25600000000000000000
jp1966: 49.5 was 32.673 @ 0.10240000000000000000
Sisoje: 49.5 was 49.499 @ 0.10240000000000000000
grigina: 50.5 was 50.501 @ 0.09102816000000000000
Zodiac: 49.5 was 49.499 @ 0.05000000000000000000
Purcell: 49.5 was 1.021 @ 0.04000000000000000000
hhhr: 50.5 was 50.499 @ 0.04000000000000000000
lucaspm982: 50.5 was 50.498 @ 0.03500000000000000000
Bright: 50.5 was 48.864 @ 0.03418000000000000000
Toje: 49.5 was 49.499 @ 0.03242097000000000000
Skeppy: 49.5 was 49.498 @ 0.02500000000000000000
Wavey: 49.5 was 38.559 @ 0.02000000000000000000
Tuffies78: 50.5 was 32.794 @ 0.02000000000000000000
Lain33: 49.5 was 49.495 @ 0.02000000000000000000
IZACS: 49.5 was 49.501 @ 0.01600000000000000000
Eltan: 50.5 was 7.44 @ 0.01600000000000000000
Zodiac: 49.5 was 49.504 @ 0.01600000000000000000
miloslim1: 49.5 was 49.498 @ 0.01280000000000000000
murcury12345: 49.5 was 55.929 @ 0.01280000000000000000
jp1966: 49.5 was 40.572 @ 0.01280000000000000000
TinaTTMM: 50.5 was 50.495 @ 0.01200000000000000000
applesauce1: 49.5 was 49.496 @ 0.01111110000000000000
yoo3311: 49.5 was 56.772 @ 0.01100000000000000000
shinet: 49.5 was 49.496 @ 0.01040006000000000000
ORANGEDEVE: 50.5 was 50.502 @ 0.01031520000000000000
maniana: 49.5 was 49.498 @ 0.01024000000000000000
amigo: 50.5 was 50.496 @ 0.01024000000000000000
troyrPD: 49.5 was 49.495 @ 0.01000000000000000000
keylo: 49.5 was 49.504 @ 0.01000000000000000000
Ashlamar: 49.5 was 40.899 @ 0.01000000000000000000
Lain33: 49.5 was 49.505 @ 0.01000000000000000000
hemp: 50.5 was 50.497 @ 0.01000000000000000000
davida: 49.5 was 62.537 @ 0.01000000000000000000
btcboss: 50.5 was 50.496 @ 0.01000000000000000000
amigo: 49.5 was 49.495 @ 0.01000000000000000000
ultima32: 49.5 was 49.498 @ 0.00952300000000000000
playerone: 49.5 was 49.503 @ 0.00909855000000000000
hui: 49.5 was 49.505 @ 0.00900000000000000000
mephy: 49.5 was 49.501 @ 0.00800000000000000000
blizard2014: 49.5 was 49.503 @ 0.00800000000000000000
hegel: 49.5 was 70.863 @ 0.00800000000000000000
Lan: 49.5 was 49.504 @ 0.00753147000000000000
topo: 50.5 was 50.495 @ 0.00692155000000000000
mephy: 49.5 was 49.501 @ 0.00672000000000000000
coinad: 49.5 was 49.502 @ 0.00645069000000000000
robertus: 50.5 was 95.434 @ 0.00640000000000000000
cheifkeef: 50.5 was 31.207 @ 0.00640000000000000000
fritzzz25: 49.5 was 49.498 @ 0.00640000000000000000
keylow: 49.5 was 49.496 @ 0.00620000000000000000
daimon: 49.5 was 49.503 @ 0.00524288000000000000
Blcsa: 49.5 was 49.503 @ 0.00500000000000000000
timmmm: 49.5 was 68.621 @ 0.00500000000000000000
Mates1337: 49.5 was 49.502 @ 0.00500000000000000000
timmmm: 49.5 was 45.5 @ 0.00500000000000000000
dobe: 50.5 was 50.496 @ 0.00500000000000000000
Draiko: 49.5 was 49.503 @ 0.00447200000000000000
Mitchel87: 50.5 was 50.502 @ 0.00409600000000000000
vifit: 50.5 was 50.502 @ 0.00400000000000000000
ruude25: 50.5 was 50.501 @ 0.00400000000000000000
Kit1234567: 50.5 was 50.499 @ 0.00400000000000000000
Draiko: 49.5 was 49.667 @ 0.00400000000000000000
jp1966: 49.5 was 49.504 @ 0.00400000000000000000
Bjorn1010: 49.5 was 49.505 @ 0.00370000000000000000
playerone: 50.5 was 50.504 @ 0.00356516000000000000
ultima32: 49.5 was 49.503 @ 0.00339300000000000000
bithero: 49.5 was 49.499 @ 0.00320000000000000000
Didldak: 49.5 was 80.194 @ 0.00320000000000000000
pale: 49.5 was 49.496 @ 0.00320000000000000000
xxChange: 49.5 was 49.496 @ 0.00279848000000000000
blank: 49.5 was 49.502 @ 0.00262144000000000000
bithero: 49.5 was 24.276 @ 0.00262144000000000000
BTCwillRISE: 50.5 was 50.495 @ 0.00250000000000000000
Androee: 49.5 was 49.501 @ 0.00250000000000000000
istanbulll: 49.5 was 49.501 @ 0.00250000000000000000
Yoshiiiiiii: 49.5 was 49.498 @ 0.00210000000000000000
WhyMeNoWin: 49.5 was 49.501 @ 0.00209995000000000000
tryingagain: 49.5 was 49.504 @ 0.00209712000000000000
nznl: 50.5 was 50.501 @ 0.00202816000000000000
Zodiac: 49.5 was 53.153 @ 0.00200000000000000000
omarhesa: 49.5 was 49.499 @ 0.00200000000000000000
xsdman923x: 49.5 was 69.914 @ 0.00200000000000000000
zyndr1: 49.5 was 49.504 @ 0.00200000000000000000
dakota: 49.5 was 39.319 @ 0.00200000000000000000
mishel: 49.5 was 49.499 @ 0.00200000000000000000
zyndr1: 49.5 was 49.497 @ 0.00200000000000000000
bithero: 49.5 was 49.501 @ 0.00200000000000000000
elmagico: 50.5 was 50.503 @ 0.00200000000000000000
omrgg: 49.5 was 49.502 @ 0.00200000000000000000
keylow: 49.5 was 49.499 @ 0.00200000000000000000
POSITIVE: 49.5 was 49.496 @ 0.00200000000000000000
iheartubuntu: 49.5 was 49.497 @ 0.00200000000000000000

-----------------------------------------------------

******UPDATE*************UPDATE******UPDATE******UPDATE******UPDATE******UPDATE

Okay so primedice sends me an email saying (verbatim):

Dev:





streaked losses after effected bet = 1:


Lain33: LOSS @ 0.0200000000000000000


Lain33: LOSS @ 0.0400000000000000000



= 0.12 Session 1 total effected profit




Lain33: LOSS  @ 0.01000000000000000000


Lain33: WIN    @ 0.02000000000000000000




Session 2:




0.02 total effected losses session 2. Streaked losses after effected bet = 0



Total due: .14


We've added a bonus due to delay


Adjusted total: 0.2


-----------------------------------------

WTF is this? I have been asking for the bet ID's for ages but the refuse to help any further. What kind of website advertises being fair then sends me this bullshit response? I must just 'beleive' this unofficial reponse from admin? WHERE THE HELL ARE THE BET ID'S -SURLEY IF THE DEVOLPER WENT THROUGH THE TROUBLE TO FIND MY BET HE WOULD ALSO INCLUDE THE BET ID'S IN THE REPLY -EVEN MORE SO SINCE I SPECIFICALLY STATED I REQUIRED THAT INFORMATION?!

On another note: PD advertised that I would increase my faucet if I wagered / chatted etc and built up my level. Now twice they have HALVED MY FAUCET- their stupid argument is why am I complaining about 'free money' HAHAHA what a pile of shite -I WAGERED OVER 4 BITCOIN (NOT TO MENTIONS HUDREDS ON PD2) IN THE BELIEF I COULD INCREASE MY FAUCET -THIS WAS NOT FREE I TOOK RISK RISK RISK AND NOW THEY JUST CLAIM THE FAUCET BACK?!

I ALREADY ANTICIPATE THE SLEW OF REPONSES FROM PD BACKERS TELLING ME I AM UNGRATEFUL ETC FOR 'FREE MONEY' BLABLABLA. MOST OF THESE PEOPLE ARE SPOTTY TEENAGERS WITH LITTLE TO NO MONEY WHILE I HAVE GAMBLED THOUSANDS WORTH OF BITCOIN ON PD -YET THIS IS THE SHITTY SERVICE I GET?

I WILL POST THIS ON THE PD THREAD AS OFTEN AS I CAN UNTIL I GET SOME REAL ANSWERS. THESE SCUMBAGS TAKE MY BITCOIN BECAUSE OF A MISTAKE AND THEN WONT PROVIDE ME WITH PROOF REGARDING MY AFFECTED BETS? SOUNDS LIKE A BLOODY SCAM TO ME


PEACE

Lain33


Since I have not had a response officially, I will just post this everyday then until I do

Was this resolved?

No, it has not been fully resolved

[angeloanggam]

I would find it hard to keep track of each server seed if I run an automatic bot. How do I verify each roll in that case?

Yes it's so hard to track server seed with auto-bet, we need to working on some API calls to solve this untrust.

Wait... So you guys could potentially observe the betting pattern of players and change the server seed to make them lose? Can't the server modify the result and show a server seed when the user requests for it via the API and gives the user the losing result when calculated?

There is a possibility of that happening. It would be better for the user to change the client seed frequently, if thats the case.

Is everything good on PD?

[ranochigo]

I would find it hard to keep track of each server seed if I run an automatic bot. How do I verify each roll in that case?

Yes it's so hard to track server seed with auto-bet, we need to working on some API calls to solve this untrust.

Wait... So you guys could potentially observe the betting pattern of players and change the server seed to make them lose? Can't the server modify the result and show a server seed when the user requests for it via the API and gives the user the losing result when calculated?

There is a possibility of that happening. It would be better for the user to change the client seed frequently, if thats the case.

Is everything good on PD?

Primedice uses the same server seed and client seed throughout till either they notify you or you change it yourself. They cannot change the result since the results are predetermined when the server seed and the client seed are set. The one affecting result is the nonce which increases by 1 after every bet.

[MICRO]

I would find it hard to keep track of each server seed if I run an automatic bot. How do I verify each roll in that case?

Yes it's so hard to track server seed with auto-bet, we need to working on some API calls to solve this untrust.

Wait... So you guys could potentially observe the betting pattern of players and change the server seed to make them lose? Can't the server modify the result and show a server seed when the user requests for it via the API and gives the user the losing result when calculated?

There is a possibility of that happening. It would be better for the user to change the client seed frequently, if thats the case.

Is everything good on PD?

All good .

[Stunna]

I would find it hard to keep track of each server seed if I run an automatic bot. How do I verify each roll in that case?

Yes it's so hard to track server seed with auto-bet, we need to working on some API calls to solve this untrust.

Wait... So you guys could potentially observe the betting pattern of players and change the server seed to make them lose? Can't the server modify the result and show a server seed when the user requests for it via the API and gives the user the losing result when calculated?

]

No. We use the same server seed until you opt to change it. The client seed is nonced in order to create different rolls. There is no way for PD to show a different server seed without you noticing.

[NLNico]

Part of fixing the issue is forcing all accounts to set a new seed pair, in an hour expect to be prompted to set a new pair.

We (bikinidice) change server seed every rool. That's isn't very pretty for player (need to check every time his pair to make sure of our fair system) but we need to protect our investors coin.

Sites like bikinidice which pick a new server seed for every roll are a real pain to play on for the paranoid gambler. In order to be sure that the rolls are fair, you have to make a note of each new server seed hash, and then pick a new random client seed as well - for every roll - and then verify the rolls afterwards, too.

If any player force the sha256 server seed is a BIG problem. Yes it's difficult but not impossible.

Lol?

I think if you had some coin of other player you need to take more care than a "lol" 

Yeh, definitely. But just the fact that he, as a dice site operator, thinks brute-forcing is a problem with a long enough seed is pretty funny. Let's do some maths.



PD uses 26 lowercase letters and 10 numbers in their seed, so 36 different characters with a length of 64 characters. So 36^64 =
4011991914547630480065053387702443812690402487741812225955731622655455723258857 248542161222254985216 different seeds.
The bitcoin network calculates double SHA256 hashes with a speed of 297,275,048.09 GH/s. So 297275048.09*1000000000 = 297275048090000000 double SHA256 hashes per second (pretty impressive right?), and single SHA256 would therefor be 297275048090000000*2= 594550096180000000 hashes per second. This is 594550096180000000*60 (seconds) *60 (minutes) *24 (hours) *365 (days) = 18749731833132480000000000 hashes a year. However, it would take:

4011991914547630480065053387702443812690402487741812225955731622655455723258857 248542161222254985216 / 18749731833132480000000000

= 213975962443264184927319954831658656345664031820000000000000000000000000000 years

to calculate all the original seed-hash calculations of PD with the power of the entire bitcoin network.



So yes. I do think it's funny that he thinks this is a serious threat or that he thinks he is "protecting his players/investors" by having a "seed per roll" system. He is actually quoting a message of October of dooglus just to say "see dooglus, this PD hack is exactly the reason why we have hashes per roll, so we cannot have teh damn brute-forcers". I kinda assumed or hoped that was a joke or something, hence the "lol?".

Don't get me wrong. A dice site can have many problems / server-seed leaks, to name a few:
- Any SQL injection or code execution or things like that to get to the database with the seeds.
- Any other way of "leaking" the un-hashed server-seed (probably what happened here - personally I am curious for the later update with hopefully some technical details)
- Running in a shared hosting or VPS environment with a bad hosting employee.
- Not separating nonces / client seeds, like BikiniDice was planning to do (like I pointed out here)
- Having a predictable random generator so the server seeds could be predicted (BikiniDice seems to use the PHP rand() function, so I hope the server seed is generated more randomly than that)
- Any other algorithm flaws, like PRC had many months ago with getting the "next character" instead of "next set of 5" thing.
- If your "server seed" is actually not that long, brute-forcing is a problem.
- And obviously any other normal security issues like XSS, CSRF, etc.


Nothing bad towards BikiniDice though, I really like the trollish-internet-concept. Just thought it was a silly statement to make.


Ps, I am not that good in math, if there is a problem please correct me, but the idea is clear I think.

[finnile]

I would find it hard to keep track of each server seed if I run an automatic bot. How do I verify each roll in that case?

Yes it's so hard to track server seed with auto-bet, we need to working on some API calls to solve this untrust.

Wait... So you guys could potentially observe the betting pattern of players and change the server seed to make them lose? Can't the server modify the result and show a server seed when the user requests for it via the API and gives the user the losing result when calculated?

]

No. We use the same server seed until you opt to change it. The client seed is nonced in order to create different rolls. There is no way for PD to show a different server seed without you noticing.

I think that post was for Bikinidice, as they change server seed on each roll.

[TheBomber999]

@NLNico

Yes it's difficult but not impossible.

[rfisher1968]

Is the API working? I wrote a betting script using curl and php and its not working, when it used to work.

[NLNico]

@NLNico

Yes it's difficult but not impossible.

Lol?

So we can just stop with the whole bitcoin system I guess? Since it's also theoretically possible to crack private keys etc.

You understand his statement "we use per-roll against brute-forcing" was silly, right?

[TheBomber999]

Lol?
So we can just stop with the whole bitcoin system I guess? Since it's also theoretically possible to crack private keys etc.
You understand his statement "we use per-roll against brute-forcing" was silly, right?

No, I'm saying that it is safer to change the seed everytime. That's it.
But I do not expect you to understand this. So, do not worry.

[NLNico]

Ps I'm one of bikinidice developer

Ah, this explains it. Just stay stubborn and keep making silly statements. That's it.
I do not expect you to understand this. So, do not worry.

[TheBomber999]

I do not expect you to understand this. So, do not worry.

Sorry, it was a joke like your lol! 
No problem with you, we listen all community advice. But we have our convictions

[Minnlo]

^ Guys, wouldn't it be better to discuss that problem in the BikiniDice thread rather than here?