If your games aren't provably fair, stop claiming they are.

[TwitchySeal]

I've been running into sites using similar methods to implement what appears to be a provably fair way to determine outcomes which could be manipulated by casino owners without detection.  What makes them different from provably fair games that are actually provably fair is the use of a 'server secret' which is a predefined state of the game (order of cards, a number to be rolled, slot reel positions, etc.) which is then manipulated according to the hashed client + server seeds.  The problem is, the 'server secret' is generated without any transparency - completely behind the scenes.  

Video Poker Example:

- The order of the cards is determined behind the scenes, this is the 'server secret'.
- The client/server seed is hashed and used to determine which card will be dealt first. (cutting the deck).

The problem is, the possibility of a high paying hand is first determined during the initial shuffle.  For example, if the A and K of each suit have more than 10 cards between them - there will be no possibility for a Royal flush to be dealt.  

An example of slots from CryptoSlots.com (archive):



I think this is kind of a big deal and don't think Casinos should get away with promoting their games as provably fair when they aren't, it's bad for both players and casinos that are actually offering provably fair games.  The problem is, the average player just doesn't have a firm grasp of the provably fair concept.  They see 'seed' and 'hash' and just assume that that means it must be fair.

Anyway, I'm going to dig through my post history and make a list of all the sites I've come across that are currently doing this.  If anyone else comes across some that aren't on the list feel free to let me know and I'll update.  Maybe this belongs in scam accusations, I don't know.  I'm fine if it gets moved, but I'd prefer it stay here and the discussion revolves more around why certain methods that appear provably fair aren't.

Cryptoslots.com/Slotland.eu  (forum thread - they disappeared from the forum after I brought this up)
Slots: Sever Secret generates 9 outcomes, Server/Client hash determines which of the 9 outcomes is used.
Video Poker: Server Secret determines the order of the cards.  Server/Client hash determines where to cut the deck.
Source (archive)

Cryptsino.io (forum thread)
Video Poker: Server Secret determines the order of the cards.  Server/Client hash determines where to cut the deck.
Dice/3D dice: Server Secret determines "initial roll", Server Client Seed hash determines a number which is added to the server secret.
Slots: Server Secret determines initial state of reels, Server/Client Seed hash adjusts initial state.
source (archive)


Coins777.com (forum thread - owners response)
Video Poker: Server Secret determines the order of the cards.  Server/Client hash determines where to cut the deck.
Dice/3D dice: Server Secret determines "initial roll", Server Client Seed hash determines a number which is added to the server secret.
Slots: Server Secret determines initial state of reels, Server/Client Seed hash adjusts initial state.
source (archive)

Betabit.casino (forum thread)
Video Poker: Server Secret determines the order of the cards.  Server/Client hash determines where to cut the deck.
Don't see an explanation on their site, you have to verify a bet to figure out how it works.  

I haven't checked the following casinos myself, but they all have the same verbatim terms that include "When you open the game page the server generates a secret and a seed and Reveals its hash" (Identicle to 3 of the casinos already on the list) .  I believe they all use the same script, which is for sale here. (Thank you to Bitinity for posting this in another thread)

Satoshicasino.io
bet42bet.com
zilflip.com
safemars.casino
bigplay.casino
cryptodicecasino.com
e-casino-games.com
cindskillgame.com
winrw.de
woowoocasino.com
cryptomegamillions.com
upcasino24.com
milliontoken.games
winning4good.com
zerocryptopoker.com
cgame88.com
cryptocazino.com
slpcasino.com
everestbet.io
moonjackcasino.com
win-star.co
cash10.io
kasinobtc.com
stakeafrica.com
siraca.com
playtoearn.casino
luckytoken.casino
nulled.to

[1715344494]

1715344494

[1715344494]

1715344494

[1715344494]

1715344494

[1715344494]

1715344494

[1715344494]

1715344494

[timerland]

For sure.

I've also seen other casinos use random.org as a generator for their outcomes, and I've always stayed away from these sites.

Are there any caveats with using random.org within this process? Is there any provably fair that does not involve the traditional client-server seed combo?

[davis196]

I'm not an expert on the technical side of this problem,but I agree with your statement.
Casino owners must not lie to their customers.Being honest to your clients is a very important part of doing business.This applies to every business,not just the gambling business.
On the other hand,the people should be skeptical about all casinos and they should just play for fun and bet small amounts of crypto.Gambling with the assumption that you will make money and betting big amounts of crypto in slots/dice/hi lo games is a recipe for disaster.
At the end of the day,the casino always wins.It doesn't matter if the games are "probably fair" or rigged.

[Ryker1]

I'm not an expert on the technical side of this problem,but I agree with your statement.
Casino owners must not lie to their customers.Being honest to your clients is a very important part of doing business.This applies to every business,not just the gambling business.
^[snip]

Well, as a gambler you can check the provably fair system that they said of what algorithm they had been used.
Indeed, don't claim a provably fair casino if you don't show anything that your gambling casino uses this and as a gambler, we must have to verify first if the code is given was the right generated as and provably fair.
However, here is a great thread on how to verify provably fair or a Provably Fair Guide which is on this thread I fully understand how it will work and how it will be used. ^{[ https://bitcointalk.org/index.php?topic=5227525.0 ]}

[Beparanf]

I'm not an expert on the technical side of this problem,but I agree with your statement.
Casino owners must not lie to their customers.Being honest to your clients is a very important part of doing business.This applies to every business,not just the gambling business.
^[snip]

Well, as a gambler you can check the provably fair system that they said of what algorithm they had been used.
Indeed, don't claim a provably fair casino if you don't show anything that your gambling casino uses this and as a gambler, we must have to verify first if the code is given was the right generated as and provably fair.
However, here is a great thread on how to verify provably fair or a Provably Fair Guide which is on this thread I fully understand how it will work and how it will be used. ^{[ https://bitcointalk.org/index.php?topic=5227525.0 ]}

The problem is most of the gambler don't know or lazy to verify if the casino is really probably fair. The thread you share is very helpful and this is the first time to know that. Typically gamblers just trust the casino based on its reputation and not because of it's probably fair system.Using the word "Probably Fair" in the website details is a must for all casino since that's the only players need to know so that they can trust it. So we can't imply it to shady casino or casino that not using it since that is a norm on online casino business.

Marking all casino that lying and making it is the best thing that I saw on this thread and its really helpful. Maybe include the link of tutorial thread above for verifying if casino is really probably fair.

[BitcoinAccepted]

That's true. Some gambling sites use these words just to attract players and let them know that by playing on their website is safe. I also don't trust some built-in bet verifiers since they maybe fake too I think every players should know how to verify their bets in manual way or using third party to verify their bets.

[Pmalek]

Provably Fair is a buzz word. It's thrown around like other buzz words such as fully decentralized, anonymous, private, etc. The sites are just telling you what you want to hear. They know that the majority won't know the difference, or have the time and patience to research it themselves. Therefore, I don't think such claims will stop. They will keep making their rounds and get even worse.

The best thing to do is expose those who are lying and giving players the tools to check such claims themselves. 

[Sterbens]

Technically displaying all procedures in the fair category does not mean that the casino is fair. Nothing is 100% if there is no factual data about the justice that is applied. Casino scripts that do not fully prove the game can be called fair. All need a profit for the casino and they have to manipulate 5-10% for the survival of the casino.

There must be a favorable balance. Casino may claim that this is fair and such, but for gamblers the statement of fair casino is a commonplace thing that becomes a welcome promotion. Just look at all the casinos saying they are fair. But is it proven in general for those who lose bets and feel often unprofitable every time they gamble.

[Saint-loup]

I've been running into sites using similar methods to implement what appears to be a provably fair way to determine outcomes which could be manipulated by casino owners without detection.  What makes them different from provably fair games that are actually provably fair is the use of a 'server secret' which is a predefined state of the game (order of cards, a number to be rolled, slot reel positions, etc.) which is then manipulated according to the hashed client + server seeds.  The problem is, the 'server secret' is generated without any transparency - completely behind the scenes.  
[...]

It's not fully provably fair since it's not provably random but it's quite provably fair since they can't change the outcome depending on your final choice and you can check which outcome was the winning one each time at the end of the round. Then if they only create poor outcomes for you each time, you will quickly see it and notice that the true RTP of the game is way lower than the expected one. They could also try to analyze how you are playing from the previous rounds but it's up to you to change the way you are playing at anytime in order to defeat this kind of ploy.

[Screwing1100]

Yeah thats a great step taken by yours.this can let everyone know that what is provably fair,as i have seen many post here users have probelms with casinos that they got unfair bets.i was having bad strike at Duckdice.io i got almost 500 losses in row at 9.8% but they keep saying its provably  fair.and later they just paid me some loseback.becous it was unbelievable losing strike.
so yeah i would like to see what you can bring on this fairnes sht

[TimeTeller]

I'm not an expert on the technical side of this problem,but I agree with your statement.
Casino owners must not lie to their customers.Being honest to your clients is a very important part of doing business.This applies to every business,not just the gambling business.
^[snip]

Well, as a gambler you can check the provably fair system that they said of what algorithm they had been used.
Indeed, don't claim a provably fair casino if you don't show anything that your gambling casino uses this and as a gambler, we must have to verify first if the code is given was the right generated as and provably fair.
However, here is a great thread on how to verify provably fair or a Provably Fair Guide which is on this thread I fully understand how it will work and how it will be used. ^{[ https://bitcointalk.org/index.php?topic=5227525.0 ]}

The problem is most of the gambler don't know or lazy to verify if the casino is really probably fair. The thread you share is very helpful and this is the first time to know that. Typically gamblers just trust the casino based on its reputation and not because of it's probably fair system.Using the word "Probably Fair" in the website details is a must for all casino since that's the only players need to know so that they can trust it. So we can't imply it to shady casino or casino that not using it since that is a norm on online casino business.

Marking all casino that lying and making it is the best thing that I saw on this thread and its really helpful. Maybe include the link of tutorial thread above for verifying if casino is really probably fair.

The thread mentioned by Ryker is a really nice thread to bookmark, for those who want to verify their bets.
Also, it is in best interest of the casino owner not to lie about provable fairness of their system, because there are users who are really knowledgeable on how to detect if they are faking it or not.
So if they are found lying, that's not a very good image from their end. And their credibility will be ruined.
Though most of the time, we don't verify our bets especially if we are using reputable casinos here, but maybe, from time to time, just make random verification.

[Kakmakr]

I am so glad someone has the knowledge and balls to come out and to take on these claims. Some of these sites are using "Provably Fair" as a tagline and a industry standard ..as if it has no meaning. (Not a lot of people have the knowledge to question them) 

In gambling.. trust is everything.... we trust the site has the bankroll to honor the winnings and that the bets are fair, so this should not even be a talking point, but some operators still think all gamblers are idiots... and that they can get away with stuff like this. 

[TwitchySeal]

Then if they only create poor outcomes for you each time, you will quickly see it and notice that the true RTP of the game is way lower than the expected one.

It could be done in a way that was basically impossible to prove, and even if you did suspect something and were correct, I would expect you would be treated similar to the way the all too frequent 'I lost too much, it's rigged, you scam site!' player is treated.

They could easily decide to make it impossible for half the Royal Flushes and half the four of a kinds to be dealt and that would change the house edge of their jacks or better game from ~1% to ~4.5%

It would take hundreds of thousands of hands to have evidence of anything suspicious and millions to make a confident accusation.


Just added 28 more casinos to the list.

[Danydee]

 How about client seeds being leaked? a web html page need just some scripts to do so

 As OP said, when the "server secret seed" can be "manipulated" as much as wanted,  that's don't give any real insurance there

[notblox1]

I wrote before about some casinos OP mentioned, they are not provably fair and most of them are probably scam that are using exact same template.
You can find many of them on my topic List of Casinos and Sportbooks to Avoid:
https://bitcointalk.org/index.php?topic=5283832.0

[Danydee]

 What of creating an external open source tool to secure the randomization provided, even if it bet very well-known, casinos would be forced in some way to adopt it !


 It can be provided from an external server so no need of adding module or extension from the client side

[TwitchySeal]

 How about client seeds being leaked? a web html page need just some scripts to do so

 As OP said, when the "server secret seed" can be "manipulated" as much as wanted,  that's don't give any real insurance there

The client seed isn't something that needs to be kept hidden from either party.  As soon as you set it, the casino knows what it is.

What of creating an external open source tool to secure the randomization provided, even if it bet very well-known, casinos would be forced in some way to adopt it !


 It can be provided from an external server so no need of adding module or extension from the client side

Sha-256 provides all the 'randomness' needed I think.

I wrote before about some casinos OP mentioned, they are not provably fair and most of them are probably scam that are using exact same template.
You can find many of them on my topic List of Casinos and Sportbooks to Avoid:
https://bitcointalk.org/index.php?topic=5283832.0

Great thread.   

[nelson4lov]

Provably Fair is a buzz word. It's thrown around like other buzz words such as fully decentralized, anonymous, private, etc. The sites are just telling you what you want to hear. They know that the majority won't know the difference, or have the time and patience to research it themselves. Therefore, I don't think such claims will stop. They will keep making their rounds and get even worse.

The best thing to do is expose those who are lying and giving players the tools to check such claims themselves. 

Only problem here is that not all players have the technical skills or are technical enough to know which casinos are genuine with their claims and which aren't. I see the provably fair as a motto on almost all crypto casinos. Since I don't know how to verify those claims, I just end up sticking with casinos that has been proven to be provably fair and sticked with them.

[Danydee]

The client seed isn't something that needs to be kept hidden from either party.  As soon as you set it, the casino knows what it is.

Getting the "secret" on your side known by the house can let them doing any manipulation, drawing any result they want
in example if they detect you playing auto-bet will let them know the bets that will be placed

Sha-256 provides all the 'randomness' needed I think.

I mean a tool that will be hold externally to prevent any manipulation from the casino
For example with using an extension/tool, which will encrypt the (secret of yours/on your side) and prevent casino accessing it
It will be able to hold all the randomization process, so avoid any manipulation/falsification from the casino

With an external online tool hold independently in an external server, the casino would have to just set at one time the process that needs to be followed

[TwitchySeal]

The client seed isn't something that needs to be kept hidden from either party.  As soon as you set it, the casino knows what it is.

Getting the "secret" on your side known by the house can let them doing any manipulation, drawing any result they want
in example if they detect you playing auto-bet will let them know the bets that will be placed

There is no secret on your side. When you set your seed, they know what it is right away - they use it to determine the outcome.  They have to set their seed first though, which is what prevents them from making any changes after you set yours.  The only real secret there should be is the unhashed server seed - if the player were to know that then they would be able to figure out the exact outcome of every bet ahead of time.  The casinos I listed are adding another secret, one that the player has no ability to influence or even confirm how it's created.