bitZino - Bitcoin Casino - Blackjack, Roulette, 3 Card Poker, Slots and more!

[joae1975]

Any comments on this, libertaad:

http://www.reddit.com/r/Bitcoin/comments/1frm4x/provably_fair_by_bitzino_not_provable_with/

hmm, I've seen the roulette wheel spin indefinitely.  Cards not being dealt.  Then it pops a window, "please check your internet connection."  Funny, my other computers are connected just fine.

[libertaad]

Any comments on this, libertaad:

http://www.reddit.com/r/Bitcoin/comments/1frm4x/provably_fair_by_bitzino_not_provable_with/

Thanks for the heads-up!

Here's my response:

Creator of bitZino here. Thanks for writing this post, TrevorXavier! I firmly believe that the best cryptography is that which is practiced in the open, with honest and open discussion about any possible weaknesses or avenues of attack.

I've read through your entire post, and I believe that at the core, you are discussing two main issues you see with our provably fair system:

The first issue is that of "stalling". In the rare event that our servers do fail to respond (either due to internet connectivity issues, or downtime on our end), this problem can easily be mitigated by a player by simply ensuring the `Hash(secret)` has not changed, and then re-entering the same `client_seed` after reloading the page.

The second issue is that of tainting the javascript that is being executed on the player's browser (Cold Deck, Hot Reading, Mutation, and Controlled Secret all fall under this). I do agree that if we managed to slip dirty code past our users, these are potentially viable attacks. However. these are all very high-risk frauds to perpetrate, because if we were caught doing this, even once, we would completely sacrifice our reputation and future earnings potential.

Furthermore, these attacks are all relatively easy for a savvy user to detect. Since modern browsers come with built-in network analysis tools, it is easy for anyone to see all data being sent down the wire. These tools would make it very easy to detect if we tried to sneak javascript partials into ajax requests.

Ultimately though, a player can be protected from all of these attacks by running a client-side greasemonkey script which generates the client_seed (rather than relying on any code sent from our servers). And, in fact, this is already possible today due to the nature of our app being in HTML5. We have already seen a handful of our players doing this on their own (we can detect it because the client_seeds they send are formatted differently than the ones our javascript generates). Additionally, if a player just edits the client_seed by hand before they play, they are also protected from any of the attacks you listed.

At the end of the day, we still haven't fully solved the trust issue of browser-based cryptography. But, our system still accomplishes its goal - it forces us to either be honest, or take a large risk. We simply have no way to manipulate the outcome of any wagers made on bitZino without taking a risk of being caught. That's why our system is indeed provably fair: it allows savvy players to ensure the house isn't cheating them.

Thanks again for the insightful post!

[Cogine]

You guys happen to be down at the moment?
Created an account, played for about 30min, now unable to load the page.
Am able to Ping and TraceRoute the site.

[joae1975]

You guys happen to be down at the moment?
Created an account, played for about 30min, now unable to load the page.
Am able to Ping and TraceRoute the site.

http://www.downforeveryoneorjustme.com/

It's down

[AvL42]

You guys happen to be down at the moment?
Created an account, played for about 30min, now unable to load the page.
Am able to Ping and TraceRoute the site.

same here...

[GlenBot]

Same here.  Wish I'd thought to check if the site was up before I sent my 0.05 BTC.  Hope they come back up, I love bitzino!

Bitzino username = mrbtc

[KingOfSports]

Guy has been around for a long time, hes made over 100 BTC from players, I highly believe you guys have nothing to worry about. Probably just a server crash.

[spike420211]

Quik Q:
minimum bet for Video Poker?

[libertaad]

I am very sorry about the downtime. We had some unexpected hardware failure.

We are now back up and fully operational. All deposits made during the downtime have been successfully credited to everyone's accounts.

[libertaad]

Quik Q:
minimum bet for Video Poker?

The minimum bet for all games is 0.000001 BTC (1 micro-BTC)

[spike420211]

Quik Q:
minimum bet for Video Poker?

The minimum bet for all games is 0.000001 BTC (1 micro-BTC)

worx 4 me

[BitCoinPokerBro]

I have lost round about $100 @ bitzino in the last month. Mostly all from my own stupid mistakes. Love the site though

[stslimited]

regarding the roulette game, how does having the client seed and hash(secret) prove that it is a provably fair game?

thanks

[libertaad]

I have lost round about $100 @ bitzino in the last month. Mostly all from my own stupid mistakes. Love the site though

I'm glad you're enjoying the site! Please let me know if there's anything we can do to improve!

regarding the roulette game, how does having the client seed and hash(secret) prove that it is a provably fair game?

thanks

Our provably fair process is explained on our website at https://bitzino.com/about/fair, and in technical depth on our tech blog.

At a high level though, here's how it works: the `client_seed` is generated by you or your browser before every hand is played, and is not known by our servers. This `client_seed` is then sent to our servers at the same time that a new hand is started. Our servers reshuffle the deck using the `client_seed` (Roulette uses a modified deck of cards, it's just a 37-card deck, with each card representing a number on the wheel. The top card is used to determine the outcome of the spin). After the hand is over, the `secret` is revealed, and you can verify both that the `Hash(secret)` correctly hashes to the `secret`, and that the `client_seed` was correctly used to reshuffle the deck. Because we had no way of knowing what the `client_seed` was before the hand started, there is no way for us to manipulate the outcome of the final shuffle.

I hope that helps!

[Wolf Rainer]

This site is scam, 47 times without getting the second dozen in the roullete... Its IMPOSIBLE.

[dooglus]

This site is scam, 47 times without getting the second dozen in the roullete... Its IMPOSIBLE.

>>> 1/((25/37.0)**47)
100531143.74551594

It happens about once every 100 million spins.  Could it be you miscounted though?  BitZino customer support can provide you a history of your play if you contact them.

[Wolf Rainer]

This site is scam, 47 times without getting the second dozen in the roullete... Its IMPOSIBLE.

>>> 1/((25/37.0)**47)
100531143.74551594

It happens about once every 100 million spins.  Could it be you miscounted though?  BitZino customer support can provide you a history of your play if you contact them.

Yes once every 100 millons but it do not happened to me when i bet 0.0000X btc, it happened to me when i was beting hard... So im the luckiest cause i played thosen of hand in the roullete at bitzino, but just when im beting hard, there it comes the 1 in 100 millons "IM TAKING YOU MONEY, ENJOY THE SCAM".

I made $160 with the $10 free bonus no deposit of https://strikesapphire.com/ with the roullete, so the owner of that casino ban me cause i was making he to lose a lot of money,  so i went to bitzino with my money (the $160) to keep winning, but guest what happend? 47 hands without winning playing the same dozen... How it is posible to multiply 16 times my money in 2 hours in one casino and lose it all (playing the same amounts than before), in just 10 minutes in other casino playing the same game (roullete) in the same way?

In the other bitcoin casinos it was strange to lose more than 8 times playing the same dozen, and it was OMG unique to lose more than 15 times, but I NEVER, repeat, NEVER (playing in real life casinos and online, for more than 6 years) NEVER see a roullete without giving a dozen in more than 20 turns, NEVER, and here it was 47!!! how the hell?

[libertaad]

This site is scam, 47 times without getting the second dozen in the roullete... Its IMPOSIBLE.

Hi Wolf, Can you please let me know your username on bitZino so that I can pull up your hand history? I'm really curious to see this streak. You're also welcome to reach out to our support team (https://bitzino.com/support) if you'd like to get your hand history privately sent to you.

Our provably fair system for shuffling the cards (which you can read about at https://bitzino.com/about/fair) makes it impossible for us to manipulate the outcome of any wagers without being detected. This ensures that the outcomes of random events in games on bitZino are truly random. So, while it is possible for a streak this long to occur, it is highly unlikely, and I suspect there were actually a few wins in there that you might have missed. Either way, I'm very curious!

[dooglus]

I made $160 with the $10 free bonus no deposit of https://strikesapphire.com/ with the roullete, so the owner of that casino ban me cause i was making he to lose a lot of money

Join the club!  He banned me too, and all my friends.  I think it was because I was being annoying though rather than because I was winning too much, although I suspect he may have tolerated me better if I was losing instead of winning. 

[ssaCEO]

I made $160 with the $10 free bonus no deposit of https://strikesapphire.com/ with the roullete, so the owner of that casino ban me cause i was making he to lose a lot of money

Join the club!  He banned me too, and all my friends.  I think it was because I was being annoying though rather than because I was winning too much, although I suspect he may have tolerated me better if I was losing instead of winning. 

You know, "Wolf" aka Juan Pablo Domenez -- I'm really glad you brought this up in a public forum, because now I can publicly denounce you as a scammer.

The situation with Dooglus -- who is the only person ever to complain of being banned from our casino "for winning" -- is different. Doog here did not try to open 10 accounts in one hour to milk a no-deposit bonus. But you did.

Regardless, we gave you free money to play in our casino, and paid you out winnings AND THEN BANNED YOU. What kind of scam would that be? If we ban you, it means we can't and will not take your money.

But let's rewind. A few days ago, we offered a no-deposit bonus for the first time in half a year. You came onto our site, took $10 and rolled it into $160 or so. Great, no problem. You requested a withdrawal, and we immediately paid you out. Then we noticed (before you complained about it) that your account had been frozen by our system. This only happens when someone tries to sign up twice in a day or two from the same IP address. You wrote and said that your brother had tried to sign up. So we unfroze your account and warned you that it was one bonus per IP.

Within the next 10 minutes, we had 9 more signups from fibertel in Buenos Aires, Argentina (your provider), in your local IP range. All of them used the same password (the hash is the same). All of them took the bonus and then logged out. Two of them shared IP addresses with other, earlier accounts. It turned out that one of those old IPs had taken our last no-deposit bonus six months ago, and guess what the name was on that account? Juan Pablo Domenez.

Brilliant work.

So you have now opened 13 accounts on our website. One lost its no-depo bonus. One never did anything. One made $160. The other 9 were trying to hold onto the $10 to play for the future.

When you first won, I congratulated you personally and even asked you to be an affiliate for us. And you will not debate that we paid you out immediately. But when we realized what you were doing, you then had the nerve to complain that we had banned you for winning -- and you cited Dooglus as an example. I am sure that Dooglus will tell you, we do not fail to pay our debts, and that in this case your ban had nothing to do with your win. You are a roulette player and we have absolutely no reason to ban you. IF in fact you lost all these times in a row, as you're now claiming (which is another lie), then tell me how you turned $10 into $160. Tell us about your brother and how you just told a bunch of your facebook friends to sign up last night. I've heard one stupid, idiotic lie after another from you since you scammed our bonus system, and STILL we paid you out and we didn't ban your account until today, when we confirmed that you had taken a previous no-deposit bonus.

You are a scammer, pure and simple. Dooglus is an advantage player and that is _not_ why we banned him, and he knows that. It had to do with inconsistencies in IP addresses, but it was nothing like the stupid, low level crap you've tried to pull.

Go on and rage against us, I don't care. I have the proof from your IP addresses and you're toast as far as we're concerned.