How 999dice.com is stealing your coins, and exactly why you won't believe me

[trixter]

Putting hash on "static", standalone page would mean they use same seed for every player and disclose it every day/ hour etc.
999dice generates new seed every roll

There is a bitcoin casino that publishes what the next will be with every bet.  They have multiple fields stating what the last one was and what the next one is.  This could be done anywhere, even if its separate on a per user per roll basis. 

999dice clearly does cookie tracking to identify users or you would not be able to have a balance without ever logging in or creating an account.  They have 4 cookies, AccountID, LastBetCurrency, Language and SessionID.  They also have an indexed DB which I think but have not confirmed is just used for  some functions that are exposed. 

Because of the AccountId cookie it would not be hard to know who  you are talking to and since they use MSSQL they could store what the next would be there or just make it part of the session so if you abandon it its gone.  Either way they could make it easier to  have a dynamic but displayed next seedHash. 

Its all about how the developer chooses to make this information available.  If this was not the scam before after this thread I am sure that there will be some that try it. 

[m3]

This guy just will not stop. So newsBTC wrote an article about them, then decided to remove it:




My theory is that this "Jake" guy sent them a message threatening them. Here is the message he sent me and my reply. God these scumbag scammers juts never stop this reminds me of Josh Garza and his bullshit accusations about coinfire and his legal threats. This guy has the audacity to go after me claiming that I am participating in extortion. Maybe we should all go after him for running an illegal gambling site for US citizens.

[busterroni]

Is this an email to newsbtc? How did you get a screenshot of it?

[keepinquiet]

WOW. Holy. Fucking. Shit.

Seriously? NewsBTC removed the article? I just googled it. Clicked the link. It's gone.

WOW.

What a spineless pile of scumbags. Extortion? Really? It's not extortion...

Here, let me tell everyone about the "extortion" I engaged in:

Hey, Jake, you stole from me, give me my bitcoin back or I expose your bullshit scam everywhere!

Yes, clearly "extortion".

You steal from someone, they demand you return it, and now, apparently, thats extortion.

Hey, NewsBTC, way to have a spine, you worthless assholes.

Yes, I'll say that in public. You are a bullshit worthless news agency if you publish a story, then remove it, because an anonymous scammer threatens you.

[trixter]

... this reminds me of Josh Garza and his bullshit accusations about coinfire and his legal threats.

In all fairness I believe that the "anonymous source" is fake.  The documents were for another case with just the name changed.  Coinfire did not do proper due diligence before posting a defamatory story which does open up a tort claim.  I say this as a law student.  I am not a lawyer, I am certainly not *your* lawyer.  This is not legal advice.  

[keepinquiet]

For the record - I am completely, absolutely, not shocked.

The ability of people to believe crap "authority" tells them is without end. Admin writes back and says I'm extorting him, ACTUAL NEWS articles on a NEWS WEBSITE are removed.

I swear to god. I should start up my own scam-and-steal-from-you-site. The scammer sites receive more trust and support than those who were stolen from.

The site is designed to force you to request the hash on every roll. And there are people who honestly believe this shit.

.1% edge.

2000+ BTC profit (claimed)

And I'm an extortionist.

Absolutely stunning.

[joter85]

Try playing on www.crypto-games.net
Our system is 100% fair. There is no way for us to cheat, you can check seeds of every bet made in past!  

* By "not me" I mean I have to be logged in/have my cookie sent to the server to see the seed. Its impossible to load the seed without telling the server I'm looking at it. Since the seeds are individual per user and not static for the site for the day, I have to identify myself to see the seed, thus leaving room for the possibility of cheating.

Yes that is true. Next server seed (SHA256) can only be seen if user clicks on provable fair page. We will add it in every AJAX response from the server, so it won't be shown only on demand. Thanks!

[trixter]

Extortion? Really? It's not extortion...

I concur.  
18 USC 1951

The term “extortion” means the obtaining of property from another, with his consent, induced by wrongful use of actual or threatened force, violence, or fear, or under color of official right.

Fear includes fear of economic harm.  Legally speaking saying "pay up or I will sue" is extortion  which is why debt collectors say "under the law we have the right to sue" or something similar to make the threat in a legal way.  

Color of official right is like a cop saying "pay up or I will cite you with something".

There are many cases where news reporting of truthful statements is 100% legal.  The news can even quote someone who is completely wrong so long as  they make it a quote and do not just parrot what is said as if its fact.  Even in defamation cases (which is the best he could go for) which comes from tort law which is common law which dates back to about the 1400s England (before that defamation didnt really exist as a claim) truth is always a defense.  Reporting that someone else is saying something would absolve  them of any liability.  That is a truthful statement easily proved because they linked to this thread.  Now they can go after the OP of this thread and require the OP to prove his claims of cheating or pay up for a defamation case.  Caveat: opinions dont count.  saying "I think they are cheating" is not defamation, saying "they are cheating" is unless its true.

I doubt that will happen though.  Tort law includes emotional distress and how many internet trolls have you seen sued?  Man I would love to be the lawyer that gets that class action lawsuit.  Parasitically attach to the websites hosting the trollfests under the same premise that landlords have to put locks on the common areas in high crime areas because they are responsible for securing against harm to tenants.  I would win all the internets!

None of this is legal advise, I am a law student not a lawyer and certainly not *your* lawyer.  Saul Goodman is my hero.

[rivoke]

I have lost over 5 btc to 999dice.  It definately seems like a scam in the way that if you need a crucial win to recover it will roll the opposite side or just out of range conveniently.  Even after an improbable loss streak.

This was after I reached max payout on 250+ losses.  I tried to recover at maxpayout and lost another 830k doge after losing 400k doge.   I knew I shouldn't have chased this loss but it just seeems a bit ridiculous.

http://prntscr.com/62shxu

With a 5% chance of win thats not improbable at all

[alani123]

OP, since 999dice's admin honored you with an entire page with your name please accept my apologies for my last post here. I was doubtful but proven wrong.

But allow me to comment that I find wrong in both yours and the admin's actions. While he did warn you to not deposit there again, you didn't listen. Him confiscating your coins right after is nothing more than outright theft though. If revealing this scam is your last resort to find justice I wish you luck. I hope those losses won't cause any serious problems in your life.

[keepinquiet]

Try playing on www.crypto-games.net
Our system is 100% fair. There is no way for us to cheat, you can check seeds of every bet made in past!  

* By "not me" I mean I have to be logged in/have my cookie sent to the server to see the seed. Its impossible to load the seed without telling the server I'm looking at it. Since the seeds are individual per user and not static for the site for the day, I have to identify myself to see the seed, thus leaving room for the possibility of cheating.

Yes that is true. Next server seed (SHA256) can only be seen if user clicks on provable fair page. We will add it in every AJAX response from the server, so it won't be shown only on demand. Thanks!

Thanks for the transparency. Going above and beyond to prove fairness and legitimacy, I hope, will bring you a lot more business.

[keepinquiet]

I doubt that will happen though.  Tort law includes emotional distress and how many internet trolls have you seen sued?  Man I would love to be the lawyer that gets that class action lawsuit.  Parasitically attach to the websites hosting the trollfests under the same premise that landlords have to put locks on the common areas in high crime areas because they are responsible for securing against harm to tenants.  I would win all the internets!

None of this is legal advise, I am a law student not a lawyer and certainly not *your* lawyer.  Saul Goodman is my hero.

Well first off, an illegally operating bitcoin gambling site illegally doing business with someone in the US very likely has absolutely zero chance of winning any lawsuit anyway, given, oh, the fact they are operating illegally. So I'm not sure why anyone would worry. As for the removed news story, well, it just speaks to the journalistic integrity there, as well as their knowledge of journalism.

They were quoting what I said. How that makes them party to "extortion" is beyond me.

And if Saul Goodman is your hero - look me up when you pass the bar.

[keepinquiet]

Wrote a script to defeat any potential cheating on 999dice.com. It pulls the hash before every bet. Doesn't do multibets yet, but if you look at it, it should be simple to do. I'll work on that lateron.

It's over here: https://bitcointalk.org/index.php?topic=950605.msg10407384#msg10407384

[trixter]

I have lost over 5 btc to 999dice.  It definately seems like a scam in the way that if you need a crucial win to recover it will roll the opposite side or just out of range conveniently.  Even after an improbable loss streak.

This was after I reached max payout on 250+ losses.  I tried to recover at maxpayout and lost another 830k doge after losing 400k doge.   I knew I shouldn't have chased this loss but it just seeems a bit ridiculous.

http://prntscr.com/62shxu

With a 5% chance of win thats not improbable at all

5% odds is .05*.05*.05 ...  to figure out the odds of consecutive losses.  Even  the best Martingale strategy will eventually lose because it will take infinite funds on a particularly bad losing streak.

[trixter]

And if Saul Goodman is your hero - look me up when you pass the bar.

if you want a lawyer like that why wait?  hire me now

[dooglus]

Similar to JustDice who used to have server provided client hashes unless you forced a randomization on your client
https://bitcointalk.org/index.php?topic=482855.0

No, Just-Dice constantly displays all relevant seed information on the 'Fair?' tab, and keeps it constant until you request for it to be changed.

That is in no way similar to 999dice knowing whether you have seen your seed hash or not. Just-Dice knows that you can been sent all your seed information before you make any rolls and so can never risk cheating for fear of detection.

tldr: at 999dice you have to specifically ask to receive your server seed hash and it constantly changes. at JD there's no way to not receive your server seed hash and it only changes when you ask it to

[paradoxal420]

Similar to JustDice who used to have server provided client hashes unless you forced a randomization on your client
https://bitcointalk.org/index.php?topic=482855.0

No, Just-Dice constantly displays all relevant seed information on the 'Fair?' tab, and keeps it constant until you request for it to be changed.

That is in no way similar to 999dice knowing whether you have seen your seed hash or not. Just-Dice knows that you can been sent all your seed information before you make any rolls and so can never risk cheating for fear of detection.

tldr: at 999dice you have to specifically ask to receive your server seed hash and it constantly changes. at JD there's no way to not receive your server seed hash and it only changes when you ask it to

This. I thought it was pretty fucking weird that you have to click a button to see your server seed hash.

I found something kind of odd in the JS.

$.connection.mainHub.server.setClientSeed

I'm pretty sure they send your client seed to them.. lol why would they need to have this function when its sent as a parameter in the raw bet request?

[dooglus]

I've received requests from people in the past to look into 999dice's provably fair system but I never got around to doing so. I'm sorry now that I didn't.

Withholding the server seed hash until it is explicitly requested is dubious behaviour. It allows the site to cheat on all rolls except those for which the server seed hash has been requested, which will be almost all of them.

Changing the server seed for each individual roll in itself is bad enough, since it requires the user to keep extensive records and also to change their client seed every roll to be sure that they aren't being cheated. Add the hiding of the server seed hash on top of that and you really do have to wonder what's going on. Why would anyone go to such lengths to hamper their provable fairness?

Of course none of this is proof that any cheating is going on, much like how having to let your boss know when you take the afternoon off doesn't prove that he's doing your wife. But when every other company in town lets you come and go as you please without notification you have to wonder what he is trying to hide.

Also, with so many sites struggling to make a profit with a 1% house edge how does 999dice manage to profit so well with only a 0.1% edge? Players should demand an overhaul of the probably fair system as soon as possible. Ideally players will be able to verify their rolls with very little effort. Using a single client/server seed pair for as many rolls as the user likes (pioneered by Just-Dice.com in June 2013) is the industry standard.

[trixter]

Players should demand an overhaul of the probably fair system as soon as possible. Ideally players will be able to verify their rolls with very little effort. Using a single client/server seed pair for as many rolls as the user likes (pioneered by Just-Dice.com in June 2013) is the industry standard.

There are some wiki pages and all but if there was a page that detailed how to properly do provably fair and flaws in every implementation known (without naming names on *that* page they can go somewhere else) along with detailed information why its not provably fair it would educate site operators as well as users and allow for better validation of provably fair claims.

For example 999dice is not "provably fair" because you cant prove its fair when you dont click the  button.  It might be fair but its not provably fair.  That is the distinction I am trying to make with the suggestion for the wikipage possibly on bitcoin.it or somewhere else that can become a public repo of knowledge on the subject.

I  think bitzino was one of the first to do provably fair systems and has some fairly detailed information about how they generate things.  https://bitzino.com/about/fair  

Casinos can be profitable as long as there is a house edge.  Short of the player cheating there would never be a break even for the player and over  time, over an aggregate amount of users the casino wins.  Even the best betting strategy will eventually crumble, although short term wins of sufficient size could pose problems for the house bank.  

The libertarian in me says that it is the players choice, if that is how they want to spend their entertainment dollars that is their choice.  The indian in me says woohoo casino profits pay for my health care, undergrad college and some other things.  Although sadly not graduate studies in law (only medicine/dental and then under strict conditions) so law school is all on me.  god I need a job.

I think that the laws that forbid gambling are legislated morality which never works out.  The US really should embrace internet gambling and stop having the silly rules.  Although I do see some progress in this. sports betting is illegal period under the federal wire act, other betting is legal if address verification is done to ensure same state as the site, age verification, and the site is registered with the state like any brick and mortar casino (which means the gambling commission can certify fairness in the games, which includes a full source code review for e-games like  slots and verified sealed (sticker) eproms containing the firmware).  This is actually progress which generally forbid it before 2006.  Maybe in a few more years they will open it further seeing how desperate they are for taxes.  Pushing it underground just encourages more scammers, fraud, deceit, unfair rules, illegal debt collection practices, etc.  Let hte people decide for themselves what is acceptable and what isnt on a personal level and the people that try to force laws to make everyone conform to their personal life choices need to stfu and go away.  

Hey at least with  the 2006 internet gambling act the gambler cant get into trouble and generally only the site management or those that facilitate the sites operation can if they are US based or US citizens.  Protip: dont hide the money source, pokerstars or whomever it was got money laundering charges because they listed credit card deposits as a purchase of goods instead of what it was.  Although  they would have gotten into troubles for  taking credit cards anyway.  That is one of many possible laws that has caused Coinbase to ban accounts that send BTC to known gambling addresses, with  their regulated exchange the fact they accept credit cards and possible status as a money transmitter  they need to be squeaky clean and cant have people using their webwallets for that or they can go down.  I think that is a side effect of the law but it is the law unfortunately.

[MICRO]

I've received requests from people in the past to look into 999dice's provably fair system but I never got around to doing so. I'm sorry now that I didn't.

Withholding the server seed hash until it is explicitly requested is dubious behaviour. It allows the site to cheat on all rolls except those for which the server seed hash has been requested, which will be almost all of them.

Changing the server seed for each individual roll in itself is bad enough, since it requires the user to keep extensive records and also to change their client seed every roll to be sure that they aren't being cheated. Add the hiding of the server seed hash on top of that and you really do have to wonder what's going on. Why would anyone go to such lengths to hamper their provable fairness?

Of course none of this is proof that any cheating is going on, much like how having to let your boss know when you take the afternoon off doesn't prove that he's doing your wife. But when every other company in town lets you come and go as you please without notification you have to wonder what he is trying to hide.

Also, with so many sites struggling to make a profit with a 1% house edge how does 999dice manage to profit so well with only a 0.1% edge? Players should demand an overhaul of the probably fair system as soon as possible. Ideally players will be able to verify their rolls with very little effort. Using a single client/server seed pair for as many rolls as the user likes (pioneered by Just-Dice.com in June 2013) is the industry standard.

Yup ,and every serious site is accepting jd provably fair system.

It isn't perfect , but its the best out there for now.