How 999dice.com is stealing your coins, and exactly why you won't believe me

[dooglus]

Yup ,and every serious site is accepting jd provably fair system.

It isn't perfect , but its the best out there for now.

What makes it look even worse is that 999dice is clearly "inspired" by Just-Dice - the site design is uncannily similar - and yet somehow they managed to mess up their provably fair system so much that they can cheat undetectably unless the play goes out of their way to click an extra button before every roll they make.

It's a little hard to believe that such a reduction in provable fairness would happen accidentally.

[pozmu]

Changing the server seed for each individual roll in itself is bad enough, since it requires the user to keep extensive records and also to change their client seed every roll to be sure that they aren't being cheated.

Good point.
On first look it may seem to be a good thing as it make everything more random.
But you're 100% right with the fact that you need to change client seed with every new server seed, which in 999dice case = every bet.

[trixter]

It's a little hard to believe that such a reduction in provable fairness would happen accidentally.

People have messed up crypto even by almost cloning good implementations on accident leading to compromises.  If they do not understand why publishing the hashes are important then they may not consider it bad to stick it out of the way to avoid the clutter of information many average people just  wont understand.

real life example: CEX messed up crypto for their API, it is a HMAC done by someone who does not understand what all HMAC is supposed to do.  They use it just to authenticate a user not the user+message.  The message itself is never HMACed and thus could be altered in transit (sha1 ssl cert not withstanding and while sha1 is broken and has been for  years no "in the wild" attack has been discovered and broken means different things to cryptographers than average people although sha1 is pretty bad).

Sony and some Bitcoin  wallets with weak random in ECDSA is another good example.  Although Sony was worse because it was not just a  group of related transactions it  was many transactions separated by a large time window.  There are something like 300 weak r wallets out there.  Most addresses havent been used in years though.  A few are still in use with instant withdraws on  the few thousand satoshi transmitted through at infrequent intervals.  No idea if someone is sweeping coins or if the legit wallet owner is transferring but the transfers out come in within 1 second of the deposit.  Last transaction I saw on a weak r wallet was Jan 31, 2015 for 6000+ satoshi.  Oh I stand corrected Feb 8, 2015 for 6717 satoshi.

End result by effectively cloning a REST API they have done it in a way that its horribly broken.  Other examples include some other crypto libraries where it tries to short circuit the encryption and returns early upon a mismatch.  Timing attacks then ensue and you just brute force the password one character at a time until you have it.  This is akin to an oracle attack on crypto which is another example of how good crypto can be improperly implemented merely by different error messages or return values.

I can see it being innocent that 999dice just thought they would move the cruft to the side without thinking about the effects - effectively removing "provably" from "provably fair".  Either they are clever cheaters or of a more innocent mind that they do not see the potential for evil in the implementation.   Without knowing more about the specific individual (not the speculated one and then more than "well he is a known scammer" not all con artists are the same) it is hard to tell.

[trixter]

Changing the server seed for each individual roll in itself is bad enough, since it requires the user to keep extensive records and also to change their client seed every roll to be sure that they aren't being cheated.

Good point.
On first look it may seem to be a good thing as it make everything more random.
But you're 100% right with the fact that you need to change client seed with every new server seed, which in 999dice case = every bet.

Total fairness can never go to 100%,  you can approach 100% but never actually reach it.  This example is just to illustrate why it cant be 100%.  However the closer you get to 100% the more likely the server is not cheating. 

The server can pregenerate about half of the potential client seeds.  In 999dice's case that would be 32 bits which would take about 1 hour on an Intel ivy bridge.  GPU farms could potentially cut this time.  Important note for non-crypto people the other half takes a much longer time, each bit doubles the time so its not 2 hours for the whole space.  Using a pre-generated pairing they could issue server keys based on probability  that they will win skewing odds in their favor.

The risk of cheating, even in an otherwise provably fair system is > 0%. 

The cost of mounting this attack in a practical way would make it less probable.  In fact I believe this attack would not be likely at all.  They would only have a small pool of server seeds that they have pregenerated and people would continually see the same ones and that would give them away.


The reality is that the more a site strives to reach 100% provably fair the more likely they are being fair. 

[dooglus]

The server can pregenerate about half of the potential client seeds.  In 999dice's case that would be 32 bits which would take about 1 hour on an Intel ivy bridge.

I tried clicking their checkbox for manually entering client seed but nothing happened. How can they be limiting it to 32 bits? That's just 4 bytes.

This again could be an innocent mistake, but really, why would you limit the client seed to something easily bruteforced if your intention was to make a provably fair game?

The reality is that the more a site strives to reach 100% provably fair the more likely they are being fair. 

If you copy an existing provably fair site and change the provably fair system in at least 3 different ways to make it less provably fair, then what are the odds that you made all three changes innocently?

1) change the server seed every roll, requiring the user to change their client seed if they want provable fairness
2) hide the server seed hash behind a button so you can tell which rolls are possibly being verified and which aren't
3) restrict the range of possible client seeds to just 32 bits

It's still possible that the site is running an honest game and it's just unfortunate that they made three unfortunate mistakes in their provably fair system. It's also possible that they knew full well what they were doing, and used it to cheat careless players.

Their theoretical edge is 0.1%, but their actual profit is closer to 0.4%, 4 times higher than it should be. That's also possibly entirely innocent.

Like I say, I would recommend not playing there until they fix things.

[keepinquiet]

I've received requests from people in the past to look into 999dice's provably fair system but I never got around to doing so. I'm sorry now that I didn't.

Withholding the server seed hash until it is explicitly requested is dubious behaviour. It allows the site to cheat on all rolls except those for which the server seed hash has been requested, which will be almost all of them.

Changing the server seed for each individual roll in itself is bad enough, since it requires the user to keep extensive records and also to change their client seed every roll to be sure that they aren't being cheated. Add the hiding of the server seed hash on top of that and you really do have to wonder what's going on. Why would anyone go to such lengths to hamper their provable fairness?

Of course none of this is proof that any cheating is going on, much like how having to let your boss know when you take the afternoon off doesn't prove that he's doing your wife. But when every other company in town lets you come and go as you please without notification you have to wonder what he is trying to hide.

Also, with so many sites struggling to make a profit with a 1% house edge how does 999dice manage to profit so well with only a 0.1% edge? Players should demand an overhaul of the probably fair system as soon as possible. Ideally players will be able to verify their rolls with very little effort. Using a single client/server seed pair for as many rolls as the user likes (pioneered by Just-Dice.com in June 2013) is the industry standard.

This. Absolutely, positively, completely, this. Every word of it is exactly what I am saying. Wish to god your site still took BTC. Really don't feel like effing around with 'clams'.

And, when I was writing my script to neuter 999dice (posted in the other thread, look for the link on page 4) I found it VERY difficult to set the client seed. The damn input box doesnt even have a name.

The way 999dice "records" your personal client seed is there is a form input type=text box, with no name, and, also, no id tag. You have to reference it by the the span it's inside.

Then, the ONLY way the client seed gets updated on the server is when that box loses focus. No submit, no change event, it's a lose focus event.

Know what that means? If you change it, and do NOT click outside it, and then click a bet button, there's a damn good chance that your bet is processed BEFORE the client seed change is processed.

Look at my code in the other thread. It takes FOUR lines of code to update the client seed. I need to set it in two places, in a roundabout way, then specifically call a server update function.

WHY is it so difficult to update the client seed? Why is the updating done on a losefocus event?

The full weight of that didn't dawn on me until just now.

New account, I can still only post once every 10 mins. Adding this here an an edit instead:

Yup ,and every serious site is accepting jd provably fair system.

It isn't perfect , but its the best out there for now.

What makes it look even worse is that 999dice is clearly "inspired" by Just-Dice - the site design is uncannily similar - and yet somehow they managed to mess up their provably fair system so much that they can cheat undetectably unless the play goes out of their way to click an extra button before every roll they make.

It's a little hard to believe that such a reduction in provable fairness would happen accidentally.

Don't forget - when the player DOES go out of his way to click that button every time, he gets banned.

I lost 207 BTC. I call the admin out on the BS 'tell us you're verifying' scam. I verify EVERY bet. I start winning. I am banned.

A 2 year old could connect those dots.

[trixter]

If you copy an existing provably fair site and change the provably fair system in at least 3 different ways to make it less provably fair, then what are the odds that you made all three changes innocently?

1) change the server seed every roll, requiring the user to change their client seed if they want provable fairness
2) hide the server seed hash behind a button so you can tell which rolls are possibly being verified and which aren't
3) restrict the range of possible client seeds to just 32 bits

It's still possible that the site is running an honest game and it's just unfortunate that they made three unfortunate mistakes in their provably fair system. It's also possible that they knew full well what they were doing, and used it to cheat careless players.

I can see #1 being "it makes it more secure" or some such thinking that clients will not be able to brute force.  This would be especially true with people that do not fully understand crypto or how to calculate how long it would take.  Other sites change that for every client every roll and are provably fair.

I can see #2 being move the cruft and clean the interface.  *especially* if a dev does not understand the implications and believes that few if anyone will ever verify as a result most people do not want to see it.  I can even see feedback to site operators suggesting such a move by people who do not understand the implications.  If you did not know what it was or never were going to be bothered checking would you even know to complain that it was not there?  I suspect that is the vast majority of people in the world.

#3 is actually 64 bits.  If I said 32 I was wrong.  According to the sql purportedly used by the site to do the wager it is 8 bytes.  32 bytes for the server seed.  The 32 bytes truncates the longer server seed though.

however if they are doing all of this to cheat there was a lot more planning that went into things.  I am a believer that most people are lazy or stupid and few go the extra mile to create something exceptionally clever.  

Take the average code injection backdoor, its simple and obvious.  A linux kernel source repo attack put a single '=' instead of '==' and most people reading the code would miss it (evidenced by the fact that people did miss it).  This allowed someone in the know elevate privs  to root (or was it ring 0?  I think it was just root).  

Take the NSA and the standard tables used for some crypto implementations.  These looked good, for a great many years it went unnoticed.  They were backdoored allowing someone in the know to much more easily break the crypto.  

I illustrate these two examples to say that sometimes people do things with malicious intent.  They go to lengths to leave it undiscovered.  These are not the norm.  It does happen but its more likely that stupidity or ignorance was behind the problem.

[trixter]

Don't forget - when the player DOES go out of his way to click that button every time, he gets banned.

I lost 207 BTC. I call the admin out on the BS 'tell us you're verifying' scam. I verify EVERY bet. I start winning. I am banned.

A 2 year old could connect those dots.

Correlation does not equal causation.  It never has it never will.  That is not proof of anything.  The emails suggest that you were banned for what you said in emails to the site operator not  for winning.  There is no proof that you were banned because you were winning.

[mtwelve]

Sent PM, please replay ASAP

[keepinquiet]

Don't forget - when the player DOES go out of his way to click that button every time, he gets banned.

I lost 207 BTC. I call the admin out on the BS 'tell us you're verifying' scam. I verify EVERY bet. I start winning. I am banned.

A 2 year old could connect those dots.

Correlation does not equal causation.  It never has it never will.  That is not proof of anything.  The emails suggest that you were banned for what you said in emails to the site operator not  for winning.  There is no proof that you were banned because you were winning.

Never said it was proof, and connecting dots isnt.

Let me say this for the 94th time in this thread and in others: I HAVE NO PROOF. I NEVER HAD PROOF. ITS WHY I THINK HIS SCHEME IS BRILLIANT, BECAUSE IT IS IMPOSSIBLE TO PROVE.

My god. Stop saying "its not proof". No shit. I NEVER said it was.

I'm not looking to convict him in a court of law by a jury of his peers beyond all reaonable doubt. But that is not the only measure of the probability (or plausibility) of something.

My son was sent home sick from school yesterday. Threw up in the bathroom. No one saw it. He APPEARED sick. He didn't want to eat. I didn't do DNA swabs of the toilet. The obvious signs of it were enough to convince me he was actually sick.

I BELIEVE (without proof, again, 95th time) 999dice's insane profits are due to a system designed to cheat the user, where the user can prove nothing, and the site can always "prove" fairness, due to intentional site design, and the be behavior of the site owner (anonymous proxies, answering every question BUT this specific one, banning, threatening news sites).

Yes, a two year old could connect those dots.

Another news site contacted me yesterday and asked me a lot of questions. One of which, I forget what we were dicussing, prompted this response:

"You tell me which of these two scenarios seems most likely for a legitimate company falsely accused:

User claims site is scam. News story is posted. News outlet contacts site. Site owner makes threats, claims news outlet is an accessory to extortion, attacks the user's character.

OR

User claims site is scam. News story posted. News outlet contacts site. Site owner responds, sorry about user's losses, we are provably fair, we'd be happy to show you."

Which of those two are the actions of someone with something to hide?

Listen, if anyone doesn't wasnt to believe me, fine, I'm at the point defending this position that I don't care anymore. Go gamble there. Have fun. Let me know how it works out. Statistics say you should, after an infinite number of bets, lose only .1% of your total bets. Let me know if that number works out for you.

[Arnab biswas]

coz its a gambling site....why will people belive u thar a gambling site is steeling coins

[mayax]

coz its a gambling site....why will people belive u thar a gambling site is steeling coins

because they want to win every time and they forget that the casinos were not invented for that. you cannot win against them.

[trixter]

Never said it was proof, and connecting dots isnt.

Let me say this for the 94th time in this thread and in others: I HAVE NO PROOF. I NEVER HAD PROOF. ITS WHY I THINK HIS SCHEME IS BRILLIANT, BECAUSE IT IS IMPOSSIBLE TO PROVE.

My god. Stop saying "its not proof". No shit. I NEVER said it was.

I read the statement that a 2 year old could connect the dots which you outlined as you lost, verified then won,  then got banned as a string of events indicating that your losses were related to not checking.  That it was implied they were cheating.  Especially coupled with the title of this thread.

"You tell me which of these two scenarios seems most likely for a legitimate company falsely accused:

User claims site is scam. News story is posted. News outlet contacts site. Site owner makes threats, claims news outlet is an accessory to extortion, attacks the user's character.

OR

User claims site is scam. News story posted. News outlet contacts site. Site owner responds, sorry about user's losses, we are provably fair, we'd be happy to show you."

Which of those two are the actions of someone with something to hide?

I understand why you can arrive at the conclusion  there is something to hide, however I can see the sheer stupidity in that and am more likely to believe in stupid people than cheating absent proof that the person is exceptionally clever.  I do not believe this person to be exceptionally clever.  Occam's Razor and all that.  It could be that he/they are really clever though, it could be that they are cheating, I do leave the possibility open but the implication is that they are cheating that circumstantial evidence is enough to support that claim. 

I think the extortion claims came from your demand that your losses be returned.  I think that upset the admin a bit (thus the banning).  It speaks to a more immature mind and a thin skin (its the internet people need to have a thicker one if they want to have a publicly accessible site).  This also speaks more to not being clever than being clever, or at least bad interpersonal skills.

[trixter]

coz its a gambling site....why will people belive u thar a gambling site is steeling coins

because they want to win every time and they forget that the casinos were not invented for that. you cannot win against them.

That is the thing and with the max win per wager as most sites do even a martingale strategy will eventually fail, assuming you do not first run out of your bankroll.  Even with a 95% chance of winning there is still provable statistical odds of a long string of consecutive losses.  The site profit would increase dramatically if people do not have a large enough bankroll.  The odds of 2 consecutive losses would be 0.05*0.05 = 1:400.  4 consecutive losses 1:160,000.  6 consecutive losses 1:64,000,000.  Lotteries in the US are often 1:175,000,000 for the grand prize (powerball, a multi-state lottery is exactly that).

With 95% chance to win you have to have almost 1900% wager increases to win back enough to cover previously lost bets.  If your base wager is 10 satoshi and a 1900% increase it goes 10->200->40000->8000000->16BTC->320 BTC.  Most people will not have that much in their bankroll anyway.  The odds of that happening are only 1:64 million.  Its not hard to make millions of bets. 

If the RNG is flawed as I suspect it is there will be ups and downs in the numbers generated.  This results in the odds skewing so at some points its less likely at others its more likely. 

This does not mean that no cheating is going on, it just means that its highly probable that over time users will lose. 

[keepinquiet]

Never said it was proof, and connecting dots isnt.

Let me say this for the 94th time in this thread and in others: I HAVE NO PROOF. I NEVER HAD PROOF. ITS WHY I THINK HIS SCHEME IS BRILLIANT, BECAUSE IT IS IMPOSSIBLE TO PROVE.

My god. Stop saying "its not proof". No shit. I NEVER said it was.

I read the statement that a 2 year old could connect the dots which you outlined as you lost, verified then won,  then got banned as a string of events indicating that your losses were related to not checking.  That it was implied they were cheating.  Especially coupled with the title of this thread.

Yes, I implied it. Oddly enough, I do not need proof to imply it or state my opinion.

"You tell me which of these two scenarios seems most likely for a legitimate company falsely accused:

User claims site is scam. News story is posted. News outlet contacts site. Site owner makes threats, claims news outlet is an accessory to extortion, attacks the user's character.

OR

User claims site is scam. News story posted. News outlet contacts site. Site owner responds, sorry about user's losses, we are provably fair, we'd be happy to show you."

Which of those two are the actions of someone with something to hide?

I understand why you can arrive at the conclusion  there is something to hide, however I can see the sheer stupidity in that and am more likely to believe in stupid people than cheating absent proof that the person is exceptionally clever.  I do not believe this person to be exceptionally clever.  Occam's Razor and all that.  It could be that he/they are really clever though, it could be that they are cheating, I do leave the possibility open but the implication is that they are cheating that circumstantial evidence is enough to support that claim.  

I think the extortion claims came from your demand that your losses be returned.  I think that upset the admin a bit (thus the banning).  It speaks to a more immature mind and a thin skin (its the internet people need to have a thicker one if they want to have a publicly accessible site).  This also speaks more to not being clever than being clever, or at least bad interpersonal skills.

So by default, no one is guilty of anything if it requires any degree of smarts to pull off, because everyone is too lazy and stupid? Thats a bit narrow for a lawyer. Just strikes me odd. While, yes, people are stupid and overlook things, I think that is EXACTLY what "Jake" was hoping for. To be thought of like you are. Massive benefits of the doubt because who would go to that amount of effort?

Well, I think someone who appears to have profited 2,000 BTC in a single year would go to that amount of effort.

Anyone here not willing to work extra hard for a bonus half a million $$$?

And at the time his site went up, that would have been $3 million. Oh I'd be one hard working sneaky sonofabitch for $3,000,000

[dooglus]

"You tell me which of these two scenarios seems most likely for a legitimate company falsely accused:

[...]Site owner makes threats, claims news outlet is an accessory to extortion, attacks the user's character.

OR

[...]Site owner responds, sorry about user's losses, we are provably fair, we'd be happy to show you."

Neither. The "correct" scenario is:

[...]Site owner responds: "Thanks for pointing out this serious flaw in our provable fairness. We will fix it as soon as possible so that every player can easily verify that their rolls are fair."

[keepinquiet]

coz its a gambling site....why will people belive u thar a gambling site is steeling coins

because they want to win every time and they forget that the casinos were not invented for that. you cannot win against them.

That is the thing and with the max win per wager as most sites do even a martingale strategy will eventually fail, assuming you do not first run out of your bankroll.  Even with a 95% chance of winning there is still provable statistical odds of a long string of consecutive losses.  The site profit would increase dramatically if people do not have a large enough bankroll.  The odds of 2 consecutive losses would be 0.05*0.05 = 1:400.  4 consecutive losses 1:160,000.  6 consecutive losses 1:64,000,000.  Lotteries in the US are often 1:175,000,000 for the grand prize (powerball, a multi-state lottery is exactly that).

With 95% chance to win you have to have almost 1900% wager increases to win back enough to cover previously lost bets.  If your base wager is 10 satoshi and a 1900% increase it goes 10->200->40000->8000000->16BTC->320 BTC.  Most people will not have that much in their bankroll anyway.  The odds of that happening are only 1:64 million.  Its not hard to make millions of bets. 

If the RNG is flawed as I suspect it is there will be ups and downs in the numbers generated.  This results in the odds skewing so at some points its less likely at others its more likely. 

This does not mean that no cheating is going on, it just means that its highly probable that over time users will lose. 

My second post in this thread goes into the numbers much more deeply.

When running simulations, at a 49.95% bet (999dice's 2:1 odds number, given the house edge), I repeatedly saw instances where the roll was failed over 350 times IN A ROW.

He's the simple math of it - if you lower the base bet to a number small enough that you can cover-by-doubling your losses to an "impossible to lose" point, you are going to have to bet enough times to make any significant winnings that the "impossible to lose" odds are suddenly a very real reality.

Lets use 999dice's numbers: Betting 95% win gets you x1.05157 your bet on a win. To even win anything, you'd need to bet at least 20 satoshi, as anything less than 20 satoshi results in winnings less than 1 satoshi.

To recoup your losses on 999dice, you need to bet 19.38x your last bet.
20 sat bets
After 1 loss: 387 satoshi
2? 7500 satoshi
3? 145535 sats
4? .0281 BTC
5? .546 BTC
6? 10.581 BTC

That's all we're willing to do. Not lose more than that.


What are the chances?

To lose once: 5% - 1 in 20
Lose twice in a row: .25% - 1 in 400
Three times: .0125% - 1 in 8000
Four? .000625% chance - 1 in 160,000
Five times in a row? .00003125% chance - 1 in 3.2 million
Six? .0000015625% - 1 in 64 million
And finally... 7... It's a 1 in 1.28 BILLION chance to lose that 7th roll. Impossible. Even the lottery is easier to win.

So, on any given roll, you are risking about 11.15 BTC to win 1 satoshi. Of course your chances of losing are 1 in 1.28 BILLION, so it's "impossible".

But winning 1 satoshi is hardly worth the effort. Whats your goal? Lets be really safe and say we just want .25 BTC. To get that, we'd need to roll slightly over 25 million times. Slightly over, because 5% of all rolls will be a loss, and it's a wasted roll, so we'll need to roll the recovery roll. So...

25 million - 5% is:
1.25mil re-rolls, and 23.75 million wins.
5% of the 1.25 million rerolls will also be losses, statistically speaking. So:
1.25mil 1st rerolls
62500 2nd... oh and 5% of those...
3125 3rd rerolls... and 5% of those...
156 (rounding down) 4th... and 5% of those...
7 (rounding down) 5th rerolls, and 5% of those...
well, rounding down, thank god we don't lose any of the 6th 10.581 BTC rolls.

So, we have 1,315,788 wasted rolls to losses, and 23,684,212 wins. We lost 5.55% of the rolls to losses, so lets up that to  getting us .2368 BTC in winnings. So we need to roll 26,470,432 times to, in theory, get .25 BTC.

Thats 26.47 million chances to roll that 1 in 1.28 billion. Whats that work out to? 1,280,000,000 / 26,470,432?

48. 1 in 48 odds to fail your roll 7 times in a row. 1 in 48 is a 2% chance. Would you risk 11.15 BTC to win .25 BTC?

If you are, save yourself a lot of time, and go bet 11.15 BTC over at 98% odds. This is where part of my example does not add up, as 999dice doesn't allow 98% bets. While Primedice DOES, their edge is 10x as large, making the math not work out. But lets say 999dice DID allow 98% bets. It would pay out 99.9/98 which is 1.01938. So, you'd get 1.938% of your risk back as winnings.

Whats 1.938% of 11.15?

.216.

Damn close to the .25 you were trying to get (the house edge breaks this example a bit - if you had no edge at all, the numbers would be much closer.) And with only ONE chance to lose it. If you did the 25 million bets, while its a 1 in 48 chance to lose it, there's also a very small chance it happens 2 or more times. Using some complicated binomial probability distribution mumbo jumbo, while there's only a 2% chance you lose 11.15 BTC trying to get .25 BTC, there's also a .000456% chance - 1 in 219k chance it happens 2 or more times. Yes, really small, but you could lose even more than 11.15 BTC.

Moral of the story: How many times can a 5% loss chance lose in a row? An infinite number. It just depends on how many chances you give it to happen.

Moral 2: Don't try and beat math. She's a mean mofo.

[trixter]

Yes, I implied it. Oddly enough, I do not need proof to imply it or state my opinion.

never said you did.  I never implied that you did.  I just pointed out that the implied statement is not proof, that the correlation of events is not proof of causation.

So by default, no one is guilty of anything if it requires any degree of smarts to pull off, because everyone is too lazy and stupid? Thats a bit narrow for a lawyer. Just strikes me odd. While, yes, people are stupid and overlook things, I think that is EXACTLY what "Jake" was hoping for. To be thought of like you are. Massive benefits of the doubt because who would go to that amount of effort?

I never said that.  I would hope that you know that I never said that.  I said that I am more willing to believe people are stupid absent proof that they are clever and are doing something nefarious.  The simplier explanation is that they are stupid, Occams Razor.  That does not mean that is correct and I even implicitly stated that I am not saying that it must be that they are just stupid.

[trixter]

What are the chances?

To lose once: 5% - 1 in 20
Lose twice in a row: .25% - 1 in 400
Three times: .0125% - 1 in 8000
Four? .000625% chance - 1 in 160,000
Five times in a row? .00003125% chance - 1 in 3.2 million
Six? .0000015625% - 1 in 64 million
And finally... 7... It's a 1 in 1.28 BILLION chance to lose that 7th roll. Impossible. Even the lottery is easier to win.

As I pointed out when  I did the same math and came up with the  same numbers that assumes their RNG is doing an even distribution.  I also pointed out that I do not believe that it is.  It appears (without doing enough statistical charting to validate my opinion) that there are times where that is much more likely and times where that is much less likely. 

The fact that they double hash also reduces the number of outputs.  If you have all the possible values a  hash will be a subset of that.  A double hash requires the input of the first hash so its outputs are even more limited.  I believe this plays into part of why their RNG appears flawed but I have not done the math to confirm it.  I still think the original RNG is flawed and if they are using MSSQL for rand() as they do for validating the bet (per their site) then its known to be flawed.  Its deterministic based in part of the C call  time(). 

[Arnab biswas]

coz its a gambling site....why will people belive u thar a gambling site is steeling coins

because they want to win every time and they forget that the casinos were not invented for that. you cannot win against them.

that's the point..we can't. win aginst them but.they are still addicted to some.techniques who.they belive will work aginst them