Hacker News Reader

Comment by gedrap | Hacker News Reader

I'm curious how actually random are current generators in online poker? I mean, some rather subtle patterns, situations would generate larger pots, therefore more rake. Or being on the new players side in 50/50 situations would 'help' to get him addicted.

I am not talking about 100% of the time dealing someone pocket kings, and someone else pocket aces and king on the flop.

Something subtle and very rare would be enough to count for large amounts of money at the end of the year, given the volume of major poker sites. On other hand, if someone would leak it, that might ruin the business for good.

View on HN

The major sites don't do this. We know because many people out there collect literally millions of poker hands observed on these sites and mine the data for every kind of statistic you can think of. If anything significant was out of whack they would have picked it up. Look at the 'online poker' section of the twoplustwo forums for example.

The random number generators used by these sites are hardware systems that use micro fluctuations in ambient temperature (for example) as a source of entropy and they are very careful to use enough bits of entropy for every card shuffled.

It's amusing to realize that they could just read from dev/urandom with zero risk. They're probably not running Linux, but still.

So, for anyone who's wondering if you need this, or if this adds any extra security: probably not. There's no reason not to use the extremely well-tested and well-understood /dev/urandom.

But their devs can't charge as much if they say "I implemented the random number generator, is one line of bash code" rather than "I created a thermal system that is connected to our server where we will use its data as seeds to generate cryptographically random numbers".

Capitalism, we all play it ;)

Actually for something cryptographic or sensitive in nature you would want to read from /dev/random. The "u" in urandom stands for unlimited, basically if the entropy pool runs dry, reads from /dev/urandom will still return data but that data doesn't necessarily have a significant amount of entropy in it. Reads from /dev/random however will block and wait for more entropy if the entropy pool runs dry.

No, this is an urban myth perpetuated by a broken man page. Cryptographic software should use urandom, not random.

tptacek has addressed this concern many times before: https://hn.algolia.com/?q=author:tptacek%20urandom#!/comment...

The summary is that it's a myth.

FWIW, Windows has an equivalent of /dev/urandom. http://msdn.microsoft.com/en-us/library/windows/desktop/aa37...

Is CryptGenRandom equally secure as /dev/urandom, or are there ways to use it wrong?

Even for bad poker sites they are using HW RNGs. I worked for a hybrid meat space/online casino and we were using IDQ cards. Except when we were not. Owner got squirrely and went for bottom dollar to implement a stand alone version of a carefully engineered system I had developed. The developers ended up using /dev/random instead of at least making a 1 gig rng lookup table. Also the ticketing system was unencrypted so you could print whatever you on a barcode and feed it to the redemption machine to clean it out. Also the games were not tested statistically. Literally a guy sat there and played games until it "felt" right.

I tried to help them out, but eventually I washed my hands of everything and walked away. Too many weird things going on. From talking to others in the industry it is not that different elsewhere.

TL;DR - If you do work for casinos be ready to walk away when things get weird.

Since the odds of getting certain hands is known and there are a lot of professionals with very large databases of hands any manipulation like that would stand out pretty quickly as a statistical anomaly.

Professionals monitor the play of other players and identify statistically abnormalities. You would have to be clever and conservative enough to evade those types of checks which, while I am sure is possible, is not trivial.

Reply on news.ycombinator.com