Cheating at online poker?

[hajario]

@Shalmanese

I beleive a number of early poker sites were hacked like this but operators have now become far more aware and have closed this loophole.

Yep. One of the earlier sites, the one owned by Mike Caro and his wife (Planet Poker?), released their code to show that they ran a fair game. Unfortunately, they also released the key for how the RNG seed was determined. It was something easy to find out having to do with the exact time of the deal. A few people made a killing for a couple of weeks.

Now the “random number” is based on information that randomly comes from each player. Here is an example from Paradise Poker.

We have two main sources of these random bits. First, the rng on the server samples the low order bits of the CPU’s time stamp counter (667MHz) at irregular parts of the program and when data is received from client connections, and uses it to add to the entropy in our large seed.

Secondly (and mainly) the client programs send their own 32-bits of entropy with every action they make and with several of the other packets they send to the server. The client’s entropy is gathered from both mouse and keyboard movements, as well as the lower 32-bits of their CPU time stamp counters. With thousands of clients connected using all sorts of different hardware and moving their mice in different non-predictable ways, this is by far the biggest source of entropy and gets us far more than 17 new random bits per second. In fact, tests performed in February 2001 indicate that it typically yields over 7000 bits of new random data per second. We’re using several sources of reliably random entropy; no single point of failure. Can you say overkill?

Haj