A player deposits money to a blockchain.info address - with a generated by the player transaction id
blockchain.info reroutes the transaction towards the final destination (our wallet address) - blockchain.info generates their own transaction id
We combine the player transaction hash and the blockchain.info generated hash to receive the final value.
We don't have control over either one, since we don't initiate either transaction of the 2. We cannot manipulate either one, and the player cannot manipulate the blockchain.info one. So it cannot be cheated by either party.
You're using the receive method in their api then? (https://blockchain.info/api/receive?method=create&address=$receiving_address&callback=$callback_url)
If so, then I no longer believe you have the ability to alter the results in your instant win game. Thanks for clearing that up.
Yes that's correct. And it very much reproduces marcotheminer's idea (or a very similar one) in a non-cheatable way.
The provably fair system implemented by casinos such as satoshidice cannot be rigged by the operator or any other parties, since it is backed by cryptography.
Is this not correct?
Yes, technically you are correct. If there is a hidden alliance between us and blockchain.info, then the fairness can be jeopardized.