Topic: Primedice.com | Since 2013 | Longest Running Crypto Casino | 113 BTC Jackpot! - page 1080. (Read 1989815 times)

Let me quote Stunna:

So it is marked as resolved... It is not my opinion i just copied what he said...

Everything is 100% true, I have a log of email detailing everything. It was not resolved, despite opinions like the one above. This post explains exactly what happened. Do you think that reply from the 'developer' counts as resovled? I have been provided NO PROOF whatsoever.

Stunna already replied a couple pages before. On PD side it is marked as resolved. I dont know why he is still posting this, he got more btc than he lost or would have won...

How true is the post above me?

Was that resolved already?

Well the discussion of vulnerability related things on dice sites and the theoretical possibility of cracking the PD server seeds seemed relevant enough (today.)

But, after that last post I was not planning to reply anymore and agree the last few posts were a bit too much offtopic, sorry guys :p That's it.

^ Guys, wouldn't it be better to discuss that problem in the BikiniDice thread rather than here?

Sorry, it was a joke like your lol! 
No problem with you, we listen all community advice. But we have our convictions

Ah, this explains it. Just stay stubborn and keep making silly statements. That's it.
I do not expect you to understand this. So, do not worry.

No, I'm saying that it is safer to change the seed everytime. That's it.
But I do not expect you to understand this. So, do not worry.

Lol?

So we can just stop with the whole bitcoin system I guess? Since it's also theoretically possible to crack private keys etc.

You understand his statement "we use per-roll against brute-forcing" was silly, right?

Is the API working? I wrote a betting script using curl and php and its not working, when it used to work.

@NLNico

I think that post was for Bikinidice, as they change server seed on each roll.

Yeh, definitely. But just the fact that he, as a dice site operator, thinks brute-forcing is a problem with a long enough seed is pretty funny. Let's do some maths.



PD uses 26 lowercase letters and 10 numbers in their seed, so 36 different characters with a length of 64 characters. So 36^64 =
4011991914547630480065053387702443812690402487741812225955731622655455723258857 248542161222254985216 different seeds.
The bitcoin network calculates double SHA256 hashes with a speed of 297,275,048.09 GH/s. So 297275048.09*1000000000 = 297275048090000000 double SHA256 hashes per second (pretty impressive right?), and single SHA256 would therefor be 297275048090000000*2= 594550096180000000 hashes per second. This is 594550096180000000*60 (seconds) *60 (minutes) *24 (hours) *365 (days) = 18749731833132480000000000 hashes a year. However, it would take:

4011991914547630480065053387702443812690402487741812225955731622655455723258857 248542161222254985216 / 18749731833132480000000000

= 213975962443264184927319954831658656345664031820000000000000000000000000000 years

to calculate all the original seed-hash calculations of PD with the power of the entire bitcoin network.



So yes. I do think it's funny that he thinks this is a serious threat or that he thinks he is "protecting his players/investors" by having a "seed per roll" system. He is actually quoting a message of October of dooglus just to say "see dooglus, this PD hack is exactly the reason why we have hashes per roll, so we cannot have teh damn brute-forcers". I kinda assumed or hoped that was a joke or something, hence the "lol?".

Don't get me wrong. A dice site can have many problems / server-seed leaks, to name a few:
- Any SQL injection or code execution or things like that to get to the database with the seeds.
- Any other way of "leaking" the un-hashed server-seed (probably what happened here - personally I am curious for the later update with hopefully some technical details)
- Running in a shared hosting or VPS environment with a bad hosting employee.
- Not separating nonces / client seeds, like BikiniDice was planning to do (like I pointed out here)
- Having a predictable random generator so the server seeds could be predicted (BikiniDice seems to use the PHP rand() function, so I hope the server seed is generated more randomly than that)
- Any other algorithm flaws, like PRC had many months ago with getting the "next character" instead of "next set of 5" thing.
- If your "server seed" is actually not that long, brute-forcing is a problem.
- And obviously any other normal security issues like XSS, CSRF, etc.


Nothing bad towards BikiniDice though, I really like the trollish-internet-concept. Just thought it was a silly statement to make.


Ps, I am not that good in math, if there is a problem please correct me, but the idea is clear I think.

]

No. We use the same server seed until you opt to change it. The client seed is nonced in order to create different rolls. There is no way for PD to show a different server seed without you noticing.

All good .

Primedice uses the same server seed and client seed throughout till either they notify you or you change it yourself. They cannot change the result since the results are predetermined when the server seed and the client seed are set. The one affecting result is the nonce which increases by 1 after every bet.

Is everything good on PD?