I've been thinking, one of the biggest problems with provable fairness is how often people simply don't use it. This is often because of the extra steps required to make sure everything is fair. As I'm sure a lot of you know by now, I like to make sure that everybody has the best experience possible. What if we had a userscript, or chrome extension that automatically did this for us?
One of the biggest holes in nearly every provably fair scheme is the hash of the server seed. Extremely often, it's just not written down/copied anywhere. Most sites don't show you the hash until you open a window or go to a page that displays it. What then? If the site knows that you haven't looked at the hash, then you wouldn't be able to tell whether or not the server seed they revealed to you was the one they were using. Now of course, this isn't perfect, as the site would have no way to guarantee that you won't look at the server seed hash halfway through playing, but it's still possible. The point of provable fairness is to remove
all doubt that the site could be altering results.
I propose a chrome extension to do this, as I believe it has the lowest "cost of entry". All a user has to do is simply click the install button and they're protected. A userscript requires too much technical knowledge for most people to set up, although it could work cross-browser. I believe that anybody privacy-conscious enough to use other browsers is also smart enough to copy down their server seed hash.
The extension could be able to do the following, all behind-the-scenes:
- Record new server seed hashes as they are generated, to prevent sites from changing them later and storing them securely in chrome.storage where the website and other extensions can't touch them. (This has the added benefit of being able to sync between different chrome browsers).
- Instantaneously verify all bets made in the past as soon as a new seed is in use and the previous one revealed.
- (Fluff) Have a counter of all bets made by the user that have been verified when you click on the extension icon
Of course, the potential for a malignant extension here is huge. A bad extension that has access to the page would be able to withdraw a user's entire balance to an attacker's address. Such an extension would have to be open-source so that anybody could examine it and make sure nothing bad is going on behind-the-scenes.
I'd love to hear people's thoughts about this, as well as hearing from anybody that doesn't use chrome as their browser so I can get a handle on how many people would be affected before I think about working on this. The great thing about a chrome extension is that it could support any number of websites, without the user needing to add additional extensions or such.
Thanks!
Hi,
it sounds great, but don't you think people are sceptical when installing extensions related to anything "Bitcoin"? At one hand an extension like this could protect people from one threat, but on the other hand (as you noted) they now would have trust the extension too, because with an extension can open ways for huuuuge abuses in general. An extension being open-source doesn't help much because you get extensions from Stores, not directly from repositories.
I have another idea that could possibly work and could apply to more dice sites, not just YD - but it has to be independently develped, not by us. A type of a "watchdog site" - it gets all seeds from the server and monitors for any changes. It could also allow verification, or even verify all bets live, but I am not sure about it. IMHO watching seeds should be enough to monitor the site, plus on-demand bet verification.
This can be all done using the API for YOLOdice, I am not sure about other sites. But it would be possible to reveal if a site cheats pretty easily. Plus, the results would be public, so any site that tries to cheat risks a lot.
It's just an idea, but what do you think?
