Man hacked random-number generator to rig lotteries, investigators say (2016) | Hacker News Reader

Man hacked random-number generator to rig lotteries, investigators say (2016)

theguardian.com

I would have a lot more faith in lottery outcomes, if they used publicly verifiable unpredictable randomness.

For instance, for a lottery drawing scheduled at time t, take the last valid bitcoin block hash with a timestamp less than t-3600, and apply some memory hard key derivation function that takes an hour to compute.

Tom Scott once made the very good point in one of is videos[1] that it's not just enough for a system to be truly, cryptographically secure. The public must also be able to understand and trust the chain that keeps the system safe.

By this measure, perhaps the best RNG is still Bev from the local RSL hand-cranking her bingo cage.

[1]https://www.youtube.com/watch?v=LkH2r-sNjQs

How about the Cloudflare lava lamps?

https://www.cloudflare.com/learning/ssl/lava-lamp-encryption...

Or just a simple microphone recording cheering audience noise for 10s...

That's why many public lotteries use a live (televised) draw from a mechanical lottery machine. Still not completely physically impossible to rig, of course, but much more transparent than a software RNG.

And rigging a physical draw probably requires physical methods that leave physical evidence that anyone could potentially see or discover after the fact.

Sure, digital footprints are a thing, but there are far fewer people who can watch for problems, and the ones most likely to be the ones subverting the system are the ones who are supposed to be watching.

I listened to a great episode of Darknet Diaries about Puerto Rico lottery being rigged.

https://darknetdiaries.com/episode/101/

it happen a couple of years ago, the national lottery of my country was rigged https://www.reddit.com/r/uruguay/comments/9kcuve/se_pusieron...

I used to work at a government lottery and often worked with the Integrity and Compliance people.

One day the Compliance guy told me the balls they used for one of the draws are stored in a vault, no surprise. But he also said they wash and weigh the balls before each use. Actual physical bouncy balls of some sort.

> publicly verifiable unpredictable randomness

Public is very large. I think it should be mechanical so that everyone understand how it works.

I guess it used to be like, here is one used in Finland at least ten years ago: https://www.youtube.com/watch?v=RFPwjeZe3Gs sure there are ways to rig this one too, but it's clearer how it works.

Lottery is a voluntary tax on people with poor math skills.

It’s either game the system to win or just write a check to the government, or invest your money in almost anything else.

It's a form of entertainment. Surely you have some entertainment that you spend money on and that is not profitable? It can become an unhealthy obsession, but so can many hobbies.

I've an audiophile friend who spent thousands of dollars buying gigantic fancy speakers and went broke shortly thereafter. He was unable to find a buyer when times got rough. Is that a "tax on people with poor math skills also"?

Uh yes. Or at a minimum terrible financial planning, which amounts to the same in both cases.

True for all gambling IMO. I went to Vegas once for a business conference, first time there. I got some quarters, put them all in a slot machine, and was bored out of my mind. I would much rather have just handed someone the cash and left.

A better way to put it is, its a tax on desperation.

Or implement the lottery directly on a public blockchain

There's quite a few lottery systems running on lightning and Ethereum, using smart contracts with clearly defined, verifiable randomness. I also like the idea of geohashing, by XKCD, where they take the date's most recent Dow Jones opening and hash it with the date.

I would be totally unsurprised if it was profitable to manipulate the Dow to a specific open price in order to win lotteries. I think it would be better to go with +10 min from open

Is there a specific XKCD about this? Picking the winning number based on the stock market sounds an awful lot like the old mafia numbers game https://en.wikipedia.org/wiki/Numbers_game

Bitcoin can be manipulated. Use timestamp from last supernova observation. There's several hundred a year, should be enough randomness.

Who makes these observations? Can those timestamps be manipulated as well?

Astronomers all over the world.

Astronomers could ignore newly spotted supernovae if their timestamps would be unfavourable to their lottery chances, no?

Imagine studying and studying so you can get access to equipment that detects supernovas just to try and scam a lottery.

And then you end up caught since you're not the only one observing.

It'd make for a good TV drama wouldn't it?

The bitcoin block hashes are almost entirely manipulation proof. A miner could decide to withhold a winning block at a cost of hundreds of thousands of dollars, but that's about it.

And with the long running key derivation function, they have no idea how a hash even effects the outcome.

in any massively synchronized system of nodes, timestamps are an important, non-obvious topic. The words "can be manipulated" don't tell that story. Others can jump in with the details but this is a lottery and random-number thread.

I guess I am confused by the idea of 'faith' in a lottery outcome. What does it matter if the outcome is rigged? You have basically no chance in winning anyways. It always felt like a tax on people who can't do math.

People don't play lotteries for an expected gain, but for entertaining dreams of winning.

And while your chance of winning the big prize may be negligible, many lotteries do offer tiers of smaller prizes with more reasonable probabilities.

In Holland there's a zipcode lottery in which many people play as a a form of insurance against neighbour envy, as prizes are shared among all entrants from the winning street:-)

For instance -- Keno -- It's pay-per-view on a very boring TV show. Numbers bouncing around. Very boring.

You pay a dollar or two for 45 seconds of entertainment where you're much more invested in the outcome than, say, if John Snow will in fact learn something this time. The fact that you're unlikely to actually turn a profit on the exercise isn't actually the point. You're also unlikely to turn a profit on the time and money invested in watching Picard discuss ethics.

> It always felt like a tax on people who can't do math.

We hear this over and over on Hacker News whenever there's a story about the lottery. But I can do math, and I buy a lottery ticket a couple of times a year when the jackpot exceeds $500 Million. I get my $2 worth of entertainment out of it: picking my numbers and imagining what to do with my money, and waiting for the drawing. The Billion Dollar one a couple years ago was especially fun! Give it a try.

>a tax on people who can't do math.

The national lottery in the UK sends about 25% of the money to charities, so for some it's a form of charitable giving. Also what the other commenter said about dreaming.

> for some it's a form of charitable giving

It would be four times as effective to just donate all of the lottery entry money directly to charity—and it wouldn't even measurably affect your chances of winning.

Also for me, the charitable giving could be a tax deduction.

I can deduct gambling losses only if I had gambling winnings, which as I pointed out earlier is not going to happen.

I recommend the Darknet Diaries episode on how an IT guy discovered the Puerto Rico State lottery was being rigged: https://darknetdiaries.com/episode/101/

(Slight spoiler) The issue they found there was that the actual lottery draw was fine, it was the database that contained all the tickets purchased which was being tampered with

I always said it isn't only the numbers that need to be random, but the record of who owns those numbers needs to be perfect. Probably the "easiest" way to win the lottery is to be the janitor where they keep the servers, then just install a transparent SQL proxy on the wire and anytime someone asks what the winning numbers are, say it's you. It only has to work once.

Back in the 90s, threre was a clever hack of Jolly Card poker machine in Europe. A Bulgarian team was able to put a single-chip computer into a car lock's remote. There is part of this poker game where after you get a winning hand, you can double up you winnings or lose it all in 10 rounds by guessing if the card drawn would be either red or black, or big or small. So, the person would sync up the computer timer with the poker machine after observing other people draws being red/black or big/small. After the computer successfully synces up, it will give a signal that it's ready and then you would always guess the card in this double down part of the game. Winning even the smallest hand and then allowing you to guess the next draws 10 times was enough to make you a lot of money. That device was sold at $10,000 a piece.

Kind of a joke: that's how a time traveler (not very clever though) would look like deciding to get some money returning to past :)

Apparently the fellow has been paroled quite recently

https://www.casino.org/news/mastermind-lottery-fraudster-edd...

Reply on news.ycombinator.com