Re: PBM die rolling web site

From: Ed Taychert <elt-notreally@irony.com>

Date: Thu, 11 Dec 1997 00:00:00 +0000

Folks have asked for many "features" for the on-web dice server at

http://www.irony.com/mroll.html

and most of them would create security risks or "loopholes"
as you suggest ... The most common goes along the lines of "I'd
like to see the roll first so I can figure out what my action is."
This creates a gaping wide opportunity to cheat ... so I won't
implemented them. (Irony Games dices rolls are mailed before they
are ever presented on the web.)

Seed generatation, valitidy, life-cycle, and the security of the
seed itself _ is _ an issure with modern cryptography
system. It's not hard to implement; but, as you suggest, it
is a necessary component of all such systems.

Monitoring your roller is also important ... The Irony Games
dice roller will enter it's 4th year of service this coming
January. It's rolled almost 6 million dice, served over 160,000
requests and there's a record of each and every roll made in the
logs!

Another opportunity to cheat, one that you allude to, is where
a recipient's email address (say the GM's) is entered incorrectly.
In this scenerio, the player rolls (using their own valid email
address) until they get one they like
and then forward ("oops, I got your email address wrong) that one
and only that one to the GM ... It's important for the recipents
to only accept email from the server! The bottom line is that
not only must the payload be secure (iG's rolls are hashed
and PGP signed) but also that the path must be secure.

A signature from the originator sounds good, but the roll
can not go to the requester's site to get signed... the requester
could "veto" a roll. Instead, you need a protocol exchange where
a "cookie" was sent, signed, returned, and then included in the
rest of dice roll email. Commercial systems go that far, but
I think that's a bit much for a dice roller to do.

- Ed.

Bruno Wolff III wrote:
>
> From article <348D7F72.29C0B7CD@gamerz.net>, by Richard Rognlie <rrognlie@gamerz.net>:
> ] A new service that is being developed on my gaming site, is
> ]
> ]       http://www.gamerz.net/shadowdice/
> ]
> ][...]
>
> Your help file doesn't state how you generate your random numbers. It looks
> like you use a seed for a random number generator. This may be exploitable
> in some cases.
[...]
> The only way to detect the forgery will be to see that the message didn't
> come directly from your site (or was relayed through your site if your
> site allows relaying).

References

Re: PBM die rolling web site
Richard Rognlie <rrognlie@gamerz.net>
Tue, 09 Dec 1997 00:00:00 +0000
Re: PBM die rolling web site
bruno@cerberus.csd.uwm.edu (Bruno Wolff III)
Tue, 09 Dec 1997 00:00:00 +0000

Referenced By

Re: PBM die rolling web site
Richard Rognlie <rrognlie@gamerz.net>
Tue, 09 Dec 1997 00:00:00 +0000
Re: PBM die rolling web site
bruno@cerberus.csd.uwm.edu (Bruno Wolff III)
Tue, 09 Dec 1997 00:00:00 +0000