Schneier on Security

Clive Robinson • October 10, 2019 5:31 AM

@ Rachel,

I trust you are well, thanks for the link, unfortunately I’m unwell again and have a thoroughly undeserved “Death rattle smokers cough”[1] so as movment causes thr muck in my chest to move occasioning another hack of furniture breaking proportions, I am currently sentanced to the usual 6ft by 5ft prison they call “bed rest” 🙁 Thus your link has provided this prisoner with a “sparrow to observe upon the sill in the fair light of the morning sun.

The subject of the piece, David Walsh makes some observations that others both agree with and believe to be correct,

But at the heart of his passion he found emptiness. “Gambling, like future-markets trading, doesn’t produce anything,” Walsh has written. “It just causes money to change hands … Winning gamblers end up with money but have achieved nothing else.”

Anyone who has met and endured “city fly boys” will know about their emptiness and their craving to fill the void, and inability to do so with pleasures of the flesh.

When I was younger I used to frequent one or two Casinos with friends and I had a policy. I would buy a number of small face value chips to about the value of what you would spend on a night out anyway, and put them in one side pocket of my dinner jacket. I would play one or two of the games where you could apply a little maths to the endevor, thus stretch the entertainment value. I had however two hard rules. The first was always to move on out to another place of entertainment at a given time, irrespective of win or loose, “cometh the hour goeth the man”. The second was winnings went in the other diner jacket pocket and I would stop playing when the stake pocket was empty or it was time to go.

Some nights the left pocket contained little not even the price of a cup of tea, others well, either way it mostly payed for the rest of the night. Thankfully back then at the bottom of London’s Leicester Sq. there was the rarity of an “all night cafe” which had tea by the mug for pennies and not much more for a couple of eggs on toast. It was a frequent “last stop of the night” for me, as at the back around midnight chessboards would start to appear and friendly sudden death games for a cup of tea could be played, often you’ld still get a game as daylight arrived to chill out before taking a train home. To bed, to sleep, perchance to dream, lost in the arms of Morpheus, till Somnus’s spell is broken.

Not exactly a misspent youth but the draw to a Casino for me was not playing or winning but watching others.

Something else the article reminded my of (the old grey porridge does need a kick start some days 😉 is from Fyodor Dostoevsky’s study on risk addiction and gambling, “The Gambler”,

“I wanted to astonish the spectators by taking senseless chances and – a strange sensation! – I clearly remember that even without any promptings of vanity I really was suddenly overcome by a terrible craving for risk.

It does as David Walsh says perfectly capture the gambling soul and mindset. Thus my earlier comment about certain gamblers being addicts, clinging to the table untill all is lost.

That is the needless risk taking to just for a fleating moment between chip down and the fall of the dice, card or ball to feal vital and alive, the flame burning bright to banish the darkness within of the pitiless void, attracting the spectators like helpless moths oft to their doom. Others call it “the thrill of the chase” of “man versus beast” and similar[2]. The need to banish the craving to kill the void if only briefly lest it grow and the dankness and humdrum of normality overwhelms and stifles. The real antidote to this “poison of the void”, if you can manage to do it, is the contemplative immersion in pure thought. This requires above all other things the ability to “live inside your own head” not the needy desperation to “live in others heads” which is the curse of many a gambler as Dostoevsky’s words depict. But it is it’s self another beast of addiction, thus it has it’s price to pay as well, for once it is awoken it does not sleep. That is, you not being able to turn it off, look at something and you analyze it, you take it apart in your head, judging it’s fitness for purpose, finding the flaws and exposing it’s weaknesses, knowing it’s imperfections, and having to live with that knowledge quietly lest others be offended. Otherwise as the speaker of unwanted truths, you will be considered rude, an agitator, up start, troublesome or some other social defective. Something I think David Walsh found out the hard way as often such people do…

[1] I’m alergic to things tabacco, the smoke causes me nose bleeds and the actuall leaf causes the skin on my fingers to dry and crack, most unpleasent, and back when I was young, due to the social norm of heavy smoking decidedly a damper on a social life…

[2] My way amongst others was “Sailing close to the wind” literally not figuratively. That is holding a sail boat on that point of capsize racing to a mark to go about or even in some cases gybing (or jibing, depending on your choice of english). Where an ill timed moment got you wet, or knocked down/out by the boom or you cracked a tooth or two. Sometimes you ended up doing all three. Another of my sins was what is now called “free form rock climbing” my prefered choice of climb being sandstone or chalk, of which others would say “Nobody in their right mind would climb that”. Then there was canoeing and cycling, the latter giving my thighs to large for the former… Diagnosis “not a team player” but then in all honesty who is, unless they are hiding for some reason 😉

Clive Robinson • October 11, 2019 3:51 AM

@ Gunter Königsmann,

… until he started to loose again. Somehow the story of one who wins at poker reminds me of that.

The mathmatics of probability does not preclude a very long “lucky streak” happening[1]. It just indicates it’s increasingly improbable the more times you win. However very occasionaly improbable events do happen[2].

As I was reminded the other day very improbable events can be very common and in part for most humans it’s their failure to comprehend what the maths is telling them that makes them appear “impossible”.

Someone had aquired a particle detector that can pick up certain high energy particals as they move through the universe. They talked about how this very very small particle had traveled straight through the universe for hundreds of light years to activate their detector, how improbable it was and thus how in awe they were of it.

What they had forgoton was that whilst it was very improbable for any individual particle to hit their detector, there are so many particles moving through the universe that the probability of the detector being activated is actually very high.

When I was quite young I read a ScFi story that was from the early 1950’s, it put it another way as understanding the problem with prediction was part of the story line.

In essence in the story it was a gruff Russian scientist making the point,

Golfer hit ball, ball lands on grass tuft is expected, yes?
Golfer say correctly befor hit ball, which tuft of grass, not expected, yes?

That is the probability of the ball landing is very very high, so most would consider it a certainty. But the probability of saying exactly where the ball lands is very very low, so most would consider it impossible. But logic dictates that if the ball lands on the grass then it must land on a tuft of grass, so predicting which, is in fact not impossible, just improbable. Thus care must be taken with using probabilities, that you are using the right ones in your reasoning.

In a way it was this issue that gave rise to the “Monty’s Goat”, “Three door” or “Monty Hall Problem” argument in the 1990’s[3].

Whilst the Monty’s Goat argument may appear harmless almost fun to see, the problem has a way way darker side. Those appearing as expert witnesses in court can play with probabilities to put weasels in the heads of a jury. The simplest and most obvious is to change a scale so that “one in X” becomes “one in Y” where X is “1” and Y is “31557600” or “nearly 2^25”. Which sounds scary untill you say it as “about once a year”.

But it’s hard for most people to see when probabilities should be multiplied and when they should be added. This by the way includes judges, who by the usuall measures are considered not just above average intelligent but quite sharp as well. In the UK a fairly public “expert witness” was found to do just this and similar tricks to help authorities convict women of abusing their children.

At the end of the day people need to remember that probabilities are indicators in a large sample size. They are not proof in the case of a single or very limited set of events.

We should realise this from being taught basic science at school with “Brownian Motion”. Or later when taught about thought experiments such as “Maxwell’s Demon”, or even “Schrödinger’s cat” but in most cases we don’t. Thus we can end up being effectively manipulated by those who know this. This is such a common problem that more than a century ago the phrase “There are lies, dam lies and statistics” came into common use. Which might have prompted nearly seven decades ago journalist Darrell Huff to write the most widely sold book in the statistics cannon “How to lie with statistics”. Also why you will find a very large number of web pages such as,

https://faculty.washington.edu/chudler/stat3.html

But even those who should know better often make mistakes, which is why we have seen quite a few published academic papers later withdrawn from journals.

[1] Something the various commentators on the analysis of this game play appear to have forgoton, not known, or deliberatly ignored for some reason.

[2] As I’ve mentioned before I’ve actually seen two “coin tosses” in my life so far come up as neither heads or tales as the coin came to rest on it’s rim/edge…

[3] https://en.wikipedia.org/wiki/Monty_Hall_problem

Clive Robinson • October 11, 2019 7:54 AM

@ MrC,

I think you followed a rhetorical flourish off onto a long tangent about gambling addiction and ended up missing the central point of that paragraph:

Actually, I think you’ve entirely missed the point I was driving at.

Did you read,

Thus the most likely conclusion if cheating is going on is that it originates with the operating company directly or indirectly…

Why the author chose not to discuss this rather than invent unlikely scenarios that the player is some kind of genius inventor or knows one puzzles me slightly.

Especially as the play is behaving like “a good employee” not a “Poker Addict”…

Or to be a little clearer,

1, The guy is employed to do it.
2, His employers are the operating company.

Which gives rise to,

3, Why the article author was “dancing around” that conclusion and very obviously avoiding it.

Which brings up the question of “Pecunary Interest” by the author. And the old saying about how it is difficult to get a man to see a point when his salary depends on him not doing so…

Which if you want it more clearly is,

4, Is the author coluding with someone himself?

Do you now see which direction I’m looking in?

As for why, on the assumption cheating is going on, I think that when the method comes out it will be very simple, dull and with hindisight “obvious” to all[1]. For the technical reasons I gave and you likewise have worked out.

So that does not realy interest my curiosity, it is after all “just work” in a different setting for those involved in these areas of security (as some one I used to know who was a consultant in the petrochem industry observed “As dull as the knife that puts jam on the bread”).

What has engaged my curiosity is the way various people are behaving the “tells” they are radiating and how others are going about things the totally wrong way.

For instance the use of probability math will in no way provide actuall proof of cheating, all it will do is provide confirmation bias, especially if people “cherry pick” which is what they appear to be doing.

This cheating almost certainly will if investigated properly turn out to be some kind of technical cheat, that is well within the bounds of the technically possible. Thus the “keys as RFID readers” is stretching it more than a bit. Whilst in theory it’s possible, in practice no it’s beyond reasonable capability, esspecially at the success rate exhibited so far. Whilst the hat is possible, it’s more likely to be beyond the capabilities they have readily available. More likely is that an acomplice in the players view, but not those of the cameras uses hand or face signals[2] and that the obviously odd mobile phone behaviour is a deliberate misdirection. Thus if the player is grabbed no hard evidence will be found on them.

My feeling is there are signs that the whole thing is a “fake news” scam rather than just a cheat. That is it’s actually being used to raise the profile of the operating company. As a piece of guerilla marketing it is working very well, probably too well. The publicity is reaching out way way beyond the nerdy little world of poker streaming, which may be a real problem.

However something in my gut says that they have “over egged the pudding” that is the story did not build naturally, that is those behind it pushed a little to hard.

The problem for them is that the cheat is technically a crime… Thus those involved want to avoid being caught, and will do so in various ways depending on their abilities. Which is where it is all likely to unravel. I’m guessing that the over publicity will attract the eyes of various authorities who won’t now be able to just ignore it.

Thus what interests me is trying to work out if there is actually a scam, who is involved with it, and how they are planning on getting away with it.

So a little thought experiment for you,

What they need is a “patsy” to be blaimed or take the fall, should the authorities get interested.

That’s because it’s unlikely there will be any hard evidence against the player if he has half a brain, because as you can work out it’s easy to avoid. That is all the player has to do is not have hard evidence on him and just keep denying he’s been cheating. Peoples gut fealings and cherry picked statistics do not make it as evidence, just a potential smear campaign…

The operating company can likewise deny it all if there is no hard evidence or the evidence points at a patsy of some kind which might be more desirable. Thus they could plant fake evidence of a back door into there systems that leakes the RFID info in real time. You could do this with something like a small single board computer and a bluetooth or WiFi dongle. As long as there is no fingerprints or DNA on it or the connections into the system to any of the conspiritors then the trail goes cold for ordinary investigators because of the resources required to go further. With care they could likewise dead end more indepth investigations as well.

If it is a scam, their best tactic now would be to pull the online events, and do an internal investigation with inept investigators before the authorities turn up. Thus those inept investigators can put “muddy boot prints all over it. Or “find” such hardware and in the process contaminate it beyond evidentiary use, the scammers then call in the local authorites who won’t want to put any resources in themselves further muddying up any investigation. Thus the scammers can then spin that up into further good publicity by appearing as “heroicaly defeating evil genius hackers” etc.

It then just becomes a “they claims, he claims” spat which won’t make it into court. Either way they blaim him for cheating, he blaims them for trying to set him up and you end up in stalemate.

Whilst a patsy does not have to be a warm body, just a ghost in the Internet, if the scammers are smart enough then they could fit up a real person in various ways to lead investigators astray and throw lots of doubt into any investigation.

But to be honest, If there is a scam in progress I don’t think that any of the potential scammers are that smart. They have publicity beyond what they probably expected and things are kind of beyond their control now. If authorities were of a mind to pursue it and found the right person to lean on it would all probably unroll fairly quickly into an anticlimax.

[1] Like magic tricks, cheats have a gimmick which is new or original, but does not have to be clever just a priori not known or reasonable to the observer. For many postpriori knowledge of the gimmick is not interesting because “the magic has gone” and often they feel duped because “they were cheated by the bleeding obvious”. Forgetting that a priori they did not have the knowledge through experience to reason out the gimmick, so actually they are not at fault (it’s the same reason why practical jokes are not funny if they are too clever).

You like other readers of this blog have sufficient experience to know it’s a cheat and try to reason out the knowledge thus likely mechanism of the gimmick. You might have a little “thrill of the chase” about it but you are not going to feel duped, as you see no magic in it. You might feel a little dispondent if you did not guess at the mechanism the gimmick used but it won’t make you feel hurt or ashamed, just “chalk it up on the score board”.

[2] Hand and face signals via an accomplice are not new in either gambling cheating or magic. On simple trick is the “two coin trick”. You are sitting with a group of friends in a pub or other social venue, and you or a plant steer the conversation to a point where a chalange is issued. You get two coins out and put them infront of the chalenger, and tell them that you are going to go to the bar/loo and whilst you are gone they should touch just one of the coins and when you get back you will without touching the coins tell them which coin they touched. When you get back you mumbo-jumbo and put on a show by waving your hands above the coins etc for a while. What the challenger does not know is you have another person who is a stooge not a plant. They have the simple task of sending a signal about which coin it is. How they do it can be done in many ways, the longer your mumbo-jumbo goes on the longer they have in which to hide the signal in an innocuous way. As a trick it makes a nice ice breaker, especially if after a little while of guesing you tell everyone how it was done. There are other silly bar games like this “spoons” and “third engine” are two that are somewhat cruler, and found in army messes to haze new people. The trick is to know that they happen, that you are a target, and to let it go just far enough that they get a laugh and you don’t get humiliated and can join in the laughter.

Clive Robinson • October 18, 2019 8:23 AM

@ Lolo,

Clearly some of the commentators above have no clue when it comes to poker in general

Is actually not a relevant statment as the subject under discussion is cheating and secondary the mechanism which is likely “general” in nature thus unrelated to poker.

But when you say,

I am myself a professional poker player and the chance or the randomness of the game have really nothing to do with it. There is ABSOLUTELY 0% chance this man was not cheating.

Says very clearly you know nothing about,

1, Probability.
2, Evidence.
3, Formal or Criminal Proof.

What have all those hours of watching videos by multiple people, produced? So what they’ve watched then, and you may well say “This is a fact” but the same can be said of people “who watch paint dry” and it’s just as relevant… Because for all those hours not a shread of actual “Evidence” of cheating, have been produced. Because if they had Mr Postel and his employers would already be in court or on their way there.

It is not enough to smell burnt gun powder you have to produce the gun. Otherwise all you have is hearsay, which even from an expert as opinion is not proof sufficient to convict beyond reasonable doubt. The prosecution has to carry “the burden of proof” not the defendent.

But if you were to ask me if I think on balance of probability Mr Postel was involved in cheating in some way then I would as I’ve said above think it probable. Can I give you evidence he was? No, but nor can you and as many poker experts as you care to line up. But unlike them I can tell you where to start looking and some of the technically possible ways the cheat could be performed (not wild flights of fancy about bunches of keys being RFID readers).

Can I tell you who I think was involved and why, well I’ve already done so. Which is rather more than any of the supposed poker experts and their “cherry picked” cognatively biased pet theories have.

Which gets around to “Will any evidence be found now?” I doubt it it’s fairly clear the entire episode has achieved it’s purpose, and if I was doing such a cheat I’d have cleared up everything, other than that designed to frame a “patsy”.

So a criminal prosecution is currently unlikely. However “balance of probability” is the hurdle you have to clear in a civil case, that has a chance of succeeding against Mr Postle, but to what purpose? The usual rules are each side picks up their own costs, bringing such a case against Mr Postle is going to cost way more than any potential gain you can make from him…

Going after his likely employeers might be possible, but balance of probability is not in you favour unless Mr Postle or someone else flaps their gums. Which would be a dumb thing to do, because it would open up the door to criminal action, that even with full immunity would still harm even the gum flapper as their identity would be known and their cards marked for good, not just as a cheat, but a snitch as well, so in effect completely untrustworthy…

The publicity might just prompt one of the relevant agencies to investigate, but as I’ve already said, those involved in the cheat if they have half a brain will have contaminated the evidence in some way or made it point to a patsy etc.

So all we can say currently is “watch this space”.

Clive Robinson • October 25, 2019 4:28 PM

@ piglet,

Earnings of $1000 per hour aren’t really that spectacular.

Mr Postel has also said that they are a lot less than that… Which just reinforces your point of,

If he has superior cheating powers, he isn’t using them very efficiently.

Which is why I think Mr Postel was/is “a good employee”. Thus the question of “Who employed him?” arises, and most likely is it is the people that effectively owned the system in some way.

Which for some reason those self proclaimed video watching poker experts don’t want to go anywhere near… I guess that should make others pause for thought about their motives in all of this.