Poker-AI.org

Re: ipoker html5 apps

2013-09-04T07:56:33+00:00

mpoker.winner. com

Statistics: Posted by flop+2cards — Wed Sep 04, 2013 7:56 am

Re: ipoker html5 apps

2013-08-07T17:28:27+00:00

Ignore my post I read it as partypoker not ipoker my bad. Ill make a thred for partypoker

Statistics: Posted by MerlinsBeard — Wed Aug 07, 2013 5:28 pm

Re: ipoker html5 apps

2013-08-06T23:23:09+00:00

Is this the client that's primarily Java based? I recently took a look at this myself if so. (The one where it says play in browser on their site)

If so, yes, they can detect extremely easily. If they had any sense they would also detect mouse movements.
It's also extremely easy to detect whether or not it was opened in a browser or not. (Just crossmatch your IP or w/e loads of ways)

Both are still extremely easy for us to spoof if we are doing a Java based bot interface. Infact we can even move the mouse inside the Java client (not moving our actual mouse). Simulate the entire mouse movement (based on human-like splines and randomness). + Random timings/locations on the click.

I have really been wanting to try to get this running on my PC. I have had great trouble though because I don't understand alot about how these applets and the javascript etc. interact. If anyone AT ALL manages to get it running on your PC (by running I mean literally loading, I don't care about whether it will login or whether it will connect etc. it's quite likely it would need some small alterations inside the client).

I personally think it would be really nice to get it running from your own PC, get this fully deobfuscated, decompiled & recompileable. I took a look at this client a little already and it's pretty straightforward ZKM obfuscation. Just string encryption, BS variable renaming and some stuff done to the flow etc. I managed to actually get a pretty decent decompile, with pretty much most of the flow sorted. Ofc the decompile was ugly as fuck and barely understandable, but I'm pretty sure I coulda got it to recompile with some tweaking. If someone can get this client running, I could start work on a fully deobfuscated renamed client. I think it'd be super super interesting for a bot.

Ofc vs this method they will slam in detection mechanisms that will be either A) hard to spoof OR B) hard to find/realise they're doing. That's fine though I know many ways to get around dumb checks like checksums & method access levels.

Infact I would only use deobfuscation & renamed client for research. I'd most definitely use a completely hidden method where the client remains absolutely untouched and is actually loaded in the end from their site. - Let's not talk about this so publicly though.

This method would just be so insane though, having direct access to any input/output methods you want. No errors, no time wasted, no moving of your own mouse etc. Lot's and lot's of benefits. (+ benefits of knowing who you're playing at anon table etc.)

Actually I'd love to talk about this in depth but this is way too public. I think I posted plenty too much already. Any ideas how to get into the restricted areas?

Statistics: Posted by MerlinsBeard — Tue Aug 06, 2013 11:23 pm

Re: ipoker html5 apps

2013-05-07T20:29:05+00:00

Coffee4tw wrote:

Now if PokerStars offered it, that would be a different story.

gods that would be a good day hahah

Statistics: Posted by galgara — Tue May 07, 2013 8:29 pm

Re: ipoker html5 apps

2013-05-01T00:52:02+00:00

flop+2cards wrote:

yeah. However, if the investigation begins only with the complaints of players, than you can complain about the players. Ipoker cease to take them seriously, if you will be sending hundreds of emails a day.

This is one of the most ridiculous ideas for "counter measures" that I've ever heard.

Statistics: Posted by Coffee4tw — Wed May 01, 2013 12:52 am

Re: ipoker html5 apps

2013-04-30T12:48:43+00:00

Coffee4tw wrote:

accidentally folding a strong hand e.g.?

Statistics: Posted by flop+2cards — Tue Apr 30, 2013 12:48 pm

Re: ipoker html5 apps

2013-04-30T08:10:46+00:00

As I said earlier, there's nothing you can't easily spoof, including "recording" of click locations and up/down times, you have full control of the information that is sent back to the server.

You can run a headless browser (meaning there's no browser open in the traditional sense) and endpoint server would never know...

Statistics: Posted by eugen — Tue Apr 30, 2013 8:10 am

Re: ipoker html5 apps

2013-04-30T07:51:28+00:00

They can record click locations:
http://stackoverflow.com/questions/6154 ... k-location

They can detect things like click up/down times:
http://www.quirksmode.org/dom/events/click.html

Although, like c4tw said, it's unlikely they'll start worrying about that stuff now. And, if they did, I'd guess it would be easy to spoof. I'd be more concerned about them looking at other info (IP, OS, Browser, strategy, game play hours, etc.) or just the speed at which you're sending information to their servers. If you play super-human, or super consistent, then that might get you some complaints.

Statistics: Posted by cantina — Tue Apr 30, 2013 7:51 am

Re: ipoker html5 apps

2013-04-30T00:13:31+00:00

I don't think they can record mouse clicks itself, or did you mean accidentally folding a strong hand e.g.?
That would fall in the category of playing behavior: Schedule, session length, reaction times, playing patterns, etc. Those they still have and always will have access to completely independent of the client interface.

But like I said, since iPoker isn't really doing anything on terms of hardware detection and such (since that would be the skins responsibility), I think HTML5 isn't really that much different security-wise on there.

Now if PokerStars offered it, that would be a different story.

Statistics: Posted by Coffee4tw — Tue Apr 30, 2013 12:13 am

Re: ipoker html5 apps

2013-04-29T23:56:41+00:00

long session without misclick. This is not a 100% guarantee that you're a bot, but they do not need 100% to ban you.

Statistics: Posted by flop+2cards — Mon Apr 29, 2013 11:56 pm

Re: ipoker html5 apps

2013-04-29T20:53:24+00:00

I don't think you can catch CC scammers with hardware IDs. Having said that, there shouldn't be a difference between native apps or web apps in detecting those.

However, this forum is for poker AI and for bots so if we are talking about security, we are usually talking about security against bots so eugen's post is a valid question. I don't think many people have looked into that yet as it's a pretty new thing. Maybe somebody else has some good ideas.

Statistics: Posted by Coffee4tw — Mon Apr 29, 2013 8:53 pm

Re: ipoker html5 apps

2013-04-29T14:13:30+00:00

that's all only need to detect bots. Bot is not the main cause for concern. It's not work against СС scammers. Get rid of the CC scammers of their main task.

Statistics: Posted by flop+2cards — Mon Apr 29, 2013 2:13 pm

Re: ipoker html5 apps

2013-04-29T13:49:46+00:00

There's a huge difference between desktop client and in-browser app..

They can't scan memory, can't scan running processes, can't scan filesystem, can't track mouse movements, can't generate hardware IDs, can't detect VPN, can't detect VM.
Heck, they can't even detect if browser is headless, which means there's potential for serious bot farms on relatively cheap VDS.

Statistics: Posted by eugen — Mon Apr 29, 2013 1:49 pm

Re: ipoker html5 apps

2013-04-29T13:17:06+00:00

ohhh... we strayed from the main topic

Why do you ask "what are they going to do with security"? I would like to say that there is not much difference in terms of safety between the download client and html5 client.

My analogy with IP should be seen as a joke. A rare things is more expensive, usually. IP is a rarer things than a people, but it is more expensive.

Statistics: Posted by flop+2cards — Mon Apr 29, 2013 1:17 pm

Re: ipoker html5 apps

2013-04-29T12:45:29+00:00

So you're forging fake identities? Good luck with that!

I still don't get your IP talk. I really try, I have deep respect for members of this community and I think every contributor is a really smart person, but...
No offense, I just can't read it without cringing all the time. It feels like you're trying to make some statement, but you don't have a firm grasp of the topic, so it makes no sense...

Just a couple of things:

* 7 billion people != 7 billion IP users, it really boggles my mind you think there's a situation where it can be. Babies, grandmas, families using same connection, 3-rd world countries...
* Multiple people can connect through same IP. Some providers connect whole neibhourhoods via single IP
* IPv6...

Statistics: Posted by eugen — Mon Apr 29, 2013 12:45 pm

Re: ipoker html5 apps

2013-04-29T11:25:15+00:00

eugen wrote:

Do you have unlimited people you can trust and who are willing to cover for you with their personal info?

no, I'm creating a new pepole.

eugen wrote:

I don't get your IP analogy

Someone should be to start selling people for $1.2 — $1.8 per unit (IP price/1.65).

Statistics: Posted by flop+2cards — Mon Apr 29, 2013 11:25 am

Re: ipoker html5 apps

2013-04-29T11:12:15+00:00

They still require valid personal information though, especially if you're going to withdraw on a regular basis, be it CC or bitcoin.
Do you have unlimited people you can trust and who are willing to cover for you with their personal info?

I don't get your IP analogy, with a click of a button I can purchase thousands of IP adresses for ~ $2-3 / month per IP. Not even black market, AWS. Can probably get cheaper from black market..

Statistics: Posted by eugen — Mon Apr 29, 2013 11:12 am

Re: ipoker html5 apps

2013-04-29T11:02:30+00:00

They ban by IP and hardware ID for serious violations, such as СС fraud, chipdumping, etc. In other cases, it is a simple ban the account. They have a tool to detect your hardware ID.

eugen wrote:

I don't have that many friends I'd trust with my bot winnings on their CC

IPv4 provides approximately 4.294 billion addresses. The world population, as of today, 7.082 billion. People is 1.65 times larger than of IP-addresses. I like that comparison. Get a new IP several times lighter than the new man.

CС is not the only deposit/withdraw method.

Statistics: Posted by flop+2cards — Mon Apr 29, 2013 11:02 am

Re: ipoker html5 apps

2013-04-29T10:23:26+00:00

Sorry, I still don't follow you.

I always assumed that they way it works now is they simply ban the account, not caring about either IP or hardware ID (whatever that is - MAC? Motherboard signature?).

Assuming you have a winning bot you need valid CC to withdraw to, they ban your account - they ban your CC info.
I'm not sure about you, but I don't have that many friends I'd trust with my bot winnings on their CC, so I have 2, maybe 3 attempts before CC info ban means permanent ban for me, even if I can create a new account to play on..

Statistics: Posted by eugen — Mon Apr 29, 2013 10:23 am

Re: ipoker html5 apps

2013-04-29T09:44:41+00:00

you got me wrong.

Your quote:

eugen wrote:

what are they going to do with security.

What do they do with the security of the download client? — collect data about IP, hardware ID, but ban by hardware ID is an inefficient measure. Maybe, they started developing html5 applications, because they know it.

Statistics: Posted by flop+2cards — Mon Apr 29, 2013 9:44 am

Re: ipoker html5 apps

2013-04-29T05:07:50+00:00

That kind of information isn't sent via browser.

And even if it was, as I said earlier - there's nothing you can't spoof via browser based requests

Statistics: Posted by eugen — Mon Apr 29, 2013 5:07 am

Re: ipoker html5 apps

2013-04-28T20:25:53+00:00

ban by hardware ID.

Statistics: Posted by flop+2cards — Sun Apr 28, 2013 8:25 pm

Re: ipoker html5 apps

2013-04-28T19:32:08+00:00

What do you mean by ID ban?

Statistics: Posted by eugen — Sun Apr 28, 2013 7:32 pm

Re: ipoker html5 apps

2013-04-28T00:14:10+00:00

eugen wrote:

what are they going to do with security.

Do you think that ID ban is effective measure?

Statistics: Posted by flop+2cards — Sun Apr 28, 2013 12:14 am

Re: ipoker html5 apps

2013-04-19T16:35:27+00:00

They have not released it. Please wait.

Quote:

A native mobile client for Apple iOS devices and an HTML5 platform are scheduled for released “within weeks” on select rooms on both iPoker and iPoker France, pokerfuse has been informed.

@pokerfuse

Statistics: Posted by flop+2cards — Fri Apr 19, 2013 4:35 pm

Re: ipoker html5 apps

2013-04-19T13:36:05+00:00

Interesting. Has anybody looked at the iPoker web app? Are they recording things like mouse click location?

Statistics: Posted by cantina — Fri Apr 19, 2013 1:36 pm

Re: ipoker html5 apps

2013-04-19T00:48:38+00:00

I know for a fact they don't care about detecting bots as much as other sites. However, they do listen to other players that complain and might start an investigation based on that.
Having said that, HTML5 would be a great interface.

Coupled with Selenium http://docs.seleniumhq.org/ botting just became a piece of cake!

Statistics: Posted by Coffee4tw — Fri Apr 19, 2013 12:48 am

Re: ipoker html5 apps

2013-04-18T18:19:08+00:00

I don't think they're too concerned with bots, which is an enlightened perspective, IMO.

Statistics: Posted by cantina — Thu Apr 18, 2013 6:19 pm

Re: ipoker html5 apps

2013-04-18T15:16:28+00:00

Quote:

browser type/version, OS, IP, etc

These can be easily spoofed.

In fact there's nothing you can't spoof in a browser based app, so I'm really curious what are they going to do with security.

Statistics: Posted by eugen — Thu Apr 18, 2013 3:16 pm

Re: ipoker html5 apps

2013-04-18T13:46:34+00:00

It would be a pretty big security issue if any website could get your computer ID. However, they can get other fingerprints, like browser type/version, OS, IP, etc.

I applaud them for taking the net step in development. These days it's kind of silly to have to install an OS specific application to play a game like poker.

Statistics: Posted by cantina — Thu Apr 18, 2013 1:46 pm

ipoker html5 apps

2013-04-18T13:21:53+00:00

iPoker announced new HTML5 apps.

Is HTML5 support to collect information about my computer id?

Statistics: Posted by flop+2cards — Thu Apr 18, 2013 1:21 pm