What is SBR's stance on the Bodog Poker security problem?

[RudyRuetigger]

From Bodog Network re: the security issue:

"The talents of the online poker community have been enormously helpful in testing the new software we have released. Obviously, any release has its teething problems and equally obviously we take any fault very seriously & we have released an update which we are confident has addressed the most pressing issues.

The input of poker players and software professionals since launch has helped us make our system more robust and highlight how strong the poker community is.

As for the debate on the rights and wrongs of anonymous tables we are thrilled with how the pros and cons are being discussed. From our own stand point we are sure that depositing players are the lifeblood of the industry and encouraging the casual player to have a better experience will make the poker eco-system better for all types of player".

Thanks,
Becky

in other threads you were saying how people can trust bodogs security team and all the other bs. what has it been? a fukkin week? and now your whole system has been proven to be a bunch of shit..and you give the stance that its a good trial stage?

hundreds of thousands of dollars are on the line each day and you give this bs answer?

[oiler]

now its exen worse cause now everybody is ante the minimum since no one knows who everyone is,,,its a total disaster and after seeing how the games have been,now they are proving that they are throwing there poker to the trash bins and worry about sportsbet,and even there sportsbook is getting worse

[RudyRuetigger]

i EXPECT SBR to downgrade bodog immediately because of this..if bodog changes, sbr can upgrade at a later point.

[donjuan]

If you weren't disgusted enough already, check this out:

http://calvinayre.com/2011/12/07/poker/volunteer-hackers-help-bodog-poker-make-security-more-robust/?utm_source=dlvr.it&utm_medium=twitter&utm_campaign=calvinayre#utm_source=rss&utm_medium=rss&utm_campaign=rss

[daneblazer]

i EXPECT SBR to downgrade bodog immediately because of this..if bodog changes, sbr can upgrade at a later point.

2p2 is about to drop them off their site completely. Not that Bodog wants 2p2ers around their site at this point anyway.

http://forumserver.twoplustwo.com/55/about-forums/bodog-security-issues-lies-etc-their-presence-these-forums-1136065/

[icancount2one]

Bodog is totally blowing their chance to claim a significant share of the US poker market before Full Tilt and Party re-enter.

I was so excited when I saw the poker update and how smoothly it was running, but that quickly soured when I realized I couldn't see who my opponents are. The concept of anonymous tables is a joke. So terrible on so many levels. If you are not colluding or running a bot, you deserve to get torn apart by cheaters when you play.

[BodogBecky]

Bodog is totally blowing their chance to claim a significant share of the US poker market before Full Tilt and Party re-enter.

I was so excited when I saw the poker update and how smoothly it was running, but that quickly soured when I realized I couldn't see who my opponents are. The concept of anonymous tables is a joke. So terrible on so many levels. If you are not colluding or running a bot, you deserve to get torn apart by cheaters when you play.

I'm sure you've probably seen this already, but just in case you haven't, here are some words from the Bodog Network VP re: the anonymous tables:

http://calvinayre.com/2011/12/01/poker/jonas-odman-on-the-bodog-network-software-update/

Thanks,
Becky

[Optional]

Doesn't ANYONE think anonymous tables is a good idea?

I've never been enticed to waste my money playing cash poker games when I know the regulars all have tools to profile and **** me over.

Not sure why all the poker rooms have waited so long to do something to level the playing field.

[SBR Lou]

Doesn't ANYONE think anonymous tables is a good idea? I've never been enticed to waste my money playing cash poker games when I know the regulars all have tools to profile and **** me over. Not sure why all the poker rooms have waited so long to do something to level the playing field.

Good post. Players with third-party programs that track hands, profile opponents & record all kinds of stats that it takes a computer to do are upset. Everyone at 2+2 thinks they're the next Durrrr so it's not surprising these are the people not in favor of the update. I think most players either have no preference or even support the change, it makes it more like a real card game.

[nosniboR11]

oh lou, sbr is making a big mistake backing bodog

[daneblazer]

I think most players either have no preference or even support the change, it makes it more like a real card game.

Yes, because when I play a "real card game" I'm usually playing against people wearing a hazmat suit with a bag over their head to anonymize themselves.

[SBR Lou]

Yes, because when I play a "real card game" I'm usually playing against people wearing a hazmat suit with a bag over their head to anonymize themselves.

I don't think it's a good analogy. When you play live poker, you don't know as soon as you sit at a table that the random guy in seat six is +$20,500 lifetime, calls X% of the time after a raise, that his usual hand range is XYZ etc. That's what third-party software programs like Poker Tracker tell you.

[Bcatswin]

Seems like a lot of mumbo jumbo out of Bodog and SBR for backing them. Use to love Bodog poker.

[RudyRuetigger]

I don't think it's a good analogy. When you play live poker, you don't know as soon as you sit at a table that the random guy in seat six is +$20,500 lifetime, calls X% of the time after a raise, that his usual hand range is XYZ etc. That's what third-party software programs like Poker Tracker tell you.

who cares?

questions were raised about the integrity/security of the game. bodogbecky got on here saying how great the security team is and that wont happen. not even a week later and they have a huge security breach, and you think there is nothing wrong with that???

[FuzzyDunlop]

Serious players have no business on Bodog playing poker. They don't want your business anymore.

[no1here]

posted by Lou,
I think most players either have no preference or even support the change, it makes it more like a real card game.

You can't really believe this.

[Optional]

Yes, because when I play a "real card game" I'm usually playing against people wearing a hazmat suit with a bag over their head to anonymize themselves.

When I sit at a real game I know no one at the table has detailed stats on me. If they are not good enough players to read me with their own brain then they don't beat me as much.

As a newbie, with enough info to know the dangers, playing online poker is not an attractive option.

[donjuan]

I don't think it's a good analogy. When you play live poker, you don't know as soon as you sit at a table that the random guy in seat six is +$20,500 lifetime, calls X% of the time after a raise, that his usual hand range is XYZ etc. That's what third-party software programs like Poker Tracker tell you.

By anonymizing tables, you are taking away the one oversight the players have of a company like Bodog stealing money directly from the players like Absolute/UB did. And given the Kahnawake ties, there is little doubt in my mind this is exactly what Bodog plans to/is currently doing. No surprise to see SBR be ridiculously gutless and support a paying advertiser though.

[TexansFan]

Bodog is a shit book, always has been.

[MonkeyF0cker]

By anonymizing tables, you are taking away the one oversight the players have of a company like Bodog stealing money directly from the players like Absolute/UB did. And given the Kahnawake ties, there is little doubt in my mind this is exactly what Bodog plans to/is currently doing. No surprise to see SBR be ridiculously gutless and support a paying advertiser though.

I feel differently actually. There is nothing that stops any site from doing that in the first place. They have the capability of creating accounts/changing usernames to mask that already. Both the Absolute and UB instances were found out by in-game play anomalies where players were making strange calls. Unless Bodog begins denying users from requesting hand histories for suspicious play, I have no problem with it. I think player tracking only gives an advantage to lesser players who are not able to adapt to the table without knowing the tendencies of his/her opponents. With "anonymous" play, game play is far more akin to sitting at a table of strangers in Vegas.

And that's the way I think poker should be.

[Trident]

Good post. Players with third-party programs that track hands, profile opponents & record all kinds of stats that it takes a computer to do are upset. Everyone at 2+2 thinks they're the next Durrrr so it's not surprising these are the people not in favor of the update. I think most players either have no preference or even support the change, it makes it more like a real card game.

Forget about 3rd party programs, look at the ease players will be able to collude with complete anonymity. The use of Bots will be even more rampant since BoDog chose to turn a blind eye when they were made aware of it before the update, following a Bot before was simple now it's impossible, if you think BoDog will police this I have a big bridge to sell you.

[MonkeyF0cker]

As for the security issue, well, that's inexcusable.

Not sure why they don't use a one-way hash to encrypt the account number.

[SBR_John]

SBR is not knowledgeable enough in poker to back or not back policy of a poker room. We will assist anyone who files a complaint and we will add the changes to the Bodog review.

[icancount2one]

I'm sure you've probably seen this already, but just in case you haven't, here are some words from the Bodog Network VP re: the anonymous tables:

http://calvinayre.com/2011/12/01/poker/jonas-odman-on-the-bodog-network-software-update/

Thanks,
Becky

I don't think it's a good analogy. When you play live poker, you don't know as soon as you sit at a table that the random guy in seat six is +$20,500 lifetime, calls X% of the time after a raise, that his usual hand range is XYZ etc. That's what third-party software programs like Poker Tracker tell you.

All of these positives could be accomplished with changeable user handles like on cake, with none of the negatives.

What poker tracker does, other than help you find and exploit poor players and allow for multitabling, is help you figure out if opposing players may be cheating, colluding, botting, etc.

Poker tracker and the like were what revealed that Ultimate Bet had a superuser problem. If bodog were to cheat it's customers in a similar manner there would be no way to detect it.

[Trident]

This was posted this afternoon by kyleb who with others discovered the safety issue.

The best I can do is tell you that we don't believe they have fixed past and current vulnerabilities.

[SBR_John]

This is an excellent thread, it touches on some very interesting subject matter. I copied this out of article from Becky.

Kyle Boddy, KyleB in the 2+2 forums is the Chief Marketing Officer behind the hand-reselling site HHSmitthy.com. If you are unfamiliar with Boddy’s site, they exploit poker operators’ data without permission. They package the data and resell it to poker players for a handsome profit.

These guys are precisely the kinds of people that Bodog does not want scalping their recreational poker players so this move by Boddy and his “friends” is helping Bodog out in a number of ways. Not only is this an example of a highly effective and entirely free volunteer QA system, but in putting the efforts into packaging this message in the way they are and releasing it to the online poker grinder community, they are likely helping Bodog drive away more of the undesirable predatory players from their ecosystem.

So the Bodog move is a way to drive off the angle/advantage players? Some very interesting terms used. "net depositor", is that the politically correct term for a square? Then there is predator and ecosystem. Then you have a guy basically stealing data from a business and selling it??? Is that true? Why wouldnt the poker companies sue him? Quite a story I must say.

[Trident]

Why wouldnt the poker companies sue him?

I really doubt any Poker Company would ever want to step inside a US court room.

Can a business that does business illegally in the US even sue someone in a US court?

[donjuan]

I feel differently actually. There is nothing that stops any site from doing that in the first place. They have the capability of creating accounts/changing usernames to mask that already. Both the Absolute and UB instances were found out by in-game play anomalies where players were making strange calls. Unless Bodog begins denying users from requesting hand histories for suspicious play, I have no problem with it. I think player tracking only gives an advantage to lesser players who are not able to adapt to the table without knowing the tendencies of his/her opponents. With "anonymous" play, game play is far more akin to sitting at a table of strangers in Vegas.

And that's the way I think poker should be.

And how was it found they were making strange plays incompatible with winning poker? From tracking sites who showed their play was completely incompatible with winning without cheating like this graph shows.



Beyond that, there are numerous problems with anonymous play online. You can play at a cash table for 10 minutes, stand up, go south and then sit back down without anyone knowing if you were the same guy sitting there before or not while you've watched and know the other people are still the same. Pretty big advantage for anyone who isn't the most ethical.

You say it's like playing in a casino where you don't know people but if you've ever been to a casino or card room you know very well that you see a lot of the same regs every day. And you certainly know if someone left and came back or not.

A much better way to go about this would be to let players change their screen names once every so often. That would help alleviate some of the other concerns while making HUDs much less effective.

[daneblazer]

Here is the cliff notes nutshell. I'm copying this word for word from Kyle's post. I don't believe he'd have an issue with that...

http://forumserver.twoplustwo.com/showpost.php?p=30255747&postcount=50

As I stated before, I will respond to all specific questions about Bodog's vulnerabilities and general commentary in the Internet Poker thread that I started. I view the Bodog Support Thread and the NVG thread as places to discuss Bodog in general, which I support - but I will confine most of my work to the Internet Poker thread where I believe it makes the most sense to concentrate our message.

Bodog Security: The Undeniable Truth

Here's the undeniable truth about Bodog's security for a quick overview

At the end of the day, here is what is undeniably true about Bodog:

1) They rolled out software that promised to keep user identities safe and anonymous. Failure (video 1).
2) They then admitted to lying about #1, but said that exposure of user IDs was not unsafe. Failure (video 2).

Now, we are at:

3) Calvin and his team say his poker software is secure. He even "assured" a top employee of his that it the exploits were patched.

Here's my question: How do you know he's telling the truth?

Answers

Quote:
<table border="0" cellpadding="5" cellspacing="0" width="100%"><tbody><tr><td class="alt2" style="border:1px inset"> i find it a bit odd that this guy kyle is saying hes doing it for the good of poker players when he at the same time is selling HH to other players </td></tr></tbody></table>
I would like to say that while I am prohibited from speaking specifically about our product, I will say that I disagree with 2+2 and most people in general when they speak out against datamining. I think that a few companies in this industry have done irreparable damage to the datamining industry, and we're trying our best to show why it is not only a good thing, but ultimately necessary.

Pokeraddict - a highly respected affiliate and industry insider - asked me this question:

Kyle, is what Bodog says true? Did they remove the account numbers from the data?

The answer to this question is not something we're releasing based on how Bodog responded to our investigation, but the overall message should not be missed: People are asking independent researchers whether or not a given site is safe. This is the future of online poker and regulation, just like the future of bank security relied on outside penetration testing teams to provide assurances that their platforms were safe. We believe that independent research made by organizations with no conflict of interest will play a large role in the regulation of online poker in the United States.

Gus Fritschie, the CTO of a very well-known security team, has looked into similar vulnerabilites (source: Getting F***** on the River, Defcon 19) and has reached out to our company in the hopes we can forge a leadership path in this sector - and we're in absolute agreement with him.

Bodog's Reputation Here

The argument has been made that it's better to have a rep here to answer to allegations of vulnerabilities and other problems rather than chase them off and have no line of communication. This argument was unsuccessfully made with Right Angle Sports - who were shown to have acted unethically in the past - and other organizations on TwoPlusTwo.

However, I don't disagree with the concept of having a responsive representative on the forums that can discuss things openly with the community. The problem, of course, is that the two major Bodog reps here offer nothing of the sort.

JustinR, aka Jurollo, was repeatedly lied to and told to tout the party line that Bodog's anonymous tables were safe. He made bold technical claims that could not be verified (that all data was server-side and that the exploit that worked on Party would not work on Bodog), and was swiftly shown to be parroting false and misleading information (source: video 1 of Bodog exploits).

I don't believe Justin was speaking on his own accord; rather, he's an unfortunate victim here that was told false information and left to hang. He did the right thing and resigned as a result of this, and I support his decisions and how he handled this down the stretch.

On the other hand, we have an Internet-wide celebrity in BodogBecky, who posts useless information on gambling forums such as TwoPlusTwo and SportsBettingReview.

She promises:

Originally Posted by b-dogBecky
Just to be clear, my main role is Reporter for CalvinAyre.com but I also serve as a Fact Checker for BodogBrand.com across the internet and industry forums. I never get involved with promos, bonuses, etc but Bodog CS is excellent and they are always happy to answer questions of this nature.

Thanks,
Becky

Here is a brief overview of Bodog's biggest problems over the last few years and what Becky has done on TwoPlusTwo as a result:

Bodog Voids Live Betting in their Sportsbooks; Freerolls Players

Originally Posted by b-dogBecky
Hey guys- I'm simply here to set the facts straight, not to change anyone's opinion on the Bodog Brand or any of its licensees.

With that said, Bodog Live is not a scam:

1) Bodog will cancel any wagers regardless of win/loss that they find to be past post
2) if any player thinks a wager of theirs was past post and not canceled or was graded unfairly as past post, they should contact customer service.

If you have trouble with CS, please PM me your account number and location and I will speak directly with the decision maker of the Bodog licensee on which you are playing- I'll get the facts for you.

Thanks!! Becky

Some responses:

Originally Posted by MyTurn2Raise
bodog live is a scam

I happened to be beating them on football in-game bets by noticing the formation subs from the sideline, such as could see the teams bringing in personnel for 5-wides or wildcat. I'd place my bets before teams even broke the huddle. Bodog still cancelled them. It wasn't past post. It was poor lines making by Bodog. Live betting is a scam. very shady... stay far away

Originally Posted by Thremp
I was. Do you understand how they're voiding bets very selectively and not being fair in any way about this? Do you understand this is a complaint voiced by dozens of people and likely experienced by orders of magnitude more?

This is getting to the core of what a "scam" does. It defrauds people out of something. Usually money. In this case it is money.

riginally Posted by beetman Since someone asked about Bodog, I figured I'd bump this old thread. Note that the Bodog rep was more concerned about discussing "the big CalvinAyre.com conference" and providing a list of all of Bodog's brand names rather than resolving why this guy had all his winning bets voided. The same thing happened on SBR.

Originally Posted by terp
if bodog can't run this smoothly than they shouldn't offer this live bet service. players are too vulnerable to getting trampled and freerolled, it seems

Originally Posted by GoDeViLs
yes and yes for me.

my limits were reduced after winning month and have had probs with past-post gradings (obv all winning bets, no losers were voided).

You can do Google searches on this very topic (terp found this thread as a results of some basic research I did) and see that Bodog is freerolling Live Bets under the guise of "past posting," which again CANNOT be independently verified. They are the final arbiter of what is and is not fair and do not participate in full disclosure of why they seize your money.

Bodog's Vulnerabilities and Their Attitude

Becky then went on to say this about our efforts:

Originally Posted by b-dogBecky
From Bodog Network:

"The talents of the online poker community have been enormously helpful in testing the new software we have released. Obviously, any release has its teething problems and equally obviously we take any fault very seriously & we have released an update which we are confident has addressed the most pressing issues."

I responded with:

Originally Posted by kyleb
Then why have you banned my accounts? Including accounts from 4 years ago? I posted evidence of this.

Her response was to contact Bodog customer service.

Keeping in mind that this is NOT solving the problem in the open public like PokerStars (an admirable organization) tends to do, I went ahead and did this. Here's what happened when I called them:

Originally Posted by kyleb
First call: Speak to someone, give account ID, wait on hold for 18 minutes, they drop the call.

Second call: Speak to someone, give account ID, they transfer me to Ron in Fraud, I wait on hold 16 minutes, they drop the call.

I can back these statements up with Skype call logs.

Becky then claims upper management attempted to call me back. I can provide logs that indicate that no effort was made.

Other Internet Behavior

When Bodog was confronted with holes in their software released to the general public, putting millions of users at risk, their response to was to make light of the situation and make fun of the people pointing out the problems. You can plainly see examples of this by these posts:

http://calvinayre.com/2011/12/07/pok...y-more-robust/

http://www.reddit.com/r/poker/

http://www.reddit.com/r/poker/commen...beef_up_their/
http://www.reddit.com/r/poker/commen...rasher/c35zkf2

PokerAddict said:

It shows the arrogance of Bodog's founder when their software got called out.

We couldn't agree more with PokerAddict's statement.

Calvin thinks that it's "funny" that we acted as "free QA engineers" pointing out software holes in Bodog's poker client AND web-facing login form. We don't think it's funny that any malicious hacker could have taken this information and stolen tens thousands of dollars from users and jeopardized personally identifiable information in the process.

-----------------------

Bodog is also waging a war against "predators" - aka winning players - on their site as a guise for "protecting recreational players." The real truth, as we all know, is that they are doing this because winning players take money out of the poker economy and the site will rake much more if it keeps break-even or worse players on the site. They puport to protect the average player who doesn't read TwoPlusTwo, doesn't use tracking software, or use a HUD during real-time gameplay, but they have been shown to be unable to protect their software with a modest 4 hours of curious research.

Additionally, as niss and others have pointed out, if they aren't producing any decent support on TwoPlusTwo (basically just referring people to CS and ignoring tough questions) and are waging war on "predators," why do they have a presence here in the first place?

I believe their views run directly opposite TwoPlusTwo's message of training and educating poker players through community posting, and their cavalier attitude towards protecting their users' information and money is simply deplorable.

I look forward to an official response from TwoPlusTwo administrators on this issue. Thank you.

Kyle Boddy
Chief Marketing Officer
A company I'm not supposed to talk about much

[benjy]

This is a fantastic thread. A great read, interesting issues, technical lessons (for me), good discussion, and more than a hint of impropriety.

I'd like to nominate the whole thing.

[FuzzyDunlop]

This is an excellent thread, it touches on some very interesting subject matter. I copied this out of article from Becky.


So the Bodog move is a way to drive off the angle/advantage players? Some very interesting terms used. "net depositor", is that the politically correct term for a square? Then there is predator and ecosystem. Then you have a guy basically stealing data from a business and selling it??? Is that true? Why wouldnt the poker companies sue him? Quite a story I must say.

Bodog's stance is that the sharp players have killed their ecosystem. Heads up cash games had 30 or more tables with one shark sitting waiting on a fish for years. There are programs like pokertracker and hold em manager that give players a ton of information they normally wouldn't be privy to if they were datamining or buying datamined hands and other programmers wrote programs that specifically reformatted hand histories from the Bodog format to theirs. There are websites that list cash game results, sit and goes, tournament results all while shilling their own affiliate links or requiring payment for access or like in the case of the site that found this exploit, just blatantly selling intellectual property of data they had no part in creating.

Coming from my Digital Forensics background, I can't fathom the balls of someone selling information like this for a profit except that they know they most likely won't face repercussion due to the industry. Couldn't imagine Ebay letting someone sell off data analytics of auctions to people to aid in them getting lower prices and making more money. Some sites were banning players for having hands in their personal database that they didn't have a part in, some sites like Cake gave players the ability to change screenames (which is super ironic as most of these butthurt sharps change their name on cake when the fish won't give them action and are now crying about anonymous tables)

The sense of entitlement from those that think they are sharp is astounding, claiming they run the games, generate rake etc when all they've done for the last few years on Bodog is drive away casual players.

[daneblazer]

Good post. Players with third-party programs that track hands, profile opponents & record all kinds of stats that it takes a computer to do are upset. Everyone at 2+2 thinks they're the next Durrrr so it's not surprising these are the people not in favor of the update. I think most players either have no preference or even support the change, it makes it more like a real card game.

You seem pretty gun ho about this anonymous poker stuff. So let me ask you. Why doesn't SBR implement anonymous poker? SBR is attempting to make their product better, why not make the tables anonymous? This is clearly what the masses want, right? You guys have the capabilities. Lets do it guys! Why not?

[Santo]

eBay of course do sell the analytics going back a year through an affiliate (Terrapeak) and there are numerous websites that take data from the last 28 days completed items search available to all...

I don't have a problem with anonymous poker in principal -- it's another option people don't have to use. That is predicated though on it being a properly regulated environment, which offshore is not, so the oversight removed by anonymous play is worrying.

[benjy]

You seem pretty gun ho about this anonymous poker stuff. So let me ask you. Why doesn't SBR implement anonymous poker? SBR is attempting to make their product better, why not make the tables anonymous? This is clearly what the masses want, right? You guys have the capabilities. Lets do it guys? Why not?

Interesting point.

But isn't this kinda apples and oranges. Or rather Granny Smith vs McIntosh? Though there certainly is a social aspect at some poker rooms (at some levels) it's not the chummy, "hey how ya doin'? I see you on the boards all the time!" kinda thing we've got here at SBR. And I imagine hopes are that SBRpoker will become even more chummy than it currently is. Anonymous poker would suck, at least in this respect.

[SBR_John]

I really doubt any Poker Company would ever want to step inside a US court room.

Can a business that does business illegally in the US even sue someone in a US court?

They do not have to sue in the US. Some folks get conditioned to think their is only one country on the planet. If they are located in Canada, for example, they can sue from there.