Salt is predictable about bitcoin-faucet-dice-faucet-box

[coinables]

HarryR, thanks for sharing your techniques as this is the only way myself and other hobbyists (not professional) developers will learn. Personally, this seems like a lot of work to attempt to get some free satoshis from a faucet, but then again there are a lot of people out there who target faucets. Based on the amount of servers it already takes to brute-force my simple algo, wouldn't widening the space removing the time stamp, and adding more factors in a specific order in a HMAC do the trick?

$genSalt = mt_rand(10, 999999999);
$genSalt2 = mt_rand(10, 999999999);
$genSalt3 = mt_rand(10, 999999999);
$salt = hash_hmac("sha384", $genSalt, $genSalt2, $genSalt3);

[coinables]

I've updated my working example using the method I mentioned above.

https://coinables.website/faucetbox

[coinables]

Ok, so don't use mt_rand(); as it can be predictable.
Instead use a CSPRNG, something like bin2hex(openssl_random_psuedo_bytes(32));

Yes I suppose the server could make it so that it rolls numbers that have lower rewards, but any pattern that emerges to the users could also be a weakness for betting against it. In the end it's just a faucet that gives out free bitcoins, the user can not lose in that regard. If the user doesn't think it's fair they can go elsewhere. If it were actual real world betting the client side would absolutely need to be implemented.

[coinables]

Thanks for your help. I will implement the change as soon as possible.