3 ms·
Most lotteries, all of them that I'm familiar with, blackout ticket sales for several minutes around the draw to avoid order sensitivity issues like this. It's
by jcrawfordor 2y ago
Most lotteries, all of them that I'm familiar with, blackout ticket sales for several minutes around the draw to avoid order sensitivity issues like this. It's funny, lotto vending machines here don't say when the drawings are for each game, but you can tell by reading the fine print for the five minute window where tickets are not sold.
- thaumasiotes 2y agoStep 6 of this process was to subvert the machine and print a backdated ticket. How does blacking out ticket sales for five minutes around the draw help against that?
- cryptonector 2y agoPresumably all ticket sales (including their numbers) are synchronously reported to the lottery office by the sales terminals. That would render backdating attacks detectable.
- jamesfinlayson 2y agoYes - in Australia's lotto system at least, the physical tickets are inserted into the database then printed once they are confirmed to be committed.
- Breza 2y agoYeah, I imagine they save the list of all the tickets they've sold, get a hash of the values, and then generate the winning number.
- jcrawfordor 2y agoThe backdating is trivially detectable unless you manage to get the database operations to happen the wrong way around, which is why the whole "holding a packet" thing has to happen. But part of the reason for the blackout period is to account for the possibility of that kind of thing happening anyway. If you have to fake the issue time by five minutes, then 1) the described method is probably infeasible anyway because the connection to the database will time out while the packet is held for multiple minutes, 2) the ticket issue date and audit date on the database event will vary by at least five minutes which makes it obvious that the ticket was improperly issued.