[cortesoft]

About 20 years ago (before the crackdown on online poker in the US), I had a friend who made a good living playing online poker. His cheating strategy was to use an engine to watch every single game being played on the server. Once he accumulated enough data on players, he would simply play at tables where there were really bad players. He would have insight into each players strategy, and could counter easily. He made quite a bit.

[Tenoke]

20 years ago online poker was extremely soft, and you could make a profit easily with a little bit of skill. At any rate, what you describe is usually not considered cheating - most sites (with some exceptions now, but likely none back then) explicitly allow software that tracks stats about players - by 2010 (when I was playing semi-professionally online) most regs used software like that (usually Poker Tracker or Hold'em Manager) both to make decisions in a given hand and to avoid tables with too many other regs in the first place.

[cortesoft]

It was a long time ago so my memory might be fuzzy, but I believe he played on pokerroom.com... the cheating part of it, from my memory, was that the tracking software had access to mucked hands, which normal players at the table wouldn't have access to.

[adanto6840]

For most of the sites, the software was reading the text-based "hand history" to collect data. When hands were mucked at showdown, the contents of the mucked hands generally appeared in the plain-text hand history (and most UIs provided a way to view them or to replay the hand action-by-action).

There were a couple of sites where this wasn't the case, or where the hand history wasn't provided in a simple text format (or at all) -- but generally, that's how it worked for the majority of the poker sites/clients.

The reason for being able to view mucked hands (at showdown) is because you can do the same in live games, at least that's the house rule in the vast majority of live rooms. It's almost always frowned upon, to varying degrees, to actually request to see a mucked hand - but generally IS allowed by rule (ie WSOP events explicitly allow asking to see hands mucked at showdown, though an 'anti-abuse' discretionary clause is included in that rule, too).

[john-radio]

Good reminder that any web site's policy that's enforced in the UI, but isn't enforced in its backend API, is really just a polite request.

[cortesoft]

That is interesting… I don’t play a ton of poker at casinos, but I haVe played in probably a dozen or so tournaments at Hollywood Park and a few in Vegas… I have never once seen anyone see or request to see a mucked hand, although I have seen someone get yelled at by the dealer for trying to turn over another player’s mucked hand after the showdown.

[adanto6840]

Years ago I played live games quite often (Vegas), and I do still play a few times a year (also Vegas). I've seen players make the request maybe 20 times total, and probably had the request granted ~50% of the time. When denied, it's usually because the cards were already intermingled in the muck, but on a few occasions it was due to the requestor exhibiting some level of 'menacing/antagonizing intent' to begin with.

You will definitely get yelled at if you attempt to flip someone's cards yourself, 100% of the time. At higher limits, it may get you removed from the game or worse. You can ask/request the dealer to show the mucked hand, though. I'd still suggest that you not request to do so -- it will almost assuredly piss someone (or multiple people) off. There are some rare occasions where it may be worth it and/or warranted, but they are few and far between.

Most common is when someone shows their hand to "half" the table immediately before mucking (at showdown), which often will cause the other half of the table to want to see too. Most dealers handle it well and just move on to the next hand while the players 'disseminate' the (usually useless) information.

[cortesoft]

I have definitely seen the dealer enforce the “show one, show all” rule. I tried googling around after your last comment, but wasn’t able to find any reference to a player’s right to see a mucked hand. Instead, I found a lot of articles about whether it is better play to show or muck losing hands, which implies it is the person’s choice.

Do you have any reference for the rule that a folded hand has to be shown on demand if play is over?

[furyofantares]

Everyone (that talked on the forums, a minority of players) ran Poker Tracker / Hold'em Manager but even in that community I think it was considered shady to use a shared database or to undergo a large datamining operation of hands you weren't involved in.

[sgjohnson]

> most sites (with some exceptions now, but likely none back then) explicitly allow software that tracks stats about players

Only from the tables you're playing at. To my knowledge most sites won't allow you to spectate other tables for the purpose of gathering data.

[latexr]

I played casually many years ago. I remember reading about that strategy to find the fish¹ and have no doubt it was reasonably widespread, because I then opened the cash tables² and noticed that despite a number of them having vacant seats, a couple had a waitlist. Sure enough, opening the game you could see that most players were trying to take from the same person.

That lead to an interesting counter-strategy: because most players were aiming to sucker a single target they heavily avoided playing anyone else, which meant that by playing a little more aggressively one could steal³ from them as well.

Can’t say how viable that would be on the long run, as I only tried it briefly. My goal was to have fun playing and that definitely wasn’t. I stopped playing altogether shortly after.

¹ https://en.wikipedia.org/wiki/Glossary_of_poker_terms#fish

² https://en.wikipedia.org/wiki/Cash_game

³ https://en.wikipedia.org/wiki/Steal_(poker)

[Tangurena2]

This article [0] from 1999 on Texas Hold'em shows how bad some developers have fouled up card shuffling algorithms.

> In a real deck of cards, there are 52! (approximately 2^226) possible unique shuffles. When a computer shuffles a virtual deck of cards, it selects one of these possible combinations. There are many algorithms that can be used to shuffle a deck of cards, some of which are better than others (and some of which are just plain wrong).

> The shuffling algorithm used in the ASF software always starts with an ordered deck of cards, and then generates a sequence of random numbers used to re-order the deck. Recall that in a real deck of cards, there are 52! (approximately 2^226) possible unique shuffles. Also recall that the seed for a 32-bit random number generator must be a 32-bit number, meaning that there are just over 4 billion possible seeds. Since the deck is reinitialized and the generator re-seeded before each shuffle, only 4 billion possible shuffles can result from this algorithm. Four billion possible shuffles is alarmingly less than 52!.

> The RST exploit itself requires five cards from the deck to be known. Based on the five known cards, our program searches through the few hundred thousand possible shuffles and deduces which one is a perfect match. In the case of Texas Hold'em poker, this means our program takes as input the two cards that the cheating player is dealt, plus the first three community cards that are dealt face up (the flop). These five cards are known after the first of four rounds of betting and are enough for us to determine (in real time, during play) the exact shuffle. Figure 5 shows the GUI we slapped on our exploit. The "Site Parameters" box in the upper left is used to synchronize the clocks. The "Game Parameters" box in the upper right is used to enter the five cards and initiate the search. Figure 5 is a screen shot taken after all cards have been determined by our program. We know who holds what cards, what the rest of the flop looks, and who is going to win in advance.

> Once it knows the five cards, our program generates shuffles until it discovers the shuffle that contains the five cards in the proper order. Since the Randomize() function is based on the server's system time, it is not very difficult to guess a starting seed with a reasonable degree of accuracy. (The closer you get, the fewer possible shuffles you have to look through.) Here's the kicker though; after finding a correct seed once, it is possible to synchronize our exploit program with the server to within a few seconds. This post facto synchronization allows our program to determine the seed being used by the random number generator, and to identify the shuffle being used during all future games in less than one second!

From the NY Times article [1]:

> The ASF vulnerability lies in a faulty implementation of what is known as a pseudo-random number generator to produce a shuffled deck of cards before each round of play. The order of each shuffled deck is completely determined by one number, known as the seed. In this case, the program chose a seed based on the time, measured in milliseconds since midnight. By synchronizing their program with the system clock on the server generating the seed, Mr. McGraw and his associates were able to narrow the number of possible decks to about 200,000. Then, given the cards dealt and the community cards in the center, they could quickly compute which deck was being used.

Your friend's strategy of only playing poor players is a lot safer than breaking the casino's wallet. I'm reminded of the scene in the movie Casino [2] where casino staff drag the cheaters into the basement and threaten to cut off their hands with a power saw.

[0] - https://web.archive.org/web/20060205100630/http://www.develo...

[1] - https://www.nytimes.com/1999/09/13/business/compressed-data-...

[2] - https://www.imdb.com/title/tt0112641/