Comment by solutionyogi
11 years ago
I think the problem is the randomness.
When you use your language's random function, you are getting a pseudorandom generator. As noted in the article, they were able to figure out the seed for the random function. Once you know the seed, the game is over. The adversary can now figure out the exact shuffled deck.
Also see: http://ericlippert.com/2013/05/06/producing-permutations-par...
My point was the algorithm, not the implementation, hence my disclaimer on 'good randomness'.
The algorithm is not the problem. The "good randomness" part is the entire problem.
Easy way to shuffle a deck is just to give each card a random 32-bit index and sort. You don't need to do anything fancy to get them shuffled up. The problem is, if your random number generator is predictable then the algorithm doesn't matter.
Even that is very slightly biased, since you don't specify what happens when 2 cards accidentally end up with the same index. It's better to do the shuffle described in the document.
It is not just the predictability of the generator that is the issue (all PRNG are predictable really), what really matters is the size of the seed state, which should vastly exceed the number of value shuffles (52! - a huge number).