Nationwide also to introduce "Card Reader Security"

But enough, it seems, for you to comment. :-)

So what? The idea is that after whichever guess you get lucky on, you are left with the best prospects of getting even luckier.

I'm not convinced. Try separating choosing the numbers from testing them. Suppose you will try 1111, 2222, 3333 on card 1,

4444, 5555, 6666 on card 2, and 7777, 8888, 9999 on card 3. Suppose card 3's actual number is 7777.

If you first try 1111 and 2222 on card 1, then 4444 and 5555 on card 2, then 7777 on card 3, you then have only one guess left on each of cards 1 & 2, and of course you would ditch

3333 in favour of 7777. If that fails, you still have 6666.

If you try 1111 on 1, then 4444 on 2, then 7777 on 3, you still have two guesses on each of cards 1 and 2.

guesses left.

Reply to
Ronald Raygun
Loading thread data ...

"Ronald Raygun" wrote

But you've just chosen the scenario in your favour!

Instead consider:- You will try 1111, 2222, 3333 on card 1, 4444,

5555, 6666 on card 2, and 7777, 8888, 9999 on card 3. Suppose card 2's actual number is 5555.

If you try 1111 on 1, then 4444 on 2, then 7777 on

3, then 2222 on 1, then 5555 on 2, you then have only one guess left on card 1 and two left on card 3.

But if you first try 1111 and 2222 on card 1, then 4444 and 5555 on card 2, then you still only have one guess left on card 1 but you have

*three* left on card 3 - one extra to your method!
Reply to
Tim

"Ronald Raygun" wrote

It can only be worthwhile saving the extra guess on card1, *if* you have a strategy to use the extra knowledge gained from the guesses on the other cards. What strategy would you use?

Let's say you guess 1111 on card1 and it fails, then 2222 on card2 and it succeeds. You try 2222 on card3 and it fails.

You now know that card2's PIN is 2222, and that card1's is not 1111 and card3's is not 2222. What do you do next?

Do you try 2222 on card1, thinking that it might be the same as card2 -- even though card3 is different? - Or - do you think the cardholder must have used different PINs on all cards, and therefore deliberately *don't* try 2222 on card1?

Reply to
Tim

I'm not convinced. Let's define three strategies A, B, C, by the order in which the 9 guesses are applied to the 3 cards. Strategy A:111222333 is the one we've been using originally to work out the probability that no card is cracked, B:123123123 is my refined version, and C:112233123 is your alternative refined version.

We're agreed, I take it, that the choice of order in which the guesses are applied will not affect the probability of all nine guesses being wrong. We're looking now solely at the chance of getting *more than one* guess right.

Consider, for each of the above 3 strategies, what possibilities are left after one card has been cracked, for cracking the others. If we enumerate by the number of the first successful guess (1-9), and subdivide by strategy (A-C), it turns out that:

Obviously if the first success happens on guess 1 or guess 9, all

3 strategies are equivalent, because guess 1, with all strategies, is necessarily applied to one card first (and we can call it card 1), and after guess 9 all guesses are used up so no further successes are possible.

It also turns out that strategy A is best if the first success happens with guess 3, because you have 3 guesses left for each of the other 2 cards, while with strategies B and C you only have 2 guesses left for each. A is also slightly better (but worse at the same time) for guess 6, because it leaves you with 3 guesses (but for only 1 card), as opposed to 2 guesses (1 for each of the others). In all other cases, A is worse than B or C.

How do B and C compare against each other? Well, they're the same, in the sense that for 7 of the 9 guesses they leave you with the same number of goes, and for the other two B is better once and C is better once. Specifically, for guess 2, C is better because it leaves you 6 guesses (as does A) whereas B only leaves you 5, and for guess 5, B is better because you still have 3 guesses instead of 2 (for 2 cards in both cases).

I'm wondering whether it may be possible to concoct a hybrid strategy which exploits the benefit of B first, and then somehow changes tack to take in the benefit of C.

Reply to
Ronald Raygun

In message , Ronald Raygun writes [...]

This robbery seems to be taking a very long time and requiring the expertise of two highly numerate people. It doesn't correlate with my knowledge of opportunist thieves.

Reply to
Dave N

"Ronald Raygun" wrote

I don't agree; why do you think strategy A is better?

The reason why you only have two guesses left for each of the other cards for B/C, is because you've already had a guess on those cards. Those guesses might have been right!

Overall, you always get to have three guesses on each card (unless you crack it before the third guess, in which case you don't need the others). If you are not going to use the information from the results on the other cards, then it doesn't matter whether the guesses are made before or after those of the other cards.

Reply to
Tim

There's a whole generation of dormant, numerate, non-opportunist thieves lurking in leafy middle class suburbia, just biding their time before they unleash themselves on all this loot. Just you wait!

Reply to
Ronald Raygun

Psychologically, of course. For any particular N, if the first success is found with guess number N, then the prospect of a second success depends on how many guesses and cards are still available.

A particular strategy, or pre-determined order in which the cards are to be visited, will accord subtly different probabilities to the ten possible outcomes, of the first success happenning with guess 1 or 2 or ... 9 or not at all.

It is obvious that the probability of a 2nd success is higher when you have 6 guesses left than if you have only 4. It is also clear that a 1st success on guess 3 leaves you with 6 guesses if you've used strategy A, but with 4 if B. It also makes sense that the probability of getting 2 successes overall is going to depend only on the numbers you are going to guess in their respective positions, and not on the order in which you make them.

This apparent paradox is resolved presumably because the probability of the 3rd guess resulting in the 1st success is lower with strategy A than it is with strategy B or C.

Reply to
Ronald Raygun

"Ronald Raygun" wrote

That doesn't change the probabilities, only your perception of them!!

"Ronald Raygun" wrote

The different order of cards visited might change the order in which any successes occur, but the same number of successes will have occurred by the time all guesses have been made, *whatever* order of cards is used.

[We are assuming you are going to make the same three guesses on card1 (eg 1111, 2222, 3333), the same three guesses on card2 (eg 4444, 5555, 6666) and the same three guesses on card3 (eg 7777, 8888, 9999) whatever order is chosen -- because you don't want to use the information gained from the outcome of any guesses to change a subsequent guess.]

"Ronald Raygun" wrote

*Not* if you [will be making / have made] the *same* guesses for each card, it won't!

"Ronald Raygun" wrote

... making all strategies exactly equivalent overall (no better, no worse) -- when you don't use the information gained from any particular guess to influence a subsequent guess.

Like I said before!

Reply to
Tim

I don't subscribe to that assumption. I want to choose the number for each guess at random immediately before trying it.

The probability of (say) card 1's 2nd guess being successful then depends on how many numbers have been previously tried in total (if you're using the strategy of all nine guesses having to be different). So it depends on whether card 1's 2nd guess is the 2nd guess overall or perhaps the 4th.

And if you're not using the all-nine-different strategy, then the probability of the 4th guess achieving success depends on whether it is the 1st on card 2 or the 2nd on card 1.

Reply to
Ronald Raygun

"Ronald Raygun" wrote

It'll be the same if you guess each at random as well (not using the extra info).

"Ronald Raygun" wrote

Only if the PINs are all the same on each card...

In that case the probability of the n-th guess (out of 9) being correct is always 1 in (10001-n), regardless of which card it is on. [Ie 1 in 10000 on 1st guess, 1 in 9999 on 2nd guess etc].

But if the PINs maybe different on different cards, then the probability of any card's i-th guess being correct is 1 in (10001-i), so 1 in 99999 for card 1's 2nd guess. In other words, that probability doesn't depend on n.

"Ronald Raygun" wrote

If the PINs are the same on all cards, then yes. But by the time you've made all 9 guesses, the probability of having cracked 1 or 2 or 3 cards will be the same whichever order you tried the cards. [As long as you leave at least one guess on each card to go back to until the end.]

"Ronald Raygun" wrote

This probability will be 1 in (10001-i), for that particular card's i-th guess, if the PINs are different on different cards (and v.close to it if the PINs are the same).

But whatever happens, I suggest the probability of having x successes (x=1,2,3) will be the same whatever order you try the cards, if you don't use the results from any guess to influence a later guess.

Reply to
Tim

Agreed, but the problem is that your assumption that the thief won't use any results is not a realistic one.

The thief reckons there is a chance the cards might have the same PIN, and so a reasonable strategy to adopt is *initially* to use random guesses, without re-using any numbers, *but* once the first success has been achieved, the next guess (if there are any left) should re-try the number which has just succeeded.

If that guess also succeeds, it's worth re-trying that number on the remaining uncracked card as well, if any, to get a 3rd success. Otherwise, if there are any guesses left, it's best to try random numbers again, but this time not bothering about suppressing numbers previously tried on a different card, but only those tried on the same card.

If the first success is achieved in guess number X, then if the application order is 111222333, there will be Y more guesses available to try, and if the order is 123123123, there will be Z more guesses to try, as summarised in the following table (the Y-1 and Z-1 columns are for later):

X Y Z Y-1 Z-1

1 6 6 5 5 2 6 5 5 4 3 6 4 5 3 4 3 4 2 3 5 3 3 2 2 6 3 2 2 1 7 0 2 - 1 8 0 1 - 0 9 0 0 - -

Now, if the scenario is such that the 3 PINS are in fact all the same, then with the strategy described above, after a 1st successful guess, the next guess, if any is available, is *assured to succeed*. The table has 6 nonzero entries in the Y column and 8 in the Z column, and so the prospect of achieving a 2nd success are better by one third overall with order

123123123 than with order 111222333, provided all the rows in the table are equiprobable, which in the "PINs same" scenario they actually are: The probability that guess i is the first successful guess is 1/10000 for all 1
Reply to
Ronald Raygun

"Ronald Raygun" wrote

That wasn't *my* assumption -- it was yours!! See here:- > "Ronald Raygun" wrote >> ... I want to choose the number for each >> guess at random immediately before trying it. > "Tim" wrote > It'll be the same if you guess each at > random as well (not using the extra info).

I've always thought that it's better to use the extra info rather than continuing to pick at random.

"Ronald Raygun" wrote

Of course, that's why we keep at least one guess on each card back until the end...

"Ronald Raygun" wrote

Yep.

"Ronald Raygun" wrote

Why on earth would you want to try that order?! My chosen order was more like: 112233321, or 332211123.

Can you now re-do your analysis actually comparing my chosen order (332211123) to yours (123123123) ?

"Ronald Raygun" wrote

The same applies equally to my strategy! Furthermore, using 332211123, will result in exactly the same cards being cracked as under your order (123123123), except there'll be less shuffling of cards.

[Eg if the first success is the 8th guess, we have both just cracked card2 and will then only be able to crack card3 as well (all of card1's guesses having been used up already, under either order).]

If you can show any difference in the probabilities of cracking n cards (n=1,2,3) using your order (123123123) or my order (332211123), then I'd be very interested to see it...

Reply to
Tim

It was the assumption *you* stated.

I didn't mean "each" quite as literally. The purpose of that remark was to emphasise the *time* at which the choice was to be made. I was rejecting your idea of making all nine choices up front before trying any of them.

Me too.

It's the first one which comes to mind because it involves the least shuffling, and it provides a benchmark against which to show that 123123123 is better!

Why would you want 332211123 in preference to 112233321? They are identical (you've just transposed 1 and 3), and you lose nothing by starting with card 1. Also, whilst for practical purposes 112233321 does involve one less shuffle than 112233123, for theoretical purposes the latter is a bit simpler, and

123123123 is structurally simpler still.

To answer, though, 112233321 is (at least broadly, on the basis that the probabilities of guess i being the first successful are approximately 1/10000 for all i -- I haven't worked out the exact probabilities) no better or worse than 123123123. The equivalent Z column would be 664422210 instead of 654432210, so the sum is the same.

Reply to
Ronald Raygun

"Ronald Raygun" wrote

I only stated it as a qualifier to my statement, to show that I was applying (what I thought was) your assumption. By using the words "at random" in your comment that I had QUOTEd below, I thought you meant that you wouldn't be using the extra info...

"Ronald Raygun" wrote

The probabilities are the same whether you choose (randomly without using future knowledge) up-front, or if you wait until immediately before the guess and then choose (randomly without using any knowledge that has been gained in the meantime).

"Ronald Raygun" wrote

Hmmm. When I said: "It can only be worthwhile saving the extra guess on card1, *if* you have a strategy to use the extra knowledge gained from the guesses on the other cards" and then I asked: "What strategy would you use?", you simply replied: "I'm not convinced...".

Can you tell us now, how you would use the extra info to make your strategy better?

"Ronald Raygun" wrote

But it gives you the least chance of using the extra info gained from earlier guesses.

"Ronald Raygun" wrote

You could equally use it to show that 332211123 is better!

"Ronald Raygun" wrote

Simply so that the last three guesses are on exactly the same cards as for your order (123123123).

That means that exactly the *same* cards would be cracked as with your method (as well as exactly the same *number* of cards).

"Ronald Raygun" wrote

Except that if you crack the (identical on each card) PIN on the penultimate (8th) guess, then both your strategy and

332211123 will give you card2 & card3, yet 112233321 would give you card2 & card1 (there might be different limits on different cards, and hence a different monetary outcome).

"Ronald Raygun" wrote

Of course (talking probabilities).

"Ronald Raygun" wrote

Exactly!

"Ronald Raygun" wrote

How so?

"Ronald Raygun" wrote

But involves much more shuffling!

"Ronald Raygun" wrote

I say the probabilities are *exactly* the same (not just "broadly"). But earlier, you suggested that your strategy was better: >> "Ronald Raygun" wrote >>> It also turns out that strategy A is best if the first >>> success happens with guess 3, because you have 3 >>> guesses left for each of the other 2 cards, while with >>> strategies B and C you only have 2 guesses left for each. >> > "Tim" wrote: >> I don't agree; why do you think strategy A is better? > "Ronald Raygun" wrote >Psychologically, of course...

Have you now changed your mind? ;-)

"Ronald Raygun" wrote

Hehe!

Reply to
Tim

Well in that case perhaps you should have concluded that I

*was* planning on using future knowledge. :-)

I hadn't appreciated at the time what you were getting at.

I have described the strategy: Guess at random from a selection which is initially 10000 in size and which reduces by one each time. This is already "using information": it remembers what numbers have been used and filters them out of subsequent guesses. Once a success is achieved, try the same number again. This "uses information" too. If that fails, carry on randomly, but using the record of what numbers have already failed on each card, filtering those out.

This strategy can be used with any application order, and so we can compare the relative merits of the orders when used with the same basic strategy.

So what? All it means is that 111222333 is pretty bad from the point of view of the chance of cracking more than one card, but optimal from the point of view of minimising shuffling, and hence perhaps of maximising the thief's success rate per unit of time, e.g. if he has a large batch of stolen wallets to get through, each containing 3 cards.

We hadn't previously considered monetary outcome, just number of cards cracked. But fair enough.

The reasoning of the steps is identical, it's just that sequencing through them with a reversal of direction upsets my sense of balance. :-)

Indeed, but for theoretical purposes, such mere practical issues are of no importance.

Then you are mistaken. I'm talking about the nine probabilities Si, that guess i is the first successful guess. Consider also the nine probabilities Fi that the first i guesses all fail, and the nine probabilities Ii that guess i is correct in isolation (given that the previous guesses have all been wrong). This for 1 >

No, not entirely. Where were we again? "Strategy A" in that context corresponds to order 111222333, and "B" to 123123123, IIRC.

Which of them is better depends on what scenario we're in, i.e. on whether the PINs are in fact the same or different.

B is better if the PINs are the same, A is better if they're not.

The number of "guesses left after the first success" only tells part of the story, and the overall probability of a 2nd success is the sum, over all 9 possible guesses on which the 1st success could have occurred, of the probability that the 1st success happened on that guess, multiplied by the probability of the guesses left in each of those situations collectively succeeding.

The difference between the "same" and "different" scenarios is that in the former, the first guess is bound to succeed, and so it isn't the actual number of guesses left in each case which matters, but simply whether that number is non-zero. With 111222333, it is nonzero for the first 6 and zero for the last 3. With 123123123 it is zero only for the last one. The probability of getting at least

2 successes is therefore 6/N for 111222333 and 8/N for 123123123 an your variants.

In the latter scenario ("different"), the first guess following the

1st successful guess is bound to fail, and the remaining ones then each have a roughly 1/N chance of succeeding, so (given that the 9 guesses have a roughly 1/N chance of achieving the 1st correct guess), the probability of getting at least a 2nd success is roughly proportional to the sum of the 9 numbers of guesses left after the 1st success (after each has first had 1 deducted from it and been replaced with 0 if negtive). This is roughly 21/N^2 for 111222333, but 19/N^2 for 123123123 and your variants.

Oops, more to the point, the Z-1 column sums (treating negative numbers as zero) are the same.

Reply to
Ronald Raygun

"Ronald Raygun" wrote

It doesn't use the information from the *results* of the guesses, though (whether they succeeded or not).

"Ronald Raygun" wrote

Yep, that's the crucial bit (you do that with my method too).

"Ronald Raygun" wrote

I still say that the number of cards cracked will be the same with both your order and mine; but as mine avoids some shuffling, it must be better.

"Ronald Raygun" wrote

I think it's best to get the most cards cracked, and if you have two methods that give the same probabilities of cracking 1 (or

2 or 3) card(s), then using the one with least shuffling is best.

That means you ignore 111222333 because the probabilities of cracking n cards is lower; the probabilities are the same for mine & yours, so use mine as it minimises shuffling.

"Ronald Raygun" wrote

No - we appear to be talking about different probabilities! [See below.]

"Ronald Raygun" wrote

Hmmm. I'm talking about the three probabilities Ci, that you crack i cards overall (i=1,2,3). Surely that's all that really matters? It doesn't really matter whether you crack

2 cards in the last three attempts, or 2 cards in the first three attempts (then go on not to crack the last card later).

Either way, you've only cracked two of the three cards.

"Ronald Raygun" wrote

Agreed. [But no better than 332211123!]

"Ronald Raygun" wrote

Are you sure? I think they're the same in that case, aren't they? [I compare "PINs the same" with "PINs not necessarily the same".]

I haven't looked through your (very long!) post all that thoroughly; I might get chance to look at it more closely at some other time...

Reply to
Tim

Sheesh! *Now* you tell me.

Well, yes. I was using the Si as a basis for speculating what C2+C3 might be for each of the 2 scenarios and 3 orders. I noted that the Si were all roughly 1/N across the board, and indeed that they are exactly 1/N for scenario S, all orders, but that they were mostly a little smaller in scenario D, and differed with order.

My preliminary calculations indicate that in scenario D, the probability of cracking at least 2 cards is actually a teeny bit bigger with C (112233123) than with B (123123123).

b = 1.89976998899859e-07 c = 1.89977998399847e-07 c/b = 1.00000526116316

Why compare with "not necessarily same" instead of with "different"? It's an impossible scenario to work with, you can't make proper assumptions about the probabilities that any two cards have the same PIN, because they are likelier to be the same as a result of the owner deciding to make them the same than that they were supplied that way by chance.

Before or after you tell Peter how to make a bank reconciliation unnecessary? :-)

Reply to
Ronald Raygun

"Ronald Raygun" wrote

Yep, "now" and also *three* times before! :-

On 09/02/2008 at 16:24, I wrote:- "If you can show any difference in the probabilities of cracking n cards (n=1,2,3) using your order (123123123) or my order (332211123), then I'd be very interested to see it..."

And also on 03/02/2008 at 16:23, I wrote:- "But whatever happens, I suggest the probability of having x successes (x=1,2,3) will be the same..."

And also on 03/02/2008 at 10:54, I wrote:- "The different order of cards visited might change the order in which any successes occur, but the same number of successes will have occurred by the time all guesses have been made, *whatever* order of cards is used..."

"Ronald Raygun" wrote

Glad you agree!

"Ronald Raygun" wrote

Is your difference here possibly just to do with rounding?

"Ronald Raygun" wrote

"Different" implies a specific sub-group of all the available possibilities. "Not necessarily the same" implies the full collection of *all* possibilities!

"Ronald Raygun" wrote

No, it's actually the easiest scenario to deal with -- because everything is totally random and any possibility may be true.

"Ronald Raygun" wrote

That's just the point -- you don't make *any* assumptions about those probabilities, and assume instead that any possibility might be true.

"Ronald Raygun" wrote

Probably before (if ever!) ;-)

Reply to
Tim

Possible, conceivably, but I don't think it is. I regret having had to resort to numerics at all, but the algebra got a bit too hairy.

But the thief suspects, probably with some justification, that there is some likelihood that the card owner may have deliberately made the numbers the same, so the "totally random" scenario is inappropriate as a basis for calculating the success probabilities of his strategy.

I've simplified things slightly by assuming the owner would make them either all the same or all different and would not choose to make only two the same. That may not be realistic, but if necessary one could consider a three-way probability split (p that they're all the same, q that only two are the same, and 1-p-q that they're all different) instead of the simple two-way split (p that they're all the same and

1-p that they're all different), it being assumed that p (and/or q) would likely be much larger than if the samenesses occurred purely by chance.

Given this simplification, the only way to work out the thief's overall Ci (i=1,2,3) is to work them out separately for the "same" and "different" scenarios and then to combine them by weighting them by p and 1-p respectively.

[What do people tend to do in real life? I have 4 cards in use:

One is Switch (now Maestro) and its PIN is "random" in the sense that I still use the same one which my Cashline card was first issued with long before RBS combined the ATM and cheque card functions, and subsequently the Switch function, all in a single card.

Then I have Access (now Mastercard) and Visa. When MC first introduced C&P, I couldn't cope with the supplied random number, so I chose my own, different from Switch. When Visa soon followed suit, I chose to make its PIN the same as the MC one.

Amex held out a long time against incorporating C&P, and when they finally did, the supplied random number was OK, so I've not changed it.

So I have two the same out of four.

I expect many people will probably not stick with the originally supplied numbers and will choose their own. There may be a tendency, in order to help them remember the PINs, to use perhaps birthdays of their nearest and dearest (or wedding anniversary, which has the added bonus that it helps them remember *that*), either as ddmm or mmyy or whatever, and this will tend to bias the digits in favour of certain ranges, which rather plays havoc with any assumptions of numbers being uniformly distributed, as also does the recommendation not to use numbers like 2222 or 3456.]

Reply to
Ronald Raygun

BeanSmart website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.