Talk:Zero-knowledge proof

message: I'm new to ZKN, so with that disclaimer, I was initially confused about how Victor is not able to impersonate Peggy after learning, with high probability, both the graph G and the Hamiltonian cycle.  I think I see it, and believe that the wording could be augmented for clarity.  Original augmented with italics of my own adding:
"The information revealed by Peggy does not give Victor any information at all about the Hamiltonian cycle of G. 
In each round, Victor receives a fresh vertex-label randomization of the graph, encrypted with unique keys that only Peggy knows; further, he receives an answer to exactly one question, which is either "reveal the graph" or "reveal the Hamiltonian cycle," but not both.  
If he requests the graph, Peggy "reveals" (gives him keys enabling him to decrypt) all edges and gives him a mapping of the random vertices to the true vertices.  From there, he can easily verify that the graph he has is identical to the published graph G.  In this case, Victor knows the graph, but not the cycle.
If he requests the cycle, Peggy reveals the cycle, but keeps the vertex mapping a secret, such that he can verify that what he has is a cycle with the same number of vertices as published graph G.  By doing this, Peggy is revealing a subgraph that is isomorphic to the real Hamiltonian cycle that only she knows.  In this case, Victor knows the cycle, but not how it maps onto the published graph.
In subsequent cycles, Peggy issues a fresh randomization and encryption of her graph to Victor, and allows him to ask only one question.
If Victor were to try to impersonate Peggy, it would be impossible for him without knowing the Hamiltonian cycle for G to create a randomized, encrypted graph that both maps to the original graph G and has a valid Hamiltonian cycle for the graph.  The impersonator does not get to choose which question to answer - thus, the impersonator's encrypted graph would have to successfully stand up to both questions, which we said is NP-hard to do.
Another point worth knowing is that
... Victor can manufacture a transcript of the game without talking to Peggy at all. He can select a sequence of heads and tails, and then prepare hypothetical replies from Peggy, without ever knowing the Hamiltonian cycle himself, by following the appropriate impostor strategy in each round. The transcript itself, and the information it contains, 
does not provide proof of possessing Peggy's ability to identify the Hamiltonian cycle in G: Zero Knowledge Proofs require interaction on the part of the verifier.
[DELETE: has no clue about the legitimacy of Peggy's identity.] 
... Peggy proves her identity not because she can give the right answers, but because she can give the right answers without knowing what the questions will be."
:Please be bold and just change it. It's a lot easier to review changes in the article itself. Deco 22:19, 13 February 2006 (UTC)
thread_title: Peggy and Victor Example

message: User:Dake has authored these fine diagrams on Commons:
Image:Zkip alibaba1.png
Image:Zkip alibaba2.png
Image:Zkip alibaba3.png
Todo: Add these to the article (with a text description of the cave thing). — Matt Crypto 12:11, 20 September 2005 (UTC)
replies: text: Done. I don't remember the exact details, so I made up some stuff. Also, I don't remember what the original source is - could you add a citation? Feel free to edit in any other way. Deco 22:48, 13 February 2006 (UTC)

text: Actually I think the cave example does a good job of demonstrating zero knowledge; Victor learns only that Peggy knows the magic word and nothing else in this scenario. Dcoetzee 02:33, 27 December 2008 (UTC)
thread_title: Images todo

message: The link to "How to Explain Zero-Knowledge Protocols to Your Children" (ref #1) appears broken. I'll fix it later when I'm not in a hurry, but I figured I'd write this here until someone gets around to it first. wdaher 01:59, 13 May 2006 (UTC)
replies: text: I've checked and it was already fixed. --Blaisorblade (talk) 17:05, 16 July 2008 (UTC)
thread_title: Broken Link

message: I just redid the example section quite a bit and changed the type of zero knowledge proof described.  I find this example with isomorphic graphs to be more intuitive than the previous encrypted graph example.  Any problems with the Peggy/Victor scenario I outlined?  Disclosure: I am pretty sure I got it straight out of the book Applied Cryptography.
Also, I changed the focus of the example from specifically party identification to a more general proof-of-knowledge, so all different applications are covered.
One more thing: I am a bit new to editing wikipedia articles, so what is the best way to consolidated external links? Should I use footnotes or the external links section instead of "(see $REF)"? --Ec- 17:25, 16 August 2006 (UTC)
replies: text: The ZK protocol with the Hamiltonian graph is indeed badly described. In fact, Peggy first just commits to a description of H, but does not reveal it. If asked to show an isomorphism she will uncover the full description of H and show the isomorphism. However, when asked to show the Hamiltonian path, she only uncovers the edges of the Hamiltonian graph. The nice thing about this ZK protocol is that it can be performed with pencil and paper only: Peggy writes each edge of H on a small piece of paper and puts them upside down on a table. When asked to prove the isomorphism she turns every piece of paper and proves the isomorphism. Otherwise she only turns those pieces that are part of the Hamiltonian path. 85.2.53.175 (talk) 21:02, 3 June 2008 (UTC)
replies: text:  When you say "writes each edge" do you mean like a random face-down pile of pairs (V1,V2)?  I think that makes more sense than the way I always envisioned it: draw the graph where all the vertices are randomly placed in a ring with their original labels, then draw the connections, then put lottery-ticket paint over the vertices, the edges, and the *non* edges, so you have a complete-looking graph.  Then for the query "show graph" Peggy scrapes off *all* the paint; for "show cycle" she traces out the cycle edges showing that each vertex (not showing labels!) is contained.  Note that here the "show graph" reply gives Victor something really easy to verify since the vertices have their original labeling, but are just moved around in the commitment and only revealed for "show graph."  In the paper method, would Peggy also provide Victor with the mapping from G->H?  (Decateron (talk) 14:58, 4 June 2008 (UTC)
replies: text: The description consists of two parts.  Part 1 is a mapping from the canonical, standard labels of the vertices to new, ad-hoc labels.   Part 2 is a pile of pairs of ad-hoc labels, one pair for each edge of H.    For "show graph" Peggy reveals all the pairs and also the mapping.  For "show cycle" she reveals the pairs that form the cycle, but not the mapping.  See  for an example.  -- Dominus (talk) 19:32, 4 June 2008 (UTC)
replies: text: OK, this pieces-of-paper description eliminates the shortcomings I have found with other presentations of this particular example in the past - namely not revealing information about a vertex's order in "show cycle."  Thank you for the clarification. -- (Decateron (talk) 23:23, 4 June 2008 (UTC)
replies: text:  It appears that this article became another victim of "Applied cryptography". The version of the graph example before August 16, 2006 was much better than it is now. Maybe we should just revert about 2 years of changes on this section. Btw, I'd also support your suggestion to add a section with a discrete logarithm example. Such an example may be better suited to explain how the protocol can be simulated. 85.0.103.65 (talk) 20:09, 5 June 2008 (UTC)
replies: text: Is there a preference for DL as an additional example or DL in place of the graph isomorphism example? (Decateron (talk) 22:45, 11 July 2008 (UTC)
replies: text:  An example based on DL would certainly be informative. Why does it have to replace one of the existing examples? I.e., the graph isomorphism is quite good to show the commitment phase (at least if it is presented correctly.) 81.62.44.149 (talk) 11:02, 27 December 2008 (UTC)
thread_title:  A slightly different example section 

message: (see comment)
and then I realized I should have checked here first. The 'owner' should change it back if (s)he feels it's not correct or appropriate, but a discussion would be valid. Andrei r 20:22, 12 March 2007 (UTC)
thread_title:  I changed "NP" to "NP-complete" 

message: Would it be valuable to establish a list of zero-knowledge proofs (like the List of NP-complete problems)? --Johnruble 15:56, 22 June 2007 (UTC)
thread_title:  List of proofs 

message: While studying the Direct anonymous attestation protocol, I've seen usage of a digital signature algorithm (in this case, the Schnorr's algorithm, or a slight variant) as a zero-knowledge proof. Indeed, a digital signature proves that the signer knows the private key without disclosing any part of it to the verifier, and seems to be a zero-knowledge proof. Shouldn't this be discussed in the article? Googling around found a technical confirmation of this, under some hypothesis:  (also here), i.e.
"Invariant Signatures and Non-Interactive Zero-Knowledge Proofs are Equivalent (Extended Abstract)" by Shafi Goldwasser and Rafail Ostrovsky; but the article warrants at least a mention of the comparison, and that the fact that there may be some difference (if any, I've just read through the abstract).
--Blaisorblade (talk) 14:14, 9 July 2008 (UTC)
replies: text: The point of signatures is not proving that the signer knows something, the point is authenticating the message. But yes, in essence, a signature is a zero-knowledge proof of the statement “this message was endorsed by someone who knows the private key corresponding to this public key”. And in this sense they are a special case of signatures of knowledge, as introduced by Chase and Lysyanskaya. Kirelagin (talk) 22:02, 23 September 2021 (UTC)
thread_title:  Digital signatures as zero-knowledge proof of knowledge of private key 

message: Why is such a source cited? It is valueless.  —Preceding unsigned comment added by 129.132.45.22 (talk) 17:24, 3 August 2008 (UTC)
thread_title:  "unpublished manuscript" 

message: Correct me if I am wrong, but completeness for knowledge of Hamiltonian cycle problem, is confused with soundness.
During each round, Peggy does not know which question she will be asked until after giving Victor H. Therefore, in order to be able to answer both, H must be isomorphic to G and she must have a Hamiltonian cycle in H. Because only someone who knows a Hamiltonian cycle in G would always be able to answer both questions, Victor (after a sufficient number of rounds) becomes convinced that Peggy does know this information.
Shouldn't completeness just say that Victor always accepts if G contains a Hamiltonian cycle and Peggy follows the protocol?
Also, it seems a committment scheme is necessary for this example, wouldn't plain Graph Isomorphism, be an easier example? Couldn't we use Protocol 2 in "Proofs that yield nothing but their validity or all languages in NP have zero-knowledge proof systems"? Icmpecho (talk) 11:38, 4 April 2009 (UTC)
replies: text: The same issue (completeness confused with soundness) now appears in the section "two balls and the colour-blind friend".  Completeness should say: if the balls are differently colored, "you" (the non-color-blind prover) will be able to correctly determine whether the balls were switched, every single time. 108.217.33.225 (talk) 15:09, 22 November 2023 (UTC)
thread_title: Corrections

message: The Hamiltonian path example is confusing, at least, if not confused. It is not clear why an ignorant Peggy cannot generate, on each round, a valid H and also a random J together with a Ham-path on it. How would Victor be assured that H and J were identical? 
Mind, I don't doubt that the mechanics envisioned expressly forbid this strategy. I just say that the description given does not make this clear; for that matter, very little of it is clear; and I have considerable background in graph theory. I understand what is being said and don't feel that my objection is, per se, valid; but a reasonable person might raise it. It took me several readings to grasp what it is that Peggy commits to, what Victor sees prior to his demand, what he sees subsequently, and so forth. The mechanics are strained and artificial. 
Since graph theory is basically not taught at the high school level and it's not immediately clear to the untrained how any of it works, I'd suggest a much simpler example. Part of the confusion here is that the game depends heavily on probability. (For example, if G is small, the game is trivial.) Asking the reader to wrap his head around both probability and graph theory is too much. 
I'd incline to a game based on balls in bags. Sorry. — Xiong熊talk* 10:39, 21 January 2010 (UTC)
replies: text: If so, I lean toward eliminating the colored-dot bags and having Peggy simply order the balls while blindfolded behind a screen that prevents Victor from seeing exactly what she's doing but lets him see she's not peeking. 
* Does anybody want to make a fuss about Victor knowing beforehand how many bags there are, or the range of the numbers, etc.? (If he already knows, he learns nothing of this nature during the game.)
* It would undoubtedly be more elegant (and concise) to have only one ball per bag but I don't like the idea of Peggy putting the tainted balls back. Any way around this? 
Ground rules (do as you like, of course; these are mine): Since I don't know anything, I won't argue about the merits of the game. I'll help if in any way I've been unclear. If you feel this example is equally strained, sorry; I certainly won't try to argue that subjective point. I welcome any attempt to improve. 
Oh, and if consensus emerges to support this game, I will be happy to contribute appropriate graphics. 
— Xiong熊talk* 11:55, 21 January 2010 (UTC)
thread_title:  Hamilton is confused 

message: A little thought suggests an approach. This is not my field, so let's have the comments. 
This game involves a large quantity of lettered bags, in each of which is a quantity of numbered balls. Peggy claims to know which balls are in each bag. Victor knows nothing except the constraints: bags are lettered, balls are numbered, and each bag holds balls of only a single number. 
Prior to each round, Peggy removes one ball, individually, from each bag and puts it into one of another set of small bags, which she has marked previously by colored dots visible only to her. This removal is performed in front of Victor and with a closed hand; that is, Victor can see that Peggy cannot see the balls during the trip from the letter-bags to the colored-dot-bags. Peggy shuffles the colored-dot-bags. 
Now Victor demands to see, for instance, a ball numbered 42. Peggy then opens the appropriate colored-dot-bag and reveals the correct ball. At no time does she expose the colored dots to Victor; she alone can see them. 
The round ends when Peggy dumps all the colored-dot bags out, discarding their contents. 
Completeness: Peggy can only retrieve, on demand, a ball of a given number if she knows the number-ball to letter-bag and the letter-bag to colored-dot-bag mappings. (She might get lucky a few times but over a large number of trials, etc.) Therefore she supports her claim to know the number-ball to letter-bag mapping. 
Soundness: The chance of Peggy producing the right ball on demand (if ignorant) is \frac{1}{N}; the chance of doing so through T trials is \left(\frac{1}{N}\right)^T, which quickly vanishes as a realistic probability (for some value of "realistic"). 
Knowledge: Peggy establishes the letter-bag to colored-dot-bag mapping in Victor's sight (she is seen not to discover, in the process, the number-ball to letter-bag mapping); but since the colored dots are never seen by Victor, he learns nothing from the game about the prize in question. The colored-dot-bags having been shuffled, when Victor sees the ball he demands, he has no idea which letter-bag it came from. 
Again, this is not my field but it seems obvious that, if Victor is given the number-ball to letter-bag mapping, he can simulate the exchange without Peggy's help. 
So. A few things about this game remain uncertain to me; I have suspicions but no proof: 
* Is it permissible for Victor to demand more than one ball per round? 
* Could Victor simply demand of Peggy that she order the colored-dot-bags (by number), then reveal all of their contents? 
: If so, I lean toward eliminating the colored-dot bags and having Peggy simply order the balls while blindfolded behind a screen that prevents Victor from seeing exactly what she's doing but lets him see she's not peeking. 
* Does anybody want to make a fuss about Victor knowing beforehand how many bags there are, or the range of the numbers, etc.? (If he already knows, he learns nothing of this nature during the game.)
* It would undoubtedly be more elegant (and concise) to have only one ball per bag but I don't like the idea of Peggy putting the tainted balls back. Any way around this? 
Ground rules (do as you like, of course; these are mine): Since I don't know anything, I won't argue about the merits of the game. I'll help if in any way I've been unclear. If you feel this example is equally strained, sorry; I certainly won't try to argue that subjective point. I welcome any attempt to improve. 
Oh, and if consensus emerges to support this game, I will be happy to contribute appropriate graphics. 
— Xiong熊talk* 11:55, 21 January 2010 (UTC)
thread_title:  Balls 

message: In the Hamiltonian cycle example, why is a commitment scheme needed? ie what advantage would a cheating verifier gain by knowing H before deciding what to ask for (under the assumption that finding cycles and isomorphisms are computationally impractical)? Also as Icmpecho pointed out above, the claim that a cheating prover would (with high probability) be found out belongs under soundness, not completeness; I'll go ahead and be bold on that one. Stewbasic (talk) 21:58, 19 September 2011 (UTC)
replies: text: Actually on further thought I think I understand; this version only assumes that the Hamiltonian path problem is hard, not the graph isomorphism problem. Even if Victor can find graph isomorphisms, when he asks for the cycle Peggy only reveals the cycle edges, so Victor does not see a graph isomorphic to G. Perhaps this could be made clearer in the zero-knowledge section. Stewbasic (talk) 22:16, 19 September 2011 (UTC)
thread_title:  Commitment scheme 

message: I'm thinking that WPA2 (and WEP, WPA) must use a kind of zero-knowledge proof authentication. Right? Because what they do is that they both prove that they know the preshared key, but in a way where they don't reveal the pre-shared key to the other part (because he could be an impostor). I have been looking for information about this, but when I google zero-knowledge wpa2, not much legit comes up.  
I must admit that I do not understand all of this article, since it is quite theoretical. Have I misunderstood this, or is it fair to say that the WEP/WPA/WPA2 use zero-knowledge proof systems? Thanks
85.97.254.28 (talk) 16:29, 4 May 2012 (UTC)
thread_title:  WPA2? 

message: I told it to my son and he asked me:
Why doesn't Victor simply send Peggy through A and sees if she appears at B?
She'd prove that she knows the password without revealing it!
João Pimentel Ferreira 16:46, 24 January 2013 (UTC)
thread_title:  Peggy and Victor, don't get it... 

message: The article talks about a "cheating" verifier, and that a "simulator" is needed to ensure the "Zero-Knowledge" property.
Here's some of what I do understand:
* The existence of the simulator means that any third party who eavesdrops the exchange between Pat and Victor cannot know if Pat really knows the secret, because the questions might have been rigged.
* Thus, a simple digital signature cannot serve as a ZKP of public-key knowledge, because a witness could validate the signature and see that the digital signature is correct or not.
* At first, I thought that an HMAC with a random key would work, but a witness who knows the secret password could validate or reject the hash.
Some particular points I don't understand:
 
* What exactly is a "cheating" verifier?  
* What benefit could a verifier gain by cheating (with or without ZK)?
* What are the benefits of this particular design?
I mean, it's obvious to me how helpful it would be if I can prove that I know a password without having to tell that password to a remote system.  But I don't see how the existence of a simulator aids in that.
Stevie-O (talk) 17:47, 28 January 2013 (UTC)
thread_title:  "Cheating" Verifier and the existence of a simulator 

message: Sorry if I am asking you to do my laundry, but I noticed two distinct pieces of knowledge with the systems described: a) the secret itself (magic word, hamiltonian path), b) knowledge that Peggie possesses this secret. Do both or only one of them have to be kept secret for the system to be characterized as zero-knowledge? In the cave example, Victor can acquire the magic word without a proof that Peggie knows it and, conversely, he can acquire a proof that Peggie knows the word without the word itself (recording with random coin tosses). I understand this is only an analogy, but what about real systems?  — Preceding unsigned comment added by 94.66.70.215 (talk) 11:15, 25 February 2013 (UTC)
replies: text: A "zero-knowledge proof protocol" is a way for Peggy to convey something to Victor without leaking any information other than the information she's trying to convey. In the cave example, Peggy is trying to convey (b) to Victor without also conveying (a); therefore she's looking for a zero-knowledge proof of (b). Real systems are actually very analogous to the cave example; typically I know ("a") my password, and I want to prove to the system that ("b") I know my password, without actually revealing anything about ("a") my password to the system. Makes sense, right? —Quuxplusone (talk) 23:32, 5 June 2013 (UTC)
thread_title:  Another question 

message: As is generally understood in modern science and philosophy, proof can only exist in defined formal systems, and not in nature.
The best one can achieve is high statistical probability. Which only guarantees things “on average”. Meaning that it can still have 10 trillion consecutive failures, followed by (10 trillion − 1) trillion successes, to be “a one in a trillion chance”. And those latter ~10 trillion trillion successes can still be outside of one’s personal universe of causality, even if that’s not the case for humanity on average. It’s just very very unlikely. Not impossible.
So this should rather be called “zero-knowledge probability determination”.  — Preceding unsigned comment added by 89.0.124.45 (talk) 15:27, 28 October 2014 (UTC)
replies: text: This distinction is incorrect. The article describes a zero-knowledge proof in the context of cryptographic systems, which are by construction a formal and rigorous system where the term "proof" can be used exactly correctly. Jrfarah1999 (talk) 22:46, 11 March 2022 (UTC)
thread_title:  But there is no such thing as “proof” in nature! It’s utterly unscientific! 

message: The phone example is not really a ZKP, as there is no simulator. Anyone standing next to Victor while Peggy is unlocking the phone will also be convinced that Peggy knows the phone's code (and thus presumably that the phone is hers). Am I right? If not, it might be better to mention this, or delete the section altogether. Digilus (talk)
: I agree. The example is not zero-knowledge for the reason you pointed out. 178.199.25.189 (talk) 18:52, 23 July 2015 (UTC)
thread_title:  Phone example 

message: Yes, it is possible to verify that a user knows his password without exchanging secret information and without secret information stored in a central database.
: Why we don't just use it?  — Preceding unsigned comment added by 84.118.82.226 (talk) 15:25, 15 February 2018 (UTC)
thread_title: ?

message: I think there is something missing in the formal definition, zero knowledge of what? The simulation paradigm is missing this part. The simulation part is hard to understand, and I would guess people often get lost on what is being hidden. So the formal definition should stress what is being hidden. Jackzhp (talk) 12:44, 28 October 2018 (UTC)
thread_title: zero knowledge of what?

message: None of these meet WP:ELNO, but I've put them here so they can be mined for references (if they're up to WP:RS):
* SZK in the Complexity Zoo
* Applied Kid Cryptography – A simple explanation of zero-knowledge proofs using Where's Waldo? as an example
* A gentle introduction to zero-knowledge proofs with applications to cryptography
* How to construct zero-knowledge proof systems for NP
* An efficient non-interactive statistical zero-knowledge proof system for quasi-safe prime products
* A tutorial by Oded Goldreich on zero knowledge proofs
* Salil Vadhan, Vadhan's phd thesis on statistical zero knowledge
* Theory of Computing Course, Cornell University 2009, Zero knowledge proofs
* Ali Baba's Cave as told by Steve Gibson on TWiT show Security Now Episode 363 Wednesday August 1, 2012
* Demonstrate how Zero-Knowledge Proofs work without using maths
* The Bitcoin's  Zero knowledge proof to binding
- David Gerard (talk) 13:58, 20 April 2019 (UTC)
thread_title: External links moved from page

message: This article is written as if the reader had a PhD in cryptography. Is this really the intended audience?  — Preceding unsigned comment added by 24.241.152.175 (talk) 14:44, 4 August 2020 (UTC)
thread_title: Target level

message: Adding some top Dapps based on Zk proof  — Preceding unsigned comment added by Web3 student (talk • contribs) 07:21, 5 May 2022 (UTC)
thread_title:  Suggestion  

message: Program 45.250.47.203 (talk) 03:49, 5 February 2023 (UTC)
thread_title:  Html program 

message: i have just edited the page; i refactored and removed a number of repetitive and verbose statements around replayabilty. these statements, roughly, insisted repeatedly that the verifier, even after having engaged in a successful proof, should remain unable to replay this proof to third parties. on the one hand, this fact is essentially true, especially for interactive proofs (this is essentially the definition of simulation). even in the (abstract) random oracle model, it may be true under certain definitions—it depends on whether we stipulate that the oracle gets "reset" between the initial proof and the subsequent verification by the recipient of the replay. this is a subtle definitional question, and i don't think there is a clear answer. if the oracle does get reset, then the second verifier has no way of knowing whether the first proof was obtained with the aid of programming (say, by the zero-knowledge simulator), and the replay should fail; if it doesn't get reset, then the second verifier can verify the proof in the usual way, and the replay would "succeed".
on the other hand, this statement is essentially misleading, for the following reason. in the real world, where we use hash functions, we're in something like the second model above: replaying always does work, since the random oracle never gets "reset". yet this isn't a problem; though it might technically contravene zero knowledge, we usually don't care about this kind of replay, since the statement is connected to the prover. (I can always replay someone's signature, but who cares—it's signed under their key, not mine, so this has no use.) this topic is discussed in detail in this paper by Rafael Pass: https://link.springer.com/chapter/10.1007/978-3-540-45146-4_19 Benediamond (talk) 02:09, 28 June 2023 (UTC)
thread_title:  excessive language about replayability 

message: I am unsure about the correctness of the following excerpt:
Further, if Victor chooses his A's and B's by flipping a coin on-camera, this protocol loses its zero-knowledge property; the on-camera coin flip would probably be convincing to any person watching the recording later. Thus, although this does not reveal the secret word to Victor, it does make it possible for Victor to convince the world in general that Peggy has that knowledge—counter to Peggy's stated wishes.
I do not think that a third party could be convinced by a recording of the coin flip followed by Peggy correctly emerging out of the announced side, for the following reason: imagine Peggy also (secretly) selects at random a side to go through. The probability that the random choices "align" (i.e., Victor and Peggy's coin outcomes both mean A or both mean B) for a single attempt is 1/4. Now, by repeating this over and over again, we are sure to have arbitrarily long "runs" of consecutive alignments. All Victor and Peggy would have to do in order to obtain a N consecutive successes is to record a sufficient number of attempts, then trim the video to some long run of coincidences. Tassion (talk) 13:29, 23 April 2024 (UTC)
thread_title:  Ali Baba cave example (problem with video-recorded coin flips)