[pokerplayerguy]

interesting discussion. disclaimer: i';m not a statistician nor do i know anything and everything written below is voodoo

ftp claims compliance with NIST standard FIPS140-1 for random number generation. a search shows there's a set of statistical tests any rng needs to pass. FIPS140-2 is available as PDF and has verifications possible with 20k bits of RNG (its struck out of the standard - not sure why but still a good read as a starting point). So one could apply the bit tests to hands from stats sites perhaps but you would need to write up some proof of some transform from cards into bit patterns that was invariant w.r.t. the bit tests, although intuitively this seems not wholy unreasonable but again i'm not an expert. Then just 20k worth of bits could test an RNG (according to crossed out bits).

The "your hands are only a fraction of the total hands" argument gets at the notion of needing a large enough sample, but the total number of hands i believe is less relevant than the size of the sample compared to what the variance/properties youre testing for is. for example, all the RNG verification tests themselves are only a fraction of all the random bits ever generated by mankind, but we still consider the tests significant.

its interesting also that becuase hands can be recorded these sites are subject to potential auditing by sufficiently motivated or annoyed rogue statisticians - so they are at risk if they were they to rig something - partly from discovery and partly from people finding flaws in their systems and abusing it. Mind you to keep conspiracy theory alive, its seems plausible that at any stage they can maintain bit patterns that would pass verification, but still pick'n choose the next card that came out - for example consider the monobit test discussed in the standard - one could conspiracy theorize rigging something that could pick a more 'exciting' card that had the same number of 1's and 0's in its bit pattern: 1010, 1001, 0101 etc. which means you'd need statistics on longer runs or patterns which would mean more cards necessary. actually determining how many cards one needs to observe to make a conclusion would be a pretty interesting task in itself. Maybe thats why the tests are crossed out in the '02 version of the standard and why they use the dieharder standards which take their queue from what look like more sophisticated NIST rng verifications.