I made a minor edit.
What I attempting to prove (as far as proving using hashes) is to show a fair shuffle. Knowing what you know after the fact, after you've seen your own cards, what is the probability that the other cards you never see are not part of the same deck?
Edit1: Other players can prove their own cards, and they don't have to tell you what the cards are, just that they verified themselves. If all or some players do that, you know that all the cards on the table, face up and face down are valid and belong to the same deck.
I think this is good enough for now. I might have an additional layer of "provability" by using additional secrets (which I'm still working on if it makes sense or not), and for now, it would be infeasible to attempt to find collisions just to manipulate cards in a deck when I have already published hashes of the cards (even if you never see them) and published a randomized order of cards with a different set of hashes that are linked to the card secrets.
I don't know the exact numbers, but I dare say you are still looking at close to 2^256 for every single card.
From the other thread, this was said:
I think we want two solutions to this:
1. With a central server that does not need to be trusted (but can generate the shuffling.)
2. P2P version of poker. No need for servers (except maybe to find other players.)
I like option 1, too. Total decentralization is like the holy grail of online poker, but it seems to me that a central server would still be needed to organize the games, keep them moving along at a reasonable pace, and to act as a trusted escrow service to transfer funds back and forth. Maybe you could build a p2p client to handle all that, but then you'd get cheaters building their own clients to get around any constraints.
It's an interesting problem anyway and I'm pretty sure there is a big market for it. My own informal survey of bitcoin gaming sites tells me that the most profitable sites are also the 'provably fair' sites (bitZino, Just-Dice, etc). People aren't fools (for the most part). A provably fair HU poker site would almost certainly get a lot of action from high-rollers ... is my guess. I can see the $$ in their eyeballs now.
So mental poker falls into #2, while I am attempting to solve #1. We have to take some assumptions, like for example, that the dealer / site operator / owner can be trusted.
And, if there are two player tables (heads up poker), then obviously I can't play my sockpuppet there. That would be too obvious, and someone is going to notice very quickly. I'd rather play as myself, while declaring that I'm not cheating.
But like dooglus, I will probably stick to limit games or low stakes, because, with a house rake, I don't need to play to make money. I will play just to be better at poker myself.