This is another high cost rule that will create a heap of costs on all sites and players. It is reasonable for players to have the option of multi-factor authentication, but the vast majority of account balances are tiny and not worth the hassle. The best people to make such judgements about whether multi-factor authentication is worthwhile are the players themselves.

For example, it costs ~$96 (including shipping, handling, etc.) to deliver a RSA Security Token to a player.

ok, I retract that...make a minimum balance requirement or at least ensure the sites offer the option to those with balances above $X

Why wouldn't we let the free market decide such things? There's a huge chunk of players who don't want the hassle of such devices (I, for example, chose my current bank for various reasons, one of them being that it does not force me to carry a stupid device with me if I want to do banking) and further, there are various technologies (phone call, text messaging, etc.) that provide similar competitive services.

Currently, a player can choose a poker site on a variety of attributes - and one of those attributes is whether or not they provide different tokens. Some sites use the original RSA Security Token, some sites provide cheaper imitations, some sites provide other technologies. If you proscribe a certain technology, it also precludes new developments and someone coming along with a better idea.

I wasn't suggesting the regulations specify the type or technology of multi-factor authentication. I assumed this would include things like text messages/phone calls or I even had the iPod app for Full Tilt (though I almost always used the token as it was more convenient).

Multi-factor authentication is required to do a payout and required if you fail to login properly 3 times in a row (I believe). I don't really understand the reasoning behind the payout requirement. I can understand for login needs.

As a player, my main reasoning for supporting legislation/regulation is to get some consumer protections and get some confidence in online poker restored. It seems like protecting bankrolls would be the main issue. Stories of hacked accounts aren't going to sit well with the recreational players.

Almost no one gets money cashed out during a hack, if that's the rationale for having some sort of multi-factor authentication, it is stupid and based on a misunderstanding of how hackers and fraudsters work in online poker.

If you want to stop hackers from cashing out money, you simply require money to be cashed out to accounts in the name of the account holder. It's not rocket surgery.

I imagine the cost would go down some over volume quantity.
I imagine the #'s issued by Stars and Tilt likely justified use of FPGA's/CPLD's by developers... 96$ sounds about right there,
altho I think some1 was skimming huuuuuuge profit margins.
You go to volume, custom, ASIC's, etc., anything over 30$ is insane.

IIRC, these things had no solar cells[bright idea!], just batteries that would go pfft after 6 months. There's no reason these couldn't be cheaper than scientific calculators imho.

6.140(3) & 6.170(1): Is this long enough? Seems like info that needs to be stored for one year at least, if not far longer.

6.180(2)(a): Records should be retained for a set period of time beyond being "resolved or voided", in case of a dispute that arises.

6.180(4) & 6.180(5): Once again, 90 days is not long enough. Detection by players of problems can take longer. (See the history of 2+2 investigations into site scandals for time frames). These incident and transaction records should be retained for a minimum of one year.

6.190(2): The same notifications should apply whenever changes are implemented, not just when implemented during a player session.

6.190(4): Not sure what "informs or enables" means. Maybe should be "informs and enables".

6.190(5): Might be construed to mean that rules & fees across all jurisdictions must be the same. If site operates in multiple jurisdictions, as allowed by law, there might be a need for multiple sets of rules, fees, etc.

6.190(7): Change "i.e. Poker" to "e.g. Poker" as it's not the only game which is played player vs. player.

6.190(7)(a): Intent of second line is not clear. Maybe change "This includes the ability" to "This includes the prevention of the ability".

6.190(7): Need to add some regulations about returning funds to players who were cheated by collusion, bots, etc.

6.210(4)(c): Add reason for account closure and disposition of account balance.

6.210(4)(d): Add IP address of authorized player.

6.120(4)(e)(1): Seems like "Date of Activity" doesn't apply to this report. Maybe should be "Date of Report".

6.120(4)(f) & (g): Add IP address of authorized player at time of transaction.

6.120: There should also be reports required regarding total player account balances, e.g. a daily/monthly report of total player balances and any transactions to trust accounts to cover the full balances and/or current method of guaranteeing security of the full balances.

And add MAC addresses of NICs used for that account.

Heh. Many, perhaps most, people don't know the difference between "i.e" (id est, "that is") and "e.g." (exempli gratia, "for example"). Usage:

"It's full of sucrose, i.e. 'sugar'."

"We need leafy greens at the pot-luck, e.g. spinach."

I make it no worse than even money that the writer of the bill didn't know that he was saying specifically poker rather than poker as an example. The poster is correct, of course, it should be fixed to cover other games.

Regards, Lee

Booked. (Whoever wrote the bill writes legal language for a living. He knows the definitions of i.e. and e.g., though he might have spaced out when he was writing that specific text here.)

Out of curiosity, what other player-vs.-player games (besides poker) would/could likely get in on this legislation? I truly don't play anything except poker when I visit a casino so I don't know what other games those places have to offer. Everything else I can think of pits the player vs. the house.

Badugi, for one.

Backgammon for an obvious other

Hmm, I would have considered badugi (or any of its variants) to be a form of poker. Perhaps another reason why it's best to read "e.g. poker" rather than "i.e. poker" as stated above.

Good call on backgammon, though... I see several for-money online backgammon sites, now that you mention it. I never knew they existed, but then again, that's another game I don't play.

And I guess mahjongg could potentially take off to the point that enough U.S. citizens would want a for-money site. Gotta keep that door open as well.

Aren't there backgammon computers?