I'd make one minor modification to Rich's procedure: result is the 13th bit of a SHA-256 hash of everyone's "votes", which "vote" could be any number they want to contribute, but it must be fixed & written down (in some fixed sequence). The problem with "odd" instead of "hash" is that every vote *counts*, but in a way such that an additional vote is trivially guaranteed to change the parity and hence the result; it is too easy to hide a person or vote twice. With a hash -- even a hash of subsequences of the list -- there is no simple relationship between the intermediate result and the final result. Yes, checking the SHA-256 hash of a long list can't be done in anyone's head, but everyone's cellphone can do SHA-256. At 06:26 PM 5/31/2017, rcs@xmission.com wrote:

Announce in advance "an odd number of Heads is outcome A". Everyone in the crowd flips his own coin in private, and reports the answer in a sealed envelope, the "ballot". The ballots are opened in full view, and Heads are counted. No particular problems with a stuffed ballot box, or multiple voting, or individuals choosing to used biased coins or just plain cheat. As long as observers are sure that every ballot is counted, anyone who cares about the outcome has contributed his own version of a random bit.

Rich

------------ Quoting Henry Baker <hbaker1@pipeline.com>:

...

In general, I don't think that any amount of *passive* observation will be convincing.

Science is only believable when *independent* experiments are supplied with *independent* random streams of bits; i.e., if I am allowed to perform the experiment myself using my own source of random bits. ("Supply a wiggle in, and see what wiggles out")

Of course, this raises the following possibility (sci-fi writers, listen up!):

In the future, the NSA will be tasked as a monopoly providing all necessary random bits. It does this by producing quantum entangled pairs of particles, supplying the market with one of each pair, and keeping the other particle in labeled storage.

If/when the NSA customer "measures" one of the "market" particles, the entangled particle will also assume the same state, so the customer will have his random bit, and the NSA will also be happy.

At 02:31 PM 5/31/2017, Dan Asimov wrote:

...

You have to perform a random binary experiment in front of a crowd of people — so no fooling is allowed — in in such a way that everyone is convinced that the experiment was fair.

The people include some technical experts but many who are not.

What is the simplest / easiest / cheapest way to ensure that the crowd will be convinced that the experiment was fair (the two outcomes had an equal chance of occurring) ???

—Dan

P.S. I do not have ann answer to this, but maybe there is a "best" answer.