Disclaimer: I am not an expert on security or RNG, programming, or mathematics. I am a hobbyist at the best of times. Forgive me for any misunderstanding or errors in the following.
Things to Ponder :
There are so many issues that will play a part in just how random things are in the game, be it deck contents or distribution of decks and the randomization thereof, especially in the first release. There are currently only 370 unique cards in the database. There are 3 out of 7 factions in each deck, with the number of cards in each faction being fairly consistent. There are 12 of each faction in a deck. For simplicity, lets say the decks are weigthed: 1(common), 2(uncommon), 8(rare), and 256(super special) . The number of any specific type of card is aslo constrained—at least two creatures in each faction, etc. Also, certain special cards will always be found together (the four horsemen). All of these factors limit complete randomization, though that's not a bad thing, as no one wants to open a deck with no Mars creatures (though I do have one with only two and sucks enough). This is all being based on algorithms, which may or may not be very securely guarded, and psuedo-randomizaton, which may or may not be I think seeing patterns that don't exist or RNG failure are both possible.
RNG (Random Number Generation) :
There is also the possibility of sloppy randomization of decks on the part of the manufacturer. Insufficient entropy early in RNG may be part of the problem in earlier product. That can also be the case with any manner of pseudorandomization. The problem is much worse if there is a definitive algorithm to determine what goes where. If the distribution of decks is based on an encrypted randomizer with improperly salted hash tables this can lead to crackers or hackers who may be able to identify deck names, contents, and various other types of information, and especially problematic where decks may end up. This is especially true in deck distribution among boxes. Those inexperienced with CCGs will be more likely open to security vulnerabilities in these area.
While FFG has done a lot of LCGs, none of these things matter for those.
All of this makes me wonder what the security team was like for KF and what their scope in the project was (purely design side or comprehensive through manufacturing/packing)? If the manufacturer is especially good as such things, but ill-informed from the company, this could lead to patterns. My father-in-law was is a retired maths professor from NYU, maybe I can drag him into some of this as a puzzle solving experiment).
The possibility of dwindling unique randomization may also come into play if they have print enough product with such constraints and minimal unique content.
Seeing Patterns :
All that being said, human beings are very good at seeing patterns where none really exist. With only 370 different cards and all the other limiting factors on randomization this can lead to these "patterns" being seen incidentally quite often. There may be a vast number of combinations, but the type of randomness you're looking for is likely to look less patterned over time as new sets come out. If it's truly random, much of what it does in a small enough sample, even if they seem large to you) will look like patterns. A deck that's truly random might have seven cards come out in order and we'll say, "Well that's not random." There's nothing special about order to a true randomizer.
I'm not saying that there isn't a pattern, and if FFG can identify exactly where each deck is to pull inappropriate ones, then it's almost certainly a hashed value that can be cracked. If they're using hashed randomization—which would decrease effort to match decks to the database—if they're not appropriately salted (ie reusing salt, or salts that are too short), then that could be an issue not only for randomizing product, but also keeping unique identifiers secure all the way up to entire box contents based on two or three decks.
It makes me want to play (the game and the hacking thereof).
!
