Page 1 of 1

Potential Exploit -- Re-Iding the deck

Posted: 10 June 2020, 15:22
by MikeIsHere
In 2 player cribbage the player gets six cards later in the hand then the non-dealer cuts a card

Right now in my game the cardIds for the player hand is expose

<div id="myhand_item_10" class="stockitem "

In one game lets say card.id = 10 is the 5 of Hearts

Now when the person goes to cut the deck I display all cards with there card Id but a card back showing

...

<div id="fullDeck_item_9" class="stockitem " style="top: 0px; left: 96px; width: 72px; height: 96px; z-index: 10; ..."></div>
<div id="fullDeck_item_11" class="stockitem " style="top: 0px; left: 108px; width: 72px; height: 96px; z-index: 11; ..."></div>

....

Now in the game database cad id 9 is 9 of diamonds and card id 11 is the 9 of hearts

IF a player was to record all the ids in there hand (and even the ids of cards played by there opponent) then over the course of a game the player can cut the correct card that they want.
I verified this using the next hand and looking for fullDeck_item_10 and cut the 5 of hearts

My question is
Can I recreate the card table every hand?
What is the computing cost of doing so?
Is it as simple as re-running these lines?

Code: Select all

     $this->cards = self::getNew( "module.common.deck" );
     $this->cards->init( "card" );
     
     $this->cards->createCards( $cards, 'deck');

Re: Potential Exploit -- Re-Iding the deck

Posted: 10 June 2020, 16:27
by tdhsmith
I don't know anything concrete about the implications of re-id-ing (though from a generic database standpoint, it seems very likely to introduce some sort of error -- for example how will the log/replay know which cards were which before/"across" a re-id-ing boundary?). However it seems to me you should be avoiding a "real" deck entirely.

It would be safer to just have "dummy" deck displayed client-side (not backed by a real server-side Deck and simply created through template manipulation) that when clicked only relays the position index within that deck. Then server-side you use that index to determine what card was actually selected and move it as appropriate.

(Or heck, if you don't care about perfect simulation, fake the whole thing. Players can never be certain whether you really cut where they selected or whether you just pulled a card out a random, and they are mathematically equivalent. But I get that it doesn't sit right with everyone.)

Even if you did manage to reissue IDs, using identifiable face-down cards leaves yourself open to other logical holes. Players might not be able to identify how to manipulate the cut, but they might be able to identify which cards are in player hands. Or they might figure out how your id shuffle works internally and be able to predict patterns in the IDs.

Re: Potential Exploit -- Re-Iding the deck

Posted: 10 June 2020, 16:29
by RavingWanderer
In cribbage, there is no reason for the browser to have the whole card deck, it only needs the cards visible either on the board or on player hands. You should execute the card cut on the server. i.e. user selects "Cut cards" (by whatever means), which makes server request. Server picks a random number N based on the current size of the deck, picks the Nth card as the cut card, and exposes it to players via notify. User has no opportunity to cheat. (This method is for verisimilitude with the actual game mechanics. Alternatively, you could just pick the top card, and Nobody Will Know The Difference.)

Re: Potential Exploit -- Re-Iding the deck

Posted: 10 June 2020, 17:50
by MikeIsHere
tdhsmith wrote: 10 June 2020, 16:27 (Or heck, if you don't care about perfect simulation, fake the whole thing. Players can never be certain whether you really cut where they selected or whether you just pulled a card out a random, and they are mathematically equivalent. But I get that it doesn't sit right with everyone.)
Yeah I wanted to make the user feel that they were part of the game and that the game wasn't just 'happening' to them. But point well taken
tdhsmith wrote: 10 June 2020, 16:27 Even if you did manage to reissue IDs, using identifiable face-down cards leaves yourself open to other logical holes. Players might not be able to identify how to manipulate the cut, but they might be able to identify which cards are in player hands. Or they might figure out how your id shuffle works internally and be able to predict patterns in the IDs.
Hopefully not, the opponent's hand is not on screen, so a card id is only revealed after it is played