Security

Fair cards and dice

• The cards are shuffled and the dice rolled on our server, with cryptographic randomness: the same kind of randomness that is used for encryption keys. Nobody can work out in advance what comes next, not even us.
• Your browser only gets your own cards. Other players' cards are never sent to your screen until they are shown on the table, so they cannot be found in the page's code.
• The server decides every move. A move that breaks the rules is not accepted, however it is sent.
• In Flaxa and Femkamp the server plays your game again from your taps and counts the score itself, so nobody can type in their own score.

The feather chain and Bitcoin

Spelbordet has its own chain of blocks, where each block carries a fingerprint of the block before. Once a day the newest block is anchored in Bitcoin's blockchain with OpenTimestamps. After that nobody, not even we, can change anything in the chain without it showing. Rounds of Stop the clock and the reaction test are saved as proofs in the chain today, and you can check a proof yourself in your browser. The card deals are not saved in the chain.

Against cheating and bad behaviour

• A game logged from a real table does not count if any of the other players says no.
• In the chat you can report a message and block a player. Rude words are hidden automatically, and reports are read by a moderator.

How we protect your account

• All traffic is encrypted over HTTPS.
• Passwords are never stored in plain text, only as a salted hash (scrypt).
• The login cookie cannot be read by scripts on the page, and other sites cannot use it to act in your name.
• Too many wrong login attempts are blocked for a while, so nobody can guess a password.
• The accounts database is backed up before every update of the site and at least once a day, and every copy is checked.
• Every change to the site is tested automatically before it goes live.
• The pages only run our own scripts. The browser stops code that someone tries to sneak in, so nobody can read your cards or take over your account that way.
• The site cannot be shown inside other sites, which protects against clickjacking.
• The server is at Oderland in Sweden.

Found a security problem?

E-mail hej@spelbordet.app with what you found and how we can see it. Only test against your own account, never touch other people's data, and please do not tell anyone publicly until it is fixed. We answer as soon as we can and are happy to thank you by name once it is fixed.

The details are also in security.txt.