How would a serverless card game (black jack) work between two players

57 minutes ago, andreib said:

I also want to be able to let players play for real money but that would come later on in the design, but keeping that in mind.

Not sure at all about money transactions without a server for some of the processing record keeping. As well as technical means, be aware of any legal requirements.

55 minutes ago, andreib said:

I was thinking I could use Gmail and send moves to the other players gmail account and the client would pick it up (so no need for firewall, server port routing, etc)

Generally I am not going to give some random access to my personal email accounts. I guess you could have players manually send/download the email themselves, but that is not a great experience.

46 minutes ago, andreib said:

There should be a "dealer" that hosts the deck so the 2 players can't see it, but how would that work?

I was thinking some kind of encryption but still the player hosting the game would see the whole deck.

How exactly can you have a "dealer" (or other "trusted party") if you are serverless? That is exactly what a server might be doing.

You can encrypt the email content, maybe even stuff stored long-term in memory, but as soon as people start going through client software code (especially easily decompilable ones like C#, Java, JS, etc.) and memory they are likely to figure it out.

Why do you want to be serverless? Something like a card game should be plenty doable if you host a web server, and as that is out of the players direct reach, you can stop them seeing other players cards etc. Card games are also pretty simple in terms of server processing compared to real time stuff, a cheap web server would be able to handle a lot of clients.

SyncViews - I want it to be server-less because I'm not interested in hosting anything. Then people can claim that I am controlling cards on my server. I guess I could just do normal tcp/ip but still how to protect the deck?

In security, something has to be trusted. If they don't trust your server, why should they trust your code? Likewise with just two people who don't trust each other, how can you know one of them didn't memory scan, network scan, or use a modified/hacked client?

Even if you encrypt the deck in memory. Where would the host player get an encryption key from that the player can't tamper with / steal? How do you know they didn't modify your code to output/copy the entire deck? Or maybe they just grab the decks contents while it is loaded like a debugger does?

Being "peer to peer" yet "free from cheating" is a very hard problem. For a long time, this was thought to be impossible, but modern mathematics has a function called a "zero-knowledge proof" that may let you implement certain algorithms without being able to predict or cheat the outcome. The best-known implementation of this is the blockchain currency ZCash, which uses "ZK-Snarks" as a unit of currency. (ZK stands for "Zero Knowledge.')

That being said, the mathematics for this is advanced, and the kinds of algorithms you can implement are limited, so this is probably not a solution to your problem. In general, no, you can't implement gambling (especially for money) without a central server that's not accessible to the players. Obviously, casino gambling websites and services exist, and one of the services they provide is the trust that other players aren't cheating. (Whether the house is cheating or not is of course up for debate ... and the reason why real-world casinos are strictly regulated in the real world.)

The least bad option for you is probably to write your gambling system to determine "the next card" using some random function that you can't predict before you make a decision. One obvious platform for this may be the Ethereum block chain -- if players make a move on turn T, the block chain hash of turn T+1 could be used as a seed for a random generator. However, black-jack still has the problem of necessary hidden state, because if the dealer shows an ace, you have to check whether there's a dealer blackjack or not. You may be able to avoid this by explicitly modeling the resolution of whether the hidden card is a 10 or not, but not exactly what it is, but this ends up being quite murky.

In short: For gambling, you need a "house" (secret server,) and you need the players to trust the house. (Whether playing for money is legal in your jurisdiction, a good idea, can be implemented, etc, is a totally different question, which this is not the right forum to answer.)