I would like to make a black jack game. I want it to run a a local web server (asp.net, c#, iis express) for the game client (instead of a window with D3d). I also want to be able to let players play for real money but that would come later on in the design, but keeping that in mind.

Regardless of the above platform, how would the design be?

I was thinking I could use Gmail and send moves to the other players gmail account and the client would pick it up (so no need for firewall, server port routing, etc)

But how would it work so that the Player hosting the game can't just read his DB/RAM/whatever and see what the Deck of Cards looks like? There should be a "dealer" that hosts the deck so the 2 players can't see it, but how would that work?

I was thinking some kind of encryption but still the player hosting the game would see the whole deck.

57 minutes ago, andreib said:

I also want to be able to let players play for real money but that would come later on in the design, but keeping that in mind.

Not sure at all about money transactions without a server for some of the processing record keeping. As well as technical means, be aware of any legal requirements.

55 minutes ago, andreib said:

I was thinking I could use Gmail and send moves to the other players gmail account and the client would pick it up (so no need for firewall, server port routing, etc)

Generally I am not going to give some random access to my personal email accounts. I guess you could have players manually send/download the email themselves, but that is not a great experience.

46 minutes ago, andreib said:

There should be a "dealer" that hosts the deck so the 2 players can't see it, but how would that work?

I was thinking some kind of encryption but still the player hosting the game would see the whole deck.

How exactly can you have a "dealer" (or other "trusted party") if you are serverless? That is exactly what a server might be doing.

You can encrypt the email content, maybe even stuff stored long-term in memory, but as soon as people start going through client software code (especially easily decompilable ones like C#, Java, JS, etc.) and memory they are likely to figure it out.

Why do you want to be serverless? Something like a card game should be plenty doable if you host a web server, and as that is out of the players direct reach, you can stop them seeing other players cards etc. Card games are also pretty simple in terms of server processing compared to real time stuff, a cheap web server would be able to handle a lot of clients.

SyncViews  -  I want it to be server-less because I'm not interested in hosting anything. Then people can claim that I am controlling cards on my server. I guess I could just do normal tcp/ip but still how to protect the deck?

In security, something has to be trusted. If they don't trust your server, why should they trust your code? Likewise with just two people who don't trust each other, how can you know one of them didn't memory scan, network scan, or use a modified/hacked client?

Even if you encrypt the deck in memory. Where would the host player get an encryption key from that the player can't tamper with / steal? How do you know they didn't modify your code to output/copy the entire deck? Or maybe they just grab the decks contents while it is loaded like a debugger does?