Scumhouse
Mafia, played out over days by post. A village of townsfolk, a couple of killers among them, and no moderator.
The loop
Day. Everyone talks in the town square and votes to lynch. A strict majority ends the day immediately. If the deadline arrives first, whoever has the most votes is lynched -- and a tie means nobody is.
Night. The mafia agree a target in their private channel. The doctor protects someone. The vigilante, if the table is big enough, may take one of their two shots. At dawn the results are announced.
The town wins when every mafia member is dead. The mafia win when they equal the number of remaining townsfolk -- at that point they cannot be out-voted, so the game is over rather than merely decided.
Tables
| Players | Mafia | Cop | Doctor | Vigilante | Roleblocker | Tracker | Watcher | Town |
|---|---|---|---|---|---|---|---|---|
| 5 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 3 |
| 6 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 3 |
| 7 | 2 | 1 | 1 | 0 | 0 | 0 | 0 | 3 |
| 8 | 2 | 1 | 1 | 1 | 0 | 0 | 0 | 3 |
| 9 | 3 | 1 | 1 | 0 | 1 | 0 | 0 | 3 |
| 10 | 3 | 1 | 1 | 0 | 0 | 1 | 1 | 3 |
Roles
- Mafia
- Kill one player per night. You know your partners and can talk to them privately at any hour.
- Cop
- Look into one player per night and learn whether they are mafia. They cannot lie to you, and you submit nothing to the server — your whole night happens in your own browser.
- Doctor
- Protect one player per night from a kill. Not the same player two nights running.
- Vigilante
- Two shots for the entire game, none on night 1. A vigilante who shoots the doctor has done the mafia's work for them.
- Watcher
- Watch one player each night and find out who visited them. Your report arrives at dawn.
- Tracker
- Follow one player each night and find out who they visited. Your report arrives at dawn, once the night is final.
- Roleblocker
- Stop one player’s night action. You find out which anonymous slot they hold — never what they were about to do, and never their role.
- Town
- No night action. Talk, read, and vote.
What the server can and cannot see
This is the unusual part, so here it is without spin.
What it cannot see
- Which player holds which role. Your role is dealt to an anonymous identity your own browser generated. The server hands out one blind-signed credential per player -- it signs a value it cannot read -- and you redeem it with no session attached. The server knows a mafia card went to "slot 3". It has nothing that says slot 3 is you.
- The mafia's conversation. Its key is a Diffie-Hellman secret between two private keys that were made in two browsers and never left them. The server stores fixed-size ciphertext it has no key for, sitting alongside the cover traffic every other player's browser posts.
- Who submitted a night action. Actions are signed by a slot, not an account, and are sent without a cookie.
What it can see
- Everything public: the day thread, every vote, who died and how. That is the game, and hiding it would be pointless.
- Which slot numbers hold which roles. The server needs this to adjudicate the night without a human moderator. It is inert without the account link.
- Your IP address, if it chooses to log it. This is the real limit. Anonymous requests still travel over the network. This game's anonymous endpoints run with access logging off and never read the client address, but that is a promise about a configuration, made to you by the person who controls that configuration. If that is not good enough for you, play over a VPN or from mobile data.
The honest ceiling
All of the above defends against an operator who reads the database, not against one who rewrites the code. The page you are reading served you the JavaScript that holds your keys. A determined operator could ship a version that quietly mails them home, and no protocol design fixes that.
What it costs them is that the backdoor has to be published. The crypto is one
static file; its hash is committed to a
public repository, written into every game page as an
integrity attribute your browser enforces, and checkable from a machine this
operator does not control — including yours.
sha384-sHSxWEeCNiNNGvmFH39LWvfbRmBxjDWG2SQ7TP5cjF7VHFKEMW770Cz91W8jrDP8
Check the code you were served →
What can and cannot exist here
The privacy design does constrain the role list, but not where you would guess. Anything that is one player asking about one named player, on a budget works — the cop, the tracker, the watcher, the roleblocker all decompose into two halves the game already has.
What cannot exist is a rule where the game engine itself needs to know a living player’s role: something like “the mafia kill fails if it hits the vigilante”. Nobody is asking anything there, so nothing pays for the lookup, and the only way to settle it would be to keep the very map this game is built to destroy.
How the cop works without anyone holding the answer
Every player publishes a sealed envelope naming which anonymous slot they hold, signed by that slot’s key so they cannot lie. It has two locks. The outer one is the investigator’s public key, which the server does not have. The inner one is a key the server does have — safe, because it can never get past the outer lock to use it.
Each night every living player’s browser draws one blind-signed token and spends it on somebody: on a real target if they have a question, on a random player if they do not. The server hands back one inner key per token and sees a pile of requests naming a pile of accounts, with no way to tell which was the real question or who asked it. Holding the rate limit and holding the ability to read are split between two parties who never combine.
Questions are only accepted during the first half of the night, and every answer opens at the halfway mark, together. That matters more than it sounds: if answers came back the moment you asked, the person who sat and thought about it would stand out from the people whose browsers asked on autopilot. Everyone waits for the same clock instead. The second half of the night is for acting on what you learned.
What it still costs: the server sees the set of accounts asked about each night and knows one of them mattered, without being able to tell which. And you have to open the game in the first half of the night to investigate at all — that one is a real inconvenience, not a cryptographic subtlety.
If someone refuses to show their card
When you die, your browser opens your card automatically. A player who tampers with theirs could refuse — and the whole game would stop, because nobody can count the mafia until every death is accounted for.
So each card is also escrowed at the start, locked with a key split into pieces and handed out one per player. If someone dies and does not show their card once the deadline passes, everyone else opens their piece, and the card opens without them.
It takes every other player to do it, which means a dead mafia’s partners can still refuse and stall. But refusing is public: whoever does not hand over their piece is visible to everyone. You cannot block a card quietly.
If you lose your keys
Your card lives in your browser's local storage. Clear it and your card is gone -- there is no copy anywhere else, by design. The game screen shows a recovery code the moment your card opens; keep it. There is also an optional server-side backup, wrapped with a passphrase that never reaches us. It is optional because it is the one record that ties your account to your (encrypted) identity, and a weak passphrase would undo that.