Why a 1914 puzzle book is on a security site

Every puzzle here fooled someone in 1914. Most of them still fool people now, and for the same reason: you assumed something and never checked. That's the whole of hacking, really. Old Tricks gets you used to the feeling of being wrong before it costs you anything.

Who was Sam Loyd?

He was America's best-known puzzle maker, and he was a bit of a troll. He told the world the tangram was 4,000 years old. He'd made that up. He took credit for the 15 puzzle, which he hadn't invented. He died in 1911, and his son put the Cyclopedia of Puzzles together in 1914. We rewrite the puzzles, keep his name on them, and say where he was wrong. A source that's confident and wrong is also a security lesson.

What's "the trick"?

Each puzzle ends with the assumption it used against you, then its twin in real security or computing. Count the chimes instead of the gaps, and you've made the same slip as a programmer who reads one byte too far. We check the numbers with a script before anything goes live.

How flags work

Solve a puzzle and you get a flag like HAM{midnight_chimes_d9ed51}. Gold means no hints. Silver is one or two. Bronze is three, or the walkthrough. Ghost means you asked for the answer: no streak, but the trick is still yours. Every flag carries one letter, and the letters from the 30 daily puzzles spell something on the last day.

Flags are honour-based. Anyone who learns an answer can work out its flag, and we know that. If you broke our hashes to get one, there's a flag for that too.

Privacy, in plain words

• No accounts, no cookies, no adverts, and nothing from other companies loads on this site.
• Your flags and streak live in this browser only. That's why there's a backup code on the flag wall.
• When you do something, such as start a puzzle, ask for a hint or solve one, the site sends one short, anonymous note to Hamcodes' own private counter. It holds a random id kept in your browser, the page and the event. No name, no email, no IP address.
• When a wrong answer is a short number, we keep the number, so we can see which mistakes are popular. We never keep what you type in the other boxes.
• If your browser sends Global Privacy Control or Do Not Track, we send nothing at all.
• We don't count page views, only people who did something. That's what the counter below means.

Credits

Puzzles adapted from Sam Loyd's Cyclopedia of Puzzles (1914), public domain. Rewrites, hints, walkthroughs, code and design by Hamcodes. Fonts are Fraunces, Newsreader and IBM Plex Mono, self-hosted under the SIL Open Font License.

If you prove an answer wrong, we fix the card the same day and your flag stays valid whichever answer you gave.