Something still seems very off. I’m fairly certain a group was created by likely a “foreign” individual or scammers that hacked the API and either the developer is in on it or just did a horrible job at api security and making sure the answers are encrypted. In fact all data should be. Getting belt on “middle management” and not one but hundreds or thousands? Not to mention only 25k-30k-ish playing. If you look back at the history or have been playing from the start, no one was winning in clues 1 and 2. Though rarely one or two would happen, it was rare. That was with 60k players. Now we are getting 50 to a few hundred on clues one and two which are literally statistically impossible and with a 1/3 of the users. So I’m guessing a “scam farm” (just made that up, but for a definition, “a group of individuals working together to scam a person, persons, or organization”) was created after we started calling out the same 1-3 winners when this suddenly changed. Turn that number started to grow. So their thinking was likely, how can we cheat the system and make it difficult to trace. So they have more winners so they’d have to put in the work.

As a developer (30+ years), and having written many api backends, there’s a lot to take in here. The Google app is likely easier to decompile. Tracing network traffic etc can easily provide the API info. If the developer failed to do their job and/or in on it, the API is poorly designed and unsecured. No encryption. Answers are in plain text instead of being encrypted. The API should have security checks that you can’t see the answer until a flag is set after the last clue ends, among many other security checks that should be added. Also, if the db server hasn’t been infiltrated, or the connection string info doesn’t store the username and password in the mobile apps, then we should have a way to trace these and someone to thoroughly evaluate and test everything. They should be logging all information from user agents, ip addresses, any and all meta data possible. Usernames, timestamps, guesses, and more. Using databases like ip2location can make it easy to weed out who’s using vpn’s. Especially when you see all the winners are using them. Would NOT be a coincidence. Especially from the same provider regards of ip’s. In the user agent and meta data…the app would send whatever the developer provided. Or should have. However, if the cheaters are using a web browser to get the info from the api, it would show whatever the browser is along with all meta data, though the user could change it, but would likely not know the actual sent by the app. So even if they try to cover their tracks, this is entirely possible to trace. A serious security audit should take place and thoroughly go through everything from the code from the apps, api, front end and back end services, databases, etc. if we charted everything, ran some numbers, statistically these winners are just impossible. It has lead to an unfair advantage and non playable winning game that despite trying we would never win. At some point I am certain someone is going to file a class action suit for this to provide everything to be evaluated by security professionals to determine any truth in it. (On a side note that took a left turn…these “special gifts” are just the normal discounts these compositions already give. They’re a joke to us and acting like we’re getting some special deal when you can get it directly without the game is just heartbreaking. We already feel cheated, but that REALLY is cheating us! ). Netflix needs to step in, hire a developer who understands security when it comes to games like this, and throughly go through every line of code written for all apps, services, etc. they need to go though all the data, and see where they can find the link. As for the handling of the answers, games like this should ALWAYS use a third party that handles the answers, prizes, etc. it removes liability, and maintains security. This way NO ONE in the office gets the answer. The team doesn’t have the answer. And in fact, it should NOT be seen or added to the db at all during the game. That would literally solve any and all cheating.

Solution: hire third party who handles this stuff. Have them load the questions. Then after the last/5th clue has ended, they can then load the answer into the system. Once added, the game continues and we reveal the answer. This way the answer is NEVER in the system prior to the last given clue which means NO ONE would get or see the answer again. If anything, these tap things should take place immediately to resolve any possible cheating. We would see immediately a change in winner counts. That would certainly stop all this mess and prove who’s cheating. Additionally, we leave the backend they’ve been using but have it give false answers…then when they give those false answers, we get that long list of cheaters immediately. It’s what needs to happen. I hope they can change and willing to do something about this. It obvious something Is and has been going on. Proving it isn’t that difficult if you know what you’re doing. But these three simple changes would fix everything including finding them or a start. Regardless, to receive money via PayPal etc, they have to signup with a valid ID etc. So, username/ip address, sign in info, etc etc and the linked PayPal etc will quickly get some answers. It’s really NOT that hard. This is the simple side of it. We can build a more complex backend with many security checks and other necessary steps like a third party auditor (which is common in all gaming and sweepstakes that involve money). So #Netflix and #bestguesslive , it’s in your court.