Identity

Who you are here

Playing needs no account. Keeping what you played does.

This browser has no identity yet. One gets minted the moment you open a game: a cookie that lasts as long as the cookie lasts, with no way to recover it once it is gone.

Anonymous visitor. A cookie, minted the first time you load a page. Nothing to remember, nothing to lose (except that clearing your cookies ends that person permanently).
A claimed identity. 24 words you keep. The same words reproduce the same identity on any device, so your history follows you.
Linked accounts. Proving that your Discord or Telegram self and this one are the same human, so the boards rank you once. This works today, in the plain version: the link is stored as "this key and that account are one person", which the operator can read. Proving it without revealing which accounts is the machinery that exists in the tree and is not what that page does.

Keep this identity

We will show you 24 words, once. Written down, they reproduce your identity on any device, forever; that is the whole mechanism. You stay signed in here either way; the words are the copy you keep.

What losing the words actually costs you

Your game history · the runs, turns and receipts filed under this identity.
Your name on the Descent board, and the actor recorded on your past run cards.
Anything a future feature files under who you are.

That is the whole list. No money is attached to this phrase. There is no balance, no token and no wallet behind it; it is the name your play is filed under. It is worth writing on paper; it is not worth a safe deposit box.

The part that matters: we cannot recover it for you. Not because of a policy, but because we never have it: the identity is derived from the words, so nobody without them can reproduce it, us included.

Already have a phrase?

Type or paste your 24 words to become that identity on this device. Nothing needs to have happened on this browser first: the words are the identity, so this works on a machine that has never seen us before.

What this does and does not protect

Where the key lives: nowhere.: Your 24 words are turned into a keypair inside the one request that needs it, and every byte of secret material is wiped before the response goes out. Nothing is stored: not on the server, and not in this browser.
The words pass through the server once, each time you use them.: They are generated here, and typed back here whenever a request needs the key they derive: restoring this identity on a device, or signing a cross-platform link. We never write them to disk or to a log, but that is a promise about this code, not a guarantee the shape of the system gives you. Generating them entirely inside your browser is the next step and is not what these pages do today.
Your browser holds a cookie, not a key.: It is HttpOnly, so page scripts, including an injected one, cannot read it. That is why the identity lives in a cookie rather than in localStorage, which any script on the page can read. It is still a bearer token: whoever has it can play as you until it expires, so treat a link containing ?user=dregg-id-… the way you would treat a password.
And nobody else can put an identity INTO this browser.: Theft is not the only direction. A hostile page can also try to give you an identity, quietly submitting its own 24 words to this site so that everything you play afterwards is filed under a name somebody else holds the words to, with nothing on screen looking wrong. Claiming, confirming, restoring, releasing and linking therefore only work from a page on this site: a request that cannot show it came from here is refused before anything is derived or set, including when it says nothing at all about where it came from. And a phrase we have just shown can only be taken up by the browser it was shown to, so a token glimpsed on somebody else's screen is not a way in.
Pressing a button here is not a signature.: Turns you play in the browser are attributed to your public key, not signed by it; the server has no key to sign with and neither does this page. A tool that holds your phrase (the dregg CLI, the browser extension) can sign turns as this identity through /act-signed, and only those turns carry a real signature.
A server restart may sign you out.: Unless the deployment pins its identity key, restarting re-rolls it and your cookie stops verifying. You come back as a fresh anonymous visitor and re-enter your words, never as somebody else.