Privacy playground in the Greenhouse¶
Welcome to the Greenhouse Games! These are a collection of simple, playful ideas designed to help you explore digital privacy and security. Each game can be easily adapted, expanded, or combined with your own twists, and nearly all can be played using everyday items you already have at home. Think of them as seeds—pick one, try it out, and watch your understanding of online safety grow.
Cookie Monster Mayhem!¶
Concept: A physical card game about tracking and blocking online “cookies” (trackers).
How to Play:
Setup: One player is the “Tracker.” Everyone else is a “User.” Scatter coloured cards (representing different websites) around the room.
Goal for the Tracker: Follow the Users and collect a data card every time a User picks up a website card. If you can name all the sites a User visited, you win.
Goal for the Users: Collect website cards without being profiled. Users can play “Ad Blocker” cards to freeze the Tracker for 10 seconds or “Private Browser” cards to force the Tracker to discard all collected data on them.
What it teaches: How online tracking works and the value of browser extensions and private modes.
Recommended age group: 8+ (Primary school and up)
Reasoning: Simple rules, physical movement, some strategic thinking, basic understanding of online tracking. Easy to grasp for kids but still educational for older players.
The VPN Tunnel Relay¶
Concept: An active, tag-like game about encrypting and routing data.
How to Play:
Setup: Choose one player to be the “ISP” (Internet Service Provider) who stands in the middle. The others are “Data Packets” trying to get from one side of the garden/room (their computer) to the other (a website).
The Catch: The ISP can tag any Data Packet they can see. If tagged, the Packet is “logged” and must give up a token.
The VPN: To win, the Packets must work together. Two players can form a “VPN Tunnel” by holding hands, creating a safe corridor. Packets can only run safely to the goal within this tunnel. The ISP cannot tag inside the tunnel.
What it teaches: The basic principle of a VPN encrypting and hiding your traffic from your ISP.
Recommended age group: 10+ (Late primary / early secondary school)
Reasoning: Active tag-style game, requires teamwork and understanding a metaphor for encrypted traffic. Younger kids may struggle with the VPN concept, but the physical part is engaging.
Metadata Detective¶
Concept: A guessing game that reveals how much information we give away unknowingly.
How to Play:
Setup: Each player draws a picture of a person, place, or thing on a card. They then write three pieces of “metadata” about it on the back (e.g., for a photo: “time taken,” “device used,” “location”).
Gameplay: Players swap cards. Using only the three metadata clues on the back, a player must guess what the picture on the front is.
Scoring: If they guess correctly, the metadata was too revealing! The drawer loses a point. If they guess wrong, the drawer successfully protected their privacy and wins a point.
What it teaches: What metadata is and how it can expose private information.
Recommended age group: 12+ (Secondary school and up)
Reasoning: Abstract thinking about metadata, requires reading/writing, understanding indirect clues, and some logical deduction. Best for teens and adults.
Password Potting Shed¶
Concept: A creative, craft-based game about building strong, memorable passwords.
How to Play:
Setup: Gather materials: paper, coloured pens, dice.
Gameplay: Use the Diceware method from the site. Roll dice to get numbers that correspond to words on a simple list you create (e.g., 1=Fox, 2=Tree, 3=Book, 4=Star, 5=Rain, 6=Coin).
Challenge: Each player rolls five times, writes down their five words, and then must create a silly story or draw a picture to remember the sequence. The first to correctly recite their “password” from memory wins.
What it teaches: The concept of strong, random passphrases and techniques for memorizing them.
Recommended age group: 10+ (Late primary / early secondary)
Reasoning: Involves Diceware, storytelling, and memory skills. Could work with slightly younger children if simplified lists are used. Engaging for teens and adults as well.
The Great Firewall Fortress¶
Concept: A strategic board game (using cardboard and toys) about censorship and circumvention.
How to Play:
Setup: Build a “firewall” (a line of books) down the middle of a table. One player is the “Censor” who controls it.
Goal: The other players must get their “message” (a token) from their side to a “friend’s computer” on the other side.
Mechanics:
VPN Card: Lets them move a token through a tunnel under the table (under the firewall).
Proxy Card: Lets them ask another player to move their token for them.
Tor Card: Lets them bounce their token to two other players before going to the goal, making it hard for the Censor to track.
What it teaches: How firewalls work and the methods used to bypass censorship.
Recommended age group: 12+ (Secondary school and up)
Reasoning: Strategic thinking, understanding censorship, and using metaphorical circumvention tools. More complex mechanics make it suitable for older children, teens, and adults.
Phishing Fishing¶
Concept: A card game about spotting phishing attempts.
How to Play:
Setup: Players are “Email Users” who receive cards with messages; some are genuine, some are phishing.
Gameplay: Players must identify phishing cards to avoid losing points. Special “Alert” cards let them scan one extra card per turn.
What it teaches: How to recognise scams and avoid social engineering traps.
Recommended age group: 10+
Reasoning: Simple rules, encourages critical thinking, introduces online scam awareness. Low physicality, medium mental engagement.
Social Media Maze¶
Concept: A board game simulating information spread and privacy leaks.
How to Play:
Setup: Players navigate a network of social media accounts. Each move reveals personal info, likes, or friend connections.
Gameplay: Players can use “Privacy Settings” or “Anonymous Mode” cards to block others’ visibility. The goal is to reach milestones without exposing too much.
What it teaches: How information propagates online and the importance of privacy settings.
Recommended age group: 12+
Reasoning: Strategic thinking and understanding indirect consequences of sharing data online. Low physicality, medium–high conceptual depth.
Two-Factor Fortress¶
Concept: A cooperative game about defending accounts using multi-factor authentication.
How to Play:
Setup: One player is the “Hacker,” the others are “Account Owners.” Each account has a token.
Gameplay: Players use dice or cards representing passwords and 2FA tokens to block hacking attempts.
What it teaches: The added security of multi-factor authentication.
Recommended age group: 10+
Reasoning: Encourages teamwork, shows the importance of layered security. Low–medium physicality, medium conceptual depth.
Data Dumpster Dive¶
Concept: A scavenger hunt-style game about what data people leave behind.
How to Play:
Setup: Players search for “discarded” cards with personal info (emails, photos, purchases) around a room or garden.
Gameplay: Players try to piece together identities using only the found cards.
What it teaches: How easily personal data can be collected and reconstructed.
Recommended age group: 12+
Reasoning: Active, investigative gameplay. Encourages awareness of digital traces and identity risks. Medium physicality, medium–high conceptual depth.
Encryption Escape Room¶
Concept: A timed puzzle game where players “unlock” encrypted messages.
How to Play:
Setup: Players receive coded messages that use substitution ciphers, pattern recognition, or logic puzzles.
Gameplay: Solving puzzles grants “safe passage” to the next stage. The team wins by decrypting the final message before time runs out.
What it teaches: Basics of encryption and problem-solving in digital security.
Recommended age group: 12+
Reasoning: High mental engagement, collaborative reasoning, abstract thinking. Low physicality, high conceptual depth.