I'm writing a simple turn-based game for mobile, just to test the waters and I'm having doubts about the approach.
Each player has 5 cards on hand.
I want for both players to be able to replay exactly what the other player did. Would it be okay (from a security perspective (and in what degree?)) for both clients to know in-memory what the other player has on hand?
Example: Game Start > Server sends encrypted data* to both clients > Clients decrypts data in memory
Server sends user action > Client replay action
*where data is Client1's cards and Client2's cards.
The reason for not having the server sending "need to know" stuff, is for code-simplicity and responsiveness.