Hacker News Reader

Aren't the cards all different? I assumed it would be a one-time-pad which is much more secure than a simple substitution.

Yes, they are different. But that just makes it a substitution cipher with unique keys.

A one time pad requires a key as long as all the messages you want to encode since each key bit is only used once.