Skip to the page

Public Wi-Fi and Online Gambling: Why It's a Bad Combo

A study by Pindyck (2008) on internet security found that users on public Wi-Fi were 11 times more likely to expose authentication credentials than users on private networks. If you gamble on public Wi-Fi, you are not being convenient. You are being reckless.

public Wi-Fi network signal with warning vulnerability nodes and encryption break paths

By CryptoSlots Club Notes

Threads (6)
  1. #the-mechanism
  2. #the-attack-vector
  3. #why-players-do-it
  4. #the-risk-math
  5. #the-defense
  6. #the-bigger-picture

A player sits in a coffee shop with his laptop. He connects to the shop's Wi-Fi. He logs into Stake. He plays some slots. He withdraws 500 dollars. He feels good about himself.

He has no idea that the person two tables over captured his login credentials using a packet sniffer. That person now has his username and password. If they also obtained his two-factor authentication code (which is possible with the right tools), they can log in, disable withdrawals, and transfer his balance to a different account.

This is not paranoia. This is how public Wi-Fi works. It is inherently unencrypted. Everyone can see everyone else's traffic. The average user does not have the technical skills to intercept passwords, but someone with an hour of YouTube learning and a 20-dollar piece of software can do it.

The Mechanism

Public Wi-Fi is a shared network. Your laptop connects to the router. So does everyone else's laptop. The router sends data to each device. A network sniffer (a piece of software that captures passing data) can see all of that data.

If you are on an unencrypted connection (HTTP instead of HTTPS), your password is visible in plain text. If you are on an encrypted connection (HTTPS, with the padlock icon), your password is encrypted, but the metadata is visible (which servers you are connecting to, how much data you are sending, etc.). A sophisticated attacker can infer a lot from metadata.

Most casinos use HTTPS. This is good. But encryption is not the whole picture.

The Attack Vector

A attacker in the coffee shop can do one of three things:

  1. Intercept your two-factor authentication code. If your 2FA is SMS-based, they can trick your phone provider into forwarding your SMS to their number. This is called SIM swapping. Your password is useless without 2FA, but your 2FA is vulnerable to social engineering.

  2. Inject a fake landing page into the network. Your browser requests the Stake website. The attacker's device intercepts that request and shows you a fake login page. You enter your password. The attacker now has it. This is called DNS hijacking.

  3. Install malware on your device if you download any files on that Wi-Fi. A malicious PDF or image can carry code that installs a keylogger. Every keystroke you make, including your password, is logged.

Why Players Do It

Players gamble on public Wi-Fi because:

  1. Convenience. The casino app works on their phone. They can play while waiting for a haircut.
  2. Normalcy bias. "Nothing has happened to me yet, so nothing will." This is a statistical argument, not a security argument.
  3. Ignorance. Many players do not understand Wi-Fi security. They think the lock on the Wi-Fi router means the connection is secure. It does not.

The Risk Math

Assume you have a 50,000-dollar balance at Stake. Assume the probability of an attack on public Wi-Fi in a given hour is 0.01% (one in ten thousand). You gamble for one hour on public Wi-Fi once a week.

Over 52 weeks, you are on public Wi-Fi for 52 hours. Your probability of being attacked is roughly 0.52% (52 times 0.01%). That is a one-in-200 chance in a year. The expected loss is 50,000 times 0.0052, which is 260 dollars.

That is the insurance cost of convenience. The actual cost could be zero (nothing happens) or complete (you lose everything).

The Defense

Use a VPN (Virtual Private Network). A VPN encrypts all your traffic and routes it through a secure server. To the coffee shop Wi-Fi, your data is gibberish. Your password is protected. Your 2FA code is protected.

Good VPN services cost 50 to 100 dollars a year. Express VPN, ProtonVPN, Mullvad are reputable. Avoid free VPNs (they make money by selling your data, which defeats the purpose).

Alternatively, just wait. Use casino apps on 4G data (your phone provider encrypts the connection), not Wi-Fi. Wait until you get home. Gamble on your home network, which is presumably secure.

The Bigger Picture

Public Wi-Fi is a known vector for identity theft. Financial companies have known this for years. That is why your bank app warns you not to use it. That is why Gmail warns you not to check email on it.

Yet millions of people do. They gamble on public Wi-Fi, they check their bank accounts, they update their passwords. The attacks are real. The consequences are severe. And yet the behavior persists.

This is prospect theory in action. The convenience of now outweighs the risk of later. A 260-dollar expected loss per year feels abstract. A 10-minute savings feels concrete.

But casinos know this. They do not care if you get hacked. Their terms absolve them of responsibility for security on your end. You gamble on public Wi-Fi, you get hacked, the casino keeps your balance. This is not their problem. It is yours.

Next notes

More from #mobile