Online Security Basics for Casino Players: 10 Simple Steps (plus Cheatsheet)

HTTP vs HTTPS

HTTP (hypertext transfer protocol) is the way the data is transferred on the internet. HTTPS is exactly the same, except for “S” stands for “secure” (all data is encrypted in this case).

Do not enter any sensitive information (bank cards info, personal info, etc.) on websites without HTTPS in place. Otherwise, such important data can easily be hijacked by basically anybody on the internet.

How to make sure that a website uses secure internet protocol (HTTPS)? Very easy. You can check it on top of your web browser. Secure websites start from https:// instead of http:// (which is insecure). Moreover, all modern web browsers place a lock icon in front of secure connections.

Watch out Domain name forgery

This attack vector is quite specific to the online gambling industry (as well to some others, for example, cryptocurrencies).

The point is that even one change in a domain name makes it a completely new address.

Some scammers copy an entire website (it is actually quite easy to do) of some legit online casino. Then they place the faked website on a domain name with just one letter (or dash/dot/domain extension) changed.

Casino players who have not noticed the difference in the domain names make deposits (often in cryptocurrencies) to frauds.

Use strong and different passwords (with the help of a password manager)

What do I mean by a strong password? A strong password can not be brute force cracked (brute force attack is when an algorithm enters millions/billions of possible passwords in an attempt to guess correctly).

Here is a very convenient service which allows us to estimate how long it is going to take to brute force hack our passwords: https://www.security.org/how-secure-is-my-password

For example,

8-symbols (with letters and digits) password: df131415 - will be cracked in 1 minute

10-symbols (with letters and digits) password: 1df131415n - will be cracked in 24 hours

12-symbols (with letters and digits) password: 1df131415n8e - will be cracked in 3 years

14-symbols (with letters and digits) password: 1df131415n8e23 - will be cracked in 4,000 years

That’s why you are constantly being told a mantra that you have to make your passwords long enough. You can see from the examples how much of the difference it actually makes.

Use at least 14-symbols (you must include both digits and letters, any other symbols makes your password even stronger) passwords. Moreover, your passwords must be unique. One password for all your accounts is not okay, to put it very mildly.

How to keep track of dozens of different and long passwords? Password managers come very handy. Here you have to remember only one long passphrase, which encrypts all other passwords.

I personally prefer to use the offline version of KeepassXC (https://keepassxc.org). It is absolutely free (without accounts opening/bank cards entering and stuff like that).

Here you can learn how to install and use a password manager (pretty much easy)

2FA is easy but super effective

2FA stands for two-factor authentication, and it is absolutely amazing.

Turn on 2FA whenever it is possible. In this case, on top of your regular password, a one-time password is going to be generated by your smartphone app (or sent by sms) each time you would like to log in. Even if hackers somehow manage to intercept this one-time password, next time it will be a completely new one.

This layer increases security in a big way.

Protect your email properly (+ don’t open links from emails)

Your email is a gateway to so many different attacks. The most obvious one derives from the fact that passwords are getting reset exactly via emails. So if someone hijacks your email, this individual can also change passwords for accounts (and log in later) which are associated with this compromised email address.

Use only big and reliable email services which allows to enable 2FA. Gmail is definitely a top-notch email service made by Google (gmail.com).

Also, do not click on links from email messages. They may lead to malicious websites or they may cause malicious software installation. Even if a link says something like “learn more on wikipedia”, it does not necessarily mean you are going to end up on the wikipedia webpage.

To find out the true destination of a weblink, you have to place your mouse cursor on it and see where it goes. The destination page will be displayed to you on the bottom left side of your web browser. Click only if it leads to reliable websites.

Another way to get your password is to directly ask you in email. It may surprise you, but so many casino players fall for it. Remember, an online casino representative will never ask you your password, they use other options to verify your credentials.

Be careful with Wi-Fi (and not only public)

Wi-Fi poses a significant security risk, both public and private networks. All transfered data can be stolen if Wi-Fi connections are not handled properly.

As for public Wi-Fi, you should access public points only with some VPN turned on. Not just simply installed on your device, VPN must be up and running. That way all transfered data is protected.

Here is how to use a free VPN browser version

As for private Wi-Fi (the one some of you use at home), it must be protected by a password (long enough as we already know). The point of locking your personal Wi-Fi is not that your neighbour can not download huge files at your expense anymore. If you do not lock it with a password, then anybody can join the Wi-Fi and intercept all transfered data, the same way it works with public Wi-Fi.

Do not rely on anti-viruses (use virustotal scanner tool instead)

Basically each and every guide on the internet tells you that you have to install some anti-virus. This is a very wrong approach since it instills a false sense of safety.

Why? Because hackers before they release some malicious program, craft it in a way that popular anti-viruses won’t raise an alarm (for some period of time). Once it becomes a known threat, anti-viruses release an update (include this particular virus to their database of viruses), but damage is already done. Think of it as a game of cat and mouse without any ending.

So to speak, an anti-virus is not going to solve the problem of malicious software. What actually works are the 3 precautions which we are going to discuss further in the article.

Anyway, whenever you need to check if a website or a file is safe to open, use this web service (absolutely free, no registrations or bank cards needed): https://www.virustotal.com/gui/home/upload

Here your file or webpage is going to be tested by all anti-viruses at once (instead of just one). The point is that hackers can not make their new viruses undetectable by all anti-viruses (it would be a nightmare for them and cost a fortune). Instead, hackers usually design viruses to avoid just several popular anti-viruses, but others will raise an alarm.

Therefore, all anti-viruses, which virustotal provides you access to, must recognize the tested file or website as safe (otherwise do not open it).

Don’t click on clickbait titles or visit dubious websites

If you see something saying like “an online casino got hacked and everybody wins shit ton of money” or stuff like that, never ever click on it.

Such titles are common used tactics to trick casino players in. The chances are high you are going to end up on some malicious website. Also just one click can trigger some malicious program to be downloaded on your device.

Do not download/update something from untrustworthy websites

Make it your life's rule to download software only from websites of companies (keep in mind domain forgery threat) that have created this software, not some third-party websites.

If you need to download KeepassXC password manager, then you have to do it from its official website. Other sources may be compromised.

However, there are many reliable third-party companies and services that can be trusted. For example, Steam is an aggregator platform of computer games. Or Microsoft store is a place where you can safely download Microsoft compatible products. I am sure you got the idea behind.

Do not use Flashplayer and open PDF files carefully

Last but not least, without an absolute necessity do not install Flashplayer. It has got many security breaches, and it is deemed as a legacy outdated technology nowadays.

Here is more on why Flashplayer is a recipe for disaster

In the same way you have to be very careful with PDF files. There is a way to insert some malicious code into files which use this format. If you need to open a PDF file, scan it with virustotal before.

Conclusion

To encourage you to memorize these tips and use them on a daily basis, I will just tell you that I have never been hacked so far (15+ years active internet user). Of course it may be just luck to some extent, but I believe that the principles that have been covered in the article have a lot of to do with it as well.