1

I am tasked with implementing a web-based gambling system that's operated on site. The requirements given to me by the company co-founder and designer for user login give red flags in regards to security, which surprises me because all of the other roles are required to be secure (cashier, site owner, admin, etc. all have usernames and passwords).

Here is how users are supposed to log into this system:

  • User goes to cashier, registers, and pays money for credits.
  • Cashier creates user, gives their account credits, and gives them their user ID.
    • The user ID is only seven characters.
    • The user ID is only digits.
    • The user ID is shown in plain text on the screen to the cashier.
    • The user ID is printed on a receipt given to the user.
    • There is no password. The user ID alone is used to log in.
  • User goes to a terminal at a site, logs in with user ID, and plays games.

The user ID is made to appear as a password because, when the player goes to a terminal to log in, they are presented on screen with a number pad and the digits they enter are masked.

What are all of the ways this system can be compromised? I suggested to him that 7 digits was insecure as it could be guessed, but he said that users don't want to have to enter long numbers to log in and that there could be max 2,000 users per site.

  • you could E-mail or text the account number to the user, then delete the contact information as soon as the account number is used. – kevin cline May 30 '17 at 2:06
  • 1
    With a "web-based gambling system" - is this accessible on the internet, or are you talking about using web technologies (html/javascript, etc) in a closed network? From your description it doesn't seem like this needs to be connected to the big internet. – Pete May 30 '17 at 10:07
  • It uses web technologies, however there are many sites so the idea is to have it accessible from anywhere. We are planning to implement an IP filter so that only authorized sites will have access. This together with an API key deployed with the Electron app installed in the terminals on site I believe allows us to be sure only authorized terminals are connecting. – Silas Mollod May 30 '17 at 14:52
  • This would be better on Security.SE. – Blrfl May 31 '17 at 12:26
2

As we are talking about deploying this system to a physical location with dedicated terminals that the players can login to, the security risks are not really high and can be easily managed.

Knowing the physical location(s) from where players can login means that it is easy to dispatch a security guard if the system detects suspicious behavior at one of the terminals before someone with malicious intent can do too much harm.

Possible risks and their mitigations are:

  • People accidentally entering the ticket number on someone else. This can be mitigated by creating random user IDs, so that the chance of accidentally entering the wrong, but a valid ID is low.
  • People trying to guess valid user IDs. This can be mitigated by limiting the number of attempts that you have for entering the user ID before a signal is given to the security team.
  • People sharing their ID (either intentionally or accidentally because someone else picked the receipt from the floor/trash). This can be mitigated by limiting the time that an ID is valid and limiting the number of machines that it can be used at at the same time.
  • Someone over the internet trying to access a terminal. This can be minimized by ensuring that you need physical access to a terminal to operate it.
2

This is the same security model successfully used by the typical automated car wash.

It works so long as what is being secured is of low value and is valid for a limited period of time. If that's true you're fine. Additional security is likely active once the player tries to redeem their winnings. If that's not true you should reconsider.

If the vender seeing the code is your real concern as I understand it employees are not allowed to gamble. So the employee trying to take advantage of seeing the code would need to have a racket to resell it and some scam to convince the customer not to complain about it. I could see all that happening except I simply can't believe you don't check ID when people redeem their winnings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.