31 ms·
NeverSSL
- equalunique 10y agoFor this purpose, I usually use http://example.com/ http://example.com/ or .org
- utbabya 10y agoexample.com ?
- snuxoll 10y agoI really wish there was a standard way of handling captive wifi portals, macOS and GNOME try to detect these portals and show them but sometimes it is unreliable. It'd be really nice if there was a reserved DNS entry (like captive.portal or something) that operating systems could try to resolve and if it points to anything other than an expected value (loopback address, maybe?) it will bring up a window to sign into the network instead of relying on these nasty hacks that leave users confused when they can't visit a site over HTTPS because they aren't authenticated / paid / whatever.
- pjmlp 10y agoSo far I have had quite a few issues with HSTS, not allowing me to access web sites, or authenticate with WiFi networks, to the point that on Android 4.3 I use the outdated system browser for authentication and only afterwards switch to Chrome.
- deleted 10y ago[deleted]
- deathanatos 10y agoThere is; both Router Advertisements and DHCP include options for captive portals[1]. In the case of DHCP for example, the DHCP server can send the URI of the portal, which the OS can display to the user. The mechanism in [1] is what OS X uses, I believe. [1]: https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710
- virtuallynathan 10y agoThis is a proposed spec, no one has implemented this. I was in the BoF for this session a few years ago.
- epimenov 10y agoI think OS X opens captive.apple.com
- zuck9 10y agoIt does, and so does iOS when you connect to a WiFi network that has a portal.
- imwally 10y agoIt's so annoying that I even wrote a script so I could connect to Starbucks WiFi without having to use a browser. This was back when I was on Linux using a tiling window manager but I still use it on macOS because it's useful. https://github.com/imwally/starbucksconnect https://github.com/imwally/starbucksconnect
- mos_basik 10y agoHey, thanks mate. With the various meetups I go and corporate networks I'm using, it's always a pain to lose all my saved chrome tabs to portal redirects because I forgot to open Firefox to get through the portal first. I might be able to leverage this to help.
- slang800 10y agoI'm glad that there isn't a standard. Implementing a captive portal should be a painful experience that ultimately results in giving up and not using one.
- innocenat 10y agoI have a feeling that should it result in giving up, they will stop providing WiFi rather than stop using captive portal.
- tekklloneer 10y agoexample.com works as well. it doesnt redirect to https://example.com https://example.com
- 83457 10y agodoes it actually make an outbound connection or just a local page?
- mgbmtl 10y agoIt makes an outbound connection. It's a real website, managed by the IANA (Internet Assigned Numbers Authority).
- cdowns 10y agohttp://captive.apple.com/ http://captive.apple.com/ also. That's what Apple devices use when trying to present the login for a captive network.
- TurningCanadian 10y agoIs that better in any way than using example.com?
- cdowns 10y agoIf I regularly used that as a known-good site that should be up with no SSL, I'd trust that an apple-maintained site (backed by akamai) would be up before "example.com". I'm sure there are plenty of others, but someone might remember that URL over another so I thought it would be helpful.
- viraptor 10y agoexample.com is maintained by IANA. It's an official example address for documentation purposes. So on one hand, it will survive even if Apple disappears, on the other, they're likely not expecting any significant traffic.
- asenna 10y agoI always used msn.com but yes, I see this site as being helpful.
- hobonumber1 10y agoOr you could just go to any non-http site like http://purple.com http://purple.com.
- zellyn 10y agofoo.com is my weapon of choice :-)
- r1ch 10y agoNot sure about Apple, but isn't this automatically handled by Android these days? Every time it connects to a network it pings http://google.com/generate_204 http://google.com/generate_204 and if the response code isn't 204 then it should prompt you to open the browser to the redirected URL.
- Pxtl 10y agoI don't know about newer versions, but I know on Android 5 it's generally a roll of the dice.
- pfranz 10y agoApple has been using http://captive.apple.com/ http://captive.apple.com/ for years. Their UI for it has gotten a lot better, too. Previous versions you'd get a popup, but you could dismiss it and it would disconnect from the network (which sucks if you're /trying/ to connect to a network without Internet). Now it has a few more options and ways to get back to the popup--but I still have issues with certain networks.
- Namidairo 10y agoThe current list is https://www.google.com/generate_204 https://www.google.com/generate_204 http://connectivitycheck.gstatic.com/generate_204 http://connectivitycheck.gstatic.com/generate_204 http://www.google.com/gen_204 http://www.google.com/gen_204 according to https://github.com/android/platform_frameworks_base/blob/5b22a826d561be3d416eb4491738eda492e8631b/services/core/java/com/android/server/connectivity/NetworkMonitor.java#L89-L92 https://github.com/android/platform_frameworks_base/blob/5b2...
- knownunown 10y agoI just use connectivitycheck.gstatic.com/generate_204. The URL is a bit long, but I have it bookmarked.
- expiredtofu 10y agowww.gstatic.com/generate_204 should work fine; that's what I use regularly.
- TheAceOfHearts 10y agoI just tried, and it looks like it'll still work after dropping www as well: gstatic.com/generate_204
- mctx 10y agohttpbin.org/status/204 works too
- bfred_it 10y ago0118 999 881 999 119 725 — 3
- knownunown 10y agoWell, this was my solution before this shorter way came along. A force of habit, really, since I noticed that it was Android's internal method of detecting captive portals. There's really no reason to use this over neverssl.com, other than the gstatic.com page returning an empty response (or redirecting you if you're actually behind a captive portal). Somewhat useful if you don't want to leave the new tab page.
- bisby 10y agoIt's sad, because these are the kinds of things that confuse the hell out of "common folk" and explaining requires explaining HTTPS, HSTS, how captive WiFi portals work, and then ultimately, why there isn't a better solution... which maybe doesn't have a great answer. I feel like this "workaround" site is designed to draw attention to the problem at hand more than it is meant to be useful for the task at hand?
- swiley 10y agoI still think having people connect to something handed out by dhcp would be really great, that's what dhcp is for in the first place. If that's too complicated you could always try connecting to the gateway.
- JoshTriplett 10y agoRFC 7710 specifies a way for DHCP servers and router advertisements to specify a portal page: https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710
- CaliforniaKarl 10y agoDo you know if any clients (iOS, Android, etc.) have implemented support for this RFC?
- JoshTriplett 10y agoNot yet; too recent.
- Already__Taken 10y agoSo is there a matching method to neatly introduce MITM in the connection? Our portal would let you log on but you'll still fail to connect to anything as we have to inspect it.
- 10y ago
- cwmma 10y agoAh something for the day xkcd[1] makes https mandatory. 1. http://xkcd.com http://xkcd.com
- Bartweiss 10y agoYep. I used to hit Reddit, but they went to SSL by default. Since then, I've had to route people to xkcd who didn't know how to get around this issue.
- nullc 10y agoI use yahoo. I don't want to use a site that I would otherwise intentionally use-- captive portals often poison the DNS.
- geocar 10y agoYahoo is starting to use Strict-Transport-Security now... I'd love to be in the meeting where they discuss adding security features lowers their traffic volumes...
- johnhenry 10y agoSo, this is for use captive wi-fi portals that are served over HTTP that would otherwise not work when initially connecting to a site using HTTPS?
- Bartweiss 10y agoYep. Most default browser homepages use SSL, as do many popular second locations like Facebook. It can get a bit annoying to remember who won't serve you SSL when you're waiting to get an approval page injected into your browsing, so this site promises to do it. It's especially relevant now that Chrome is threatening a big unsecure site warning for HTTP pages, so many sites which don't strictly need security are going to switch.
- pkinsky 10y agoI've always used example.com for this purpose, but this is cool. Thanks!
- Pxtl 10y agoThis is handy. I was at an airport and was helping numerous people with android devices get through the wifi portals, and dealing with the same frustrating failure of the captive-portal redirect. Android is supposed to detect that there's a redirect and give you a notification that takes you to the login page, but it's very inconsistent. I usually use Xkcd for that purpose, one of the few lightweight non-ssl sites I can think of offhand. Only problem with neverssl is that it's a big jargon-laden for laymen, I mean the name.
- majewsky 10y agoI bought unencryptedwebsite.com last week after running into the same problem without knowing that neverssl.com exists. I still have to set it up, though. Too bad I'm lazy. :/
- Nadya 10y agoAsk the owner of neverssl.com if you can redirect the domain to them until it lapses. That way it might see at least some use. :)
- dnautics 10y agousually i do craigslist.org
- Pxtl 10y agoConsidering how much clandestine activity has historically gone on on Craigslist, I'm shocked to hear it's not https only.
- AntiRush 10y agohttp://http.rip http://http.rip is another site with this purpose. Pretty easy to remember too.
- deleted 10y ago[deleted]
- swrobel 10y agoGreat idea but wish it was a shorter url. I use cnn.com because it's quick to type even on mobile.
- enknamel 10y agoI usually use rawr.com It has no guarantees but the site hasn't been updated in a very long time.
- sfrailsdev 10y agoI've been using bing.com for this, but this will probably replace that.
- keeganjw 10y agoI was just thinking about this today! The New York Times had been my go to site but that won't work anymore. This is perfect!
- dongslol 10y agoYou don't even need an actual website. I just type 1.2.3.4 and it always redirects fine for me.
- amenghra 10y agoFor the French speakers among us, http://perdu.com/ http://perdu.com/ has been around since the 90s.
- kowdermeister 10y agoI don't get it. What does it do stop redirecting users to the https version?
- colmmacc 10y agoThere is no (working!) https version of the domain. I own/maintain neverssl.com and I'll be doing my best to make sure that it can never poison the intended experience. I use it myself. Basically, it's designed to be easy to remember, and over time I'll deploy whatever "Nope, really use HTTP" workarounds are available as TLS-by-default, and maybe even DANE, gain traction. The difference between neverssl.com and others is just that "guarantee" and the slightly tongue-in-cheek text that tries to make it clear to users what's going on. Actually right now I'm on a plane, between Newark and Seattle, and just typed it in to log in ... only to see it featured on HackerNews. Mind Blown. I'm coming back from 7 days spent with other implementors of TLS, and it's something I stay up to date on. That's it. It's pretty weird that example.com does not use https:// https:// , I expect it will in the near-future. Part of its job is to set a good ... example.
- peteretep 10y agoIt doesn't. It loads a page that's HTTP only, so that the wifi provider's login page can be displayed without an SSL error.
- kowdermeister 10y ago> so that the wifi provider's login page can be displayed without an SSL error AHA! That's it. Now it makes sense.
- notJim 10y agoI was really hoping for a (possibly unhinged) manifesto against ssl, but this is good too.
- dorianm 10y agoNice, I use http://perdu.com http://perdu.com usually
- noway421 10y agoI was always using ya.ru Easier to type and they never plan to add HSTS because of that reason.
- venantius 10y agoThank you for doing this. For years the NYT has been my unencrypted go-to; having something like this is great.
- zpallin 10y agoI hope this site can reword their explanation. It's a bit confusing what their intent is, especially in the final paragraph.
- bloudermilk 10y agoLeaving this feedback here because there's no contact info on the page: for the purpose of accessing captive portals, it would be a good idea to disable page caching. Since this was posted I've had to use it twice and the second time I had to hard refresh to see the portal.
- colmmacc 10y agoWill do, thanks! Feel free to send me any specifics colm AT allcosts.net. Update: I've added Cache-Control and Expire HTTP headers to the HTTP responses for neverssl.com
- oxguy3 10y agoI've always just used asdf.com, but I suppose there's always the risk it might switch over to HTTPS; might switch to this instead.
- bogomipz 10y agoI might just be really stupid but I read the "what" and the "how" a couple of times and I still don't understand. I only inferred from the comments that this is to get through captive portals used in coffee shops by exploiting the fact that they have to to permit HTTP unauthenticated in order for the redirect to the login page to work. But can someone walk me through how never SSL allows me to connect to FB once my browser loads their default page? I feel like I am missing something which is maybe obvious?
- GrayShade 10y agoWith a captive portal, your first HTTP request will be redirected to the network's login page or whatever they have. Many large sites now use HTTPS and HSTS and if you visit them once, they will always (or until the max-age header expires) be loaded over HTTPS by your browser. As a result, many people will be unable to see the network's login page. If you are in this situation, you can load neverssl.com once, log in to the network, then browse normally.
- Cogito 10y agoI'll add mine to the list - http://bom.gov.au http://bom.gov.au Useful to see the weather updates as well!
- crumpled 10y agoI've suffered from routers or captive portals poisoning my dns when they do dns redirects, so I usually opt for a nonsense domain like fjlsdfoierldoidflug.com But I know that some appliances do content injection or 302 redirects which only work over http. I like knowing about this neverssl. I like that all the page assets are inlined to limit the page load to one request. Makes it easy to see what is being injected by your browser and the network.
- jaimex2 10y agoCool, I've been using www.cats.com. This will do nicely.
- shapath 10y agoCan some ELI5 (explain like I'm 5) to me? I don't get this. Seems like something I should know about.
- iandanforth 10y agoSome routers and networks try to intercept all requests and replace them with a 'captive portal' page for logging into that network. When you make a request to a webpage using https:// https:// (i.e. SSL) the network has a much harder time injecting the login page, so you end up seeing nothing. The connection isn't going through and the network's login page can't break through SSL battle-warrior-armor.
- Kiro 10y agoBut what is the purpose of this page?
- codemusings 10y agoThe scenario is: You want to connect to a public wifi hotspot and use their internet connection. In order to do so you need to trigger the login page in your browser after you connect to the hotspot. However if you open common urls like google.com or facebook.com you'll automatically get redirected to secure connections (https) and they can't intercept this to present the login page. This is because TLS (the protocol behind HTTPS connections) uses end-to-end encryption. Thus the author proposes to open this simple unprotected website. However most hotspots manage to automatically trigger the vendor specific mechanism as soon as you connect to their Wifi. Don't use public wifi unless you really need to!
- SZJX 10y ago> Don't use public wifi unless you really need to! Well if you always turn on VPN I don't think it would be such a huge issue would it
- taejo 10y ago
- evinism 10y agoalways used xkcd for this
- cantagi 10y agoalways used http://vimcasts.org/ http://vimcasts.org/ . So glad someone made neverssl
- pedro2 10y agohttp://www.bing.com http://www.bing.com also works ^^
- xenadu02 10y agoThe worst code I ever had to write was captive portal detection for the PlanGrid app. I discovered there is a whole host of sysadmins out there attempting to actively subvert the iOS capitve portal detection. They try to figure out the domains used and whitelist them so iOS will think it is connected to a good network, but they redirect everything else which horribly breaks SSL connections. The whole thing is an arms race where Apple adds new domains to iOS but doesn't start using them until a certain date to evade the whitelist. The stated reason for this stupidity? The mini-browser that pops up doesn't work with their stupid captive portal login or payment page. Fix the page? Nahhh, let's just fuck everyone's network connections instead. It caused an endless barrage of battery-draining network errors, eating the retry count and eventually causing POST requests to error out. The complete lack of respect for the users, internet protocol standards, etc was extremely evident. We ultimately stuck a file with a specific phrase in a text file on the site, then when the app was having network trouble the code tries to fetch that file. If it gets an HTML response it marks it as in captive portal mode. IIRC it offered to take the user to safari and would open some non-HTTPS URL so the captive portal redirect could fire and let the user know. I hope anyone trying to circumvent captive portal detection dies a very painful death, then gets revived, recovers through the miracle of modern medical technology, then dies another painful death.
- innocenat 10y agoApple could also makes the mini-browser supports those captive portal instead? Then none of this bypassing would be required.
- anon363764 10y agoWhen iOS cannot fetch the fixed content of www.thinkdifferent.*, a UIWebView pops and displays that content, assuming it's a captive portal needing attention. Instead, there should be some non-routable, local-only special IPv4/IPv6 address that all captive portals are required to present. No more DNS spoofing, no more page rewriting which breaks the web.
- kristofferR 10y agoThe mini-browser (Captive Network Assistant) is designed to protect the user's privacy, so support for Javascript and cookies is deliberately disabled.
- red_admiral 10y agoThere's already a site for that: http://example.com http://example.com
- lathiat 10y agoI often just type in an IP address, 1.2.3.4 often works. Having said that i've had alot of problems where iOS refuses to detect the captive portal, but also decides it has no internet so doens't route any intentional web browser visits to the wi-fi.. driving me crazy. Just restored without a backup.. see if that fixes it :(
- lathiat 10y agofor clarity, this was happening when another iOS device worked fine right next to me. So "probably" not the network, but who knows what weird interaction causes the issue.
- andygambles 10y agoCaptive portal craziness. "Click the confirmation link in the email we sent you to get online" "Enter the code we sent you via SMS to confirm your number" "Login via Facebook - provide permission to post on your behalf" "Share on FaceBook for internet access" "Confirm acceptance of our 6000 word terms and conditions"
- sigi45 10y agoThe name is bad :( SSL is not used any more and it shouldn't get into people minds. Its either https (as a common word) or tls.
- rando832 10y agoWords get to have more than one meaning. Your comment is not made from a cow, but there's nothing wrong with calling it bs.
- deleted 10y ago[deleted]
- foo101 10y agoI don't understand how this website works. If I visit http://neverssl.com/ http://neverssl.com/ I just see a home page that explains how it works which is to visit http://neverssl.com/ http://neverssl.com/. Can someone explain me step by step how to use http://neverssl.com/ http://neverssl.com/?
- pricechild 10y agoI think the idea is that many wifi networks out there require registration/payment to use. They also do this in really, really weird ways because making stuff is hard. Some of these only work by capturing http requests and rewriting them to take you to their portal. Funnily enough, that and other methods often work very badly and so you might be left trying to visit a site getting timeouts. Maybe your browser visited it previously and saw HSTS for example and so only tries https? The point of this site is that when you realise this has happened, you type in 'http://neverssl.com' http://neverssl.com' into your browser to force an http connection which hopefully the network will grab, mangle and take you to the login page. It's a solution to a problem that really shouldn't exist. Annoyingly, different client venders require different things. Here's an example of someone working on this: http://www.revk.uk/2016/08/captive-portals-apple.html http://www.revk.uk/2016/08/captive-portals-apple.html (and a money quote from the comments: "OS X only does it if you're on Wifi though - for some reason they assume you'll never see a captive portal when wired"
- foo101 10y agoThanks for the lucid explanation!
- codewithcheese 10y agoMost have a favourite non SSL site they use for captive portals. My is http://chairs.com http://chairs.com, i've typed that so many times I now have a special relationship with it. With an ad blocker is very conveniently light weight.
- andreareina 10y agoMy go-to for this situation is http://www.example.com http://www.example.com
- formula_ninguna 10y agouse example.org, that's it.
- brak1 10y agoexample.com is something that'll do the same job, and its reserved https://en.wikipedia.org/wiki/Example.com https://en.wikipedia.org/wiki/Example.com
- deleted 10y ago[deleted]