8 ms·
It's sad, because these are the kinds of things that confuse the hell out of "common folk" and explaining requires explaining HTTPS, HSTS, how captive WiFi port
by bisby 10y ago
It's sad, because these are the kinds of things that confuse the hell out of "common folk" and explaining requires explaining HTTPS, HSTS, how captive WiFi portals work, and then ultimately, why there isn't a better solution... which maybe doesn't have a great answer.
I feel like this "workaround" site is designed to draw attention to the problem at hand more than it is meant to be useful for the task at hand?
- swiley 10y agoI still think having people connect to something handed out by dhcp would be really great, that's what dhcp is for in the first place. If that's too complicated you could always try connecting to the gateway.
- JoshTriplett 10y agoRFC 7710 specifies a way for DHCP servers and router advertisements to specify a portal page: https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710
- CaliforniaKarl 10y agoDo you know if any clients (iOS, Android, etc.) have implemented support for this RFC?
- JoshTriplett 10y agoNot yet; too recent.
- Already__Taken 10y agoSo is there a matching method to neatly introduce MITM in the connection? Our portal would let you log on but you'll still fail to connect to anything as we have to inspect it.
- JoshTriplett 10y ago> So is there a matching method to neatly introduce MITM in the connection? No, for fairly obvious reasons. If you MITM traffic, clients will correctly flag security errors. No method exists or ever should exist for a network to cause clients to not flag such security errors. Any such method would defeat one of the primary purposes of TLS: to protect against hostile networks. > Our portal would let you log on but you'll still fail to connect to anything as we have to inspect it. For what purpose? I have not seen any legal jurisdiction sufficiently draconian to impose such a requirement. (I've seen a few terrible ones that might require logging IP addresses.)
- Already__Taken 10y agoFor what purpose? > Schools and BYOD. I know MITM should never be silent of course but some kind of interaction flow would be good. When you try to add a school account to your android it won't let you if you don't install the MDM client. A similar thing for the network would be great (of course, the MDM will install the cert). I'd love if I could also pin our MITM cert to only be valid when the client is on our IP address' which if using ipv6 could work very nicely.
- hannob 10y ago> why there isn't a better solution... There is a better solution: No captive portals.
- Filligree 10y agoWhat would you suggest for the case of someone wanting payment for the connection? Like it or not, a lot of places do that.
- ploxiln 10y agoput the payment url on a sign, just enforce an ip whitelist until customer has paid. Or in extreme sign-less situations put it in the ssid e.g. "pay at portalpage.com"
- bastawhiz 10y ago> put the payment url on a sign, just enforce an ip whitelist until customer has paid. Or in extreme sign-less situations put it in the ssid e.g. "pay at portalpage.com" This is a captive portal. But worse, because even HTTP sites don't send you to the portal.
- ploxiln 10y agoBut on the plus side: * no MITM attack * no TLS cert errors * no "do I need to hard-refresh? what's the key for that?" * no question if network access is working or not * one reliable clear action to get access See the various comments about work-arounds for work-arounds. Random plain-http intercept-check sites because some captive portals try to make iOS not pop up the mini sandboxed captive portal browser. The endless confusion. This stuff would be a lot simpler if people weren't always trying to make it needlessly "easy" and fucking it up even more every time.
- samtho 10y agoWPA/WPA2 Enterprise supports a multi user environment. You can require a unique login per user and thus associate payment with that. It also alleviates the problem with mac address whitelisting.
- makomk 10y agoThis isn't generally a problem on smartphones and tablets because they can usually detect captive portals and prompt the user appropriately.
- Viper007Bond 10y agoWindows does the same thing, at least in 10. I get a notification that further action is required and clicking it opens a no-SSL Microsoft URL that Will redirect.
- deleted 10y ago[deleted]
- pfranz 10y agoDo you travel? I often have problems and am running out of non-https sites to test against. Best I can figure is that they're whitelisting certain domains so the captive portal detection isn't triggered. I think this is so certain things like iMessage or email work (hence, whitelisting apple.com), but blocking out the rest of the web. I don't travel often (Christmas and maybe once or twice a year outside of that), but it's when I encounter this. It's very frustrating because I'll be walking, pass a store I've previously connected to Wifi, and suddenly lose Internet, then hunt for a website to get the portal to pop up. I'm annoyed that captive portals have been commonly using DNS hacking since 802.11b and I'm surprised a better solution hasn't been standardized. I have no idea where in the stack it should go (DHCP, wireless standards, or whatever) but DNS hacking drives me nuts.
- mikehollinger 10y agoThe question that I always ask family is, "Can you get to www.purple.com if you're having trouble?" It does what it says, is easy to understand, and is obvious if it's not functional.
- bisby 10y agoMy family always rhetorically asks "Why is this so hard?" or "Why does this never seem to work?" - which I never answer, because they are asking rhetorically, but also because there are a lot of deep technical issues you need to know about before you understand the common implementation and then I'm not sure I can explain why we dont have a better implementation.
- EGreg 10y agoHow DO captive wifi portals work? Can I set one up on a home network with a regular router without WifiDog or some other OpenWRT firmware? Maybe somehow use one of the computers on the network to run a DNS server that all requests go through??
- fragmede 10y agoYou could set one up with a regular router but you need something you can customize, be it the router itself, a raspberry pi, or a desktop PC acting as a server. And yeah, you've got it, the router needs to allow DNS to be customized so clients get pointed to a system that (intentionally) MiTMs requests and returns a http 302 redirect to go to the portal page.
- johncolanduoni 10y agoUsually they let DNS resolve normally (because intercepting at this level will break the website even after you've satisfied the captive portal) and intercept any HTTP connections, responding with a temporary redirect to a controlled domain. Doing this with a mere DNS server will only work if you don't visit the website you initially tried to access for a while after you connect. It's also super easy to bypass; just pick a public DNS server instead of the one the network tries to assign to you. To do this properly either your router or switch/AP need to be configured to do the necessary rewriting as well as maintain a list of authenticated clients. Your best bet to do this with something in the consumer(ish) price range without a custom firmware like OpenWRT is something like a Uni-Fi access point which can handle the captive portal interception itself.
- EGreg 10y agoCan't I use a regular consumer router but hook up a computer on the LAN to do something? Intercept DNS? Intercept HTTP requests like you said? But the problem is what if the user makes https requests? All I want to do is make a system which "takes attendance" via the phones automatically trying to join the local network, and I use the session is to look up the user. People would have accounts where they log in once via the captive portal and then the attendance would happen automatically. Basically I want to make a captive portal with regular routers so I can sell the solution to regular venues. How do these guys do it: https://www.fusionwifi.com/ https://www.fusionwifi.com/ There are a lot of social wifi solutions now