6 ms·

> why there isn't a better solution... There is a better solution: No captive portals.

by hannob 10y ago

Filligree 10y ago
What would you suggest for the case of someone wanting payment for the connection? Like it or not, a lot of places do that.
- ploxiln 10y ago
  put the payment url on a sign, just enforce an ip whitelist until customer has paid. Or in extreme sign-less situations put it in the ssid e.g. "pay at portalpage.com"
  - bastawhiz 10y ago
    > put the payment url on a sign, just enforce an ip whitelist until customer has paid. Or in extreme sign-less situations put it in the ssid e.g. "pay at portalpage.com" This is a captive portal. But worse, because even HTTP sites don't send you to the portal.
    - ploxiln 10y ago
      But on the plus side: * no MITM attack * no TLS cert errors * no "do I need to hard-refresh? what's the key for that?" * no question if network access is working or not * one reliable clear action to get access See the various comments about work-arounds for work-arounds. Random plain-http intercept-check sites because some captive portals try to make iOS not pop up the mini sandboxed captive portal browser. The endless confusion. This stuff would be a lot simpler if people weren't always trying to make it needlessly "easy" and fucking it up even more every time.
- samtho 10y ago
  WPA/WPA2 Enterprise supports a multi user environment. You can require a unique login per user and thus associate payment with that. It also alleviates the problem with mac address whitelisting.
  - michaelmior 10y ago
    Then people either have to pay offline or you need to set up a different unencrypted network with a captive portal to facilitate payment.
- hannob 10y ago
  What would you suggest if someone wants payment for a water tab? Ever seen that? I think we should move towards considering Internet access as a general service that people make available for their guests/customers.
  - droopybuns 10y ago
    How do you see this scaling? Do you think hotels and restaurants can deliver reliable internet without charging for it? Is it reasonable to assume that companies that don't charge for wifi can afford the staff to make sure that users don't abuse it? I am considering your proposal & I don't see it working at all.
    - smsm42 10y ago
      > Do you think hotels and restaurants can deliver reliable internet without charging for it? Many do. I've never seen a restaurant charging for Wifi, and I've seen plenty offering it for free. Quality varies, some are good, some suck. Hotels are all over them map, but I just stayed at the hotel that advertises free high quality Wifi (and it indeed was fine) as one of the amenities. US-centric, of course, in some places I guess it many be too expensive for restaurants to do this.
      - OriginalPenguin 10y ago
        It shouldn't be too expensive for a restaurant to do. Although a restaurant can get by without wifi, most modern restaurants have it for managing OpenTable, monitoring yelp reviews, ordering supplies online, etc. I guess the signal might get a bit worse the farther away you get from the wifi router, but in general, providing wifi to customers shouldn't cost any additional money.
        Turing_Machine 10y ago
        "It shouldn't be too expensive for a restaurant to do." Heck, most McDonalds restaurants have free wifi these days, and that's about as cheap as it comes.
- omginternets 10y ago
  Honestly? It's 2017. Just throttle bandwidth and give your internet away for free. There are some obvious cases in which this is unacceptable, but they are few and far between. The overwhelming majority of captive portals I see are just trying to get your contact info... so now you have two reasons why they should disappear.
  - BillyParadise 10y ago
    Ah, first world problems. Where I am, data connections are out of reach for the vast majority of the population (yet somehow, they all seem to have smartphones - go figger). Everyone goes to the mall, not to shop, it would seem, but to use the free wifi and bask in the comfort of free aircon. Captive portals are here to stay in places around the world, and like it or not, they are a widely used solution that is not going away any time soon. I for one applaud the author of this website's attempts to shine light on the problem of authenticating to this network type.
  - innocenat 10y ago
    There are still part of the world where you are require by law to log who is accessing the internet, in case he/she does something illegal.
    - slang800 10y ago
      Yet another fantastic reason to get rid of captive portals. They spy on you _and_ are frequently broken.
  - arjie 10y ago
    I don't want your shitty slow internet. I want to pay $20 for fast enough Internet on a plane, not some 56.6kbps bullshit.
    - pmontra 10y ago
      $20 is one month worth of broadband in some countries. Anybody can do what he wants with his money, but $2 would be a more appropriate price tag for a few hours of Internet. If you're working, $20 could be OK though because you're gaining more.
- est 10y ago
  802.11 standard could come up with some kind of captive portal standard.
- JoshTriplett 10y ago
  Almost none of the captive portals I run into want payment of any kind; they almost always just have a click-through for "don't abuse this network" or similar terms. If you really want payment, then post a URL wherever you post a sign about the SSID, and/or make the SSID "Go To example.com after connecting".
colmmacc 10y ago
My real plan with NeverSSL.com is to use the access logs to publish an up-to-date database of broken networks and what the rough popularity of each broken network is. I'm hopeful that these kinds of public analytics could lead to solutions, or at least who to start talking to.
- gumby 10y ago
  Since this involves information capture, you should let people know on the page. Although admittedly the naive user, for whom this is intended, may be confused by that. Good idea by the way!
  - Buge 10y ago
    A link to a privacy policy at the bottom shouldn't confuse anyone.
- IsmaOlvey 10y ago
  Keep in mind that you'll also get hits from users with devices that completely lack automatic captive portal detection.
ar0 10y ago
> No captive portals. The problem isn't even so much with captive portals, but only with those actively trying to circumvent captive portal detection provided e.g. by iOS (as pointed out above). "Regular" captive portals will be captured by iOS and you can log-in via the mini browser before any requests to Facebook etc. go through - problem solved (albeit in a very hacky way). The problem only (re-)materialises when some smartass developers actively try (and succeed) to break portal detection (my guess is that they do it because iOS will close the portal once the Internet connection works, so all the nice ads they want to display just disappear).
- jandrese 10y ago
  IIRC the big problem is that Apple severely restricts the captive portal displaying minibrowser, so the tracking cookies they want to inject don't work.

> why there isn't a better solution... There is a better solution: No captive portals.

by hannob 10y ago

> why there isn't a better solution... There is a better solution: No captive portals.

What would you suggest for the case of someone wanting payment for the connection? Like it or not, a lot of places do that.

ploxiln 10y ago
put the payment url on a sign, just enforce an ip whitelist until customer has paid. Or in extreme sign-less situations put it in the ssid e.g. "pay at portalpage.com"
- bastawhiz 10y ago
  > put the payment url on a sign, just enforce an ip whitelist until customer has paid. Or in extreme sign-less situations put it in the ssid e.g. "pay at portalpage.com" This is a captive portal. But worse, because even HTTP sites don't send you to the portal.
  - ploxiln 10y ago
    But on the plus side: * no MITM attack * no TLS cert errors * no "do I need to hard-refresh? what's the key for that?" * no question if network access is working or not * one reliable clear action to get access See the various comments about work-arounds for work-arounds. Random plain-http intercept-check sites because some captive portals try to make iOS not pop up the mini sandboxed captive portal browser. The endless confusion. This stuff would be a lot simpler if people weren't always trying to make it needlessly "easy" and fucking it up even more every time.
samtho 10y ago
WPA/WPA2 Enterprise supports a multi user environment. You can require a unique login per user and thus associate payment with that. It also alleviates the problem with mac address whitelisting.
- michaelmior 10y ago
  Then people either have to pay offline or you need to set up a different unencrypted network with a captive portal to facilitate payment.
hannob 10y ago
What would you suggest if someone wants payment for a water tab? Ever seen that? I think we should move towards considering Internet access as a general service that people make available for their guests/customers.
- droopybuns 10y ago
  How do you see this scaling? Do you think hotels and restaurants can deliver reliable internet without charging for it? Is it reasonable to assume that companies that don't charge for wifi can afford the staff to make sure that users don't abuse it? I am considering your proposal & I don't see it working at all.
  - smsm42 10y ago
    > Do you think hotels and restaurants can deliver reliable internet without charging for it? Many do. I've never seen a restaurant charging for Wifi, and I've seen plenty offering it for free. Quality varies, some are good, some suck. Hotels are all over them map, but I just stayed at the hotel that advertises free high quality Wifi (and it indeed was fine) as one of the amenities. US-centric, of course, in some places I guess it many be too expensive for restaurants to do this.
    - OriginalPenguin 10y ago
      It shouldn't be too expensive for a restaurant to do. Although a restaurant can get by without wifi, most modern restaurants have it for managing OpenTable, monitoring yelp reviews, ordering supplies online, etc. I guess the signal might get a bit worse the farther away you get from the wifi router, but in general, providing wifi to customers shouldn't cost any additional money.
      - Turing_Machine 10y ago
        "It shouldn't be too expensive for a restaurant to do." Heck, most McDonalds restaurants have free wifi these days, and that's about as cheap as it comes.
omginternets 10y ago
Honestly? It's 2017. Just throttle bandwidth and give your internet away for free. There are some obvious cases in which this is unacceptable, but they are few and far between. The overwhelming majority of captive portals I see are just trying to get your contact info... so now you have two reasons why they should disappear.
- BillyParadise 10y ago
  Ah, first world problems. Where I am, data connections are out of reach for the vast majority of the population (yet somehow, they all seem to have smartphones - go figger). Everyone goes to the mall, not to shop, it would seem, but to use the free wifi and bask in the comfort of free aircon. Captive portals are here to stay in places around the world, and like it or not, they are a widely used solution that is not going away any time soon. I for one applaud the author of this website's attempts to shine light on the problem of authenticating to this network type.
- innocenat 10y ago
  There are still part of the world where you are require by law to log who is accessing the internet, in case he/she does something illegal.
  - slang800 10y ago
    Yet another fantastic reason to get rid of captive portals. They spy on you _and_ are frequently broken.
- arjie 10y ago
  I don't want your shitty slow internet. I want to pay $20 for fast enough Internet on a plane, not some 56.6kbps bullshit.
  - pmontra 10y ago
    $20 is one month worth of broadband in some countries. Anybody can do what he wants with his money, but $2 would be a more appropriate price tag for a few hours of Internet. If you're working, $20 could be OK though because you're gaining more.
est 10y ago
802.11 standard could come up with some kind of captive portal standard.
JoshTriplett 10y ago
Almost none of the captive portals I run into want payment of any kind; they almost always just have a click-through for "don't abuse this network" or similar terms. If you really want payment, then post a URL wherever you post a sign about the SSID, and/or make the SSID "Go To example.com after connecting".

colmmacc 10y ago

My real plan with NeverSSL.com is to use the access logs to publish an up-to-date database of broken networks and what the rough popularity of each broken network is. I'm hopeful that these kinds of public analytics could lead to solutions, or at least who to start talking to.

gumby 10y ago
Since this involves information capture, you should let people know on the page. Although admittedly the naive user, for whom this is intended, may be confused by that. Good idea by the way!
- Buge 10y ago
  A link to a privacy policy at the bottom shouldn't confuse anyone.
IsmaOlvey 10y ago
Keep in mind that you'll also get hits from users with devices that completely lack automatic captive portal detection.

ar0 10y ago

> No captive portals. The problem isn't even so much with captive portals, but only with those actively trying to circumvent captive portal detection provided e.g. by iOS (as pointed out above). "Regular" captive portals will be captured by iOS and you can log-in via the mini browser before any requests to Facebook etc. go through - problem solved (albeit in a very hacky way). The problem only (re-)materialises when some smartass developers actively try (and succeed) to break portal detection (my guess is that they do it because iOS will close the portal once the Internet connection works, so all the nice ads they want to display just disappear).

jandrese 10y ago
IIRC the big problem is that Apple severely restricts the captive portal displaying minibrowser, so the tracking cookies they want to inject don't work.