5 ms·

Here's a question: how are captive portals going to present the login site if the user never uses HTTP? I know Android and other mobile OSs probe the network by

by jdiez17 10y ago

Here's a question: how are captive portals going to present the login site if the user never uses HTTP? I know Android and other mobile OSs probe the network by requesting a HTTP site. On my laptop, I have to load something like `example.org` to get redirected.

LogicX 10y ago
I believe we need to work on a standard usable by those currently trying to MITM, which works with browser makers to present a nicer message to users, but maintains the privacy of their connection.
kalleboo 10y ago
There was some discussion about that dilemma a couple weeks ago https://news.ycombinator.com/item?id=13369038 https://news.ycombinator.com/item?id=13369038 There's an RFC for a way to add this to DHCP https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710
NoGravitas 10y ago
The solution is for captive portals to go away. Captive portals should absolutely not exist.
- guitarbill 10y ago
  iOS already prints a security warning when connecting to such networks, my hope is that Apple will simply have phones disconnect from MitM'ed networks in future, breaking captive portals but making the situation right. They only really exist where people have no other choice (e.g. hotel). They're often broken, or unusable on mobile devices with tiny UI. Captive portals are an abomination and misuse of technology, not to mention a terrible user experience. And any brand using a captive portal just diminishes my view of the brand.
  - neuland 10y ago
    I totally agree that captive portals suck and we should name and shame anybody using them, especially ones that are poorly built. But, there has to be some reason that these exist right? To get rid of captive portals, there needs to be this functionality in the underlying protocols: - Requiring Terms of Service - Showing a special site from the service provider (like the page Starbucks takes you to after "Accept and Connect") - Selecting what kind of connection you want (like at airports and hotels where there's free and paid) - Login to some system the service provider controls (also airports and hotels w/ paid plans) - ... and, potentially other things I haven't seen Edit: Somewhere else in this thread, kelleboo mentioned this [0] [0] https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710
    - guitarbill 10y ago
      > To get rid of captive portals, there needs to be this functionality in the underlying protocols Not really - I don't think implementing legal considerations into technology is the way to go. Mainly because laws vary by country and laws also change independently from technology. For example, in Germany, EULAs only valid if agreed on at the time of purchase of the goods or service. If presented after purchase, even if you have to click some "I agree" button, they are not valid. (And even then, they can't contradict German consumer law.) I don't believe anybody has sued because of WiFi, but then the question becomes when does service start? When you connect, or when you click accept? Keep in mind that some devices like Nintendo DS' or Kindles can't use captive portals, better implementations of portals recognise these devices and let them connect. In reality, what does the ToS really way, anyway? Don't do illegal stuff - but that's illegal with or without ToS. For free WiFi, you only have X amount of traffic - well, it's free WiFi, there's no obligation for for service. (Put simply, EULAs and ToS' also need to die - but that's a different discussion.) Billing is more interesting. One argument is it's 2017 - should we really encourage billing for basic WiFi when bandwidth is cheap? One solution could be to give users x amount for free, and only if they use all that use a captive portal. It's not ideal, but at least it doesn't happen right at the start. You could also simply have different SSIDs for paid and free.
      - neuland 10y ago
TorKlingberg 10y ago
Most likely desktop OSes will start doing the same detection heuristics as mobile OSes.
- ReverseCold 10y ago
  My Windows 10 laptop does this. As soon as I connect to a captive portal wifi, it opens up my default browser with a sign in window.
fulafel 10y ago
There are standard protocols for it, HTTP MITM was always (well, in recent history) just asshattery.
dullgiulio 10y ago
Google keeps a service on HTTP on purpose: https://www.chromium.org/chromium-os/chromiumos-design-docs/network-portal-detection https://www.chromium.org/chromium-os/chromiumos-design-docs/... Try visiting: http://clients3.google.com/generate_204 http://clients3.google.com/generate_204

by jdiez17 10y ago

LogicX 10y ago

I believe we need to work on a standard usable by those currently trying to MITM, which works with browser makers to present a nicer message to users, but maintains the privacy of their connection.

kalleboo 10y ago

There was some discussion about that dilemma a couple weeks ago https://news.ycombinator.com/item?id=13369038 https://news.ycombinator.com/item?id=13369038 There's an RFC for a way to add this to DHCP https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710

NoGravitas 10y ago

The solution is for captive portals to go away. Captive portals should absolutely not exist.

guitarbill 10y ago
iOS already prints a security warning when connecting to such networks, my hope is that Apple will simply have phones disconnect from MitM'ed networks in future, breaking captive portals but making the situation right. They only really exist where people have no other choice (e.g. hotel). They're often broken, or unusable on mobile devices with tiny UI. Captive portals are an abomination and misuse of technology, not to mention a terrible user experience. And any brand using a captive portal just diminishes my view of the brand.
- neuland 10y ago
  I totally agree that captive portals suck and we should name and shame anybody using them, especially ones that are poorly built. But, there has to be some reason that these exist right? To get rid of captive portals, there needs to be this functionality in the underlying protocols: - Requiring Terms of Service - Showing a special site from the service provider (like the page Starbucks takes you to after "Accept and Connect") - Selecting what kind of connection you want (like at airports and hotels where there's free and paid) - Login to some system the service provider controls (also airports and hotels w/ paid plans) - ... and, potentially other things I haven't seen Edit: Somewhere else in this thread, kelleboo mentioned this [0] [0] https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710
  - guitarbill 10y ago
    > To get rid of captive portals, there needs to be this functionality in the underlying protocols Not really - I don't think implementing legal considerations into technology is the way to go. Mainly because laws vary by country and laws also change independently from technology. For example, in Germany, EULAs only valid if agreed on at the time of purchase of the goods or service. If presented after purchase, even if you have to click some "I agree" button, they are not valid. (And even then, they can't contradict German consumer law.) I don't believe anybody has sued because of WiFi, but then the question becomes when does service start? When you connect, or when you click accept? Keep in mind that some devices like Nintendo DS' or Kindles can't use captive portals, better implementations of portals recognise these devices and let them connect. In reality, what does the ToS really way, anyway? Don't do illegal stuff - but that's illegal with or without ToS. For free WiFi, you only have X amount of traffic - well, it's free WiFi, there's no obligation for for service. (Put simply, EULAs and ToS' also need to die - but that's a different discussion.) Billing is more interesting. One argument is it's 2017 - should we really encourage billing for basic WiFi when bandwidth is cheap? One solution could be to give users x amount for free, and only if they use all that use a captive portal. It's not ideal, but at least it doesn't happen right at the start. You could also simply have different SSIDs for paid and free.
    - neuland 10y ago

TorKlingberg 10y ago

Most likely desktop OSes will start doing the same detection heuristics as mobile OSes.

ReverseCold 10y ago
My Windows 10 laptop does this. As soon as I connect to a captive portal wifi, it opens up my default browser with a sign in window.

fulafel 10y ago

There are standard protocols for it, HTTP MITM was always (well, in recent history) just asshattery.

dullgiulio 10y ago

Google keeps a service on HTTP on purpose: https://www.chromium.org/chromium-os/chromiumos-design-docs/network-portal-detection https://www.chromium.org/chromium-os/chromiumos-design-docs/... Try visiting: http://clients3.google.com/generate_204 http://clients3.google.com/generate_204