5 ms·

One small annoyance/drawback with everything moving to https: I travel a fair bit, and hotel wifi usually relies on users connecting to their AP and then using

One small annoyance/drawback with everything moving to https: I travel a fair bit, and hotel wifi usually relies on users connecting to their AP and then using a DNS-based redirect to send the user to the login page. That only happens when on http, as https sites which are redirected get the MITM warning from the browser. I used to be able to just type in "google.com" in the address bar and be redirected accordingly; nowadays I struggle to remember a site I use which isn't https. Looking up the gateway address is kind of a pain too.

CiPHPerCoder 9y ago
http://neverssl.com/ http://neverssl.com/
- gowld 9y ago
  Alternatively, try "This well known URL": http://clients3.google.com/generate_204 http://clients3.google.com/generate_204 https://www.chromium.org/chromium-os/chromiumos-design-docs/network-portal-detection https://www.chromium.org/chromium-os/chromiumos-design-docs/...
- racer-v 9y ago
  I use the neverssl.com trick and I worry: if browsers stop supporting plan HTTP, doesn't it mean this won't work anymore?
  - dx034 9y ago
    No, worst case you'll see a security warning. Or chrome will add an exception for such a site. This is a well known problem that I'm sure will be addressed. But with the current state of the web (~20% unencrypted) it's not really an issue yet.
    - gpvos 9y ago
      If it were addressed in a way that would break captive portals forever, so much the better.
- Buge 9y ago
  Or http://http.rip http://http.rip extra appropriate today.
detaro 9y ago
I use example.com, for now it's HTTP.
- dx034 9y ago
  But the browser could default that to https since that's allowed. If you use a real domain that has no https equivalent you should be safer (neverssl.com is one of those).
haberman 9y ago
I always use captive.apple.com, which appears to be designed for this purpose.
riffic 9y ago
go to http://example.com http://example.com - it will never redirect you to HTTPS and it is an IANA reserved domain which will never disappear.
- ancarda 9y ago
  example.com has SSL: https://example.com/ https://example.com/ -- so may one day default to using that. I'd really recommend http://neverssl.com/ http://neverssl.com/ for this purpose. The homepage explains it's literally designed for situations like captive portals.
  - riffic 9y ago
    http://example.com http://example.com does not redirect: $ curl -IL http://example.com HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=604800 Content-Type: text/html Date: Thu, 08 Feb 2018 22:19:07 GMT Is neverssl.com IANA reserved?
    - bradfitz 9y ago
      neverssl.com is not IANA reserved, but a) typing in "example.com" into a browser may default to https in the future, instead of http, and b) no IANA or RFC guarantees that example.com won't redirect in the future anyway.
    - Jaruzel 9y ago
      For a while (Back in ~2011) example.com did redirect to: http://www.iana.org/domains/example/ http://www.iana.org/domains/example/ LOADS of people got upset (quite rightly) and at some point they reverted it back. But... it does show that you can't trust any URL to never change in the future, not even neverssl.com or http.rip.
- gpvos 9y ago
  No-one has pledged that it will never redirect to HTTPS, and neither is it forbidden in any standard. Technically, they could easily change it. In fact, I'm not happy that there is anything responding to example.com at all.
gok 9y ago
If this means the ultimate death of captive networks, that would be worth it on its own.
- dawnerd 9y ago
  There must be ways around it since some captive networks work with https.
  - gpvos 9y ago
    Exampls?
    - dawnerd 9y ago
      I wish I could give direct examples but it's happened a few times when traveling. I believe they were all boingo hotspots but not 100% sure.
skim_milk 9y ago
Windows 10 detects this by trying to go to msftconnecttest.com in a browser if it detects using some heuristics that the wifi requires signin which should redirect you to the wifi signin page. Android also detects this as well by going to some Google-owned page that redirects you to the wifi signin if it detects that it is needed. What are you using that this is still a problem?
- kalleboo 9y ago
  iOS and macOS both have captive-portal detection (in fact I think they pioneered it) but it's not 100% fool-proof and sometimes doesn't show up when it should. Also supposedly some captive portals trap the well-known URLs used by captive portal detection for whatever reason (which is why Apple uses a huge list of seemingly-random domains)
mkj 9y ago
Maybe one day they'll all implement https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710

CiPHPerCoder 9y ago

http://neverssl.com/ http://neverssl.com/

gowld 9y ago
Alternatively, try "This well known URL": http://clients3.google.com/generate_204 http://clients3.google.com/generate_204 https://www.chromium.org/chromium-os/chromiumos-design-docs/network-portal-detection https://www.chromium.org/chromium-os/chromiumos-design-docs/...
racer-v 9y ago
I use the neverssl.com trick and I worry: if browsers stop supporting plan HTTP, doesn't it mean this won't work anymore?
- dx034 9y ago
  No, worst case you'll see a security warning. Or chrome will add an exception for such a site. This is a well known problem that I'm sure will be addressed. But with the current state of the web (~20% unencrypted) it's not really an issue yet.
  - gpvos 9y ago
    If it were addressed in a way that would break captive portals forever, so much the better.
Buge 9y ago
Or http://http.rip http://http.rip extra appropriate today.

detaro 9y ago

I use example.com, for now it's HTTP.

dx034 9y ago
But the browser could default that to https since that's allowed. If you use a real domain that has no https equivalent you should be safer (neverssl.com is one of those).

haberman 9y ago

I always use captive.apple.com, which appears to be designed for this purpose.

riffic 9y ago

go to http://example.com http://example.com - it will never redirect you to HTTPS and it is an IANA reserved domain which will never disappear.

ancarda 9y ago
example.com has SSL: https://example.com/ https://example.com/ -- so may one day default to using that. I'd really recommend http://neverssl.com/ http://neverssl.com/ for this purpose. The homepage explains it's literally designed for situations like captive portals.
- riffic 9y ago
  http://example.com http://example.com does not redirect: $ curl -IL http://example.com HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=604800 Content-Type: text/html Date: Thu, 08 Feb 2018 22:19:07 GMT Is neverssl.com IANA reserved?
  - bradfitz 9y ago
    neverssl.com is not IANA reserved, but a) typing in "example.com" into a browser may default to https in the future, instead of http, and b) no IANA or RFC guarantees that example.com won't redirect in the future anyway.
  - Jaruzel 9y ago
    For a while (Back in ~2011) example.com did redirect to: http://www.iana.org/domains/example/ http://www.iana.org/domains/example/ LOADS of people got upset (quite rightly) and at some point they reverted it back. But... it does show that you can't trust any URL to never change in the future, not even neverssl.com or http.rip.
gpvos 9y ago
No-one has pledged that it will never redirect to HTTPS, and neither is it forbidden in any standard. Technically, they could easily change it. In fact, I'm not happy that there is anything responding to example.com at all.

gok 9y ago

If this means the ultimate death of captive networks, that would be worth it on its own.

dawnerd 9y ago
There must be ways around it since some captive networks work with https.
- gpvos 9y ago
  Exampls?
  - dawnerd 9y ago
    I wish I could give direct examples but it's happened a few times when traveling. I believe they were all boingo hotspots but not 100% sure.

skim_milk 9y ago

Windows 10 detects this by trying to go to msftconnecttest.com in a browser if it detects using some heuristics that the wifi requires signin which should redirect you to the wifi signin page. Android also detects this as well by going to some Google-owned page that redirects you to the wifi signin if it detects that it is needed. What are you using that this is still a problem?

kalleboo 9y ago
iOS and macOS both have captive-portal detection (in fact I think they pioneered it) but it's not 100% fool-proof and sometimes doesn't show up when it should. Also supposedly some captive portals trap the well-known URLs used by captive portal detection for whatever reason (which is why Apple uses a huge list of seemingly-random domains)

mkj 9y ago

Maybe one day they'll all implement https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710