7 ms·
They don't! Isn't that amazing? The only use I know for captive portals is EULAs, and I'm not sure those ever had legal weight (though obviously IANAL). But h
by gboudrias 9y ago
They don't! Isn't that amazing?
The only use I know for captive portals is EULAs, and I'm not sure those ever had legal weight (though obviously IANAL).
But honestly they were starting to be outdated (technologically) even before this. Since a lot of popular sites use HTTPS, I usually have to try and think of a non-HTTP site before I can get through. They're just a nuisance at this point.
This is not to defend Google's actions as "altruistic" in any way. But sometimes Google's interests and the public's do align.
- jtl999 9y agoI just use http://example.com http://example.com for those
- jimmaswell 9y ago>The only use I know for captive portals is EULAs What? You use them to log in with some criteria more than just a username/password. For example CableWifi hotspots that let you log in with TWC, Optimum, or others.
- chainsaw10 9y ago> log in with some criteria more than just a username/password The problem there is that captive portals don't add any extra link-layer security. The network is open, so literally anyone can sniff packets. It's uncommon, but a network using WPA2-Enterprise and user/pass uses different keys for each person (not sure if per device or per user), so you don't have to trust everyone in the room.
- fyfy18 9y agoMost portals I use intercept your request to a HTTP site and redirect you to their logic form which is served over HTTPS.
- icebraining 9y agoYes, but after authentication, all traffic can be sniffed - including unencrypted connections.
- ori_b 9y agoHow is this different from the case without a captive portal, again?
- icebraining 9y agoUsing WPA-Enterprise, each connection is encrypted separately, eliminating that hole.
- ori_b 9y agoUsing WPA-Enterprise, as I understand it, requires devices to be preconfigured to authenticate with the radius server, which makes it a non-starter for the kinds of networks that use a captive portal.
- icebraining 9y agoNo, there's no preconfiguration needed, it's just a username/password account. You choose the network, then the OS asks you for your user/pass, then you're connected. It's the router that connects to the RADIUS server, not the device directly. And some routers have one embedded, so you don't even need to configure that, it "just works".
- tinus_hn 9y agoNow you don’t have to trust the other customers, only the bar you’re at, their ISP and a million other parties between you and the site you’re visiting.
- icebraining 9y ago
- lorenzhs 9y agoWouldn't it be nice if there was an encryption mode for Wifi that ensures integrity without requiring authentication? At CCC events, the workaround is to have a WPA2-Enterprise network that accepts every username/password combination, but that's going to be hard to explain to non-technical users. I think WPA3 is going to support this use case.
- fulafel 9y agoWifi has supported that kind of login for ages (15 years?) at the protocol level, without fucking with the traffic in a MITM fashion. OS support was there already for XP and iOS 2.0. https://en.m.wikipedia.org/wiki/IEEE_802.1X https://en.m.wikipedia.org/wiki/IEEE_802.1X
- throwaway2048 9y agoexcept there is no provisions for UI indications whatsoever, not even what login you should be using, or what you are logging into, or why.
- dingaling 9y agoEvery hotel room in which I've stayed has a placard on the table with the BSSID name, userID and password for the portal login. It would be identical with 802.1X. The only difference in the UI flow is that the authentication prompt is generated by the OS, not on some HTTP page that I only remember about when I wonder why my VPN isn't coming-up.
- deleted 9y ago[deleted]
- endless1234 9y agoSo why don't captive portals at e.g. cafés use 802.1X? Are they just stupid and don't know it exists, or is it really user unfriendly in that setting?
- icebraining 9y agoCompanies can easily adapt by changing your username to the form of an email (e.g. "jsmith@optimum.net"). Many of those already offer email addresses anyway.
- Zarel 9y agoHow do you communicate "log in with an email address" to a user if you can't display a web page?
- icebraining 9y agoNo, I mean the only username given by Optimum et all would be the email address.
- api_or_ipa 9y agoI use cbc.ca. It's short, memorable and to date, hasn't implemented http->https redirect.
- ComodoHacker 9y ago>they were starting to be outdated (technologically) even before this So what is the proper technology today for limited guest Wi-Fi access?
- icebraining 9y agoIf it's unauthenticated, the portal doesn't give you any advantage beyond showing a message. If it's authenticated, you should be using WPA-Enterprise anyway, which supports different logins, and actually isolates the traffic between clients, whereas those "portals" don't, allowing any other user to sniff your traffic.
- ComodoHacker 9y agoIt's surely authenticated, but I don't want guests to use WPA-Enterprise. I just need a way to communicate temporary passwords to them.
- icebraining 9y agoRight, and WPA-Enterprise (which even many cheap home routers support nowadays) is that way - you can just generate temporary logins.
- ComodoHacker 9y agoWPA-Enterprise is a way to authenticate users, not a way to distribute logins/passwords. Am I missing something about it?
- icebraining 9y agoI guess I misunderstood you before. You're using the portal to provide passwords to the users? How does that work?
- ComodoHacker 9y ago
- kuschku 9y agoThey are in fact legally required in many jurisdictions. How do you implement them properly when the user has to agree to certain terms to connect?
- tinus_hn 9y agoWhat if this isn’t possible? The world implodes? Or suddenly the lawyers discover it isn’t that ‘required’ anyway?
- kuschku 9y agoThen your country will look like Germany did until a few years ago, with no WiFi hotspots anywhere, not even in Starbucks, and people being careful not to open their WiFi to guests at a party even. That's what has happened before, that's what's just going to happen again. In Germany, the owner of a WiFi hotspot was liable for anything users on the WiFi did, unless the owner could prove that every user had signed an agreement that they would not do illegal stuff
- aemreunal 9y ago> I usually have to try and think of a non-HTTP site before I can get through. http://neverssl.com/ http://neverssl.com/ is built for that problem; it's what I use