15 ms·
When I'm on free airport wifi they'll often limit the session to half an hour and then start MITMing your traffic to try to bounce you back out to the sign-in p
by repsilat 8y ago
When I'm on free airport wifi they'll often limit the session to half an hour and then start MITMing your traffic to try to bounce you back out to the sign-in page to agree to the terms and conditions again. When that happens, the redirect won't work if you're trying to browse to an HTTPS URL. Worse, for many sites you can't tell your browser to "just go along with the MITM" because of HSTS.
So in airports I rack my brain for a website that might serve content over HTTP, not HTTPS. Alas, they're getting harder to find, and it's getting harder to keep those airport wifi sessions going. I half considered registering "alwaysinsecure.com" or "alwayshttp.com" so I could reliably find one... Now I'll probably just use qq.com, it's short and easy to remember.
EDIT: Thanks all :-)
- ribasushi 8y agoneverssl.com ( not a suggestion, it does exist )
- pascoej 8y agocaptive.apple.com
- glenjamin 8y agohttp://neverssl.com/ http://neverssl.com/ is what you're looking for here.
- sebazzz 8y agoI just use example.com
- bogomipz 8y agoInteresting. What the prescription here - to simply use http://neverssl.com http://neverssl.com in order to see if you need to re-authenticate to the captive portal? Is that correct?
- pohl 8y agoThat's my interpretation of what http://neverssl.com http://neverssl.com says. (Did you click-through to read it?)
- octosphere 8y agoAnd http://info.cern.ch/hypertext/WWW/TheProject.html http://info.cern.ch/hypertext/WWW/TheProject.html still retains it non-encryptedness
- jpetrucc 8y agohttp://http.rip http://http.rip is what I use
- merb 8y agodoesn't most OS's now have a captive portal which always check a url if it is accessible, if not they open a sane looking portal?
- saulrh 8y agoI use example.org for that. I wouldn't be surprised if it has to stay available on http for hysterical raisins, such as everyone using it in their tests and outage detectors.
- dvfjsdhgfv 8y ago> hysterical raisins Thanks for making me smile!
- aorth 8y agohttp://detectportal.firefox.com http://detectportal.firefox.com
- mike-cardwell 8y agohttp://1.2.3.4 http://1.2.3.4 or any other random IP generally works for me. It doesn't necessarily have to exist.
- tinus_hn 8y agoExample.com is defined to not have ssl.
- gpvos 8y agoDefined by what or whom? (I'm still sad that example.com responds to anything at all. It was originally defined as a completely unused, thus unresponsive, domain.)
- nkristoffersen 8y agoRead example.com it answers all your questions :-)
- crunchatized 8y agoIt doesn't say that IANA defined it to not have HTTPS anywhere at all.
- crunchatized 8y ago? https://www.example.com/ https://www.example.com/ It's had HTTPS since at least 2014. [0] [0] https://crt.sh/?id=5857507 https://crt.sh/?id=5857507
- tinus_hn 8y agoThat is a surprise to me, but you are right. I’m not quite sure what’s the use but there it is.
- sgshsf 8y agohttp://http.rip/ http://http.rip/
- octosphere 8y agohttp://info.cern.ch http://info.cern.ch
- Scott_Helme_ 8y agoThis really highlights the problem that we need a proper technical solution for and not hacky traffic interception/redirects! I also created http://httpforever.com/ http://httpforever.com/ for this purpose until such a time that the problem is solved properly.
- deleted 8y ago[deleted]
- supertrope 8y agoIt's not a technical or even standards setting problem. IIRC there's already a RFC for DHCP announced login webpage. It's business and legal - layer 8 and 9 problems. Operating system maintainers have added captive portal detection to improve user experience. Hotspot owners often sabotage captive portal detection by whitelisting Apple and Google's CPD URLs! AAPL & GOOG have to change these URLs periodically and 802.11 vendors add the new ones in a cat and mouse game. So the customer's phone and thus customer think they're connected but they end up hitting a CP. Why? Because the CPD browser will close immediately upon receiving unencumbered Internet access. While many just want the legal liability limiting I Agree button to be tapped, many others owners want customers to see their store promotion/ad flyer page for longer than a second, place a tracking cookie, and do other value adds. The interests of Wi-Fi network operators and users are not aligned. Right now only equipment manufacturers directly profit off Wi-Fi service. Hotspot owners can only indirectly earn money through attracting more hotel guests, cafe customers, etc. Some now harvest customer MAC address and in-store walking behavior. Ideally hotspot owners could receive a revenue share for offloading traffic from LTE, which would give them an incentive to be more loyal to users and maintain quality of experience. https://news.ycombinator.com/item?id=13369038 https://news.ycombinator.com/item?id=13369038
- snek 8y agoyou also always have to disable your custom DNS settings, and sometimes that means disable your DNS over TLS or go without internet :(
- mintplant 8y agoRecent versions of Firefox should detect this and present a prompt to go to the portal login page.
- torgoguys 8y agowww.com is a short, easy to remember, parked domain I tend to use. It has some text ads, but is probably reasonably light on bandwidth. neverssl.com, mentioned below, is one I seem to for some reason always struggle to remember it's name when I need it. I end up typing things like nossl.com or neverhttps.com and such...
- nkristoffersen 8y agoexample.com is great for testing http. And it’s owned by IANA and not some rando. No ads either and easy to remember.
- wdroz 8y agoThat's why I always use my DNS tunnel. You can bypass such system on almost all public wifi.
- oliwarner 8y agoAlmost all? You've had access to some pretty crappy captive portals. In my experience most portals' firewalls block all traffic (at IP level) except ports 80 and 443, which are transparently redirected to their auth server. Tunnelling isn't an option because you just can't contact anything else. And it's not like I'm describing something that's hard to do. You've been able to script this stuff in iptables forever.
- xnyanta 8y agoDNS happens over port 53
- oliwarner 8y agoYes. I'm saying in my experience everything but 80/443 are blocked. Completely. 80/443 get redirected. Edited parent for clarity.
- iforgotpassword 8y agoThen how can they redirect you to anything in the first place? I type www.google.com in my browser and then what exactly happens next on the IP level? Think about it...
- pixl97 8y agoDNS isn't secure, all they have to do is capture and answer all queries on unauthenticated IPs. No route to the internet needed.
- iforgotpassword 8y ago
- dijit 8y agocaptive.apple.com I love this site.
- syncsynchalt 8y agohp.com is still not strict and is quick to type. No guarantee that they won't turn on HSTS tomorrow though.
- mustak_im 8y agoFor a long time I used my bank's homepage to get me redirected to the login page. Until the (reluctantly) forced HTTPS. Since then I'm using http://neverssl.com http://neverssl.com :)