3 ms·

With the web and related technology comfortably 20+ years old I'm very surprised standards haven't developed where huge, annoying hacks have developed. I check

by pfranz 7y ago

With the web and related technology comfortably 20+ years old I'm very surprised standards haven't developed where huge, annoying hacks have developed. I checked out via ApplePay on a website by random. What do you mean shipping, email, payment, confirmation are all one streamlined step where no account is needed? This is way better than poorly auto-filling random fields based on name matching. The other big one is WiFi captive portals with unencrypted connections. Can't there be a more elegant process that passes off to an encrypted connection instead of DNS spoofing? I have to manually type in http://nossl.net http://nossl.net when it messes up because most all sites are https.

est31 7y ago
> Can't there be a more elegant process that passes off to an encrypted connection instead of DNS spoofing? I have to manually type in http://nossl.net http://nossl.net when it messes up because most all sites are https. Which browser do you use? Firefox which I use has captive portal detection. It queries a mozilla provided http web site in the background and if there is DNS redirection, it displays a message.
- pfranz 7y ago
  That's exactly the kluge I'm talking about. I use iOS and macOS and it /mostly/ works. Primarily Chrome on the desktop, but use Firefox for work related stuff and Safari as a contingency. It seems to break on things like expiration (they seem to re-enable the captive portal after an hour or two) or waking from sleep. Some captive portals seem to let through iMessage or email, but block http traffic until you click through--this seems to confuse some portal detection. There have also been different "hacks" around it for decades to bypass it and get full web access. Most of my personal frustration is around apps. I get an error downloading a podcast or connecting a game so I would fire up the browser because the captive portal handling messed up. Starting a few years ago my go-to domains started https by default so I took time to seek out http-only domains because it still comes up. Assuming that all worked perfectly, you still end up with an unencrypted connection. I'm just kind of amazed that with all of the big players implementing this stuff on the client side; Apple, Microsoft, Mozilla, and on the server side AT&T, xfinity, Gogo, and any other chains plus Google on both sides deploying to Starbucks and authoring Android. Nobody seems to see this as a problem.

by pfranz 7y ago

est31 7y ago

> Can't there be a more elegant process that passes off to an encrypted connection instead of DNS spoofing? I have to manually type in http://nossl.net http://nossl.net when it messes up because most all sites are https. Which browser do you use? Firefox which I use has captive portal detection. It queries a mozilla provided http web site in the background and if there is DNS redirection, it displays a message.

pfranz 7y ago
That's exactly the kluge I'm talking about. I use iOS and macOS and it /mostly/ works. Primarily Chrome on the desktop, but use Firefox for work related stuff and Safari as a contingency. It seems to break on things like expiration (they seem to re-enable the captive portal after an hour or two) or waking from sleep. Some captive portals seem to let through iMessage or email, but block http traffic until you click through--this seems to confuse some portal detection. There have also been different "hacks" around it for decades to bypass it and get full web access. Most of my personal frustration is around apps. I get an error downloading a podcast or connecting a game so I would fire up the browser because the captive portal handling messed up. Starting a few years ago my go-to domains started https by default so I took time to seek out http-only domains because it still comes up. Assuming that all worked perfectly, you still end up with an unencrypted connection. I'm just kind of amazed that with all of the big players implementing this stuff on the client side; Apple, Microsoft, Mozilla, and on the server side AT&T, xfinity, Gogo, and any other chains plus Google on both sides deploying to Starbucks and authoring Android. Nobody seems to see this as a problem.