4 ms·

I'm curious if that includes falling back to HTTP when HTTPS has worked in the past. I only ask because I'm curious what this will do with captive portal nonse

I'm curious if that includes falling back to HTTP when HTTPS has worked in the past. I only ask because I'm curious what this will do with captive portal nonsense.

TimBurr 6y ago
I've found http://neverssl.com http://neverssl.com very helpful for captive portals. It does what you'd expect - hosts a HTTP-only page that allows captive portals to work correctly. Since it's only ever HTTP, it sidesteps the certificate errors or HTTP downgrades that normal sites are hit with during captive portal interception. I am curious what happens to captive portals as HTTPS adoption rises. Some OS's (Android, OSX) already detect captive portals and launch a lightweight webview.
- xeromal 6y ago
  Thanks for this. I never can remember URLs like this but I always remember chicken.com. It's sad day to see it go away.
  - rnotaro 6y ago
    I'm French-Canadian I use http://perdu.com http://perdu.com [1] (Perdu is lost in French). It's a light funny page i've found about 10+ years ago but it's HTTP and helpfull for captive portals. [1] https://fr.wikipedia.org/wiki/Perdu.com https://fr.wikipedia.org/wiki/Perdu.com
- banana_giraffe 6y ago
  Yep, I use neverssl.com, when I remember it. Though, mostly I use example.com, since that works without SSL as well. I guess now I'll need to remember to type http://example.com http://example.com . Based off my experience, more and more captive portals appear to be letting the requests the OS makes to captive.apple.com or whatever through but still try to present a captive portal to the user. I can guess as to the motivation, but as a user it's danged annoying.
marcosdumay 6y ago
It has been a long time since I've seen a captive portal that doesn't trigger the "this connection needs authentication" message on my phone.
remram 6y ago
HSTS takes care of that. It's an HTTP header to indicate not to connect without TLS in the future. It makes sense to keep falling back to HTTP if that header is not set.

I'm curious if that includes falling back to HTTP when HTTPS has worked in the past. I only ask because I'm curious what this will do with captive portal nonsense.

TimBurr 6y ago

I've found http://neverssl.com http://neverssl.com very helpful for captive portals. It does what you'd expect - hosts a HTTP-only page that allows captive portals to work correctly. Since it's only ever HTTP, it sidesteps the certificate errors or HTTP downgrades that normal sites are hit with during captive portal interception. I am curious what happens to captive portals as HTTPS adoption rises. Some OS's (Android, OSX) already detect captive portals and launch a lightweight webview.

xeromal 6y ago
Thanks for this. I never can remember URLs like this but I always remember chicken.com. It's sad day to see it go away.
- rnotaro 6y ago
  I'm French-Canadian I use http://perdu.com http://perdu.com [1] (Perdu is lost in French). It's a light funny page i've found about 10+ years ago but it's HTTP and helpfull for captive portals. [1] https://fr.wikipedia.org/wiki/Perdu.com https://fr.wikipedia.org/wiki/Perdu.com
banana_giraffe 6y ago
Yep, I use neverssl.com, when I remember it. Though, mostly I use example.com, since that works without SSL as well. I guess now I'll need to remember to type http://example.com http://example.com . Based off my experience, more and more captive portals appear to be letting the requests the OS makes to captive.apple.com or whatever through but still try to present a captive portal to the user. I can guess as to the motivation, but as a user it's danged annoying.

marcosdumay 6y ago

It has been a long time since I've seen a captive portal that doesn't trigger the "this connection needs authentication" message on my phone.

remram 6y ago

HSTS takes care of that. It's an HTTP header to indicate not to connect without TLS in the future. It makes sense to keep falling back to HTTP if that header is not set.