3 ms·

Captive portals aren't malicious. They're arguably helpful. But I've never seen a captive portal using fake certificates either.

• justsomehnguy 4y ago
  > But I've never seen a captive portal using fake certificates either. I never seen a captive portal using a valid certificate either. Not like I saw many captive portals (last time was like... 2018?) but still.
• notriddle 4y ago
  Whether they’re malicious or not, I don’t want to send them the session cookie for an unrelated website.
  • saurik 4y ago
    So scope cookies to the SSL certificate instead of the domain name, or simply offer to clear them for a domain whenever you bypass the HSTS on one.
    • duskwuff 4y ago
      > So scope cookies to the SSL certificate And invalidate every user's session whenever the server's certificate is renewed??
• Thorrez 4y ago
  >using fake certificates What's the definition of a fake certificate? Self signed? Signed by a real CA, but for a different domain (the captive portal operator's generally)?