5 ms·

I absolutely hate this nonsense. They cause countess headaches just to make people click an unenforceable "I Agree" button to terms nobody reads. What would be

I absolutely hate this nonsense. They cause countess headaches just to make people click an unenforceable "I Agree" button to terms nobody reads. What would be the best way to kill captive portals once and for all?

hansel_der 4y ago
imho either outlawing or automating them
blue_cookeh 4y ago
Whilst I hate Captive Portals in most circumstances (most hotels I stay at have completely broken implementations) we find them to be extremely useful. We run LAN gaming events and a Captive Portal helps us enforce our physical check in procedure. If someone has somehow bypassed checkin, they have no access to our network... puts a bit of a downer at a LAN event.
- weberer 4y ago
  You would think modern wi-fi standards would be able to support per-user username and passwords by now.
  - blue_cookeh 4y ago
    You can do 802.1x user/pass auth. In general though it's far more expensive to run and maintain because your access layer (APs, switches etc) now needs to be fully managed to support 802.1x. That, and a lot of OSs have janky support that doesn't follow the standard well.
- stonewareslord 4y ago
  How do you enforce the physical check with captive portal? Do you give everyone a shared password to go into the portal?
bo0tzz 4y ago
While those TOS button captive portals are definitely annoying, there are cases where this can be useful - for example, to enroll users for 802.1x certificates.
Denatonium 4y ago
A properly designed captive portal can make it harder for someone leaving a small computer in the vicinity of your network and reverse tunneling through it for nefarious purposes. Having to log in every day would disrupt the tunnel and prevent remote access. (Un)fortunately many captive portal are poorly designed, allowing arbitrary traffic to be sent over UDP/53 or ICMP, even when not authenticated. This kind of defeats the purpose of a captive portal, as the tunnel can be operated over UDP/53 (or whatever) and the captive portal can be solved remotely.
- Nextgrid 4y ago
  An attacker dedicated enough to pull off such an attack will absolutely be dedicated enough to spend 15 minutes screen-scraping the portal.

hansel_der 4y ago

imho either outlawing or automating them

blue_cookeh 4y ago

Whilst I hate Captive Portals in most circumstances (most hotels I stay at have completely broken implementations) we find them to be extremely useful. We run LAN gaming events and a Captive Portal helps us enforce our physical check in procedure. If someone has somehow bypassed checkin, they have no access to our network... puts a bit of a downer at a LAN event.

weberer 4y ago
You would think modern wi-fi standards would be able to support per-user username and passwords by now.
- blue_cookeh 4y ago
  You can do 802.1x user/pass auth. In general though it's far more expensive to run and maintain because your access layer (APs, switches etc) now needs to be fully managed to support 802.1x. That, and a lot of OSs have janky support that doesn't follow the standard well.
stonewareslord 4y ago
How do you enforce the physical check with captive portal? Do you give everyone a shared password to go into the portal?

bo0tzz 4y ago

While those TOS button captive portals are definitely annoying, there are cases where this can be useful - for example, to enroll users for 802.1x certificates.

Denatonium 4y ago

A properly designed captive portal can make it harder for someone leaving a small computer in the vicinity of your network and reverse tunneling through it for nefarious purposes. Having to log in every day would disrupt the tunnel and prevent remote access. (Un)fortunately many captive portal are poorly designed, allowing arbitrary traffic to be sent over UDP/53 or ICMP, even when not authenticated. This kind of defeats the purpose of a captive portal, as the tunnel can be operated over UDP/53 (or whatever) and the captive portal can be solved remotely.

Nextgrid 4y ago
An attacker dedicated enough to pull off such an attack will absolutely be dedicated enough to spend 15 minutes screen-scraping the portal.