5 ms·

Hotel Hotspot Hijinks

60 points by oalders 3y ago

RunningDroid 3y ago
I've been tempted to work on some kind of script environment to automatically bypass captive portal screens like this, but I've been putting it off in the hopes someone who actually knows how to do it makes one.
lxgr 3y ago
It’s kind of baffling that after decades of wifi and captive portals, we still don’t have any kind of standard for the network to properly signal the fact “you’ll need to visit <url> in a browser” to a device. It’s hacks (DNS hijacking) upon hacks (captive portal detection) upon hacks (captive portal detection evasion, used e.g. to allow devices to stay connected to networks offering “messaging only” plans). On top of that, after a captive login, the entire session is only identified/authenticated via MAC address, which is very sniffable/cloneable in unencrypted wifi… At least I have yet to see any captive portal hotspot to leverage OWE for something more secure than that.
- DannyBee 3y ago
  "It’s kind of baffling that after decades of wifi and captive portals, we still don’t have any kind of standard for the network to properly signal the fact “you’ll need to visit <url> in a browser” to a device. " We do, actually, and have for decades. https://en.wikipedia.org/wiki/WISPr https://en.wikipedia.org/wiki/WISPr Back in ~2010 I wrote a simply python script that parses out the WISPR data that you get, and submits data to the place specified by the XML. It works on 90+% of hotspots i've ever encountered.
  - cbsks 3y ago
    Could you share your script? That sounds really useful!
  - lxgr 3y ago
    That sounds cool – are you saying that commercial hotspots actually use this? The specification website seems to be offline, for one thing. Assuming that's indeed a thing, I wonder why the experience (at least on macOS/iOS) is still so mixed then. For example, in inflight Wi-Fi, I practically always have to manually navigate to a non-HTTPS site in my browser to hopefully get redirected to airlinename.com/wifi or whatever they use, to be able to pay for an internet pass (with credit card or by watching their ads). I suspect this is because many airlines now offer free in-flight entertainment and messaging on their free tiers, and the OS's native captive login UI would interfere with that. So I suppose that WISPr protocol doesn't support communicating something like "limited connectivity, navigate to URL x to pay for full access, portal available at URL y".
    - DannyBee 3y ago
      Yes, most commercial hotspots use it. Particularly the redirect to login page ones. If you get some form of “you need to login” pop up notification, it is the main way they detect that. Those that don’t give you such a notification are probably not using it
- CaliforniaKarl 3y ago
  For the captive-portal detection part, there’s an RFC covering it: The network provider can tell the device where to send the user, and can provide an endpoint to get info like how long is left on the session. Apple has a page on it, here: https://developer.apple.com/news/?id=q78sq5rv https://developer.apple.com/news/?id=q78sq5rv
- xg15 3y ago
  Not sure if this is deliberate, but it seems like a straightforward application of the "paving the cowpaths" approach to standards that was advocated so much in the last decades. Basically I guess, browser vendors decided that there is no way to convince every captive portal operator on earth to adopt some kind of standard, so they just "standardized" the existing practice of querying some random http host and see if it gets intercepted. I think there are also discentives to standardisation, unfortunately: Captive portal operators want their portals seen by humans, often just to get people to agree to some ToS. If this were standardized, someone would build a tool that could log into a captive portal without user interaction, and while this would be awesome for me and you, it defeats the entire purpose of the portal from the operator's perspective. So I fear, this is why we (techies) can't have nice things.
  - RajT88 3y ago
    > so they just "standardized" the existing practice of querying some random http host and see if it gets intercepted. What I have seen a lot is only certain URI's redirecting you to the captive portal. ("A lot" being some minority of open access points, not most of them which redirect everything - but it's common enough) For anyone stuck in this labyrinthine hell, the two which always work belong to warring big tech behemoths: https://www.google.com https://www.google.com http://www.msftconnecttest.com/ http://www.msftconnecttest.com/ Others may work on these AP's; I haven't had to try different ones after trying these two.
    - netsharc 3y ago
      https://www.google.com https://www.google.com will most likely not load because browsers nowadays have HSTS, and they will stop loading as soon as the server offers the wrong certificate...
      - RajT88 3y ago
        Yeah, ran into that one a few times. Sometimes clicking "advanced" if presented as an option, lets me proceed. Other times, I think I just used Internet Explorer to get around it.
- deleted 3y ago
  [deleted]
- zzo38computer 3y ago
  It is problematic because it would still require that you even have a compatible web browser.
- m463 3y ago
  On the other hand, this sort of nonsense is why some places just have an AP and give the wifi password and you can just connect. (instead of visiting a page, setting a bunch of cookies and tracking you all over the universe)
- rcarmo 3y ago
  Actually, we do. The WISPr standard (https://en.m.wikipedia.org/wiki/WISPr https://en.m.wikipedia.org/wiki/WISPr) has since evolved into ETSI recommendations, and the new ones are automatable. But cheapskate hotel Wi-Fi systems are only upgraded when the building is torn down.
dang 3y ago
(Re-upped from https://news.ycombinator.com/item?id=39780937 https://news.ycombinator.com/item?id=39780937 and comments moved hither)
xwowsersx 3y ago
Funny enough, I'm reading this while connected to hotel Wi-Fi, fresh from navigating through the login page of their website. In my situation, it required inputting my room number along with the last name. Does anyone happen to possess a functional script akin to the one mentioned in this post, or perhaps a comparable script that I could just plug in and use?
- carl_dr 3y ago
  Try opening the console tools of your browser, find the network tab, then log in (you should be able to get the captive portal in your browser if you experiment a bit, kinda as per the article.) Then locate the request that was made when you logged in, right click, and “Copy as cURL.” Then just paste the resulting command in a terminal when needed. It should capture everything you need (notwithstanding CSRF/session IDs rotating etc.)
  - xwowsersx 3y ago
    Will give this a try. Thanks!
andreasha 3y ago
For travel routers there’s travelmate for OpenWrt https://github.com/openwrt/packages/blob/master/net/travelmate/files/README.md https://github.com/openwrt/packages/blob/master/net/travelma...
- brokenmachine 3y ago
  Does that automate login to a captive portal?
  - andreasha 3y ago
    Haven't tried it but sounds like it should, it already have a few shell scripts for some captive portals. "captive portal auto-login hook (configured via uci/LuCI), you are able to reference an external script for captive portal auto-logins (see example below)" https://github.com/openwrt/packages/blob/master/net/travelmate/files/README.md#captive-portal-auto-logins https://github.com/openwrt/packages/blob/master/net/travelma... It can also auto join open networks "automatically add open uplinks to your wireless config, e.g. hotel captive portals (disabled by default)"
lxe 3y ago
Judging by the password and username posted here, it's trivial to deduce the specific hotel in question.
- oalders 3y ago
  That has now been fixed.
wildrhythms 3y ago
I wanted to connect my Nintendo Switch to the hotel wifi, but the captive portal wouldn't load on it. So I just spoofed my Switch MAC on my laptop, got thru the captive portal, reverted everything, and I was able to happily play Diablo 3 :)
- seabass-labrax 3y ago
  > I wanted to connect my Nintendo Switch to the hotel wifi, but the captive portal wouldn't load on it. So I just spoofed my Switch MAC on my laptop, got thru the captive portal, reverted everything, and I was able to happily play Diablo 3 :) And next time, you can try to beat your personal high score for speed-running captive portal automation/evasion ;) Now I think about it, that seems like it would be a rather fun activity for a software meetup!
BobbyTables2 3y ago
Couldn’t he just have used Firefox’s developer mode to record the POST and then do “copy a cURL” for a nice one liner? (Or maybe two to handle cookies)

60 points by oalders 3y ago

I've been tempted to work on some kind of script environment to automatically bypass captive portal screens like this, but I've been putting it off in the hopes someone who actually knows how to do it makes one.

lxgr 3y ago

It’s kind of baffling that after decades of wifi and captive portals, we still don’t have any kind of standard for the network to properly signal the fact “you’ll need to visit <url> in a browser” to a device. It’s hacks (DNS hijacking) upon hacks (captive portal detection) upon hacks (captive portal detection evasion, used e.g. to allow devices to stay connected to networks offering “messaging only” plans). On top of that, after a captive login, the entire session is only identified/authenticated via MAC address, which is very sniffable/cloneable in unencrypted wifi… At least I have yet to see any captive portal hotspot to leverage OWE for something more secure than that.

DannyBee 3y ago
"It’s kind of baffling that after decades of wifi and captive portals, we still don’t have any kind of standard for the network to properly signal the fact “you’ll need to visit <url> in a browser” to a device. " We do, actually, and have for decades. https://en.wikipedia.org/wiki/WISPr https://en.wikipedia.org/wiki/WISPr Back in ~2010 I wrote a simply python script that parses out the WISPR data that you get, and submits data to the place specified by the XML. It works on 90+% of hotspots i've ever encountered.
- cbsks 3y ago
  Could you share your script? That sounds really useful!
- lxgr 3y ago
  That sounds cool – are you saying that commercial hotspots actually use this? The specification website seems to be offline, for one thing. Assuming that's indeed a thing, I wonder why the experience (at least on macOS/iOS) is still so mixed then. For example, in inflight Wi-Fi, I practically always have to manually navigate to a non-HTTPS site in my browser to hopefully get redirected to airlinename.com/wifi or whatever they use, to be able to pay for an internet pass (with credit card or by watching their ads). I suspect this is because many airlines now offer free in-flight entertainment and messaging on their free tiers, and the OS's native captive login UI would interfere with that. So I suppose that WISPr protocol doesn't support communicating something like "limited connectivity, navigate to URL x to pay for full access, portal available at URL y".
  - DannyBee 3y ago
    Yes, most commercial hotspots use it. Particularly the redirect to login page ones. If you get some form of “you need to login” pop up notification, it is the main way they detect that. Those that don’t give you such a notification are probably not using it
CaliforniaKarl 3y ago
For the captive-portal detection part, there’s an RFC covering it: The network provider can tell the device where to send the user, and can provide an endpoint to get info like how long is left on the session. Apple has a page on it, here: https://developer.apple.com/news/?id=q78sq5rv https://developer.apple.com/news/?id=q78sq5rv
xg15 3y ago
Not sure if this is deliberate, but it seems like a straightforward application of the "paving the cowpaths" approach to standards that was advocated so much in the last decades. Basically I guess, browser vendors decided that there is no way to convince every captive portal operator on earth to adopt some kind of standard, so they just "standardized" the existing practice of querying some random http host and see if it gets intercepted. I think there are also discentives to standardisation, unfortunately: Captive portal operators want their portals seen by humans, often just to get people to agree to some ToS. If this were standardized, someone would build a tool that could log into a captive portal without user interaction, and while this would be awesome for me and you, it defeats the entire purpose of the portal from the operator's perspective. So I fear, this is why we (techies) can't have nice things.
- RajT88 3y ago
  > so they just "standardized" the existing practice of querying some random http host and see if it gets intercepted. What I have seen a lot is only certain URI's redirecting you to the captive portal. ("A lot" being some minority of open access points, not most of them which redirect everything - but it's common enough) For anyone stuck in this labyrinthine hell, the two which always work belong to warring big tech behemoths: https://www.google.com https://www.google.com http://www.msftconnecttest.com/ http://www.msftconnecttest.com/ Others may work on these AP's; I haven't had to try different ones after trying these two.
  - netsharc 3y ago
    https://www.google.com https://www.google.com will most likely not load because browsers nowadays have HSTS, and they will stop loading as soon as the server offers the wrong certificate...
    - RajT88 3y ago
      Yeah, ran into that one a few times. Sometimes clicking "advanced" if presented as an option, lets me proceed. Other times, I think I just used Internet Explorer to get around it.
deleted 3y ago
[deleted]
zzo38computer 3y ago
It is problematic because it would still require that you even have a compatible web browser.
m463 3y ago
On the other hand, this sort of nonsense is why some places just have an AP and give the wifi password and you can just connect. (instead of visiting a page, setting a bunch of cookies and tracking you all over the universe)
rcarmo 3y ago
Actually, we do. The WISPr standard (https://en.m.wikipedia.org/wiki/WISPr https://en.m.wikipedia.org/wiki/WISPr) has since evolved into ETSI recommendations, and the new ones are automatable. But cheapskate hotel Wi-Fi systems are only upgraded when the building is torn down.

dang 3y ago

(Re-upped from https://news.ycombinator.com/item?id=39780937 https://news.ycombinator.com/item?id=39780937 and comments moved hither)

xwowsersx 3y ago

Funny enough, I'm reading this while connected to hotel Wi-Fi, fresh from navigating through the login page of their website. In my situation, it required inputting my room number along with the last name. Does anyone happen to possess a functional script akin to the one mentioned in this post, or perhaps a comparable script that I could just plug in and use?

carl_dr 3y ago
Try opening the console tools of your browser, find the network tab, then log in (you should be able to get the captive portal in your browser if you experiment a bit, kinda as per the article.) Then locate the request that was made when you logged in, right click, and “Copy as cURL.” Then just paste the resulting command in a terminal when needed. It should capture everything you need (notwithstanding CSRF/session IDs rotating etc.)
- xwowsersx 3y ago
  Will give this a try. Thanks!

andreasha 3y ago

For travel routers there’s travelmate for OpenWrt https://github.com/openwrt/packages/blob/master/net/travelmate/files/README.md https://github.com/openwrt/packages/blob/master/net/travelma...

brokenmachine 3y ago
Does that automate login to a captive portal?
- andreasha 3y ago
  Haven't tried it but sounds like it should, it already have a few shell scripts for some captive portals. "captive portal auto-login hook (configured via uci/LuCI), you are able to reference an external script for captive portal auto-logins (see example below)" https://github.com/openwrt/packages/blob/master/net/travelmate/files/README.md#captive-portal-auto-logins https://github.com/openwrt/packages/blob/master/net/travelma... It can also auto join open networks "automatically add open uplinks to your wireless config, e.g. hotel captive portals (disabled by default)"

lxe 3y ago

Judging by the password and username posted here, it's trivial to deduce the specific hotel in question.

oalders 3y ago
That has now been fixed.

wildrhythms 3y ago

I wanted to connect my Nintendo Switch to the hotel wifi, but the captive portal wouldn't load on it. So I just spoofed my Switch MAC on my laptop, got thru the captive portal, reverted everything, and I was able to happily play Diablo 3 :)

seabass-labrax 3y ago
> I wanted to connect my Nintendo Switch to the hotel wifi, but the captive portal wouldn't load on it. So I just spoofed my Switch MAC on my laptop, got thru the captive portal, reverted everything, and I was able to happily play Diablo 3 :) And next time, you can try to beat your personal high score for speed-running captive portal automation/evasion ;) Now I think about it, that seems like it would be a rather fun activity for a software meetup!

BobbyTables2 3y ago

Couldn’t he just have used Firefox’s developer mode to record the POST and then do “copy a cURL” for a nice one liner? (Or maybe two to handle cookies)