4 ms·

Not sure if this is deliberate, but it seems like a straightforward application of the "paving the cowpaths" approach to standards that was advocated so much in

by xg15 3y ago

Not sure if this is deliberate, but it seems like a straightforward application of the "paving the cowpaths" approach to standards that was advocated so much in the last decades. Basically I guess, browser vendors decided that there is no way to convince every captive portal operator on earth to adopt some kind of standard, so they just "standardized" the existing practice of querying some random http host and see if it gets intercepted. I think there are also discentives to standardisation, unfortunately: Captive portal operators want their portals seen by humans, often just to get people to agree to some ToS. If this were standardized, someone would build a tool that could log into a captive portal without user interaction, and while this would be awesome for me and you, it defeats the entire purpose of the portal from the operator's perspective. So I fear, this is why we (techies) can't have nice things.

RajT88 3y ago
> so they just "standardized" the existing practice of querying some random http host and see if it gets intercepted. What I have seen a lot is only certain URI's redirecting you to the captive portal. ("A lot" being some minority of open access points, not most of them which redirect everything - but it's common enough) For anyone stuck in this labyrinthine hell, the two which always work belong to warring big tech behemoths: https://www.google.com https://www.google.com http://www.msftconnecttest.com/ http://www.msftconnecttest.com/ Others may work on these AP's; I haven't had to try different ones after trying these two.
- netsharc 3y ago
  https://www.google.com https://www.google.com will most likely not load because browsers nowadays have HSTS, and they will stop loading as soon as the server offers the wrong certificate...
  - RajT88 3y ago
    Yeah, ran into that one a few times. Sometimes clicking "advanced" if presented as an option, lets me proceed. Other times, I think I just used Internet Explorer to get around it.
    - avidiax 3y ago
      example.com, example.net, and neverssl.com all lack HTTPS.
    - Citizen8396 3y ago
      [dead]
- kennethrc 3y ago
  I have "neverssl.com" as a prominent bookmark; as its name implies, the lack of SSL means I get directly to the captive portal page.
  - 3np 3y ago
    Except every once in a blue moon when the opposite happens: HTTPS 443 gets blocked/hijacked while HTTP 80 goes out just fine (in which case either of the beforementioned generally gets you to the portal).
    - xg15 3y ago
      How would that work? The entire point of https is that it can't be hijacked. (Or rather, you can hijack it, but you can't show a portal on that connection, so what would be the point?)
      - 3np 3y ago
        I'm not saying it works as intended or that there is a point to it. Just that it does happen.
- avidiax 3y ago
  You can add http://connectivitycheck.android.com http://connectivitycheck.android.com, http://connectivitycheck.gstatic.com http://connectivitycheck.gstatic.com, and http://www.apple.com/library/test/success.html http://www.apple.com/library/test/success.html to your list.
Nextgrid 3y ago
> Captive portal operators want their portals seen by humans The concept of "engagement" strikes again. The objective there isn't to complete some business transaction or payment (otherwise it would be in every party's interests to make tooling to facilitate said transaction), it's to explicitly waste a human's time.

by xg15 3y ago

RajT88 3y ago

> so they just "standardized" the existing practice of querying some random http host and see if it gets intercepted. What I have seen a lot is only certain URI's redirecting you to the captive portal. ("A lot" being some minority of open access points, not most of them which redirect everything - but it's common enough) For anyone stuck in this labyrinthine hell, the two which always work belong to warring big tech behemoths: https://www.google.com https://www.google.com http://www.msftconnecttest.com/ http://www.msftconnecttest.com/ Others may work on these AP's; I haven't had to try different ones after trying these two.

netsharc 3y ago
https://www.google.com https://www.google.com will most likely not load because browsers nowadays have HSTS, and they will stop loading as soon as the server offers the wrong certificate...
- RajT88 3y ago
  Yeah, ran into that one a few times. Sometimes clicking "advanced" if presented as an option, lets me proceed. Other times, I think I just used Internet Explorer to get around it.
  - avidiax 3y ago
    example.com, example.net, and neverssl.com all lack HTTPS.
  - Citizen8396 3y ago
    [dead]
kennethrc 3y ago
I have "neverssl.com" as a prominent bookmark; as its name implies, the lack of SSL means I get directly to the captive portal page.
- 3np 3y ago
  Except every once in a blue moon when the opposite happens: HTTPS 443 gets blocked/hijacked while HTTP 80 goes out just fine (in which case either of the beforementioned generally gets you to the portal).
  - xg15 3y ago
    How would that work? The entire point of https is that it can't be hijacked. (Or rather, you can hijack it, but you can't show a portal on that connection, so what would be the point?)
    - 3np 3y ago
      I'm not saying it works as intended or that there is a point to it. Just that it does happen.
avidiax 3y ago
You can add http://connectivitycheck.android.com http://connectivitycheck.android.com, http://connectivitycheck.gstatic.com http://connectivitycheck.gstatic.com, and http://www.apple.com/library/test/success.html http://www.apple.com/library/test/success.html to your list.

Nextgrid 3y ago

> Captive portal operators want their portals seen by humans The concept of "engagement" strikes again. The objective there isn't to complete some business transaction or payment (otherwise it would be in every party's interests to make tooling to facilitate said transaction), it's to explicitly waste a human's time.