You connect to an access point, and your browser/OS tries to open one of http://detectportal.firefox.com/canonical.html http://detectportal.firefox.com/canonica

You connect to an access point, and your browser/OS tries to open one of http://detectportal.firefox.com/canonical.html http://detectportal.firefox.com/canonical.html, http://www.msftconnecttest.com/connecttest.txt http://www.msftconnecttest.com/connecttest.txt, http://connectivitycheck.gstatic.com/generate_204 http://connectivitycheck.gstatic.com/generate_204, https://captive.apple.com/hotspot-detect.html https://captive.apple.com/hotspot-detect.html and loads/displays whatever unencrypted web page is served. Getting someone to open an unencrypted webpage is almost trivial. It's often one of the only web pages you can open on a device.