Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NeverSSL

neverssl.com

Post reply on HN
Print view View original

131–140 of 212 posts

Re: NeverSSL

#131

Post by mos_basik »

imwally wrote: post #59
snuxoll wrote: post #2

I really wish there was a standard way of handling captive wifi portals, macOS and GNOME try to detect these portals and show them but sometimes it is unreliable. It'd be really nice if there was a reserved DNS entry (like captive.portal or something) that operating systems could try to resolve and if it points to anything other than an expected value (loopback address, maybe?) it will bring up a window to sign into…

It's so annoying that I even wrote a script so I could connect to Starbucks WiFi without having to use a browser. This was back when I was on Linux using a tiling window manager but I still use it on macOS because it's useful. https://github.com/imwally/starbucksconnect

Hey, thanks mate. With the various meetups I go and corporate networks I'm using, it's always a pain to lose all my saved chrome tabs to portal redirects because I forgot to open Firefox to get through the portal first. I might be able to leverage this to help.

Re: NeverSSL

#132

Post by poizan42 »

Viper007Bond wrote: post #55
makomk wrote: post #43

Earlier quoted context omitted.

This isn't generally a problem on smartphones and tablets because they can usually detect captive portals and prompt the user appropriately.

Windows does the same thing, at least in 10. I get a notification that further action is required and clicking it opens a no-SSL Microsoft URL that Will redirect.

It's go.microsoft.com. I Think you can be pretty sure that will forever be without https as well since it is hardcoded into several Windows versions

Re: NeverSSL

#133

Post by johncolanduoni »

EGreg wrote: post #116
bisby wrote: post #15

It's sad, because these are the kinds of things that confuse the hell out of "common folk" and explaining requires explaining HTTPS, HSTS, how captive WiFi portals work, and then ultimately, why there isn't a better solution... which maybe doesn't have a great answer. I feel like this "workaround" site is designed to draw attention to the problem at hand more than it is meant to be useful for the task at hand?

How DO captive wifi portals work? Can I set one up on a home network with a regular router without WifiDog or some other OpenWRT firmware? Maybe somehow use one of the computers on the network to run a DNS server that all requests go through??

Usually they let DNS resolve normally (because intercepting at this level will break the website even after you've satisfied the captive portal) and intercept any HTTP connections, responding with a temporary redirect to a controlled domain. Doing this with a mere DNS server will only work if you don't visit the website you initially tried to access for a while after you connect. It's also super easy to bypass; just pick a public DNS server instead of the one the network tries to assign to you.

To do this properly either your router or switch/AP need to be configured to do the necessary rewriting as well as maintain a list of authenticated clients. Your best bet to do this with something in the consumer(ish) price range without a custom firmware like OpenWRT is something like a Uni-Fi access point which can handle the captive portal interception itself.

Re: NeverSSL

#134

Post by CaliforniaKarl »

JoshTriplett wrote: post #98
swiley wrote: post #19

Earlier quoted context omitted.

I still think having people connect to something handed out by dhcp would be really great, that's what dhcp is for in the first place. If that's too complicated you could always try connecting to the gateway.

RFC 7710 specifies a way for DHCP servers and router advertisements to specify a portal page: https://tools.ietf.org/html/rfc7710

Do you know if any clients (iOS, Android, etc.) have implemented support for this RFC?

Re: NeverSSL

#135

Post by johncolanduoni »

cdowns wrote: post #6
tekklloneer wrote: post #3

example.com works as well. it doesnt redirect to https://example.com

http://captive.apple.com/ also. That's what Apple devices use when trying to present the login for a captive network.

Except some portals actively try to avoid intercepting any of Apple's methods for determining whether you're on one. You're much better off with an off the beaten path solution.

Re: NeverSSL

#138

Post by gumby »

pfranz wrote: post #126
gumby wrote: post #112

Earlier quoted context omitted.

> The captive portal browser (pop-up on macOS, slide-over on iOS) I have never seen a captive portal interceptor on MacOS (much to my disappointment), only iOS. Is there some setting I previously screwed up?

I've never seen a setting for it. It's just a modal dialog with a webview. Like iOS, you have "Cancel" as an option until it connects and changes to "Done." Here's a screen shot I found: https://www.wireless.bris.ac.uk/gfx/eduroam-osx/captive_port...

Drat, I've never seen that on OS X. Just on iOS.

Because of this thread I simulated it on my network and couldn't cause it to show up.

Re: NeverSSL

#139

Post by GrayShade »

bogomipz wrote: post #85

I might just be really stupid but I read the "what" and the "how" a couple of times and I still don't understand. I only inferred from the comments that this is to get through captive portals used in coffee shops by exploiting the fact that they have to to permit HTTP unauthenticated in order for the redirect to the login page to work. But can someone walk me through how never SSL allows me to connect to FB once my b…

With a captive portal, your first HTTP request will be redirected to the network's login page or whatever they have. Many large sites now use HTTPS and HSTS and if you visit them once, they will always (or until the max-age header expires) be loaded over HTTPS by your browser.

As a result, many people will be unable to see the network's login page. If you are in this situation, you can load neverssl.com once, log in to the network, then browse normally.

Post reply on HN