Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NeverSSL

neverssl.com

Post reply on HN
Print view View original

151–160 of 212 posts

Re: NeverSSL

#151

Post by anon363764 »

innocenat wrote: post #146
xenadu02 wrote: post #141

The worst code I ever had to write was captive portal detection for the PlanGrid app. I discovered there is a whole host of sysadmins out there attempting to actively subvert the iOS capitve portal detection. They try to figure out the domains used and whitelist them so iOS will think it is connected to a good network, but they redirect everything else which horribly breaks SSL connections. The whole thing is an arms…

Apple could also makes the mini-browser supports those captive portal instead? Then none of this bypassing would be required.

When iOS cannot fetch the fixed content of www.thinkdifferent.*, a UIWebView pops and displays that content, assuming it's a captive portal needing attention.

Instead, there should be some non-routable, local-only special IPv4/IPv6 address that all captive portals are required to present.

No more DNS spoofing, no more page rewriting which breaks the web.

Re: NeverSSL

#152

Post by sangnoir »

xenadu02 wrote: post #141

The worst code I ever had to write was captive portal detection for the PlanGrid app. I discovered there is a whole host of sysadmins out there attempting to actively subvert the iOS capitve portal detection. They try to figure out the domains used and whitelist them so iOS will think it is connected to a good network, but they redirect everything else which horribly breaks SSL connections. The whole thing is an arms…

Android detects wifi with captive portals automatically and pops-up a notification that says "Wifi network requires sign-in". Clicking on that takes you to non-HTTPS page in a browser that is intended to be intercepted.

There is no reason why Apple can't add captive portal detection at OS level like Android does.

Re: NeverSSL

#153

Post by geocar »

nullc wrote: post #71
cwmma wrote: post #22

Ah something for the day xkcd[1] makes https mandatory. 1. http://xkcd.com

I use yahoo. I don't want to use a site that I would otherwise intentionally use-- captive portals often poison the DNS.

Yahoo is starting to use Strict-Transport-Security now...

I'd love to be in the meeting where they discuss adding security features lowers their traffic volumes...

Re: NeverSSL

#154

Post by Kiro »

iandanforth wrote: post #124
shapath wrote: post #123

Can some ELI5 (explain like I'm 5) to me? I don't get this. Seems like something I should know about.

Some routers and networks try to intercept all requests and replace them with a 'captive portal' page for logging into that network. When you make a request to a webpage using https:// (i.e. SSL) the network has a much harder time injecting the login page, so you end up seeing nothing. The connection isn't going through and the network's login page can't break through SSL battle-warrior-armor.

But what is the purpose of this page?

Re: NeverSSL

#155

Post by kristofferR »

innocenat wrote: post #146
xenadu02 wrote: post #141

The worst code I ever had to write was captive portal detection for the PlanGrid app. I discovered there is a whole host of sysadmins out there attempting to actively subvert the iOS capitve portal detection. They try to figure out the domains used and whitelist them so iOS will think it is connected to a good network, but they redirect everything else which horribly breaks SSL connections. The whole thing is an arms…

Apple could also makes the mini-browser supports those captive portal instead? Then none of this bypassing would be required.

The mini-browser (Captive Network Assistant) is designed to protect the user's privacy, so support for Javascript and cookies is deliberately disabled.

Re: NeverSSL

#156

Post by pmontra »

sangnoir wrote: post #152
xenadu02 wrote: post #141

The worst code I ever had to write was captive portal detection for the PlanGrid app. I discovered there is a whole host of sysadmins out there attempting to actively subvert the iOS capitve portal detection. They try to figure out the domains used and whitelist them so iOS will think it is connected to a good network, but they redirect everything else which horribly breaks SSL connections. The whole thing is an arms…

Android detects wifi with captive portals automatically and pops-up a notification that says "Wifi network requires sign-in". Clicking on that takes you to non-HTTPS page in a browser that is intended to be intercepted. There is no reason why Apple can't add captive portal detection at OS level like Android does.

It doesn't work so well. Sometimes I have to try every single browser on my phone or tablet and different sites. Eventually one of them triggers the captive portal detection. Sometimes I just give up.

Any Android from 4 to 7. I guess it depends on how much the portal is trying to be smart.

Re: NeverSSL

#157

Post by JoshTriplett »

CaliforniaKarl wrote: post #134
JoshTriplett wrote: post #98

Earlier quoted context omitted.

RFC 7710 specifies a way for DHCP servers and router advertisements to specify a portal page: https://tools.ietf.org/html/rfc7710

Do you know if any clients (iOS, Android, etc.) have implemented support for this RFC?

Not yet; too recent.

Re: NeverSSL

#158

Post by sigi45 »

The name is bad :(

SSL is not used any more and it shouldn't get into people minds. Its either https (as a common word) or tls.

Re: NeverSSL

#159

Post by pmontra »

arjie wrote: post #122
omginternets wrote: post #86

Earlier quoted context omitted.

Honestly? It's 2017. Just throttle bandwidth and give your internet away for free. There are some obvious cases in which this is unacceptable, but they are few and far between. The overwhelming majority of captive portals I see are just trying to get your contact info... so now you have two reasons why they should disappear.

I don't want your shitty slow internet. I want to pay $20 for fast enough Internet on a plane, not some 56.6kbps bullshit.

$20 is one month worth of broadband in some countries. Anybody can do what he wants with his money, but $2 would be a more appropriate price tag for a few hours of Internet. If you're working, $20 could be OK though because you're gaining more.

Re: NeverSSL

#160

Post by rando832 »

sigi45 wrote: post #158

The name is bad :( SSL is not used any more and it shouldn't get into people minds. Its either https (as a common word) or tls.

Words get to have more than one meaning. Your comment is not made from a cow, but there's nothing wrong with calling it bs.
Post reply on HN