Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NeverSSL

neverssl.com

Post reply on HN
Print view View original

171–180 of 212 posts

Re: NeverSSL

#171

Post by 0x0 »

xenadu02 wrote: post #141

The worst code I ever had to write was captive portal detection for the PlanGrid app. I discovered there is a whole host of sysadmins out there attempting to actively subvert the iOS capitve portal detection. They try to figure out the domains used and whitelist them so iOS will think it is connected to a good network, but they redirect everything else which horribly breaks SSL connections. The whole thing is an arms…

You would think captive portal vendors will stop doing this sooner than later as more and more web sites and apps use HTTPS only. When most customers fail to connect because HTTPS is everywhere, maybe they will take the hint.

Re: NeverSSL

#172

Post by pricechild »

foo101 wrote: post #169

I don't understand how this website works. If I visit http://neverssl.com/ I just see a home page that explains how it works which is to visit http://neverssl.com/ . Can someone explain me step by step how to use http://neverssl.com/ ?

I think the idea is that many wifi networks out there require registration/payment to use. They also do this in really, really weird ways because making stuff is hard.

Some of these only work by capturing http requests and rewriting them to take you to their portal. Funnily enough, that and other methods often work very badly and so you might be left trying to visit a site getting timeouts. Maybe your browser visited it previously and saw HSTS for example and so only tries https?

The point of this site is that when you realise this has happened, you type in 'http://neverssl.com' into your browser to force an http connection which hopefully the network will grab, mangle and take you to the login page.

It's a solution to a problem that really shouldn't exist.

Annoyingly, different client venders require different things. Here's an example of someone working on this: http://www.revk.uk/2016/08/captive-portals-apple.html (and a money quote from the comments: "OS X only does it if you're on Wifi though - for some reason they assume you'll never see a captive portal when wired"

Re: NeverSSL

#173

Post by foo101 »

pricechild wrote: post #172
foo101 wrote: post #169

I don't understand how this website works. If I visit http://neverssl.com/ I just see a home page that explains how it works which is to visit http://neverssl.com/ . Can someone explain me step by step how to use http://neverssl.com/ ?

I think the idea is that many wifi networks out there require registration/payment to use. They also do this in really, really weird ways because making stuff is hard. Some of these only work by capturing http requests and rewriting them to take you to their portal. Funnily enough, that and other methods often work very badly and so you might be left trying to visit a site getting timeouts. Maybe your browser visited…

Thanks for the lucid explanation!

Re: NeverSSL

#174

Post by Semaphor »

lloeki wrote: post #142
omginternets wrote: post #86

Earlier quoted context omitted.

Honestly? It's 2017. Just throttle bandwidth and give your internet away for free. There are some obvious cases in which this is unacceptable, but they are few and far between. The overwhelming majority of captive portals I see are just trying to get your contact info... so now you have two reasons why they should disappear.

> The overwhelming majority of captive portals I see are just trying to get your contact info... IIRC in some countries they're required (by law) to do so, because, y'know, terrorists.

Far worse than terrorists, filesharers.

Re: NeverSSL

#176

Post by codemusings »

Kiro wrote: post #154
iandanforth wrote: post #124

Earlier quoted context omitted.

Some routers and networks try to intercept all requests and replace them with a 'captive portal' page for logging into that network. When you make a request to a webpage using https:// (i.e. SSL) the network has a much harder time injecting the login page, so you end up seeing nothing. The connection isn't going through and the network's login page can't break through SSL battle-warrior-armor.

But what is the purpose of this page?

The scenario is: You want to connect to a public wifi hotspot and use their internet connection. In order to do so you need to trigger the login page in your browser after you connect to the hotspot.

However if you open common urls like google.com or facebook.com you'll automatically get redirected to secure connections (https) and they can't intercept this to present the login page. This is because TLS (the protocol behind HTTPS connections) uses end-to-end encryption.

Thus the author proposes to open this simple unprotected website. However most hotspots manage to automatically trigger the vendor specific mechanism as soon as you connect to their Wifi.

Don't use public wifi unless you really need to!

Re: NeverSSL

#177

Post by slang800 »

innocenat wrote: post #121
omginternets wrote: post #86

Earlier quoted context omitted.

Honestly? It's 2017. Just throttle bandwidth and give your internet away for free. There are some obvious cases in which this is unacceptable, but they are few and far between. The overwhelming majority of captive portals I see are just trying to get your contact info... so now you have two reasons why they should disappear.

There are still part of the world where you are require by law to log who is accessing the internet, in case he/she does something illegal.

Yet another fantastic reason to get rid of captive portals. They spy on you _and_ are frequently broken.

Re: NeverSSL

#178

Post by taejo »

Kiro wrote: post #154
iandanforth wrote: post #124

Earlier quoted context omitted.

Some routers and networks try to intercept all requests and replace them with a 'captive portal' page for logging into that network. When you make a request to a webpage using https:// (i.e. SSL) the network has a much harder time injecting the login page, so you end up seeing nothing. The connection isn't going through and the network's login page can't break through SSL battle-warrior-armor.

But what is the purpose of this page?

It will never use HTTPS, so by visiting it, you allow the man-in-the-middle to do its thing, and show you a log-in page or whatever.

Re: NeverSSL

#179

Post by Already__Taken »

JoshTriplett wrote: post #98
swiley wrote: post #19

Earlier quoted context omitted.

I still think having people connect to something handed out by dhcp would be really great, that's what dhcp is for in the first place. If that's too complicated you could always try connecting to the gateway.

RFC 7710 specifies a way for DHCP servers and router advertisements to specify a portal page: https://tools.ietf.org/html/rfc7710

So is there a matching method to neatly introduce MITM in the connection? Our portal would let you log on but you'll still fail to connect to anything as we have to inspect it.

Re: NeverSSL

#180

Post by slang800 »

snuxoll wrote: post #2

I really wish there was a standard way of handling captive wifi portals, macOS and GNOME try to detect these portals and show them but sometimes it is unreliable. It'd be really nice if there was a reserved DNS entry (like captive.portal or something) that operating systems could try to resolve and if it points to anything other than an expected value (loopback address, maybe?) it will bring up a window to sign into…

I'm glad that there isn't a standard. Implementing a captive portal should be a painful experience that ultimately results in giving up and not using one.
Post reply on HN