NeverSSL

Post by bogomipz » Wed, Jan 11, 2017, 2:21 PM UTC

GrayShade wrote: post #139

bogomipz wrote: post #85

I might just be really stupid but I read the "what" and the "how" a couple of times and I still don't understand. I only inferred from the comments that this is to get through captive portals used in coffee shops by exploiting the fact that they have to to permit HTTP unauthenticated in order for the redirect to the login page to work. But can someone walk me through how never SSL allows me to connect to FB once my b…

With a captive portal, your first HTTP request will be redirected to the network's login page or whatever they have. Many large sites now use HTTPS and HSTS and if you visit them once, they will always (or until the max-age header expires) be loaded over HTTPS by your browser. As a result, many people will be unable to see the network's login page. If you are in this situation, you can load neverssl.com once, log in…

Post by brainfire » Wed, Jan 11, 2017, 3:36 PM UTC

EGreg wrote: post #149

johncolanduoni wrote: post #133

Earlier quoted context omitted.

Usually they let DNS resolve normally (because intercepting at this level will break the website even after you've satisfied the captive portal) and intercept any HTTP connections, responding with a temporary redirect to a controlled domain. Doing this with a mere DNS server will only work if you don't visit the website you initially tried to access for a while after you connect. It's also super easy to bypass; just…

Can't I use a regular consumer router but hook up a computer on the LAN to do something? Intercept DNS? Intercept HTTP requests like you said? But the problem is what if the user makes https requests? All I want to do is make a system which "takes attendance" via the phones automatically trying to join the local network, and I use the session is to look up the user. People would have accounts where they log in once v…

Post by innocenat » Wed, Jan 11, 2017, 4:46 PM UTC

slang800 wrote: post #180

snuxoll wrote: post #2

I really wish there was a standard way of handling captive wifi portals, macOS and GNOME try to detect these portals and show them but sometimes it is unreliable. It'd be really nice if there was a reserved DNS entry (like captive.portal or something) that operating systems could try to resolve and if it points to anything other than an expected value (loopback address, maybe?) it will bring up a window to sign into…

I'm glad that there isn't a standard. Implementing a captive portal should be a painful experience that ultimately results in giving up and not using one.

Post by Pxtl » Wed, Jan 11, 2017, 7:28 PM UTC

dnautics wrote: post #117

Pxtl wrote: post #34

This is handy. I was at an airport and was helping numerous people with android devices get through the wifi portals, and dealing with the same frustrating failure of the captive-portal redirect. Android is supposed to detect that there's a redirect and give you a notification that takes you to the login page, but it's very inconsistent. I usually use Xkcd for that purpose, one of the few lightweight non-ssl sites I…

usually i do craigslist.org

Post by ploxiln » Wed, Jan 11, 2017, 8:30 PM UTC

bastawhiz wrote: post #95

ploxiln wrote: post #47

Earlier quoted context omitted.

put the payment url on a sign, just enforce an ip whitelist until customer has paid. Or in extreme sign-less situations put it in the ssid e.g. "pay at portalpage.com"

> put the payment url on a sign, just enforce an ip whitelist until customer has paid. Or in extreme sign-less situations put it in the ssid e.g. "pay at portalpage.com" This is a captive portal. But worse, because even HTTP sites don't send you to the portal.

  * no MITM attack
  * no TLS cert errors
  * no "do I need to hard-refresh? what's the key for that?"
  * no question if network access is working or not
  * one reliable clear action to get access