Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How does Windows decide whether your computer has full Internet access?

devblogs.microsoft.com

Post reply on HN
Print view View original

211–220 of 305 posts

Re: How does Windows decide whether your computer has full Internet access?

#211

Post by temac »

toast0 wrote: post #57
justusw wrote: post #49

Earlier quoted context omitted.

I was using a Win 11 Pro installer stick on a Surface 4 the other day paired with a USB Ethernet interface. Aside from the fact that keyboard and mouse don’t work, because Windows doesn’t have drivers for a Microsoft Surface during install, I was able to convince Microsoft that I have no connection by unplugging the Ethernet cable right before the Microsoft account login prompt. Maybe I was lucky? Or really old insta…

If I've been following tech news, Pro lets you move on with a local account, but Home might not.

Iirc it is not the case anymore even for pro in 22h2. But bypassnro works for both home and pro.

Re: How does Windows decide whether your computer has full Internet access?

#212

Post by password4321 »

jeroenhd wrote: post #136
password4321 wrote: post #64

Anyone here who can explain how to force Hyper-V to use a specific network adapter for the default switch? I like that one because it provides NAT + DHCP, creating another switch doesn't.

You can manually configure the network adapters from the Hyper-V UI. I don't know if you can set a priority order, but you can definitely configure the interface Hyper-V uses for VM network connectivity.

Thanks for your reply.

In my experience it is a selectable option when creating a new virtual switch but is not modifiable for the default.

I have my machine directly connected to my underpowered Remote Desktop client via ethernet, and it always picks that connection instead of the WiFi that actually has internet until I disable ethernet (or maybe the virtual adapter created on top of ethernet, I forget every month) and reboot.

Re: How does Windows decide whether your computer has full Internet access?

#213

Post by c0nsumer »

pkulak wrote: post #100
vgb2k18 wrote: post #96

Earlier quoted context omitted.

In the linked comment section, Raymond Chen replied somewhat abrasively to a comment similar to this (the comment was "wouldn't this be easy to spoof?"). A bit harsh I thought!

He just had to say that this is for convenience, not security.

Yep, exactly. Because another part of this is NCSI is used for captive portal detection, so Windows can/will notify the user that they need to do something more to keep using the network.

Android and Chrome do the same sort of thing to detect internet access; this is how Android pops the notification to sign in to the network.

Then, at least on Windows, the results of NCSI flow down into WinHTTP and a ton of other things so apps can know the status of the network.

It's also possible, via Group Policy, to configure a different URL for NCSI. This is useful in enterprises which may not have the NCSI URL available to unauthenticated things (eg: the OS) but still has internet access via proxies.

It's also possible to disable NCSI, captive portal detection, etc, which is useful on some closed network boxes (eg: some enterprises) but this will cause problems if the machines are ever used on public/walled garden/captive portal networks.

The biggest problem I've seen with this comes about where captive portal detection is disabled, a user ends up on a captive portal, tries to hit a website to satisfy the portal, but due to most sites that normal users will try being https these days can't get their session redirected in order to display the portal, so they think "the internet is broken". The NCSI/captive portal detection makes a point of using HTTP so captive portal redirection can work properly.

Re: How does Windows decide whether your computer has full Internet access?

#215

Post by c0nsumer »

muppetman wrote: post #88

I'd love to know how Apple decides if a Wifi network is usable or not. For some reason my home network is flagged as a "Mobile" network and people connected to it can't update to the latest version of iOS etc. Is it because I've also created a Mobile Hotspot with the same SSID on a spare mobile phone I have, so my family can use their iPads out and about without having to connect to a new Wifi network? (i.e. I just w…

DHCP option 43 is often used to indicate if a mobile network is metered. (May be other ways, this is the one I'm most familiar with.) I'm guessing your "spare mobile phone" is Android?

Apple caches a lot of info about networks it connects to. So it's probably caching that it received this option and "knows" that network to be metered.

Best solution for this is to have either more control over your mobile network so it's not sending that option, or more easily, name the mobile network something else from your home one.

Re: How does Windows decide whether your computer has full Internet access?

#216

Post by c0nsumer »

trustingtrust wrote: post #89

What if your ISP hijacks your DNS (pretty common) and someone was to poison it and instead downloads a malware ? That would mean thousands of windows pcs download this malware by just connecting to the internet.

Windows Updates are downloaded via HTTP but signed in the package themselves. This is why Delivery Optimization (peer to peer distribution) can be used. HTTP downloads for WU are also good because it allows upstream proxies to cache the content reducing overall network load.

Thus: Hijacking WU to download malicious content takes far, far more than just DNS hijacking. You'd also need to subvert the WU signing system. (This is more nation-state level stuff.)

Re: How does Windows decide whether your computer has full Internet access?

#217

Post by c0nsumer »

YPPH wrote: post #9
jasonzemos wrote: post #7

Is it a problem that the URL is not HTTPS or is it the blessing required to defeat it?

One reason for that is explained well in a comment on the article. Note that as with the Windows version, the protocol is HTTP, not HTTPS – because captive portals completely break TLS, but plaintext HTTP will result in a clean redirect to the portal, allowing the network service to detect the presence of the portal and to bring up a browser window to let the user authenticate. ( https://devblogs.microsoft.com/oldnew…

You've got it exactly. This is also part of Windows captive portal detection, which makes what you say even more important. HTTPS would actually be a step backwards here.

Re: How does Windows decide whether your computer has full Internet access?

#218

Post by Kwpolska »

ryandrake wrote: post #198
Kwpolska wrote: post #182

Earlier quoted context omitted.

I do not want my home computer to be exposed to the Internet. I do not want your fancy new Internet apps, the existing ones with explicit user-initiated connectivity are more than enough for 99% of people. And even if you somehow have a non-NAT, non-CGNAT, no-ISP-filtering home connection, do you have full Internet access if the server behind NowhereNews.com refuses all your connections because you’re in Europe?

You probably know this but NAT is not the same thing as a firewall. You can have one without the other or both. Just because your machine is addressable doesn’t mean it is accessible. You can have machines on your home LAN that have public IP addresses but are not publicly accessible. NAT exists because historically ISPs didn’t give out blocks of public IP addresses, and now that they are running out of them, they ar…

Yeah, I know, but NAT’s side effect of preventing all sorts of remote access is quite convenient, I don’t have to trust the cheap router or cheap internet of shit device to do the right thing firewall-wise.

Re: How does Windows decide whether your computer has full Internet access?

#219

Post by kiwijamo »

franga2000 wrote: post #179
justsomehnguy wrote: post #158

Earlier quoted context omitted.

Ten years ago you needed iTunes to enable your iPhone/iPad. Sure there are probably was a way to skip most of the requirements (except iTunes itself) but around that time I helped a friend to activate an iPad. I was forced to register an Apple account AND give it a credit card to activate that iPad. You can blame MS all you want, but MS IS LATE FOR THE PARTY WITH ALL THAT SHIT .

I bought my first Apple device (an iPad) two weeks ago out of necessity and even created an Apple account in advance, assuming Apple will force me to use it. I was very surprised to find a very obvious "Skip" button that let me complete the process with no account. And just because other manufacturers do it, isn't a reason not to blame MS for what MS did. Nobody forced them to do this and it's not even common practic…

Are you able to e.g. install apps without an apple account? I seem to recall simple things like that wasn't possible unless you had signed into an apple account.

Re: How does Windows decide whether your computer has full Internet access?

#220

Post by jeroenhd »

password4321 wrote: post #212
jeroenhd wrote: post #136

Earlier quoted context omitted.

You can manually configure the network adapters from the Hyper-V UI. I don't know if you can set a priority order, but you can definitely configure the interface Hyper-V uses for VM network connectivity.

Thanks for your reply. In my experience it is a selectable option when creating a new virtual switch but is not modifiable for the default. I have my machine directly connected to my underpowered Remote Desktop client via ethernet, and it always picks that connection instead of the WiFi that actually has internet until I disable ethernet (or maybe the virtual adapter created on top of ethernet, I forget every month)…

I don't know if it solves your entire use case, but in PowerShell you can change the interface metric number to rearrange connection priorities (https://learn.microsoft.com/en-US/windows-server/networking/...). You have to watch out to pick the right interface (Hyper-V takes over packet routing from your real network adapter in many cases) but it may be worth looking into. Higher metric number means lower priority, so setting the bad connection to a metric of 100 and the real uplink to a metric of 5 may resolve your problem.

In Windows 2000-8.1 the control panel GUI was the standard way of accomplishing this, but in modern Windows 10/11 I doubt Microsoft has the setting still accessible. There are still guides out there with screenshots, though: https://www.windowscentral.com/how-change-priority-order-net...

The automatic metric detection system bases its decision on network speed (https://learn.microsoft.com/en-us/troubleshoot/windows-serve...) so virtual 10gbps adapters can cause problems if you use a common network adapter and the custom settings for Hyper-V and such get messed up.

Post reply on HN