Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Captive Portal IPv6 Support

github.com

Post reply on HN
Print view View original

21–30 of 57 posts

Re: Captive Portal IPv6 Support

#21

Post by stephenr »

gruez wrote: post #19
stephenr wrote: post #17

Earlier quoted context omitted.

> or you want finer grained authentication than a shared key? Configure your access points to use RADIUS or SAML for auth?

Is WPA enterprise authentication still a dumpster fire? Last time I set it up it was still a hassle because you had to import CAs and manually choose the authentication protocol. Definitely not a good experience for someone who's stopping by a cafe for 30min and wants wifi.

In your coffee shop-like scenario, what benefit does a captive portal on anonymous Wifi offer to either the customer or the coffee shop, over regular Wifi authentication, and a sign on the wall that says "wifi username/passowrd is..."

As for importing a private CA. Use a certificate trusted by a public CA and you won't have this problem?

Re: Captive Portal IPv6 Support

#22

Post by 0xbadcafebee »

zamadatix wrote: post #14
arjvik wrote: post #3

As much as we need infrastructure to move us all the way to IPv6 (no more CGNAT please!), I'm not sure I want more captive portals in the world. I'd much rather an addition to the WiFi standard to support interactive login, though I suppose that would be hard pressed to come by now.

Interactive auth sounds attractive at first but it's really the wrong place for an answer once you look at all of the ways captive portals are used (i.e. more than just "check this agreement box"). You really need the power of the browser to display a custom form behind the solution or you end up with n+1 solutions instead of replacing captive portals. Something like a DHCP option or NDP option ends up being a lot mo…

A DHCP option would be the correct way to specify a captive portal on a LAN. We have DHCP options for tons of things: IP phones, TFTP servers, cable boxes. One more option for a captive portal authentication URL would properly inform clients that there is a captive portal and how to access it. (It being a URL means it can also specify the protocol, so you aren't even locked into web browsers)

My assumption is this wasn't adopted because operators want the option of placing the captive portal upstream of the local network DHCP server. DNS spoofing works great over multiple network hops, but DHCP doesn't. (I'm not sure if that's a valid argument, but I'm sure somebody insisted on it)

Re: Captive Portal IPv6 Support

#23

Post by thwarted »

zamadatix wrote: post #11

As a heads up your project is MIT licensed - that means companies do not need to reach out to purchase a license for commercial use. It might make sense to change that to an offer for official support (or relicense the project to meet your desires if applicable).

It says right in the readme:

    This project is licensed under the MIT License.

    I hope everyone benefits from this open-source project for the development of IPv6.

Re: Captive Portal IPv6 Support

#24

Post by Uptrenda »

This is really cool. Nice work and I find the MIT license you've chosen to be interesting. I chose the very same license for my own open source project because I wanted there to be few excuses not to use it.

Damn, you've done significant work on this. Will have to check this out more in depth.

Re: Captive Portal IPv6 Support

#25

Post by gruez »

stephenr wrote: post #21
gruez wrote: post #19

Earlier quoted context omitted.

Is WPA enterprise authentication still a dumpster fire? Last time I set it up it was still a hassle because you had to import CAs and manually choose the authentication protocol. Definitely not a good experience for someone who's stopping by a cafe for 30min and wants wifi.

In your coffee shop-like scenario, what benefit does a captive portal on anonymous Wifi offer to either the customer or the coffee shop, over regular Wifi authentication, and a sign on the wall that says "wifi username/passowrd is..." As for importing a private CA. Use a certificate trusted by a public CA and you won't have this problem?

>In your coffee shop-like scenario, what benefit does a captive portal on anonymous Wifi offer to either the customer or the coffee shop, over regular Wifi authentication, and a sign on the wall that says "wifi username/passowrd is..."

From an access control perspective, it probably doesn't matter much for a coffee shop, but matters more for something for a hotel where you want to limit to certain guests only (eg. ones with room or loyalty program members)

From a legal perspective, having an interstitial might provide cover for when a baddie uses the connection to order drugs or whatever. IANAL and I'm not sure whether it's actually needed or not, but most companies rather not risk it. Moreover it's unlikely that no jurisdictions require it, so you'd still support for it.

>As for importing a private CA. Use a certificate trusted by a public CA and you won't have this problem?

No idea. Last time I had to use WPA enterprise, the organization providing the connection isn't exactly small and couldn't afford a certificate, but still required me to import a CA. That makes me think it might be an inherent issue with WPA enterprise.

Re: Captive Portal IPv6 Support

#26

Post by jacobaul »

thwarted wrote: post #23
zamadatix wrote: post #11

As a heads up your project is MIT licensed - that means companies do not need to reach out to purchase a license for commercial use. It might make sense to change that to an offer for official support (or relicense the project to meet your desires if applicable).

It says right in the readme: This project is licensed under the MIT License. I hope everyone benefits from this open-source project for the development of IPv6.

The readme of repository includes a paragraph suggesting that companies should reach out for a commercial license. For an MIT licensed codebase that is unusual. I believe the top-level commenter is assuming that discrepancy is by mistake and is giving a heads up.

From the readme:

>Note: Companies interested in purchasing a license to use the source code commercially can contact this number on WhatsApp

Re: Captive Portal IPv6 Support

#27

Post by stephenr »

gruez wrote: post #25
stephenr wrote: post #21

Earlier quoted context omitted.

In your coffee shop-like scenario, what benefit does a captive portal on anonymous Wifi offer to either the customer or the coffee shop, over regular Wifi authentication, and a sign on the wall that says "wifi username/passowrd is..." As for importing a private CA. Use a certificate trusted by a public CA and you won't have this problem?

>In your coffee shop-like scenario, what benefit does a captive portal on anonymous Wifi offer to either the customer or the coffee shop, over regular Wifi authentication, and a sign on the wall that says "wifi username/passowrd is..." From an access control perspective, it probably doesn't matter much for a coffee shop, but matters more for something for a hotel where you want to limit to certain guests only (eg. on…

> Legal cover for when a baddie uses the connection to order drugs or whatever.

.... Is this meant to be a joke?

> still required me to import a CA

It's reasonably likely that they wanted it to only work on known devices with their private CA cert installed; but either way, and regardless of the technology in question, I wouldn't suggest it's particularly meaningful to use one organisation's setup as the basis for how things inherently work.

Re: Captive Portal IPv6 Support

#28

Post by gruez »

stephenr wrote: post #27
gruez wrote: post #25

Earlier quoted context omitted.

>In your coffee shop-like scenario, what benefit does a captive portal on anonymous Wifi offer to either the customer or the coffee shop, over regular Wifi authentication, and a sign on the wall that says "wifi username/passowrd is..." From an access control perspective, it probably doesn't matter much for a coffee shop, but matters more for something for a hotel where you want to limit to certain guests only (eg. on…

> Legal cover for when a baddie uses the connection to order drugs or whatever. .... Is this meant to be a joke? > still required me to import a CA It's reasonably likely that they wanted it to only work on known devices with their private CA cert installed; but either way, and regardless of the technology in question, I wouldn't suggest it's particularly meaningful to use one organisation's setup as the basis for ho…

>.... Is this meant to be a joke?

Are you a lawyer? I wasn't making a definitive statement, but if you have stronger evidence to the contrary please present them rather than making shallow dismissals.

>It's reasonably likely that they wanted it to only work on known devices with their private CA cert installed

It's an organization where BYOD is very common.

Re: Captive Portal IPv6 Support

#29

Post by leptons »

snvzz wrote: post #5
gruez wrote: post #4

Earlier quoted context omitted.

Is there even an alternative to captive portals?

Just give internet access directly. Or do not offer internet access at all. People carry their own already-connected devices anyway.

Captive portals are used for many, many things that aren't just internet access gateways. Many IoT devices use them to enter wifi credentials so the device can connect to the wifi router. One of my projects is an IoT device with a custom web interface that can be used from a cellphone when there are no nearby wifi routers for the IoT device and phone to connect to - the phone connects directly to the IoT device and gets the custom device control interface.

Re: Captive Portal IPv6 Support

#30

Post by somerandomqaguy »

snvzz wrote: post #5
gruez wrote: post #4

Earlier quoted context omitted.

Is there even an alternative to captive portals?

Just give internet access directly. Or do not offer internet access at all. People carry their own already-connected devices anyway.

16% of Canadians in 2022 didn't have a data plan on their phone, according to Statistics Canada. Roughly 6 million Canadians or so.

So not everyone. Actually a decent number of people that don't.

Post reply on HN