Live data from Hacker News

NeverSSL

neverssl.com

141–150 of 212 posts

Re: NeverSSL

#141
The worst code I ever had to write was captive portal detection for the PlanGrid app.

I discovered there is a whole host of sysadmins out there attempting to actively subvert the iOS capitve portal detection. They try to figure out the domains used and whitelist them so iOS will think it is connected to a good network, but they redirect everything else which horribly breaks SSL connections. The whole thing is an arms race where Apple adds new domains to iOS but doesn't start using them until a certain date to evade the whitelist.

The stated reason for this stupidity? The mini-browser that pops up doesn't work with their stupid captive portal login or payment page. Fix the page? Nahhh, let's just fuck everyone's network connections instead. It caused an endless barrage of battery-draining network errors, eating the retry count and eventually causing POST requests to error out. The complete lack of respect for the users, internet protocol standards, etc was extremely evident.

We ultimately stuck a file with a specific phrase in a text file on the site, then when the app was having network trouble the code tries to fetch that file. If it gets an HTML response it marks it as in captive portal mode. IIRC it offered to take the user to safari and would open some non-HTTPS URL so the captive portal redirect could fire and let the user know.

I hope anyone trying to circumvent captive portal detection dies a very painful death, then gets revived, recovers through the miracle of modern medical technology, then dies another painful death.

Re: NeverSSL

#142

Earlier quoted context omitted.

What would you suggest for the case of someone wanting payment for the connection? Like it or not, a lot of places do that.

Honestly? It's 2017. Just throttle bandwidth and give your internet away for free. There are some obvious cases in which this is unacceptable, but they are few and far between. The overwhelming majority of captive portals I see are just trying to get your contact info... so now you have two reasons why they should disappear.

> The overwhelming majority of captive portals I see are just trying to get your contact info...

IIRC in some countries they're required (by law) to do so, because, y'know, terrorists.

Re: NeverSSL

#144
I often just type in an IP address, 1.2.3.4 often works. Having said that i've had alot of problems where iOS refuses to detect the captive portal, but also decides it has no internet so doens't route any intentional web browser visits to the wi-fi.. driving me crazy. Just restored without a backup.. see if that fixes it :(

Re: NeverSSL

#145

I often just type in an IP address, 1.2.3.4 often works. Having said that i've had alot of problems where iOS refuses to detect the captive portal, but also decides it has no internet so doens't route any intentional web browser visits to the wi-fi.. driving me crazy. Just restored without a backup.. see if that fixes it :(

for clarity, this was happening when another iOS device worked fine right next to me. So "probably" not the network, but who knows what weird interaction causes the issue.

Re: NeverSSL

#146

The worst code I ever had to write was captive portal detection for the PlanGrid app. I discovered there is a whole host of sysadmins out there attempting to actively subvert the iOS capitve portal detection. They try to figure out the domains used and whitelist them so iOS will think it is connected to a good network, but they redirect everything else which horribly breaks SSL connections. The whole thing is an arms…

Apple could also makes the mini-browser supports those captive portal instead? Then none of this bypassing would be required.

Re: NeverSSL

#147
post #20
post #15

It's sad, because these are the kinds of things that confuse the hell out of "common folk" and explaining requires explaining HTTPS, HSTS, how captive WiFi portals work, and then ultimately, why there isn't a better solution... which maybe doesn't have a great answer. I feel like this "workaround" site is designed to draw attention to the problem at hand more than it is meant to be useful for the task at hand?

> why there isn't a better solution... There is a better solution: No captive portals.

> No captive portals.

The problem isn't even so much with captive portals, but only with those actively trying to circumvent captive portal detection provided e.g. by iOS (as pointed out above). "Regular" captive portals will be captured by iOS and you can log-in via the mini browser before any requests to Facebook etc. go through - problem solved (albeit in a very hacky way).

The problem only (re-)materialises when some smartass developers actively try (and succeed) to break portal detection (my guess is that they do it because iOS will close the portal once the Internet connection works, so all the nice ads they want to display just disappear).

Re: NeverSSL

#149
post #116

Earlier quoted context omitted.

How DO captive wifi portals work? Can I set one up on a home network with a regular router without WifiDog or some other OpenWRT firmware? Maybe somehow use one of the computers on the network to run a DNS server that all requests go through??

Usually they let DNS resolve normally (because intercepting at this level will break the website even after you've satisfied the captive portal) and intercept any HTTP connections, responding with a temporary redirect to a controlled domain. Doing this with a mere DNS server will only work if you don't visit the website you initially tried to access for a while after you connect. It's also super easy to bypass; just…

Can't I use a regular consumer router but hook up a computer on the LAN to do something? Intercept DNS? Intercept HTTP requests like you said? But the problem is what if the user makes https requests?

All I want to do is make a system which "takes attendance" via the phones automatically trying to join the local network, and I use the session is to look up the user. People would have accounts where they log in once via the captive portal and then the attendance would happen automatically.

Basically I want to make a captive portal with regular routers so I can sell the solution to regular venues.

How do these guys do it:

https://www.fusionwifi.com/

There are a lot of social wifi solutions now

Re: NeverSSL

#150
Captive portal craziness.

"Click the confirmation link in the email we sent you to get online"

"Enter the code we sent you via SMS to confirm your number"

"Login via Facebook - provide permission to post on your behalf"

"Share on FaceBook for internet access"

"Confirm acceptance of our 6000 word terms and conditions"

Post reply on HN