Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NeverSSL

neverssl.com

Post reply on HN
Print view View original

201–210 of 212 posts

Re: NeverSSL

#201

Post by jandrese »

omginternets wrote: post #86
Filligree wrote: post #45

Earlier quoted context omitted.

What would you suggest for the case of someone wanting payment for the connection? Like it or not, a lot of places do that.

Honestly? It's 2017. Just throttle bandwidth and give your internet away for free. There are some obvious cases in which this is unacceptable, but they are few and far between. The overwhelming majority of captive portals I see are just trying to get your contact info... so now you have two reasons why they should disappear.

Most captive portals I run across are trying to verify that you are in fact a paying customer. Typically by making you enter your hotel room number and name or something.

Normally you would think it would just be easier to set a wifi password and skip the captive portal nonsense, but so many vendors harbor the fantasy that other people will pay for the wifi so they have to leave it open and put a "buy 24 hours of internet for only $30!" link in there.

I hate captive portals. They are such a nuisance, especially when you have your machine configured to always connect via VPN.

Re: NeverSSL

#202

Post by jandrese »

pfranz wrote: post #68
makomk wrote: post #43

Earlier quoted context omitted.

This isn't generally a problem on smartphones and tablets because they can usually detect captive portals and prompt the user appropriately.

Do you travel? I often have problems and am running out of non-https sites to test against. Best I can figure is that they're whitelisting certain domains so the captive portal detection isn't triggered. I think this is so certain things like iMessage or email work (hence, whitelisting apple.com), but blocking out the rest of the web. I don't travel often (Christmas and maybe once or twice a year outside of that), bu…

I just make up fake sites to see if I'm stuck behind a captive portal because too many times I've accidentally loaded a cached version instead and not realized that I'm being blocked. fjiodfakliew.com or something.

The most sensible option would be a DHCP extension that indicates you are behind a portal and gives the IP to load, but this requires updates to every DHCP server and client, so it would take many years before it works reliably. Also, it fails for IPv6, but a modification to the Router Advertisement message could maybe do the same thing. It's a little scarier in this regard because it would be even easier to abuse.

Re: NeverSSL

#203

Post by viraptor »

dom0 wrote: post #52
viraptor wrote: post #23

Earlier quoted context omitted.

example.com is maintained by IANA. It's an official example address for documentation purposes. So on one hand, it will survive even if Apple disappears, on the other, they're likely not expecting any significant traffic.

Using the site for captive portal access does not actually generate any traffic for the site, because the middlebox intercepts and rewrites the request. Traffic only occurs if there is no captive portal. Hence the easily parsed "Success" body of the Apple site.

Phones confirm whether you passed the captive portal by requesting the usual check url again. That means they'll still get one request after a successful login.

Re: NeverSSL

#204

Post by EGreg »

johncolanduoni wrote: post #198
EGreg wrote: post #149

Earlier quoted context omitted.

Can't I use a regular consumer router but hook up a computer on the LAN to do something? Intercept DNS? Intercept HTTP requests like you said? But the problem is what if the user makes https requests? All I want to do is make a system which "takes attendance" via the phones automatically trying to join the local network, and I use the session is to look up the user. People would have accounts where they log in once v…

Think about it this way: if you could do it with a random computer on the network without special cooperation from the router, what would stop someone from connecting to your network with this software you propose and doing the same? As I explained, telling your router to instruct your clients to use a particular DNS server isn't nearly enough. The closest you could get would be to use another computer with 2 network…

I know it isn't an unsolved problem. That's my point. I have the software to run on a local area network and now I just want to explore the right ways to actually set up our own captive portals on those networks.

Consider a building or cruise ship with an existing network. It's a much harder sell to say "replace all your routers" or "flush all your routers and install our firmware" than to say "use your existing router and just set up our DNS server on a computer".

Re: NeverSSL

#205

Post by johncolanduoni »

EGreg wrote: post #204
johncolanduoni wrote: post #198

Earlier quoted context omitted.

Think about it this way: if you could do it with a random computer on the network without special cooperation from the router, what would stop someone from connecting to your network with this software you propose and doing the same? As I explained, telling your router to instruct your clients to use a particular DNS server isn't nearly enough. The closest you could get would be to use another computer with 2 network…

I know it isn't an unsolved problem. That's my point. I have the software to run on a local area network and now I just want to explore the right ways to actually set up our own captive portals on those networks. Consider a building or cruise ship with an existing network. It's a much harder sell to say "replace all your routers" or "flush all your routers and install our firmware" than to say "use your existing rout…

What networks have you seen that have more than one router and use consumer routers? Even medium sized networks often have only one router and multiple switches. You can get a router that can handle a captive portal and push a million packets per second for around $100. How little are you going to charge for your solution that it's going to be cheaper than that?

Re: NeverSSL

#207

Post by bisby »

mikehollinger wrote: post #57
bisby wrote: post #15

It's sad, because these are the kinds of things that confuse the hell out of "common folk" and explaining requires explaining HTTPS, HSTS, how captive WiFi portals work, and then ultimately, why there isn't a better solution... which maybe doesn't have a great answer. I feel like this "workaround" site is designed to draw attention to the problem at hand more than it is meant to be useful for the task at hand?

The question that I always ask family is, "Can you get to www.purple.com if you're having trouble?" It does what it says, is easy to understand, and is obvious if it's not functional.

My family always rhetorically asks "Why is this so hard?" or "Why does this never seem to work?" - which I never answer, because they are asking rhetorically, but also because there are a lot of deep technical issues you need to know about before you understand the common implementation and then I'm not sure I can explain why we dont have a better implementation.

Re: NeverSSL

#209

Post by smsm42 »

seirim wrote: post #118
OriginalPenguin wrote: post #92

Earlier quoted context omitted.

It shouldn't be too expensive for a restaurant to do. Although a restaurant can get by without wifi, most modern restaurants have it for managing OpenTable, monitoring yelp reviews, ordering supplies online, etc. I guess the signal might get a bit worse the farther away you get from the wifi router, but in general, providing wifi to customers shouldn't cost any additional money.

I think the real cost isn't that they use wifi, but that they actually sit around longer but purchase less in their time spent at the establishment. It's really important for restaurants to turn tables over quickly.

People usually don't lurk in those places anyway, I think. Usually there are coffee shops etc. that are much more open to that kind of thing.
Post reply on HN