CoffeeShopWifi.com – An HTTP website for connecting to guest WiFi

Post by boring_twenties » Thu, Jul 08, 2021, 8:53 PM UTC

moftz wrote: post #34

topher515 wrote: post #21

Earlier quoted context omitted.

The way a captive portal works is that the router at the coffee shop sees your browser's DNS request for `google.com` and instead of responding with the real IP address for Google it lies to your browser and returns an IP address which it controls. If google.com were a non-HTTPS website then the router could simply then serve up any arbitrary content it wanted. i.e., it's own login/access form. However, since google…

You now also end up in the situation where your browser has the google.com certificate pinned so even if the portal tries to serve up a self-signed certificate for google.com, the browser will still complain about something fishy going on. The most complete solution is for the browser to try to detect captive portals and load up a plain HTTP website for the portal to hijack. I remember in public school, IT had a webs…

Post by darwinwhy » Thu, Jul 08, 2021, 9:00 PM UTC

Post by elgaard » Thu, Jul 08, 2021, 9:13 PM UTC

Lt_Riza_Hawkeye wrote: post #26

jacobwil wrote: post #11

My favorite version of this trend remains http://alwayshttp.com because https://alwayshttp.com doesn't work since alwayshttp.com:443 doesn't connect. On the other hand, it's possible to reach https://coffeeshopwifi.com and (with a cloudfront certificate error) https://neverssl.com which makes me wonder if something in whatever I'm using is trying to upgrade to HTTPS when I fail to reach them.

Huh, I don't even get a certificate error on https://coffeeshopwifi.com/ - and I got automatically upgraded (I guess due to https everywhere) haha

Post by notwedtm » Thu, Jul 08, 2021, 9:26 PM UTC

sigjuice wrote: post #53

ykat7 wrote: post #2

I like the straightforward explanation this site provides. That said, I tend to use http://example.com to trigger captive portals because it's an IANA reserved domain [1] that other people can't register. This gives me confidence to browse to it without fear that the domain could lapse in the future and get taken over (e.g. in a watering hole attack). [1]: https://www.iana.org/domains/reserved

I'm not sure how example.com is better than any other domain in a coffee shop setting. Any DNS lookup can be made to resolve to any arbitrary IP address, so it would not matter if a domain is lapsed or even real.

Post by notwedtm » Thu, Jul 08, 2021, 9:29 PM UTC

jastr wrote: post #49

Lt_Riza_Hawkeye wrote: post #26

Earlier quoted context omitted.

Huh, I don't even get a certificate error on https://coffeeshopwifi.com/ - and I got automatically upgraded (I guess due to https everywhere) haha

Browser extensions will redirect HTTP to HTTPS as the request is made, so CoffeeShopWifi can't help you there. Most sites will send a redirect to HTTPS, which CoffeeShopWifi does not. So I decided it's safe to make a cert and support HTTPS.