News for hackers. Stuff that matters.
Re:NeverSSL by makomk on Tuesday January 10, 2017 @05:36PM (#13369860)
This isn't generally a problem on smartphones and tablets because they can usually detect captive portals and prompt the user appropriately.
Re:NeverSSL by pfranz on Tuesday January 10, 2017 @06:53PM (#13370476)
Do you travel? I often have problems and am running out of non-https sites to test against. Best I can figure is that they're whitelisting certain domains so the captive portal detection isn't triggered. I think this is so certain things like iMessage or email work (hence, whitelisting apple.com), but blocking out the rest of the web.

I don't travel often (Christmas and maybe once or twice a year outside of that), but it's when I encounter this. It's very frustrating because I'll be walking, pass a store I've previously connected to Wifi, and suddenly lose Internet, then hunt for a website to get the portal to pop up.

I'm annoyed that captive portals have been commonly using DNS hacking since 802.11b and I'm surprised a better solution hasn't been standardized. I have no idea where in the stack it should go (DHCP, wireless standards, or whatever) but DNS hacking drives me nuts.

Re:NeverSSL by jandrese on Wednesday January 11, 2017 @04:42PM (#13377744)
I just make up fake sites to see if I'm stuck behind a captive portal because too many times I've accidentally loaded a cached version instead and not realized that I'm being blocked. fjiodfakliew.com or something.

The most sensible option would be a DHCP extension that indicates you are behind a portal and gives the IP to load, but this requires updates to every DHCP server and client, so it would take many years before it works reliably. Also, it fails for IPv6, but a modification to the Router Advertisement message could maybe do the same thing. It's a little scarier in this regard because it would be even easier to abuse.

Re:NeverSSL by Gaelan on Tuesday January 10, 2017 @07:29PM (#13370688)
Apple uses a large amount of domains to avoid this problem.
Re:NeverSSL by pfranz on Tuesday January 10, 2017 @08:33PM (#13371024)
Really? My point was, I have no specific idea why, but I /constantly/ have problems. My solution is to go to a non-https website in Safari and use the clickthrough. It seems to be on certain networks (not just a % of the time on all networks).

The experience has gotten a lot better. I see Apple's pop up covering a lot more corner cases, but after years I see have problems almost every time I travel.

Re:NeverSSL by HappyTypist on Tuesday January 10, 2017 @10:56PM (#13371630)
Some networks started sniffing for the user agent 'CaptivePortalAssist' instead of domain.
Re:NeverSSL by Viper007Bond on Tuesday January 10, 2017 @06:22PM (#13370228)
Windows does the same thing, at least in 10. I get a notification that further action is required and clicking it opens a no-SSL Microsoft URL that Will redirect.
Re:NeverSSL by poizan42 on Wednesday January 11, 2017 @01:48AM (#13372251)
It's go.microsoft.com. I Think you can be pretty sure that will forever be without https as well since it is hardcoded into several Windows versions
Re:NeverSSL by squidi on Wednesday January 11, 2017 @07:01AM (#13373325)