News for hackers. Stuff that matters.

A comment on NeverSSL. Parent comment

Re:NeverSSL by bastawhiz on Tuesday January 10, 2017 @09:05PM (#13371169)
> put the payment url on a sign, just enforce an ip whitelist until customer has paid. Or in extreme sign-less situations put it in the ssid e.g. "pay at portalpage.com"

This is a captive portal. But worse, because even HTTP sites don't send you to the portal.

[ Parent | on HN ]
Re:NeverSSL by ploxiln on Wednesday January 11, 2017 @03:30PM (#13377250)
But on the plus side:

  * no MITM attack
  * no TLS cert errors
  * no "do I need to hard-refresh? what's the key for that?"
  * no question if network access is working or not
  * one reliable clear action to get access
See the various comments about work-arounds for work-arounds. Random plain-http intercept-check sites because some captive portals try to make iOS not pop up the mini sandboxed captive portal browser. The endless confusion.

This stuff would be a lot simpler if people weren't always trying to make it needlessly "easy" and fucking it up even more every time.

[ Parent | on HN ]