News for hackers. Stuff that matters.

A comment on NeverSSL. Parent comment

Re:NeverSSL by innocenat on Wednesday January 11, 2017 @03:12AM (#13372506)
Apple could also makes the mini-browser supports those captive portal instead? Then none of this bypassing would be required.
[ Parent | on HN ]
Re:NeverSSL by kristofferR on Wednesday January 11, 2017 @03:47AM (#13372628)
The mini-browser (Captive Network Assistant) is designed to protect the user's privacy, so support for Javascript and cookies is deliberately disabled.
[ Parent | on HN ]
Re:NeverSSL by richrichardsson on Wednesday January 11, 2017 @05:15AM (#13372930)
Javascript IS enabled in CNA!
[ Parent | on HN ]
Re:NeverSSL by anon363764 on Wednesday January 11, 2017 @03:35AM (#13372590)
When iOS cannot fetch the fixed content of www.thinkdifferent.*, a UIWebView pops and displays that content, assuming it's a captive portal needing attention.

Instead, there should be some non-routable, local-only special IPv4/IPv6 address that all captive portals are required to present.

No more DNS spoofing, no more page rewriting which breaks the web.

[ Parent | on HN ]