Re:NeverSSL – helping you get online
by roywiggins on Thursday August 01, 2019 @11:15AM
(#20584517)
The point is to generate a 302 redirect, so I guess it doesn't matter what example.com is actually serving if you never see it. But the captive portal may forward you along to it after you authenticate.
This doesn't do anything to prevent a MITM at all, just that if neverssl.com starts serving crap you have a nonzero chance of loading it when trying to use it to generate a redirect. If there's a local MITM you're in trouble either way.
Re:NeverSSL – helping you get online
by sowbug on Thursday August 01, 2019 @01:31PM
(#20586203)
That makes sense. My one change to the workflow is that I tend to visit example.com again, one last time, after jumping through the captive-portal hoops to make sure it's all really working. Thus I do see the content.
This doesn't do anything to prevent a MITM at all, just that if neverssl.com starts serving crap you have a nonzero chance of loading it when trying to use it to generate a redirect. If there's a local MITM you're in trouble either way.