News for hackers. Stuff that matters.
Re:How Windows decide whether your computer has limited or f... by divbzero on Saturday November 19, 2022 @12:40AM (#33667314)
I suppose you could spoof having full Internet access by hosting nsci.txt or connecttest.txt locally and editing your hosts file to direct www.msftncsi.com or www.msftconnecttest.com to 127.0.0.1? Conversely, if those Microsoft websites ever failed, countless Windows machines would determine that they have limited or no Internet access.
Re:How Windows decide whether your computer has limited or f... by number6 on Saturday November 19, 2022 @01:09AM (#33667481)
Best hosting company: localhost
Re:How Windows decide whether your computer has limited or f... by vgb2k18 on Saturday November 19, 2022 @01:24AM (#33667558)
In the linked comment section, Raymond Chen replied somewhat abrasively to a comment similar to this (the comment was "wouldn't this be easy to spoof?").

A bit harsh I thought!

Re:How Windows decide whether your computer has limited or f... by pkulak on Saturday November 19, 2022 @01:30AM (#33667597)
He just had to say that this is for convenience, not security.
Re:How Windows decide whether your computer has limited or f... by c0nsumer on Saturday November 19, 2022 @09:32AM (#33670393)
Yep, exactly. Because another part of this is NCSI is used for captive portal detection, so Windows can/will notify the user that they need to do something more to keep using the network.

Android and Chrome do the same sort of thing to detect internet access; this is how Android pops the notification to sign in to the network.

Then, at least on Windows, the results of NCSI flow down into WinHTTP and a ton of other things so apps can know the status of the network.

It's also possible, via Group Policy, to configure a different URL for NCSI. This is useful in enterprises which may not have the NCSI URL available to unauthenticated things (eg: the OS) but still has internet access via proxies.

It's also possible to disable NCSI, captive portal detection, etc, which is useful on some closed network boxes (eg: some enterprises) but this will cause problems if the machines are ever used on public/walled garden/captive portal networks.

The biggest problem I've seen with this comes about where captive portal detection is disabled, a user ends up on a captive portal, tries to hit a website to satisfy the portal, but due to most sites that normal users will try being https these days can't get their session redirected in order to display the portal, so they think "the internet is broken". The NCSI/captive portal detection makes a point of using HTTP so captive portal redirection can work properly.

Re:How Windows decide whether your computer has limited or f... by bboygravity on Saturday November 19, 2022 @01:48AM (#33667700)
Doesn't windows ignore localhost for Microsoft adresses? I vaguely recall reading an article on that.
Re:How Windows decide whether your computer has limited or f... by lukeboi on Saturday November 19, 2022 @02:39AM (#33667978)
yep! or do this at the dns level
Re:How Windows decide whether your computer has limited or f... by tveyben on Saturday November 19, 2022 @03:49AM (#33668368)

   Not if they parse the payload of the response
   Yes if they only use the http status
(I Think they rely on the payload…)