Re:WiFi without internet on a Southwest flight
by Nextgrid on Thursday September 28, 2023 @03:23PM
(#37694419)
In cases where the Wi-Fi is provided as a value-add or is bought via another channel than the Wi-Fi network itself, I think you can just generate one-time WPA Enterprise credentials, with a QR code to facilitate data entry?
In case of in-flight Wi-Fi, the credentials/QR code can be printed on the boarding pass, or available in the app (the app caches it in advance while it's still on the ground, so when in the air you can use those credentials to connect).
This doesn't cover 100% of use-cases but it would at least cover a big one (a significant amount of public Wi-Fi is "value add" to another service - whether restaurants, hotels, flights, etc where there's an existing channel to provide one-off wi-Fi credentials over), it's a shame nobody deploys this.
Re:WiFi without internet on a Southwest flight
by labcomputer on Thursday September 28, 2023 @04:14PM
(#37695175)
I think you could even take this one step further: Have a captive portal on an unencrypted channel (using TLS obviously) to do the vending, so that the credentials don’t need to be purchased before the flight.
Re:WiFi without internet on a Southwest flight
by lxgr on Thursday September 28, 2023 @07:46PM
(#37697494)
Oh, these are neat ideas, I hadn’t thought of that!
One concern might be expiring access credentials (not sure if most OSes will re-prompt for a new password or just give up), but you could just make the EAP credentials per-user instead and redirect users to the captive portal again once needed.
This leaves clients not supporting WPA-EAP, but these could just continue using the regular unencrypted/MAC-authenticated service.
Re:WiFi without internet on a Southwest flight
by MBCook on Thursday September 28, 2023 @10:47PM
(#37698738)
You might be able to just do the sign up on the in-flight entertainment system and have the user scan the resulting WR code.
Only works with IFE equipped planes, of course.
Re:WiFi without internet on a Southwest flight
by eru on Friday September 29, 2023 @12:11AM
(#37699175)
Well, the customer also needs to futz around with scanning a WR code, and get it from the device she scanned it on to the device she wants to use the wifi on (if they ain't the same.)
Though you could route around these problems, but giving them both a scannable code, and underneath some credentials as plain text they could type.
Re:WiFi without internet on a Southwest flight
by yub on Tuesday October 03, 2023 @07:52AM
(#37750623)
That’s what Passpoint (aka Hotspot2)’s Online Sign Up is supposed to do. Main network is protected by WPA2/3-Enterprise (aka EAP), and there’s the OSU open network where you can get signed up and get a profile installed for the full main network. And every modern device supports EAP these days.
Re:WiFi without internet on a Southwest flight
by cxcorp on Thursday September 28, 2023 @04:35PM
(#37695452)
What if the captive portal just had a link (or on an IFE screen, a QR code) that connected your phone to a different, WPA2/WPA3 protected, hidden WiFi SSID that was generated exclusively for you? Phones nowadays support joining a passphrase protected WiFi AP via a QR code, so I'd imagine that's doable. The hard part would be finding routers that support >300 different hidden SSIDs, but honestly I would hope that that is technically feasible nowadays.
That way you'd at least have the protection of the WPA GTK.
Re:WiFi without internet on a Southwest flight
by tharkun__ on Thursday September 28, 2023 @06:56PM
(#37697031)
This. And even if the >300 is not available, how many people actually buy Wi-Fi on the plane? That is the number of clients that need to be supported. And if that's still a problem (or you don't want to guess), the SSID can be hidden and static and the only thing non-static is the password that works for just the duration of the flight you are on.
Re:WiFi without internet on a Southwest flight
by pbhjpbhj on Thursday September 28, 2023 @07:06PM
(#37697126)
So you just take a photo of anyone's QR code? I'm not sure the hidden SSID achieves anything, that is presumably plaintext in the wi-fi transmission?
Re:WiFi without internet on a Southwest flight
by eru on Friday September 29, 2023 @12:12AM
(#37699182)
That QR code would only be displayed for a short time, and mostly only people sitting directly behind you could snap the picture.
It's not airtight, but better than the system it would be replacing.
Re:WiFi without internet on a Southwest flight
by cxcorp on Friday September 29, 2023 @02:18PM
(#37708152)
The hidden SSID stops the users' WiFi list being full of random, password protected SSIDs when they just want to connect to the open portal WiFi.
Re:WiFi without internet on a Southwest flight
by tpolzer on Friday September 29, 2023 @01:54AM
(#37699768)
The AP still has to send regular beacons for each hidden SSID, taking up air time.
Re:WiFi without internet on a Southwest flight
by zekica on Friday September 29, 2023 @06:15AM
(#37701559)
You can have an AP accepting multiple different WPA2-PSK and/or WPA3-SAE passphrases, and since on WPA2 PMK depends on the password, and on WPA3 PMK is different for each client, you can put them in different VLANs or have per PMK MAC mapping if they share the same VLAN.
Re:WiFi without internet on a Southwest flight
by vezuchyy on Thursday September 28, 2023 @05:04PM
(#37695826)
You can always use an open network to generate passwords for the proper internet connected WPA-EAP network (along with some in-flight multimedia like some carriers do). Extra step for sure but it solves the problem.
PS: I'm a couch expert so I have no idea if there's a problem with this idea.
Re:WiFi without internet on a Southwest flight
by Wowfunhappy on Thursday September 28, 2023 @07:34PM
(#37697366)
The first problem that comes to my mind--clients will remember both wifi networks and may continue to choose the open network when e.g. waking from sleep.
The user can go in and forget the open network of course, but most won't know to do that.
Re:WiFi without internet on a Southwest flight
by lxgr on Thursday September 28, 2023 @07:42PM
(#37697453)
You could just prevent access to the wider internet on the open version!
Re:WiFi without internet on a Southwest flight
by Wowfunhappy on Thursday September 28, 2023 @07:45PM
(#37697478)
Yes but the client will still connect and the user will wonder why their internet isn't working.
Re:WiFi without internet on a Southwest flight
by stereo on Thursday September 28, 2023 @11:14PM
(#37698912)
It would theoretically be possible to bounce clients which you know are already authorised on the paid network.
Re:WiFi without internet on a Southwest flight
by gorlilla on Friday September 29, 2023 @09:36AM
(#37704035)
QR code to connect to the _open_ but _hidden_ SSID. Instructs user to join WPA-EAP with supplied credentials once they've paid. Remains available to connect via QR in case customer somehow misplaced creds but avoids auto-reconnect during scan.
Re:WiFi without internet on a Southwest flight
by IggleSniggle on Thursday September 28, 2023 @11:18PM
(#37698928)
Use Bluetooth instead of WiFi for the password generation channel
Re:WiFi without internet on a Southwest flight
by dangus on Thursday September 28, 2023 @05:44PM
(#37696309)
Isn’t this data meant to be exposed? You can get all this flight status on the Southwest intranet when you’re connected to WiFi as part of the flight status page.
This hack just goes a step further to plot the data over time.
Re:WiFi without internet on a Southwest flight
by lxgr on Thursday September 28, 2023 @07:40PM
(#37697435)
The concern isn’t access to the flight status data (or even your data, which is most likely encrypted these days), but theft of service you paid for, by another passenger on the flight (you would probably at least get kicked out/experience issues with your own connectivity, and might worst-case be blamed if something bad happens using the connection you bought).
Re:WiFi without internet on a Southwest flight
by dangus on Thursday September 28, 2023 @10:09PM
(#37698498)
I’m confused, none of what you’re describing is part of the article.
Re:WiFi without internet on a Southwest flight
by nenaoki on Thursday September 28, 2023 @10:21PM
(#37698567)
It's responding to the scenario described in GGP.
Re:WiFi without internet on a Southwest flight
by dangus on Friday September 29, 2023 @06:26AM
(#37701637)
Ah, does that hack still work though? I would be surprised if it did, since the story was from years ago.
Re:WiFi without internet on a Southwest flight
by nerdbert on Friday September 29, 2023 @03:56PM
(#37709345)
I used to play with IP-over-DNS, which more or less worked on an awful lot of these plane wifi systems. Haven't tried it in the past couple years though; it's always slow the point of barely being usable. You can probably get your mail via IMAP if you're patient and nobody's sending you large attachments, that's about it.
The state of "open Wi-Fi" security is actually really sad. I'm not aware of an easy way for the airline to actually do better than this!
I suppose they could use Opportunistic Wireless Encryption [1] and bind session authentication to that (i.e. authenticate a given OWE session, not a given MAC address) if the device supports it, as at least modern Apple devices do? But I have no idea how stable an OWE session is; it would be very inconvenient to have to login again every time my device switches between access points.
In any case, I'm sad that this isn't a solved problem yet, and paid Wi-Fi (as well as securing free Wi-Fi) still requires custom and clunky solutions like unreliable captive portals that need to pass through selective traffic (e.g. for 3DS, for payments, sometimes emails for password reset codes etc and more).
A standardized endpoint and API would also be nice, i.e. something to tell the client whether it's connected, restricted (i.e. able to only access a limited set of hosts such as the in-flight map as described in the article), or needs to pay/authenticate (and if so, at which URL). This could then yield an authentication token, to be provided for seamless reconnections for the same session.
There's "Hotspot 2.0" and WPA-EAP (i.e. WPA Enterprise), but these don't really have a good story for "pay via web portal" style usages and are more geared towards wireless carrier operated hotspot networks and corporate scenarios, respectively.
[1] https://en.wikipedia.org/wiki/Opportunistic_Wireless_Encrypt...