They may be self-signed but if he rolls out his own self-signed certificate the browser will also put a big warning to not go forward.

LetsEncrypt cert? The domain could be something like amazon.freeewifi.com, it can have a username/password field and a text above it that says "enter your Google/Facebook/Amazon login", and the majority of users won't realize that this is a 3rd-party site. Experts like us might notice "That's not how 3rd party auth is supposed to work!", but the majority really won't know.

A few years ago I read a statistics that most (90%+) computer users just do things based on rote memorization of sequences of actions, not understanding what happens in the background. I wonder how it is nowadays.

Maybe AI that can "smell" if you're on a scammy site (e.g. prompts to enter your Google/FB/Amazon password) would be useful, but then again the implementation might end up being like MS's "let us record your screen, for AI!" horseshit..

I was imagining them trying to spoof an amazon.com domain using an evil dns server or something of that nature. That would be much harder to detect, but the. The cert is an issue.

I guess it's overcomplicating things, though. Most people will just not notice that whatever domain they use is not legit.

Yeah, just like "I'm a prince who needs your help to move money" scams are riddled with poor grammar, it's easier to keep it dumb, to attract the unsuspecting.

But on the flip-side, if there's an expert on the flight, they'd notice it's a spoof site and chances are higher they'll report it to the crew. I can imagine the trick is to show a page that says "For free WiFi, follow our Instagram account, click here for our account", and the click will fail because there's no connection (if we're on the plane), but the click can trigger some Javascript to say "If you couldn't follow our Instagram, login using your Google/Amazon account: Username: ____ Password: ____". Or a more sophisticated trick would be to show a DIV that looks like Instagram and the "follow" button, which will then show the fake login...

The privacy-wary IT expert will look at the "Follow our Instagram" and think "Fuck off, I'm not doing that!" and might miss the spoofed login prompt...

Amazon is also super sloppy with domains even when its legit. Working there I had to put my password into probably four or five tlds, and the onboarding process involved giving my SSN to an non amazon.com tld linked from an email that was from a different non amazon tld with a misconfigured cert that got it sent to spam by gmail and dotted with red rectangles and stop signs

Why would they be self-signed

Well you can't have a real amazon.com cert ¯\_(ツ)_/¯.

If you use a random domain sure it works, but it's also fishy. I guess most people won't notice...

Make the domain login-to-[airline]-wifi.com, get a real cert, and return a form with <h1>Login with Facebook</h1> and you won't ring alarm bells for the average user

What's the imagined obstacle in obtaining a real cert?