Timeline for How is no password more secure than username+password?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 31, 2018 at 18:49 | comment | added | supercat | Perhaps the right approach would not be to pick a domain, but instead require that a browser used for such purposes be run within a particular VM, and instruct users that nothing requiring security should be run within that VM, but even there, picking a domain which one expects to be hijacked by a captive portal would help to recognize the difference between captive-portal hijacking and other forms. | |
| Aug 31, 2018 at 18:48 | comment | added | supercat | @TheGreatDuck: If a browser would allow a visited page to execute code of its choosing with sufficient privilege to install a virus, that's a problem even if everything is done through a VPN. Likewise almost any publicly-addressable http-based web site visited through a VPN could be hijacked by anyone at any node between the web host and the VPN bridge, no matter what the VPN does. The particular use case of using a browser to access www.example.com and whatever that redirects to would seem like it should be safe in the absence of security flaws within the browser itself. | |
| Aug 29, 2018 at 23:16 | comment | added | user64742 | @supercat there is nothing enforcing that the captive portal is actually a captive portal and not something that will download a virus. It might look like a page for entering a password or username, but it might not actually do anything aside from allowing you to continue browsing. With a standardized website that is even worse as now hackers can just mimick that website on a network that doesn't have captive portals and every user would fall for it and have no reason to believe otherwise. Captive portals that have different named URLs depending on the network actually aids in the security. | |
| Aug 29, 2018 at 22:37 | comment | added | Brilliand | @supercat After you're redirected to the captive portal, then what? You're still on an insecure connection until you explicitly switch back to your secure mode, which you may forget to do. | |
| Aug 28, 2018 at 18:53 | comment | added | supercat |
Would there be any security risks if software explicitly allowed accesses to a particular site like (perhaps literally) www.example.com to be "hijacked" via captive portal? Captive portals should have no trouble hijacking that site like any other, but it would be unlikely that a captive portal masquerading as www.example.com would be able to trick anyone into doing anything they're not wanting to.
|
|
| Aug 28, 2018 at 12:54 | history | answered | Philipp | CC BY-SA 4.0 |