What is the best form of authorization for captive portal WiFi

Question

I've been looking into captive portal WiFi implementations and on a few I'be been able to easily bypass their login with the following steps:

1. 1) Open Wireshark and run a report getting the most used IPs in my network (except the router's IP and mine)
2. Chang my mac address to that IPs associated mac
3. refreshing the NIC

My rational was that it seemed like most captive portal just redirect all your traffic to a login page, once you login it seems to whitelist your mac. So I just found the IPs that had the most traffic that were on my network and assumed they are probably already authorized to use the internet. Sometimes it takes a few tries to get the right mac, but this normally works. I'm wondering what other better authentication methods are out there that solve this problem.

Answer 1

As you have identified, MAC address based authentication/authorization is not effective. A proper solution is 802.1X, which can be implemented using WPA2 or WPA3 enterprise. This way, credentials are exchanged over a secure channel, and authentication is required before you are allowed to join the wireless network.

This model is a bit different, since it requires knowledge of credentials before ever connecting. This is an issue for paid WiFi networks, or since the setup isn't as easy for a regular user. One method to resolve this is to provide an open WiFi network where the user can register/pay/login (of course, requiring HTTPS). After setting up their account, they can download a profile that allows them to connect to the WPA enterprise network. This is the model used by Xfinity WiFi hotspots. The problem still remains that anybody can create an open network to impersonate the legitimate one, and collect credentials that way, unless the user is trained to validate the domain and HTTPS. Depending on the setting, this may be mitigated just like any rogue network scenario.