4

In some coffee shops that offer free WiFi (for instance Starbucks), I have noticed that attempting to use HTTP or HTTPS fails unless you accept a notification (on Windows at least) which looks something like the image below:

click additional information popup

Attempting to open a webpage causes the browser to be momentarily highjacked by a 'httpclient' which redirects to one of the coffee shop's web pages (for instance, below). All subsequent pages opened appear to work normally.

httpclient

My question is if this has any bearing on information security. It feels as if one of the coffee shop's machines is acting as a man-in-the-middle. Could this machine, if doing so, snoop on traffic?

Improve this question
1
  • 1
    If you are part of the network, you will be able to snoop all traffic. After you log in to this network, and make your first http request, it will be redirected. Look for Captive Portal. Scanning traffic could be done by the guy next to you. It's an open network.
    – aw-think
    Commented Jul 2, 2016 at 10:59

2 Answers 2

Reset to default
11

What you are referring to is called a captive portal. It allows WiFi providers to authorise users, get confirmation for service agreement from them, display ads, require payment for extended usage time, etc. Its existence doesn't have security implications in itself (unless it was poorly implemented and leaking user-provided information, but that is on a different level).

However: when you connect to a WiFi which you do not control, from the moment you connected your device to the network your traffic can be (and is) captured and altered (this is why you are redirected to a captive portalーit is not used as a tool for MitM attack, it is the result of MitM attack*).

The only line of defence, is proper use of HTTPS for the sites that process sensitive information (after authorisation or whatever captive portal requires you to do). It means: (1) using HTTPS in the first place and (2) not accepting untrusted certificates.

* I use phrase "MitM attack" here to refer to the mechanism, not to the intentions. In case of reliable free WiFi providers it is not an attack, but their service model. And as you noticed, Microsoft recognises such actions as legitimate and displays a user-friendly notification.

Improve this answer
4
  • 1
    I'm not sure if this is correct from the human port of the equation. Of course a captive portal may not have too much influence on the technical aspects (you're too late if you're already on an untrusted network) but it can be used to give users a false sense of security (but I did see that secured page from the telecom provider! this must be real!).
    – Maarten Bodewes
    Commented Jul 2, 2016 at 11:27
  • 2
    I'm not sure, if I understand your comment correctly, but you are basically saying that free WiFi at Starbucks offers users a false sense of security, because Starbucks is a renowned brand and public WiFis are inherently insecure. With such assumption, it doesn't matter if you display a message on a screen via a captive portal, print a leaflet, or hang a poster in a shop.
    – techraf
    Commented Jul 2, 2016 at 11:33
  • 1
    Having a poster on the wall is in my opinion something different than hosting a fake wifi hotspot and showing a page on the user's computer itself saying, e.g. "welcome to starbucks, please enjoy our free and - above everything else secure - WiFi hotspot. Please click here to accept our internet policy [agree], truly yours: https://free-wifi.starbugs.com".
    – Maarten Bodewes
    Commented Jul 2, 2016 at 11:42
  • 3
    Could you explain how do your comments relate to this answer and to OP's question? Possibly by quoting relevant parts which you are commenting on.
    – techraf
    Commented Jul 2, 2016 at 12:09
1

Although the captive portal doesn't technically allow anything that an attacker cannot already do with a fake hotspot, it may lure users into a false sense of security.

As users expect such a portal, a fake portal can be set up in addition to the fake hotspot. It's likely that users put more trust in such a connection then in just the hotspot itself (their computer is telling them it is safe, right?). It can therefore be detrimental to security.

On the other hand, if users are apt and the private key/certificate of the - often secured - hotspot is handled correctly then such a portal may even somewhat enhance security.

This is especially the case when e.g. an Android application is used to verify the hotspot access, by binding the WiFi session to the TLS session.

Improve this answer
1
  • 1
    PS I'm currently unaware if a hotspot access can be securily tied to a TLS session (or other authentication of the hotspot provider). If there is any more information on this I'm very interested.
    – Maarten Bodewes
    Commented Jul 2, 2016 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .