I'm aware the risks of connecting to a public AP poses as well as how MITMish is the hotspot approach.
I wonder if there is anything in the OS layer (iOS, Android) that prohibit the execution of applications installed in the device such as browser or Facebook app inside Captive Portal.
The scenario I have in mind is some cool button that appears in the screen after user is authenticated in the hotspot that has a nifty "whatsapp://", "googlechrome://" or even URL' s that are "app-aware" like Messenger "m.me/coolPage" that open in the browser and than closes opening the Messenger application, if installed.
If there are these controls in place for this kind of attack, can they be circunvented by any means?
Thanks in advance!