5

Suppose I connect to the Wi-Fi of a company I trust enough to give them my credit card number (say, my local airport). When I connect to their Wi-Fi network, my web browser gets redirected from any page to their captive payment page.

With luck, they'd be using a company-owned domain and HTTPS. If I'm really lucky, it might even be an EV certificate with the company name on it.

It seems that some phones, in particular the current version of iOS, show any such captive forms in a special interface, instead of the standard browser. As best as I can tell from the official guide, there is no way in this special interface to check the SSL certificate. It shows the domain, but not the certificate status.

Does this interface only work if the portal uses HTTPS and the certificate is valid? Is there some way to see the actual certificate, or at least whether it's a domain certificate or EV? It's not uncommon for companies to use a weird separate domain that you can't know is theirs off the top of your head, but if they used EV on it then you have some confidence that it's theirs.

|improve this question
  • You're sending credit card info over WiFi in an airport? Ew. – Iszi May 21 '15 at 15:20
  • 2
    @Iszi over HTTPS after verifying the EV certificate to a company I also trust with my credit card at home - sure, why not? I'd love to authorize a one-off payment instead, but alas credit card systems aren't quite there yet. – RomanSt May 21 '15 at 16:04
2

I'll let someone else answer about how the iOS captive portal interface displays certificate status and whether the captive portal is served over HTTPS, but I do know a solution.

When connecting to an open Wi-Fi, dismiss the captive portal sheet then click on the network entry's "i" icon on the right in the Wi-Fi network list. That will display properties for the network and will include a "Auto login" toggle which controls whether iOS tries to detect and handle the captive portal. Turn it off. That way, iOS will connect to the network and you'll be able to use the standard Safari browser to log in to the captive portal, which displays a lock icon if the page is served over HTTPS.

An even better solution would be to push your public Wi-Fi provider into using EAP to authenticate users instead of horrible and insecure captive portals.

|improve this answer
1

I'm sure that Apple tries to make it secure but there's no real way to know exactly how they define "secure". As it sounds like you have some fairly strict requirements for considering such a connection secure, I'd assume that what the OS provides is using a lower standard.

So, if you can, open the page in your browser and perform your standard security checks rather than using the OS's functionality.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.