Information Security

Questions tagged [captive-portal]

Ask Question

A captive portal is a web page served to users of a network, often asking for credentials, before they can use the internet.

30 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
0
votes
0answers
47 views

Defense from Captive Portal MAC-spoofing in OWE (WPA-3)

Previously, user authentication on Captive portal was only by his mac address. Accordingly, in wi-fi networks it was very easy to intercept the user's mac address and apply it to yourself. Captive ...
1
vote
2answers
413 views

Why do evil twin attacks against WiFi use a captive portal?

I was recently the victim of an evil twin attack on my WiFi network, probably by the new upstairs neighbors. It prompted me, with a captive portal, saying there had been an update and I needed to ...
78
votes
8answers
27k views

How is no password more secure than username+password?

Context: I have a laptop supplied by my organisation. I am trying to connect to eduroam, but I cannot do it using my organisation's laptop. When I use a personal computer, it asks me for a username ...
1
vote
1answer
488 views

Building a malicious captive portal

So I'm trying to build a malicious captive portal but I'm stuck on the part where you need to know stuff. Anytime a HTTP request comes in, everything works fine. However, when an HTTPS connection ...
7
votes
2answers
4k views

How should captive portals redirect?

I recently read this question, which makes me wonder a follow up question: how is this captive portal likely trying to redirect the user? A highly voted comment does say that it's doing it wrong, ...
3
votes
1answer
2k views

Can Captive Portal links open browser/apps?

I'm aware the risks of connecting to a public AP poses as well as how MITMish is the hotspot approach. I wonder if there is anything in the OS layer (iOS, Android) that prohibit the execution of ...
0
votes
1answer
169 views

Captive Portal Security Measures

I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use iptables to restrict access to all devices unless they ...
4
votes
1answer
9k views

Why is firefox attempting to direct me to a Captive Portal, when I'm connected to my own router?

I am connected to my own router, and I know for a fact that I do not have a captive portal installed. Firefox displays a banner at the top of the page saying that "you must log in to this network ...
2
votes
1answer
884 views

Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi?

As far as I understand, the captive portal is implemented by some sort of iptable firewall rules. Since there is no handshake established during the initial association with the AP(As no passphrase is ...
2
votes
3answers
424 views

Need a leniant browser for captive portals (WiFi and LAN)

I'm currently working from a customer LAN which is "protected" through authentication through captive-portal-like technology. In theory, first thing you do in the morning is click on some URL, get ...
1
vote
1answer
616 views

Captive portal (Wifi) remembers me even if I change my MAC address

On occasion I change my MAC address from time to time at a public Wifi service. However lately something has changed. The captive portal (Wifi) remembers me even if I change my MAC address on my ...
2
votes
1answer
2k views

WPA2-EAP and Captive Portal

Is it possible to use Captive Portal for WiFi and WPA2-EAP at the same time? Is there any EAP supporting Captive Portal? For example - user connects to WiFi, goes to Captive Portal over unsecure ...
2
votes
2answers
1k views

Change device MAC address to router's MAC address

This is in respect to bypassing Captive Portals. I haven't tried it yet on a captive portal yet. But I was wondering, what will happen if : I connect to a wireless network Get the router's MAC ...
3
votes
3answers
2k views

Enterprise HTTPS redirection without certificate error

I have a captive portal setup for my organization that forces users to authentication prior to being allowed access to the network. Challenge is that when a user opens their browser and their homepage ...
4
votes
2answers
643 views

Httpclient redirect in coffee shops

In some coffee shops that offer free WiFi (for instance Starbucks), I have noticed that attempting to use HTTP or HTTPS fails unless you accept a notification (on Windows at least) which looks ...
20
votes
4answers
4k views

Is HTTPS secure over public Wi-Fi with an expired certificate?

I am staying at a hotel with free public Wi-Fi. To get Internet access I had to visit a web page and agree to the terms and conditions. This website has a security certificate, but it expired over a ...
4
votes
1answer
2k views

How does Karma's open WiFi network successfully protect its users?

Foreword This question has a lot of build-up, so please scroll down to the bottom if you just want to see the question. Please at least skim the background info, though. Background I ordered a ...
5
votes
2answers
458 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
2
votes
1answer
1k views

Using dnscrypt on a public hotspot with a captive portal

What strategy shall I take if I wanted to use a dnscrypt with a public hotspot that requires login through a captive portal? Such hotspots require DNS settings to point to their servers (via DHCP) so ...
4
votes
2answers
1k views

Public AP: How to reduce vulnerability window between Captive Portal and starting VPN?

I always use a VPN on my Mac when I access over public APs (such as coffee shop free WiFi) How much should I worry about the window of time where I am in the captive portal (the agreement screen) and ...
5
votes
2answers
222 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time (i.e....
5
votes
2answers
3k views

HTTPS in captive portals and the Apple Captive Network Assistant

Suppose I connect to the Wi-Fi of a company I trust enough to give them my credit card number (say, my local airport). When I connect to their Wi-Fi network, my web browser gets redirected from any ...
10
votes
1answer
3k views

Distinguish between Wi-Fi Captive portal and MitM attack

Not sure whether this should be asked in Super User or here. How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS? Are ...
-1
votes
2answers
847 views

Is there any reason that captive portal server can't block the ICMP echo request/reply packet

We can get connected to those public WiFi hotspot without the account but can access to no website but the login page. As I tested, all those login website would respond to my ping even I was an ...
3
votes
1answer
2k views

How are Captive Wifi Portals secured?

I'm looking for a captive portal solution that prevents other users from stealing the session key from other active users. (or prevents the cloning the authenticated user's MAC) Is there a reliable ...
4
votes
1answer
774 views

Can a captive portal be secured [closed]

I am interested in using a captive portal on a public network. After reading the wikipedia article and several questions here on sec.SE, I don't understand how I can secure it, or even, if I can ...
5
votes
2answers
5k views

How is user authentication sent in a public wifi? Radius/802.1x/EAP etc

I visit the airport, I pull out my laptop and connect to a network (no password needed). I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
3
votes
1answer
625 views

captive portal wikipedia article

Something on the wikipedia page regarding captive portals have confused me: http://en.wikipedia.org/wiki/Captive_portal When a client requests a website, DNS is queried by the browser. The ...
1
vote
1answer
1k views

Designing and managing a captive portal

I'd like to learn more about how a captive portal works, especially the management system regarding usage, security monitoring, billing, security architecture etc. Does anybody know any good ...
8
votes
1answer
17k views

Bypassing a captive portal with tor

I know that NSXTS and Iodine can be used to bypass a captive portal by taking advantage of permissive DNS firewall rules. What I have found recently is that simply by using Tor, I can also bypass a ...