Questions tagged [captive-portal]
A captive portal is a web page served to users of a network, often asking for credentials, before they can use the internet.
79
votes
8answers
27k views
How is no password more secure than username+password?
Context: I have a laptop supplied by my organisation. I am trying to connect to eduroam, but I cannot do it using my organisation's laptop. When I use a personal computer, it asks me for a username ...
0
votes
1answer
285 views
Building a malicious captive portal
So I'm trying to build a malicious captive portal but I'm stuck on the part where you need to know stuff.
Anytime a HTTP request comes in, everything works fine. However, when an HTTPS connection ...
7
votes
2answers
2k views
How should captive portals redirect?
I recently read this question, which makes me wonder a follow up question: how is this captive portal likely trying to redirect the user? A highly voted comment does say that it's doing it wrong, ...
3
votes
1answer
1k views
Can Captive Portal links open browser/apps?
I'm aware the risks of connecting to a public AP poses as well as how MITMish is the hotspot approach.
I wonder if there is anything in the OS layer (iOS, Android) that prohibit the execution of ...
0
votes
1answer
131 views
Captive Portal Security Measures
I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use iptables to restrict access to all devices unless they ...
2
votes
1answer
5k views
Why is firefox attempting to direct me to a Captive Portal, when I'm connected to my own router?
I am connected to my own router, and I know for a fact that I do not have a captive portal installed. Firefox displays a banner at the top of the page saying that "you must log in to this network ...
2
votes
1answer
792 views
Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi?
As far as I understand, the captive portal is implemented by some sort of iptable firewall rules. Since there is no handshake established during the initial association with the AP(As no passphrase is ...
1
vote
3answers
319 views
Need a leniant browser for captive portals (WiFi and LAN)
I'm currently working from a customer LAN which is "protected" through authentication through captive-portal-like technology.
In theory, first thing you do in the morning is click on some URL, get ...
1
vote
1answer
486 views
Captive portal (Wifi) remembers me even if I change my MAC address
On occasion I change my MAC address from time to time at a public Wifi service. However lately something has changed. The captive portal (Wifi) remembers me even if I change my MAC address on my ...
3
votes
1answer
1k views
WPA2-EAP and Captive Portal
Is it possible to use Captive Portal for WiFi and WPA2-EAP at the same time?
Is there any EAP supporting Captive Portal?
For example - user connects to WiFi, goes to Captive Portal over unsecure ...
2
votes
2answers
957 views
Change device MAC address to router's MAC address
This is in respect to bypassing Captive Portals. I haven't tried it yet on a captive portal yet. But I was wondering, what will happen if :
I connect to a wireless network
Get the router's MAC ...
3
votes
3answers
2k views
Enterprise HTTPS redirection without certificate error
I have a captive portal setup for my organization that forces users to authentication prior to being allowed access to the network. Challenge is that when a user opens their browser and their homepage ...
4
votes
2answers
634 views
Httpclient redirect in coffee shops
In some coffee shops that offer free WiFi (for instance Starbucks), I have noticed that attempting to use HTTP or HTTPS fails unless you accept a notification (on Windows at least) which looks ...
20
votes
4answers
4k views
Is HTTPS secure over public Wi-Fi with an expired certificate?
I am staying at a hotel with free public Wi-Fi. To get Internet access I had to visit a web page and agree to the terms and conditions. This website has a security certificate, but it expired over a ...
4
votes
1answer
1k views
How does Karma's open WiFi network successfully protect its users?
Foreword
This question has a lot of build-up, so please scroll down to the bottom if you just want to see the question. Please at least skim the background info, though.
Background
I ordered a ...
5
votes
2answers
427 views
How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?
I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
2
votes
1answer
830 views
Using dnscrypt on a public hotspot with a captive portal
What strategy shall I take if I wanted to use a dnscrypt with a public hotspot that requires login through a captive portal?
Such hotspots require DNS settings to point to their servers (via DHCP) so ...
4
votes
2answers
966 views
Public AP: How to reduce vulnerability window between Captive Portal and starting VPN?
I always use a VPN on my Mac when I access over public APs (such as coffee shop free WiFi)
How much should I worry about the window of time where I am in the captive portal (the agreement screen) and ...
5
votes
2answers
179 views
If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?
There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time (i.e....
5
votes
2answers
3k views
HTTPS in captive portals and the Apple Captive Network Assistant
Suppose I connect to the Wi-Fi of a company I trust enough to give them my credit card number (say, my local airport). When I connect to their Wi-Fi network, my web browser gets redirected from any ...
11
votes
1answer
3k views
Distinguish between Wi-Fi Captive portal and MitM attack
Not sure whether this should be asked in Super User or here.
How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS?
Are ...
-1
votes
2answers
789 views
Is there any reason that captive portal server can't block the ICMP echo request/reply packet
We can get connected to those public WiFi hotspot without the account but can access to no website but the login page. As I tested, all those login website would respond to my ping even I was an ...
2
votes
1answer
2k views
How are Captive Wifi Portals secured?
I'm looking for a captive portal solution that prevents other users from stealing the session key from other active users. (or prevents the cloning the authenticated user's MAC)
Is there a reliable ...
3
votes
1answer
701 views
Can a captive portal be secured [closed]
I am interested in using a captive portal on a public network. After reading the wikipedia article and several questions here on sec.SE, I don't understand how I can secure it, or even, if I can ...
5
votes
2answers
5k views
How is user authentication sent in a public wifi? Radius/802.1x/EAP etc
I visit the airport, I pull out my laptop and connect to a network (no password needed).
I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
3
votes
1answer
607 views
captive portal wikipedia article
Something on the wikipedia page regarding captive portals have confused me:
http://en.wikipedia.org/wiki/Captive_portal
When a client requests a website, DNS is queried by the browser. The
...
1
vote
1answer
1k views
Designing and managing a captive portal
I'd like to learn more about how a captive portal works, especially the management system regarding usage, security monitoring, billing, security architecture etc.
Does anybody know any good ...
8
votes
1answer
17k views
Bypassing a captive portal with tor
I know that NSXTS and Iodine can be used to bypass a captive portal by taking advantage of permissive DNS firewall rules.
What I have found recently is that simply by using Tor, I can also bypass a ...
