Questions tagged [captive-portal]

A captive portal is a web page served to users of a network, often asking for credentials, before they can use the internet.

Filter by
Sorted by
Tagged with
0 votes
2 answers
353 views

Is WIFI that is 'open' but requires a password to access the internet safe?

It is common knowledge that connecting to open public WIFI networks can pose a security risk (e.g. to man-in-the-middle attacks). However, I have come across 'open' WIFI networks that require no ...
1 vote
1 answer
2k views

How to protect against MAC spoofing in WiFi network?

I have this scenario: I want to create a WiFi network for a hotel that the customers should pay to gain access to the internet. I tried Captive portal, but captive portal is very vulnerable against ...
2 votes
2 answers
2k views

Using dnscrypt on a public hotspot with a captive portal

What strategy shall I take if I wanted to use a dnscrypt with a public hotspot that requires login through a captive portal? Such hotspots require DNS settings to point to their servers (via DHCP) so ...
8 votes
2 answers
6k views

How should captive portals redirect?

I recently read this question, which makes me wonder a follow up question: how is this captive portal likely trying to redirect the user? A highly voted comment does say that it's doing it wrong, ...
0 votes
1 answer
266 views

Unregister your device from a WiFi network [closed]

Recently, I connected my Android device to an open wi-fi network. Then a web page opened up asking me to choose username and password to log in with. Now when I connect the same device to that network,...
6 votes
2 answers
14k views

Why is firefox attempting to direct me to a Captive Portal, when I'm connected to my own router?

I am connected to my own router, and I know for a fact that I do not have a captive portal installed. Firefox displays a banner at the top of the page saying that "you must log in to this network ...
1 vote
1 answer
508 views

What is the best form of authorization for captive portal WiFi

I've been looking into captive portal WiFi implementations and on a few I'be been able to easily bypass their login with the following steps: 1) Open Wireshark and run a report getting the most used ...
1 vote
2 answers
2k views

Why do evil twin attacks against WiFi use a captive portal?

I was recently the victim of an evil twin attack on my WiFi network, probably by the new upstairs neighbors. It prompted me, with a captive portal, saying there had been an update and I needed to ...
78 votes
8 answers
28k views

How is no password more secure than username+password?

Context: I have a laptop supplied by my organisation. I am trying to connect to eduroam, but I cannot do it using my organisation's laptop. When I use a personal computer, it asks me for a username ...
1 vote
1 answer
1k views

Building a malicious captive portal

So I'm trying to build a malicious captive portal but I'm stuck on the part where you need to know stuff. Anytime a HTTP request comes in, everything works fine. However, when an HTTPS connection ...
4 votes
1 answer
4k views

Can Captive Portal links open browser/apps?

I'm aware the risks of connecting to a public AP poses as well as how MITMish is the hotspot approach. I wonder if there is anything in the OS layer (iOS, Android) that prohibit the execution of ...
0 votes
1 answer
302 views

Captive Portal Security Measures

I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use iptables to restrict access to all devices unless they ...
3 votes
1 answer
2k views

Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi?

As far as I understand, the captive portal is implemented by some sort of iptable firewall rules. Since there is no handshake established during the initial association with the AP(As no passphrase is ...
1 vote
1 answer
968 views

Captive portal (Wifi) remembers me even if I change my MAC address

On occasion I change my MAC address from time to time at a public Wifi service. However lately something has changed. The captive portal (Wifi) remembers me even if I change my MAC address on my ...
5 votes
2 answers
2k views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time (i.e....
2 votes
3 answers
652 views

Need a leniant browser for captive portals (WiFi and LAN)

I'm currently working from a customer LAN which is "protected" through authentication through captive-portal-like technology. In theory, first thing you do in the morning is click on some URL, get ...
4 votes
2 answers
1k views

Public AP: How to reduce vulnerability window between Captive Portal and starting VPN?

I always use a VPN on my Mac when I access over public APs (such as coffee shop free WiFi) How much should I worry about the window of time where I am in the captive portal (the agreement screen) and ...
19 votes
4 answers
6k views

Is HTTPS secure over public Wi-Fi with an expired certificate?

I am staying at a hotel with free public Wi-Fi. To get Internet access I had to visit a web page and agree to the terms and conditions. This website has a security certificate, but it expired over a ...
4 votes
2 answers
713 views

Httpclient redirect in coffee shops

In some coffee shops that offer free WiFi (for instance Starbucks), I have noticed that attempting to use HTTP or HTTPS fails unless you accept a notification (on Windows at least) which looks ...
3 votes
1 answer
4k views

WPA2-EAP and Captive Portal

Is it possible to use Captive Portal for WiFi and WPA2-EAP at the same time? Is there any EAP supporting Captive Portal? For example - user connects to WiFi, goes to Captive Portal over unsecure ...
2 votes
2 answers
2k views

Change device MAC address to router's MAC address

This is in respect to bypassing Captive Portals. I haven't tried it yet on a captive portal yet. But I was wondering, what will happen if : I connect to a wireless network Get the router's MAC ...
3 votes
3 answers
2k views

Enterprise HTTPS redirection without certificate error

I have a captive portal setup for my organization that forces users to authentication prior to being allowed access to the network. Challenge is that when a user opens their browser and their homepage ...
5 votes
2 answers
594 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
4 votes
1 answer
2k views

How does Karma's open WiFi network successfully protect its users?

Foreword This question has a lot of build-up, so please scroll down to the bottom if you just want to see the question. Please at least skim the background info, though. Background I ordered a ...
8 votes
1 answer
19k views

Bypassing a captive portal with tor

I know that NSXTS and Iodine can be used to bypass a captive portal by taking advantage of permissive DNS firewall rules. What I have found recently is that simply by using Tor, I can also bypass a ...
5 votes
2 answers
3k views

HTTPS in captive portals and the Apple Captive Network Assistant

Suppose I connect to the Wi-Fi of a company I trust enough to give them my credit card number (say, my local airport). When I connect to their Wi-Fi network, my web browser gets redirected from any ...
3 votes
1 answer
3k views

How are Captive Wifi Portals secured?

I'm looking for a captive portal solution that prevents other users from stealing the session key from other active users. (or prevents the cloning the authenticated user's MAC) Is there a reliable ...
11 votes
1 answer
4k views

Distinguish between Wi-Fi Captive portal and MitM attack

Not sure whether this should be asked in Super User or here. How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS? Are ...
-1 votes
2 answers
1k views

Is there any reason that captive portal server can't block the ICMP echo request/reply packet

We can get connected to those public WiFi hotspot without the account but can access to no website but the login page. As I tested, all those login website would respond to my ping even I was an ...
4 votes
1 answer
952 views

Can a captive portal be secured [closed]

I am interested in using a captive portal on a public network. After reading the wikipedia article and several questions here on sec.SE, I don't understand how I can secure it, or even, if I can ...
5 votes
2 answers
6k views

How is user authentication sent in a public wifi? Radius/802.1x/EAP etc

I visit the airport, I pull out my laptop and connect to a network (no password needed). I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
1 vote
1 answer
1k views

Designing and managing a captive portal

I'd like to learn more about how a captive portal works, especially the management system regarding usage, security monitoring, billing, security architecture etc. Does anybody know any good ...
3 votes
1 answer
717 views

captive portal wikipedia article

Something on the wikipedia page regarding captive portals have confused me: http://en.wikipedia.org/wiki/Captive_portal When a client requests a website, DNS is queried by the browser. The ...