168

They have configured the laptops to spin up a VPN connection and only speak to "home base" after they go on the network. That means that if there is a local "captive portal" that requires you to enter credentials, you will not be able to use it, because that would require evading the VPN. (It's a chicken and egg thing. No VPN, no ability to reach the ...


20

So you were redirected to a captive portal page that had an expired certificate. Theoretically this puts in risk only the data you transfer over this particular connection, ie. accepting the rules and eventually your personal or payment data if you had to provide any. In fact the captive portal did not have to use https connection at all and you wouldn't ...


15

When you first connect to some websites, they require that you give them an email address, or some other piece of data before you can use their service, this page is referred to as a captive portal. Your company laptop is setup so that when it detects an internet connection, it connects back to your corporate VPN, and then connects back out from there. In ...


12

There are already good answers as to the understanding of the policy, but I'm going to talk briefly about eduroam security and connection profiles to make sure that all bases are covered in terms of the answer. I've worked for two universities that offer eduroam and have spent a lot of time working with it. Eduroam is a global network of universities and ...


11

What you are referring to is called a captive portal. It allows WiFi providers to authorise users, get confirmation for service agreement from them, display ads, require payment for extended usage time, etc. Its existence doesn't have security implications in itself (unless it was poorly implemented and leaking user-provided information, but that is on a ...


9

An expired certificate just means that the certificate didn't got renewed as soon as it should have been. Certificate renewal is a preventive measure for the case that the private key gets stolen without anyone knowing. Replacing a certificate in regular intervals reduces the usefulness of a stolen key. But expiration dates for certificates can be chosen ...


9

What you are referring to is called a captive portal. In order for such a portal to get displayed in your web browser, the following things need to happen: The WiFi router waits until your computer makes a non-encrypted (http://) request to a public website. It intercepts that request It responds by impersonating the website you wanted to reach and send ...


8

About Chrome According to https://www.google.com/chrome/browser/privacy/whitepaper.html In the event that Chrome detects SSL connection timeouts, certificate errors, or other network issues that might be caused by a captive portal (a hotel's WiFi network, for instance), Chrome will make a cookieless request to http://www.gstatic.com/generate_204 ...


7

Technically a captive portal is always a man-in-the-middle attack. Therefore, all techniques against MitM will and should warn about them, giving the user power to decide whether to trust or not. Some browsers do have captive portal detection, in general temporarily allowing the redirection without showing any page with the original domain. Contemporary ...


5

Everything is authenticated based upon the mac address of your wireless card. When you connect initially you are assigned a DHCP address by the gateway device which is controlling your DNS. Before you are authenticated all DNS requests are redirected to the HTTP(S) server of the gateway device. This controller has created you an account based upon your mac ...


5

curiousguy is correct that Tor doesn't actually obfuscate the protocol other than HTTPS. Of note, however, is that Tor (using something like Tor Browser or Vidalia) does proxy DNS requests through Tor. Some captive portals work only by redirecting default DNS to a login portal. If this is the case, the combination of encrypted communication and third-party ...


4

It may use your WebGL ID (which never changes, unless you reinstall MacOS), or some other variable. Try disabling images, javascript (noscript, scriptsafe). Have a look at https://amiunique.org/faq . Disable flash and java as well via an appropriate add-on. The obvious answer is that it's using a cookie, but I assume you've cleared those. Try clearing ...


4

A captive portal is essentially doing a man in the middle attack. HTTPS and other protocols using SSL/TLS are explicitly to detect and prevent such man in the middle attacks. This leaves you with two choices: don't do a man in the middle attack or make the client trust the man in the middle. All fully transparent solutions require that you have some control ...


4

So it appears that this service is vulnerable to MAC spoofing. I'm not sure that I see a direct security concern threat here. You've demonstrated that you can bypass their licensing to access the service for free. That's not necessarily a security problem. But as @AndréBorie has pointed out, activity performed by the MAC spoofer will appear to come from you....


4

Not just OSX but most platforms now will request a known URL and see whether the content is replaced or tampered with to detect hotspots. Windows 7+ : NCSI performs a DNS lookup on www.msftncsi.com, then requests http://www.msftncsi.com/ncsi.txt. This file is a plain-text file and contains only the text Microsoft NCSI. NCSI sends a DNS lookup ...


4

The captive portal detection works by requesting http://detectportal.firefox.com/success.txt (or something similar) and seeing if the expected contents are returned. Possibly something on your router, or computer is altering the page, so Firefox is assuming that there is a captive portal in the way?


4

However, when an HTTPS connection comes in, it refuses to accept my certificate. That's expected. You are trying to man in the middle a TLS connection with a certificate which is either not issued by a CA trusted by the client or where the subject of the certificate does not match the hostname of the target URL. That's exactly the kind of attacks ...


3

The browser does not know anything about the authentication. It is done on the outside: outgoing connections are intercepted. This can be done in several ways; usually, the WiFi router intercepts outgoing TCP connections, and, if the contents of the connection look like an HTTP request, the router serves back the 'pay me' page; all other connections are ...


3

Generally, these Wi-Fi hotspots authenticate via a MAC address. That is to say, after you sign in via their captive portal, they remember your system's Wi-Fi MAC address. Traffic from that MAC address will be permitted on their Wi-Fi hotspot for X minutes/hours, depending on their policy. They also store it long enough that you can walk away, come back, get ...


3

They cannot create a twin WPA network without knowing the password of the legitimate one. So they usually disrupt the legitimate network, create an open network with the same SSID, and wait until some user connects to it by mistake. After connecting, the user is redirected to a fake "Maintenance Mode" portal, or something like that, asking for the network ...


2

Many captive portals are a self contained httpd/dhcpd/router/whatever else (some routers have bittorrent clients but that is beside the point). I don't think that this Wikipedia page disagrees with that. The attack being discussed in the last part of this excerpt is referring to DNS tunneling. If its a very large network, such as a WISP, then they are ...


2

There are a large number of open source hotspot software suites available. EasyHotSpot has an integrated billing system. I have not audited these applications and i have no idea how secure they are. From a security perspective, "captive portals" break ssl pretty badly. Convergence, which is the Anti-MITM addon for firefox will detect captive portals as ...


2

Most large networks will use a firewall or proxy to perform web content filtering. HTTPS pages can cause issues as the data on the page is encrypted. So I would assme that the pages that give you a red error are HTTPS pages. The reason for this is because the firewall acts as the client and decrypts the page to check it for viruses and against the network ...


2

I'll let someone else answer about how the iOS captive portal interface displays certificate status and whether the captive portal is served over HTTPS, but I do know a solution. When connecting to an open Wi-Fi, dismiss the captive portal sheet then click on the network entry's "i" icon on the right in the Wi-Fi network list. That will display properties ...


2

It's depends and might be messy. Under OS X, I follow Cupertino's method and add networking connection link state monitoring in a script which fetches and compares the contents http://www.thinkdifferent.us. Plus, I have a manual toggle script for slow links, incompletely-blocking captive portals and downloading Apple updates from this hemisphere, which are ...


2

If I understand your question, you have a proxy server that blocks internet access until the end user has authenticated. By "blocks" I mean: If your proxy receives a request for https://google.com, it will spoof the requested host (google.com) and return a 302 redirect header to a login page that is hosted on the proxy itself. This a very common scheme ...


2

Chrome detect captive portal: When a main frame HTTPS load is taking a while, we preemptively open a background request for http://www.gstatic.com/generate_204 https://docs.google.com/document/d/1k-gP2sswzYNvryu9NcgN7q5XrsMlUdlUdoW9WRaEmfM/edit This determination of being in a captive portal or being online is done by attempting to retrieve the ...


2

Use a throw-away domain you don't mind the captive portal knowing (I use redirect.me.away) and when you get the certificate error for it just accept the certificate. The browser will pin that domain with the (untrusted) certificate so you won't get errors about it next time. Finally, consider using mobile broadband instead of this nonsense, and make sure to ...


2

Yes, wireless networks protected only by a captive portal are unsecured. They work by denying access to websites other than the captive portal until the connected device, identified by MAC address, has clicked through the portal. Requests to non-HTTPS sites made through the network are sent in the clear, the same as an entirely open network.


Only top voted, non community-wiki answers of a minimum length are eligible