Hacker News Reader

Comment by shapath | Hacker News Reader

Can some ELI5 (explain like I'm 5) to me? I don't get this. Seems like something I should know about.

Some routers and networks try to intercept all requests and replace them with a 'captive portal' page for logging into that network. When you make a request to a webpage using https:// (i.e. SSL) the network has a much harder time injecting the login page, so you end up seeing nothing. The connection isn't going through and the network's login page can't break through SSL battle-warrior-armor.

But what is the purpose of this page?

The scenario is: You want to connect to a public wifi hotspot and use their internet connection. In order to do so you need to trigger the login page in your browser after you connect to the hotspot.

However if you open common urls like google.com or facebook.com you'll automatically get redirected to secure connections (https) and they can't intercept this to present the login page. This is because TLS (the protocol behind HTTPS connections) uses end-to-end encryption.

Thus the author proposes to open this simple unprotected website. However most hotspots manage to automatically trigger the vendor specific mechanism as soon as you connect to their Wifi.

Don't use public wifi unless you really need to!

> Don't use public wifi unless you really need to!

Well if you always turn on VPN I don't think it would be such a huge issue would it

It will never use HTTPS, so by visiting it, you allow the man-in-the-middle to do its thing, and show you a log-in page or whatever.

Reply on news.ycombinator.com