Hacker News Reader

Comment by baggachipz | Hacker News Reader

One small annoyance/drawback with everything moving to https: I travel a fair bit, and hotel wifi usually relies on users connecting to their AP and then using a DNS-based redirect to send the user to the login page. That only happens when on http, as https sites which are redirected get the MITM warning from the browser. I used to be able to just type in "google.com" in the address bar and be redirected accordingly; nowadays I struggle to remember a site I use which isn't https. Looking up the gateway address is kind of a pain too.

View on HN

http://neverssl.com/

Alternatively, try "This well known URL": http://clients3.google.com/generate_204

https://www.chromium.org/chromium-os/chromiumos-design-docs/...

I use the neverssl.com trick and I worry: if browsers stop supporting plan HTTP, doesn't it mean this won't work anymore?

No, worst case you'll see a security warning. Or chrome will add an exception for such a site. This is a well known problem that I'm sure will be addressed. But with the current state of the web (~20% unencrypted) it's not really an issue yet.

If it were addressed in a way that would break captive portals forever, so much the better.

Or http://http.rip extra appropriate today.

If this means the ultimate death of captive networks, that would be worth it on its own.

There must be ways around it since some captive networks work with https.

Exampls?

I wish I could give direct examples but it's happened a few times when traveling. I believe they were all boingo hotspots but not 100% sure.

go to http://example.com - it will never redirect you to HTTPS and it is an IANA reserved domain which will never disappear.

example.com has SSL: https://example.com/ -- so may one day default to using that. I'd really recommend http://neverssl.com/ for this purpose. The homepage explains it's literally designed for situations like captive portals.

http://example.com does not redirect:

  $ curl -IL http://example.com
  HTTP/1.1 200 OK
  Accept-Ranges: bytes
  Cache-Control: max-age=604800
  Content-Type: text/html
  Date: Thu, 08 Feb 2018 22:19:07 GMT

Is neverssl.com IANA reserved?

neverssl.com is not IANA reserved, but a) typing in "example.com" into a browser may default to https in the future, instead of http, and b) no IANA or RFC guarantees that example.com won't redirect in the future anyway.

For a while (Back in ~2011) example.com did redirect to:

http://www.iana.org/domains/example/

LOADS of people got upset (quite rightly) and at some point they reverted it back.

But... it does show that you can't trust any URL to never change in the future, not even neverssl.com or http.rip.

No-one has pledged that it will never redirect to HTTPS, and neither is it forbidden in any standard. Technically, they could easily change it.

In fact, I'm not happy that there is anything responding to example.com at all.

I always use captive.apple.com, which appears to be designed for this purpose.

Maybe one day they'll all implement https://tools.ietf.org/html/rfc7710

Windows 10 detects this by trying to go to msftconnecttest.com in a browser if it detects using some heuristics that the wifi requires signin which should redirect you to the wifi signin page. Android also detects this as well by going to some Google-owned page that redirects you to the wifi signin if it detects that it is needed. What are you using that this is still a problem?

iOS and macOS both have captive-portal detection (in fact I think they pioneered it) but it's not 100% fool-proof and sometimes doesn't show up when it should.

Also supposedly some captive portals trap the well-known URLs used by captive portal detection for whatever reason (which is why Apple uses a huge list of seemingly-random domains)

I use example.com, for now it's HTTP.

But the browser could default that to https since that's allowed. If you use a real domain that has no https equivalent you should be safer (neverssl.com is one of those).

Reply on news.ycombinator.com