Hacker News Reader

Comment by jimmaswell | Hacker News Reader

>The only use I know for captive portals is EULAs

What? You use them to log in with some criteria more than just a username/password. For example CableWifi hotspots that let you log in with TWC, Optimum, or others.

View on HN

Wifi has supported that kind of login for ages (15 years?) at the protocol level, without fucking with the traffic in a MITM fashion. OS support was there already for XP and iOS 2.0.

https://en.m.wikipedia.org/wiki/IEEE_802.1X

except there is no provisions for UI indications whatsoever, not even what login you should be using, or what you are logging into, or why.

Every hotel room in which I've stayed has a placard on the table with the BSSID name, userID and password for the portal login.

It would be identical with 802.1X. The only difference in the UI flow is that the authentication prompt is generated by the OS, not on some HTTP page that I only remember about when I wonder why my VPN isn't coming-up.

So why don't captive portals at e.g. cafés use 802.1X? Are they just stupid and don't know it exists, or is it really user unfriendly in that setting?

> log in with some criteria more than just a username/password

The problem there is that captive portals don't add any extra link-layer security. The network is open, so literally anyone can sniff packets.

It's uncommon, but a network using WPA2-Enterprise and user/pass uses different keys for each person (not sure if per device or per user), so you don't have to trust everyone in the room.

Most portals I use intercept your request to a HTTP site and redirect you to their logic form which is served over HTTPS.

Yes, but after authentication, all traffic can be sniffed - including unencrypted connections.

How is this different from the case without a captive portal, again?

Using WPA-Enterprise, each connection is encrypted separately, eliminating that hole.

Using WPA-Enterprise, as I understand it, requires devices to be preconfigured to authenticate with the radius server, which makes it a non-starter for the kinds of networks that use a captive portal.

No, there's no preconfiguration needed, it's just a username/password account. You choose the network, then the OS asks you for your user/pass, then you're connected.

It's the router that connects to the RADIUS server, not the device directly. And some routers have one embedded, so you don't even need to configure that, it "just works".

Now you don’t have to trust the other customers, only the bar you’re at, their ISP and a million other parties between you and the site you’re visiting.

That's a reasonable point, but I'm speaking from the perspective of the bar owner - I feel I have a duty to provide better security even if the patrons have no reason to trust me.

Like a bar is going to run account administration.. at most they’re going to set a proper password with WPA2-PSK which provides protection against outsiders. But it can’t provide protection against an active attacker that has the password.

They're probably also not putting up a captive portal, so what's your point?

You could have a wifi access product that used a voucher system. The code could be on the bar receipt.

Wouldn't it be nice if there was an encryption mode for Wifi that ensures integrity without requiring authentication? At CCC events, the workaround is to have a WPA2-Enterprise network that accepts every username/password combination, but that's going to be hard to explain to non-technical users.

I think WPA3 is going to support this use case.

Companies can easily adapt by changing your username to the form of an email (e.g. "jsmith@optimum.net"). Many of those already offer email addresses anyway.

How do you communicate "log in with an email address" to a user if you can't display a web page?

No, I mean the only username given by Optimum et all would be the email address.

Reply on news.ycombinator.com