Hacker News Reader

Comment by weberer | Hacker News Reader

I absolutely hate this nonsense. They cause countess headaches just to make people click an unenforceable "I Agree" button to terms nobody reads. What would be the best way to kill captive portals once and for all?

View on HN

Whilst I hate Captive Portals in most circumstances (most hotels I stay at have completely broken implementations) we find them to be extremely useful.

We run LAN gaming events and a Captive Portal helps us enforce our physical check in procedure. If someone has somehow bypassed checkin, they have no access to our network... puts a bit of a downer at a LAN event.

You would think modern wi-fi standards would be able to support per-user username and passwords by now.

You can do 802.1x user/pass auth. In general though it's far more expensive to run and maintain because your access layer (APs, switches etc) now needs to be fully managed to support 802.1x. That, and a lot of OSs have janky support that doesn't follow the standard well.

How do you enforce the physical check with captive portal? Do you give everyone a shared password to go into the portal?

A properly designed captive portal can make it harder for someone leaving a small computer in the vicinity of your network and reverse tunneling through it for nefarious purposes. Having to log in every day would disrupt the tunnel and prevent remote access.

(Un)fortunately many captive portal are poorly designed, allowing arbitrary traffic to be sent over UDP/53 or ICMP, even when not authenticated. This kind of defeats the purpose of a captive portal, as the tunnel can be operated over UDP/53 (or whatever) and the captive portal can be solved remotely.

An attacker dedicated enough to pull off such an attack will absolutely be dedicated enough to spend 15 minutes screen-scraping the portal.

While those TOS button captive portals are definitely annoying, there are cases where this can be useful - for example, to enroll users for 802.1x certificates.

imho either outlawing or automating them

Reply on news.ycombinator.com