<story><title>I told the flight attendant &quot;the WiFi isn&apos;t working&quot;</title><url>https://twitter.com/erratarob/status/1739132876732674539?s=46&amp;t=FFxXRm_qmWG4nJwsccRUbA</url></story><parent_chain><item><author>sandworm101</author><text>I have a work laptop (government) that hates captive portals.  It has a security system that won&amp;#x27;t let it connect using the local DNS.  So it doesn&amp;#x27;t get captured.  Those of us with such laptops all have tricks for getting to a hotel&amp;#x27;s wifi login page using IP addresses.  But we have to do it fast, before the security software fully wakes up and blocks the hack.&lt;p&gt;We used to just login on our phones, then tether the work laptop to the phone over USB. The security people caught up to that a couple years ago and disabled USB tethering.  So now I alter my laptop&amp;#x27;s MAC to be the same as that from the work laptop. That tricks about 90% of hotel wifi into allowing the work laptop to connect without need of a splash page.  But for the other 10%...&lt;p&gt;(Not a joke, I do this) I sometimes login to the hotel wifi on my personal phone, tether that phone to my personal laptop, then setup that laptop as a router.  The work computer can then connect to the wifi from the personal laptop, which tethers into the phone, which is on the hotel wifi.  All of this just avoid another ridiculous wifi login page.</text></item><item><author>placatedmayhem</author><text>Every time I have to interact with a &amp;quot;captive portal&amp;quot;, I&amp;#x27;m annoyed at the hack implemented through DNS hijacking, rather than implementing and extending 802.1X and&amp;#x2F;or another layer-2 authentication scheme. The idea seems to have been tossed aside entirely. Instead, every device has to have a web browser. There&amp;#x27;s not even a way to do surrogate registration for devices that don&amp;#x27;t have browsers, with Apple TV and Nintendo Switch at launch (added later) being prime examples. IoT and headless gear is also a pain. On trips, I end up bringing my own travel router and using my laptop to auth it by proxy, but it&amp;#x27;s another thing to remember to bring.</text></item><item><author>woodruffw</author><text>This is adjacent to the classic free WiFi hack on airplanes, which is to boot another client off of their DHCP lease by spoofing their MAC.&lt;p&gt;It’s unfortunate that, below HTTPS and a light smattering of WiFi encryption, there’s essentially no authenticity controls on LAN management protocols.</text></item></parent_chain><comment><author>hkchad</author><text>Why not just get a travel router and be done with all the “hacks”. They are so small these days they take up very little space. With mine I get connected to hotel WiFi then all my family devices just connect to it, just like they are at home. I even tunnel all hectic traffic back home though a Tailscale exit node.</text></comment>
<story><title>I told the flight attendant &quot;the WiFi isn&apos;t working&quot;</title><url>https://twitter.com/erratarob/status/1739132876732674539?s=46&amp;t=FFxXRm_qmWG4nJwsccRUbA</url></story><parent_chain><item><author>sandworm101</author><text>I have a work laptop (government) that hates captive portals.  It has a security system that won&amp;#x27;t let it connect using the local DNS.  So it doesn&amp;#x27;t get captured.  Those of us with such laptops all have tricks for getting to a hotel&amp;#x27;s wifi login page using IP addresses.  But we have to do it fast, before the security software fully wakes up and blocks the hack.&lt;p&gt;We used to just login on our phones, then tether the work laptop to the phone over USB. The security people caught up to that a couple years ago and disabled USB tethering.  So now I alter my laptop&amp;#x27;s MAC to be the same as that from the work laptop. That tricks about 90% of hotel wifi into allowing the work laptop to connect without need of a splash page.  But for the other 10%...&lt;p&gt;(Not a joke, I do this) I sometimes login to the hotel wifi on my personal phone, tether that phone to my personal laptop, then setup that laptop as a router.  The work computer can then connect to the wifi from the personal laptop, which tethers into the phone, which is on the hotel wifi.  All of this just avoid another ridiculous wifi login page.</text></item><item><author>placatedmayhem</author><text>Every time I have to interact with a &amp;quot;captive portal&amp;quot;, I&amp;#x27;m annoyed at the hack implemented through DNS hijacking, rather than implementing and extending 802.1X and&amp;#x2F;or another layer-2 authentication scheme. The idea seems to have been tossed aside entirely. Instead, every device has to have a web browser. There&amp;#x27;s not even a way to do surrogate registration for devices that don&amp;#x27;t have browsers, with Apple TV and Nintendo Switch at launch (added later) being prime examples. IoT and headless gear is also a pain. On trips, I end up bringing my own travel router and using my laptop to auth it by proxy, but it&amp;#x27;s another thing to remember to bring.</text></item><item><author>woodruffw</author><text>This is adjacent to the classic free WiFi hack on airplanes, which is to boot another client off of their DHCP lease by spoofing their MAC.&lt;p&gt;It’s unfortunate that, below HTTPS and a light smattering of WiFi encryption, there’s essentially no authenticity controls on LAN management protocols.</text></item></parent_chain><comment><author>throw0101b</author><text>&amp;gt; &lt;i&gt;I have a work laptop (government) that hates captive portals. It has a security system that won&amp;#x27;t let it connect using the local DNS.&lt;/i&gt;&lt;p&gt;Does the OS not pay attention to DHCP option 114:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    This document describes a DHCP option (and a Router Advertisement
    (RA) extension) to inform clients that they are behind some sort of
    captive-portal device and that they will need to authenticate to get
    Internet access.  It is not a full solution to address all of the
    issues that clients may have with captive portals; it is designed to
    be used in larger solutions.  The method of authenticating to and
    interacting with the captive portal is out of scope for this
    document.

&lt;/code&gt;&lt;/pre&gt;
* &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;datatracker.ietf.org&amp;#x2F;doc&amp;#x2F;html&amp;#x2F;rfc8910&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;datatracker.ietf.org&amp;#x2F;doc&amp;#x2F;html&amp;#x2F;rfc8910&lt;/a&gt;&lt;p&gt;* &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;news&amp;#x2F;?id=q78sq5rv&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;news&amp;#x2F;?id=q78sq5rv&lt;/a&gt;</text></comment>