Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

18
  • 18
    I wonder if the fact that google.com is a very common start page and WiFi networks often rely on capturing requests to serve a login page (which doesn't work with HSTS), perhaps it's to reduce that specific user hassle. I had trouble finding something to load the other day to force a WiFi login page to come up. Commented Oct 7, 2020 at 9:48
  • 14
    @ChrisH You might find neverssl.com a useful option in that case. Commented Oct 7, 2020 at 10:47
  • 22
    @ChrisH looks like it, Android (and other Google's products) uses Google's domain when checking for the captive portal. Commented Oct 7, 2020 at 13:19
  • 3
    @Joshua that would completely stop the very purpose of HSTS. A captive portal check is a MITM, where a user is given a different page than the one requested. Of course, you could have browsers make an exception for captive portal checks, but it would be a dangerous precedent, and a very real potential attack vector. Commented Oct 8, 2020 at 9:07
  • 4
    @Joshua Even if there were an exception, it would be difficult to retroactively apply that to the hundreds of millions of Android devices out there that no longer receive updates. Commented Oct 8, 2020 at 12:12