coffeeClean

cross-posted from: https://infosec.pub/post/11021006

The red padlock (at a cafe)

The captive portal of a cafe simply rendered a red padlock on with a line through it. Essentially, it was apparently telling me I am being denied access arbitrarily without using any words. There was no other screen before that. Immediately after wifi handshaking Android’s built-in captive portal detection app just went straight to a padlock. I have never been in that cafe in my life and never use my device maliciously.

Showed the screen to the staff who said “works for me on my phone”, who then noticed the airplane on my status bar and said “oh, you got the little airplane, that’s the problem”. Shit; so then I had to explain that wi-fi works in airplane mode. It was just a distraction for them. I couldn’t really convince them that the problem isn’t anything I’m doing wrong. There is no tech support for this situation -- like pretty much all captive portal scenarios. Being the customer of the customer is a very weak position to be in when the direct customer doesn’t really give a shit if it works or not.

So, has anyone seen this kind of behavior? I run into shitty broken captive portals often enough that I guess I really need to get a better understanding of them, and ways to bypass them.

TLS-encumbered captive portal (transit service)

A transit service offered wi-fi but the network forcibly redirected me to a captive portal that triggers this error:

net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH

I tried a couple browsers and tried rewriting the https:// scheme as http:// but SSL redirect was forced consistently. The error apparently implies my phone’s browser can’t do TLS 1.3.

It seems like a shitty move for a transit service to require passengers to use TLS 1.3 just to tick a fucking box that says “I agree” (to the terms no one reads anyway). Couple questions:

• I’m generally in the /protect everything by default/ school of thought. But I cannot get my head around why a captive portal where people just tap “I agree” would warrant disclosure protection that could hinder availability. In reality, I don’t really know what the captive portal at hand requests.. maybe it demands people’s phone# or email, in which case it might make sense (though I would object to them collecting that info in a GDPR region in the 1st place).

• Is there a good reason for a captive portal to require TLS 1.3? It seems either the network provider does not trust their own network, or they’re simply incompetent (assumes everyone runs the latest phones). But if I’m missing something I would like to understand it.

I still have to investigate what limitation my browser has and whether I can update this whilst being trapped on an unrooted Android 5.

Bypass methods

I guess I need to study:

• ICMP tunnel (slow, but IIUC it’s the least commonly blocked)
• SSH tunnel
• others?

Are there any decent FOSS tools that implement the client side of tunnels without needing root? I have openvpn but have not tested to see if that can circumvent captive portals. I’ve only found:

• MultiVNC - VNC over SSH
• AVNC - VNC over SSH
• ConnectBot - Can all traffic be routed over this SSH tunnel, or just a shell session?
• VX ConnectBot - same as connectBot but expanded

I’m curious if the VNC clients would work but at the same time I’m not keen to bring in the complexity of then having to find a VNC server. Running my own server at home is not an option.

My to-do list of things to tinker with so far:

• Captive Portal Controller
• ~~CaptivePortalLogin~~ (AOS 6+, and no Izzy archives on this)
• Hotspot Login

Legal options

If a supplier advertises Wi-Fi but then they render it dysfunctional by imposing arbitrary tech requirements after consumers have already bought the product/service it was included with (coffee, train/bus/plane fare, etc), then they neglect to support it, doesn’t that constitute false advertising? Guess this is out of scope for the community but I might be ½ tempted to file false advertising claims with consumer protection agencies in some cases.

And when a captive portal demands email or phone number, it would seem to be a GDPR violation. Some public libraries make wi-fi access conditional on sharing a mobile phone number which then entails an SMS verification loop.

“Only because of that official investigation did Canadians learn that ‘over 5 million nonconsenting Canadians’ were scanned into Cadillac Fairview's database”. Wow.

This Wired article is contradictory. The spokesperson says:

“an individual person cannot be identified using the technology in the machines. The technology acts as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface”

I suppose it’s possible that a sloppy developer would name an executable Invenda.Vending.FacialRecognitionApp.exe which merely senses the presence of a face. But it seems like a baldfaced lie when you consider that:

“Invenda sales brochures that promised ‘the machines are capable of sending estimated ages and genders’ of every person who used the machines—without ever requesting consent.”

Boycott Mars

I already boycott Mars because they are a GMA member and they spent ~$500k lobbying against #GMO labeling -- and they have been blackballed for using child slave labor -- and Mars supports Russia. This is another good reason to #boycottMars.

Update

Apparently a LemmyBug replaced the article URL with a picture URL. The article is here:

https://www.wired.com/story/facial-recognition-vending-machine-error-investigation/

The vending machine pic is here:

https://infosec.pub/pictrs/image/2041d717-7cd7-4393-94f3-96aa87817aa7.jpeg

After working on a bicycle or an engine, hands covered in grease, I can confirm that coffee does the job. Spent coffee grounds are gritty like sand so they work amazingly well to get the grease off. I use a bar of soap at the same time which causes coffee grounds to get embedded in the bar. It’s a good thing too because it always helps to have the soap bar a bit gritty.

That much is proven for me.. been using coffee for years to wash greasy hands instead of buying the special purpose heavy-duty hand cleaners.

Coffee is now being used to make clothing and one of the claims is that it gives odor control. I’ve cut back to showering once per WEEK (a pandemic side-effect that became a habit). Even though I’m back to leaving the house regularly the shower habit did not change. So my armpits get quite rank after a week. 💡 If coffee grounds have a deodorizing effect, why not use them on arm pits? I’ve not heard of anyone doing this but thought it’d be worth a test.

So I brought spent coffee grounds into the shower and after one scrubbing with them my armpit odor was gone. Coffee grounds work better than shower gel. Normally I scrub with shower gel, rinse, & sniff. The first iteration is usually not enough.. I have to repeat that process 2 or 3 times with shower gel to get the stink off. Coffee grounds worked on just one iteration. I think what happens is the deodorant is sticky & waxy which then gets coated with sweat then the sweat-loving bacteria. The abrasive grit from the coffee grounds scrapes the sticky waxy nasties away faster than soap can dissolve it.

Coffee seems to work on its own but I only did this experiment once so far so I followed with shower gel anyway for good measure.

(stop reading at this point)

nsfw begin

Of course arm pits aren’t the only area that stinks after a week. The groin doesn’t smell too good either. What develops to maturity is what’s called cock cheese¹. I’m not flexible enough to do a proper scientific test. The nose-crotch proximity is what it is. It stunk before the coffee treatment but not after. So it worked at least to the extent that I could confirm. I guess my next partner will have the noble scientific task of assisting with the close proximity sniff test mid-shower and indicate whether shower gel is still needed.

footnotes:

1. Sorry folks. Indeed it’s not the most elegant nomenclature. IMO there’s a language deficiency here. That’s the only name the stuff has AFAIK. Be sure to forget that term whenever you’re eating cheese. Or alternatively it may not be a bad idea to just cut cheese out of your diet at this point.¯\_(ツ)_/¯ You were warned.

nsfw end