Security Basics mailing list archives
Re: Wireless hotspot login pages
From: Rafael Correia <rafaelnominato () gmail com>
Date: Fri, 28 May 2010 15:54:16 -0300
Hi Paul, I don't know that's possible or not, but if the mobile browser have a auto-discovery proxy tool, you can verify if the login page comes from the IP discovered and unlock it. Just a suggestion. :) -- Rafael Correia 2010/5/28 Paul Johnston <paul.johnston () pentest co uk>
Hi, I have a client who restricts their mobile workers' browsers so they can only access a single site - the client's citrix access gateway. They don't want users directly browsing the Internet out of the office - because of both malware and AUP concerns. They enforce this by setting the proxy to the corporate proxy (only accessible in the office), having a proxy exclusion for the CAG, and preventing users editing the settings. This all works fine for use on home broadband (wired/wireless) and 3G. However, it falls down for Wireless Hotspots. Many of these have a browser-based login page. The proxy configuration prevents access to the login page, stopping the hot spot being used at all. This must be a problem a lot of people have hit. How do you allow access to Hot spot login pages, but not web pages in general? Any suggestions much appreciated, Paul -- Pentest - When a tick in the box is not enough Paul Johnston - IT Security Consultant / Tiger SST Pentest Limited - ISO 9001 (cert 16055) / ISO 27001 (cert 558982) Office: +44 (0) 161 233 0100 Mobile: +44 (0) 7817 219 072 Email policy: http://www.pentest.co.uk/legal.shtml#emailpolicy Registered Number: 4217114 England & Wales Registered Office: 26a The Downs, Altrincham, Cheshire, WA14 2PU, UK ------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
Current thread:
- Wireless hotspot login pages Paul Johnston (May 28)
- Re: Wireless hotspot login pages Rafael Correia (May 28)
- Re: Wireless hotspot login pages Edd Burgess (May 31)
- RE: Wireless hotspot login pages Kavesh Moodley (May 31)
- Re: Wireless hotspot login pages Rafael Correia (May 28)