5 ms·

I used to do this all the time over port 53. My closest coffee shop would allow people to access Wi-Fi only if you gave them full access to your Facebook accou

I used to do this all the time over port 53. My closest coffee shop would allow people to access Wi-Fi only if you gave them full access to your Facebook account. DNS was the only port open to the outside world.

s_gourichon 6y ago
> My closest coffee shop would allow people to access Wi-Fi only if you gave them full access to your Facebook account. What the???
- mercora 6y ago
  I've seen this on Ubiquity hardware as an option too. Apparently it requires you to "check-in" via facebook to use it, whatever that means exactly. There is also an option to login via facebook without this though.
  - orbitingpluto 6y ago
    This was awhile back and was particularly nasty. No token, no check-ins, it was an unapologetic man-in-the-middle login prompt. Terms of service had wording that made mining all data in your Facebook account sound like the intent.
    - jandrese 6y ago
      How about no. Or hell no. If I see a request like that it is an immediate disconnect. Might as well have a requirement that they do a full anal cavity sweep before they can sell you a cup of coffee.
MaxBarraclough 6y ago
Interesting that they permit TCP port 53, rather than just UDP port 53.
- Piskvorrr 6y ago
  My guess is that it stems from lax firewall defaults. "Allow port 53 - [tcp/udp/BOTH]?" (Yeah, I know that DNS can also work over 53/tcp, but it's rare compared to the 53/udp volume)
  - acdha 6y ago
    It's not as rare as it used to be a couple decades ago. If you block tcp/53 you will find a surprising number of things breaking as record sizes have increased over the years.
- kubanczyk 6y ago
  RFC7766 "Recursive server (or forwarder) implementations MUST support TCP so that they do not prevent large responses from a TCP-capable server from reaching its TCP-capable clients." large responses == some DNSSEC, some IPv6
- mercora 6y ago
  i think that is fine actually. however, if i would implement such thing i would probably redirect DNS traffic to my DNS server as long as you are not authenticated :)

s_gourichon 6y ago

> My closest coffee shop would allow people to access Wi-Fi only if you gave them full access to your Facebook account. What the???

mercora 6y ago
I've seen this on Ubiquity hardware as an option too. Apparently it requires you to "check-in" via facebook to use it, whatever that means exactly. There is also an option to login via facebook without this though.
- orbitingpluto 6y ago
  This was awhile back and was particularly nasty. No token, no check-ins, it was an unapologetic man-in-the-middle login prompt. Terms of service had wording that made mining all data in your Facebook account sound like the intent.
  - jandrese 6y ago
    How about no. Or hell no. If I see a request like that it is an immediate disconnect. Might as well have a requirement that they do a full anal cavity sweep before they can sell you a cup of coffee.

MaxBarraclough 6y ago

Interesting that they permit TCP port 53, rather than just UDP port 53.

Piskvorrr 6y ago
My guess is that it stems from lax firewall defaults. "Allow port 53 - [tcp/udp/BOTH]?" (Yeah, I know that DNS can also work over 53/tcp, but it's rare compared to the 53/udp volume)
- acdha 6y ago
  It's not as rare as it used to be a couple decades ago. If you block tcp/53 you will find a surprising number of things breaking as record sizes have increased over the years.
kubanczyk 6y ago
RFC7766 "Recursive server (or forwarder) implementations MUST support TCP so that they do not prevent large responses from a TCP-capable server from reaching its TCP-capable clients." large responses == some DNSSEC, some IPv6
mercora 6y ago
i think that is fine actually. however, if i would implement such thing i would probably redirect DNS traffic to my DNS server as long as you are not authenticated :)