The issue

Wifi networks with captive portals ("Before we let you connect, you have to agree to our terms of use" pages; I'd prefer the term "wifi splash screens" but use "captive portals" for consistency) are a terrible thing, network-wise: They announce a default route that is by default out of service, and they mangle your DNS requests to point to their entry web server; as a result, they mess with your browser tabs, confuse update managers and may require you to turn off DNSSEC.

On the other hand, even if some jurisdictions become more wifi friendly (or not?), the legal requirement will stay around for some time -- operators of wifi access points will, under certain conditions, stay forced to make their users acknowledge some terms before they may route their traffic into the internet.

We should try to find a solution that satisfies both the technical requirements ("don't mess with my traffic") and the legal ones ("you have to establish a contract").

Requirements for solutions

Solution attempt: DHCP flags

The first offender in the course of a typical captive portal setup is the DHCP server; it announces a route to the internet it does not really provide at that time; whatever we do, it happens before that is sent.

Fortunately, DHCP is extensible. Assuming a DHCP option "Terms of use" (ToU), a DHCP dialog could look like that:

Choice of URIs and content

The response to the request to the server's ToU URL needs to indicate

More detailed functionality, like logging in with room number, access codes from a bill or classical username / password credentials could be transferred in that process as well, even though WPA Enterprise would often be the more sane approach. Still, this allows businesses that previously chose to operate a captive portal based wifi to do that in a more technically sane manner.

Independent of how the contract is indicated, the accepting URI can be any of the following:

As for the HTTP response, this could be (not mutually exclusive):

Open questions


Implementation schedule

Note that this is more a theoretical thing (see "incubator status" below).

By that time, the whole setup can be presented in a video demonstration, and virtual machines can be provided that ease development and integration on both sides. This should get power users and free wifi operators interested.

Incubator status

This is currently just an idea with some scribbling attached, neither a plan nor a concrete proposal -- that's why it resides in my idea incubator.

I'd be happy to participate in doing and promoting this if there is significant interest in the topic (as expressed by other people actively participating, or by people funding such an undertaking), but apart from that won't do much more on this than updating ideas and gathering links, information and feedback here.

ToDo / Links

Those sites or statements need to be reviewed for possibly enhancing this idea:

--chrysn 2015-03-08

This page is part of chrysn's public personal idea incubator; go up for its other entries, or read about the idea of having an idea incubator for more information on what this is.