Reconsider disabling captive portal detection (0360)

[Kladki]

This link is the reference/reason given for disabling captive portals. From reading the article, here are the main problems pointed out about captive portals:

1. Networks using captive portals often intercept HTTPS traffic with their own site, which on top of the direct security implications, also teach bad habits of bypassing the warnings you get.
2. Captive portals don't play nicely with devices that don't have web browsers.
3. Captive portals typically harvest data by asking users for their email address and/or phone number before they are able to connect to the internet.

Obviously, point 2 isn't relevant to Arkenfox, but about the other two:

1. I'm not sure about captive portals around the world, but in 2025, I don't think I ever came across a captive portal network that did this. But the thing is that even if this was still common, disabling captive portal detection doesn't fix this issue. If anything, it makes it worse, as the user cannot actually login to the captive portal to stop this happening.
2. When captive portals collect users data, users will know, as they have to actively give up that information, and they can then make the choice not to if that's something they are not comfortable doing. In contrast, completely disabling portal detection just removes the choice for the user to give their data, which isn't really helpful for anyone.

I'd also like to mention that obviously with me writing this, I don't think captive portals are a privacy threat that need to be disabled by privacy-protecting browsers/user.js scripts, which made me confused why some public networks wouldn't let me access the internet after switching to Librewolf at the time, as they do the same, linking to the same article for the reasoning. I know that people are expected to use overrides, but with the benefits not being clear to disable them, on top of the significant inconvenience caused by this decision, I'd like to at least start a discussion about whether this could be reconsidered.

[Thorin-Oakenpants]

I'm not sure about captive portals around the world, but...

I don't think anyone knows - let's not make assumptions

disabling captive portal detection doesn't fix this issue

What issue? The issue is not that the user knowingly gives away some PII. The issue is that a captive portal is a MitM

I don't think captive portals are a privacy threat

see MitM

---

Arkenfox is for "desktop" - anyone traveling who absolutely requires to use a captive portal can use their mobile phone IMO. Additionally, users should have a secondary browser.

[Kladki]

What issue? The issue is not that the user knowingly gives away some PII. The issue is that a captive portal is a MitM

The thing is that if you connect to a network using a captive portal, disabling captive portal detection doesn't prevent this MitM, it just removes a hint as to the reason (whether it be good or bad) why this MitM is happening. The network will still override your DNS to their captive portal whether you detect the network is using a portal or not, as you are still connected to the network regardless, and that's why I don't think disabling portal detection brings any benefits.

Arkenfox is for "desktop" - anyone traveling who absolutely requires to use a captive portal can use their mobile phone IMO.

i use Arkenfox on my laptop, which I often use on the train, where captive portals are frequently used.

[62f1346c-4576-42b3-afcb-23ef1820da34]

I think this one is from the old times when people wanted to silence FF completely to prevent Mozilla from even knowing that they started FF (or at least stop every unnecessary connection).

Funny thing is that the EFF link actually recommends captive portal detection in the 2nd-to-last section.

[Thorin-Oakenpants]

The network will still override your DNS to their captive portal whether you detect the network is using a portal or not, as you are still connected to the network regardless

explain

[Kladki]

Well I presume the way they make all connections point to their captive portal is by making the default DNS server of the network return the address of their portal for all hostnames. Either that or the redirects happen on the router level, preventing you from accessing the internet even if IP addresses are directly used.

[Kladki]

Funny thing is that the EFF link actually recommends captive portal detection in the 2nd-to-last section.

Oh, I never noticed that, good point too!