[relevant_thing]

This is good and clever work, and I applaud the author for looking at a boring feature and seeing in it a potential attack vector that probably wouldn't have occurred to most people. Kudos! That said, I think the security implications are pretty minimal.

(FWIW, iOS and MacOS do the exact same thing, opening captive.apple.com and showing whatever it redirects to if you're on a captive portal network.)

This behavior does incur a security risk, but using public wifi networks is basically impossible without doing this check either automatically or manually, and most users would be completely bewildered if the OS did nothing to prompt them when they needed to click through a page to make the internet work.

Moreover, if you can MITM the network and they're not tunneling their connection, you have lots of great ways to send them hostile code already! You can use classic SSL stripping to just send them whatever you want! (Granted, a lot of traffic goes straight to HTTPS these days, and browsers are getting wiser about this with HSTS and things like the new automatic HTTPS upgrade in Safari).

If you're paranoid enough not to want to run untrusted javascript (fair enough), you shouldn't be connecting to weird public wifi networks anyway.

[lmz]

Yup. I thought this (captive portal detection) was common knowledge? Android also does this.

[CaveTech]

I believe NCSI probes are also purposefully HTTP because captive portals MITM all traffic to force authentication. If it was HTTPS the probe would fail with a certificate error. The whole point is that the url can be hijacked. This is not really a vulnerability, they have just independently discovered this feature.

[AstralStorm]

The certificate error is of itself diagnostic of a portal rather than a proxy. The reason to use HTTP, is that some portal systems just drop TLS connections until authenticated. (Which is the correct behavior, rather than MITM.)

Opening the browser automatically is a big bug, that should be easy to fix.

[jon-wood]

It's not a bug, it is quite literally the feature, and something that also happens on Android and iOS, and I believe even on recent releases of Gnome.