Question 1

What is a captive portal, and why does hotel Wi-Fi work that way?

Accepted Answer

A network that lets you **associate and get an address, but intercepts your traffic** until you complete some action — accepting terms, entering a room number, watching an advert. The awkwardness everyone experiences comes from the fact that it works by **deliberately breaking** the thing your device expects.

**How it works:**

You associate with the access point and receive an IP address by DHCP as normal.

The gateway **allows only DNS and traffic to the portal**, blocking everything else.

When you request any website, the gateway **returns its own page instead**, or redirects you to it.

Once you authenticate, your **MAC address is added to an allow list** and traffic passes normally — usually with a session timeout, which is why you must sign in again the next day.

**Why devices behave oddly:**

**HTTPS cannot be intercepted.** Redirecting an encrypted request produces a certificate error, not a login page, because that interception is exactly what TLS exists to prevent. Devices therefore probe with a **plain HTTP request to a known URL** and watch for an unexpected response — that is what triggers the "sign in to network" prompt.

**DNS over HTTPS and encrypted DNS** interfere with the detection, which is why turning them on can leave you unable to reach the portal at all.

**Private or randomised MAC addresses** can break the allow list between sessions, so your device appears as a new client.

**Apps fail silently.** Anything that is not a browser gets no login page — only a timeout — which is why email and messaging appear broken before you have signed in.

**The security position.** A captive portal authenticates you **to the network**; it does not encrypt anything. Open networks with portals are **unencrypted over the air** unless they use one of the newer opportunistic encryption modes. Treat them as untrusted: rely on HTTPS, use a VPN for anything sensitive, and turn off automatic reconnection to familiar open names.

Question 2

How does a phone decide which Wi-Fi network to join?

Accepted Answer

Through a stored priority list and a continuous signal assessment, which together explain the two behaviours people find most annoying: clinging to a weak network, and joining the wrong one. How

Question 3

What is DNS over HTTPS, and should I use it?

Accepted Answer

DNS over HTTPS (DoH) encrypts your DNS queries so that whoever carries your traffic cannot read which sites you are looking up. It closes a genuine privacy gap and shifts trust rather than

Question 4

What is UPnP, and why do people say to turn it off?

Accepted Answer

A set of protocols that lets a device on your network ask the router to open a port to itself, automatically and without authentication — which is exactly why it is convenient and why it is

Question 5

What is NAT, and why does every home network use it?

Accepted Answer

Network Address Translation lets many devices share one public IP address, by rewriting addresses and ports as traffic passes through the router. Why it exists. IPv4 provides around 4.3 billion

Question 6

How do video calls actually connect?

Accepted Answer

By establishing a direct path between the two devices wherever possible, which is harder than it sounds because almost every device sits behind a router that blocks incoming connections by default.

Question 7

What is HSTS, and why does it stop you bypassing a certificate warning?

Accepted Answer

HTTP Strict Transport Security is a instruction from a website telling your browser to only ever connect to it over HTTPS — and to refuse to proceed if anything is wrong, without offering you a way

Related Questions