said by train_wreck:said by NetFixer:Why would checking the validity of the Xfinity login site's SSL certificate be meaningless?
because it's something that most (97-99%) of users won't do or care about.
Those users are not interested in security in the first place.
said by train_wreck:i was thinking about this the other day; how easy would it be to set up a fake access point/captive portal named "xfinitywifi", download the source of a real xfinitywifi captive portal page, and modify it so it collects usernames/passwords. many devices will auto-connect to SSIDs by their name only, and the same account credentials used for xfinitywifi are also used to manage one's actual Comcast account.
But you wouldn't have a valid xfinitywifi SSL certificate for your fake hotspot login site, so you would not fool me (or anyone interested in on-line security). Of course, the victims you did attract would be the kind who would not know they had been fleeced in the first place (a definite advantage for the fleecer).
Before I retired, I used to do scans at many local hotspots looking for fake SSIDs in order to at least try to protect those customers who did not care/know enough about security to protect themselves. I don't know if Comcast has its own field techs do this (just as they check for signal egress), but they certainly should.
