CyberCertPrepMobile Security FundamentalsMobile ConnectivityEASYFree question
Scenario
An iPhone user at an international airport connects to a network named "Airport_Free_WiFi." A captive portal page appears asking them to log in with their Google or Facebook account to gain internet access. The URL bar shows an HTTP address.
A user connects their iPhone to free airport Wi-Fi. The captive portal page asks them to "log in with Google" to get access. The URL in the captive portal browser shows http://wifi-login.airport.com. What attack should the user be concerned about?
- A.A) This is likely a phishing captive portal designed to steal OAuth tokens or Google credentials; the HTTP (not HTTPS) URL means the page has no TLS protection and credentials entered are sent in plaintext over the network.
- B.B) This is normal; all captive portals use HTTP and Google login is a standard industry practice for Wi-Fi access with no security concern.
- C.C) The risk is purely about battery drain from keeping the captive portal open; credential risk is zero because Google OAuth always uses HTTPS.
- D.D) The iOS captive portal browser has full certificate pinning built in, making credential theft impossible regardless of URL scheme.