Unlocking free WiFi on British Airways
I was recently flying between HKG & LHR via British Airways. I’d done the same flight back in 2023, and remember relying on the in-flight entertainment for the 14 hour journey. However, this time on my way to London, they had an interesting offer: Free WiFi for “Messaging”, for members of “The British Airways Club”.
I was pretty sure I wasn’t a member of any sort of club (I’m only flying economy anyway); but turns out this is just the name of their frequent flyer program. Conveniently enough, you’re able to sign up for this via the captive portal while in the sky; and although it asks for your E-Mail you don’t need to verify it (thereby allowing you to complete the signup without access to the internet).
Once signed in, the captive portal invited me to “Start session”, which true to it’s word, let me start texting people. I tried Whatsapp, Signal, Wechat and Discord. The first three worked (though not for images), Discord expectedly did not. Not bad for free wifi!
How does it know?
This was the first question I had as soon as I confirmed messaging did work. It’s 2025; everything should be encrypted in transit. So how does it know if I’m using Whatsapp vs. Discord? One idea I had is it just somehow capped the bandwidth / data transfer of individual TCP connections; so when you’re sending a single message or two it gets through, but something larger would fail.
To test this, I used my phone to open up the classic: example.com. Unfortunately this didn’t load - so there must’ve been a bit more going on…
Thankfully I had my laptop on me, so the next step was to connect to WiFi with the devtools open to the network tab, and wireshark on the side for good measure. After registering for the WiFi again, it was time to play around a bit. Opening up something like example.com revealed a TCP reset in the wireshark, right after the Client Hello, and my brain immediately jumped to SNI. It’s something that’s really annoyed me about the TLS spec since it’s widely used by ISPs in India to block websites (although there is work being done to fix this; ECH (which was itself previously ESNI)).
tl;dr SNI reveals the domain name of EVERY website you connect to in the TLS handshake, before the tunnel is established! Although the actual contents of what you’re doing, on say, totallynondodgywebsite.com are encrypted, anyone on the wire can see that you connected to it (including ISPs). My guess was that they had a set of whitelisted domains used by messaging apps, and if they see anything else, they just reset the connection.
Sidebar: people’s reactions when I try to tell this are always extremely varied. Many of my non-technical friends think anything you do without a VPN is visible to everyone, while some slightly technical ones still think that the URL (including query params) is visible, but the responses are not. Finally there is some subset of people who believe TLS means all data is encrypted in transit between client & server, though they had no idea SNI leaks all the domains they visit!
... continue reading