What captive portals are

A captive portal is a web page that is often displayed before you can access the Internet on public networks in airports, hotels, libraries, and other places.

Train station Wi-Fi. Click here for 60 minutes of free Wi-Fi

Tails cannot connect to the Tor network when the Internet connection is initially blocked by a captive portal.

Security implications of the Unsafe Browser

For better security, the Unsafe Browser is disabled by default because:

  • The Unsafe Browser is not anonymous.

    The Unsafe Browser does not use Tor. The websites that you visit can see your real IP address.

    This is why we recommend that you:

  • The Unsafe Browser can be used to deanonymize you.

    An attacker could exploit a security vulnerability in another application in Tails to start an invisible Unsafe Browser and reveal your IP address, even if you are not using the Unsafe Browser.

    For example, an attacker could exploit a security vulnerability in Thunderbird by sending you a phishing email that starts an invisible Unsafe Browser and reveals your IP address to the attacker.

    Such an attack is very unlikely but could be performed by a strong attacker, such as a government or a hacking firm.

    This is why we recommend that you:

    • Only enable the Unsafe Browser if you need to sign to a network using a captive portal.
    • Always upgrade to the latest version of Tails to fix known vulnerabilities as soon as possible.

    We have plans to fix the root cause of this problem but it requires important engineering work.

To learn how Tails implements the Unsafe Browser, see our design documentation about the Unsafe Browser.

Starting the Unsafe Browser

To start the Unsafe Browser:

  1. When the Welcome Screen appears, click on the Add Additional Setting button.

  2. Choose Unsafe Browser in the Additional Settings dialog.

  3. Select the Enable the Unsafe Browser option.

  4. Click Start Tails.

  5. In Tails, choose Applications ▸ Internet ▸ Unsafe Browser.

Signing in to a network using a captive portal

To sign in to a network using a captive portal:

  1. Try visiting an innocent-looking website that is common in your location, for example, a search engine or news site:

  2. If you are redirected to a captive portal, sign in to the network.

    If you are not redirected to a captive portal and the website loads, this means that you are already connected to the Internet. Close this browser the Unsafe Browser and try connecting to the Tor network again.

  3. After Tor is ready, close this browser. the Unsafe Browser.

    You can use Tor Browser or any other application as usual.

To always enable the Unsafe Browser, turn on the Welcome Screen feature of the Persistent Storage.

If you download files using the Unsafe Browser, it is impossible to access them outside of the Unsafe Browser itself.