  In a scenario where hotspot wireless networks are increasingly being used,
and given the amount of sensitive information exchanged on Internet
interactions, there is the need to implement security mechanisms that guarantee
data confidentiality and integrity in such networks, as well as the
authenticity of the hotspot providers.
  However, many hotspots today use Captive Portals, which rely on
authentication through Web pages (thus, an application-level authentication
approach) instead of a link-layer approach. The consequence of this is that
there is no security in the wireless link to the hotspot (it has to be provided
at upper protocol layers), and is cumbersome to manage wireless access profiles
(we need special applications or browsers' add-ons to do that).
  This work exposes the weaknesses of the Captive Portals' paradigm, which does
not follow a unique nor standard approach, and describes a solution that
intends to suppress them, based on the 802.1X architecture. This solution uses
a new EAP-compliant protocol that is able to integrate an HTTP-based
registration or authentication with a Captive Portal within the 802.1X
authentication framework.
