PSA: RP5 Chinese Captive Portal Enabled

Hi everyone,

I just wanted to share my experience with people who may be privacy conscious and just spread some awareness on the topic:

I received my RetroidPocket 5 the other day and excitedly went to set it up, right off the bat I tried connecting to my homes Wi-Fi network and received a message "Sign-In Required", tapping on this brought up a captive portal page captive[dot]v2ex[dot]co, and the connection was blocked by my networking firewall. I have a strict firewall policy and this domain was indicated to be a Chinese captive portal server. Long story short I temporarily whitelisted this domain and it was as if it never existed, my Wi-Fi connected right away and all was good. I later discoverd after re-blocking the domain again my device would not connect to the internet at all with this domain blocked. It must be allowed in order to connect the RP5 to the internet.

Why this is concerning: I'm sure a lot of people don't even realize this is happening because it's not blocked on most people's networks, and you don't see it if it's allowed. In the US, we may be familiar with captive portals when connecting to public Wi-Fi access points, like Starbucks, or McDonalds for example, you connect to the Wi-Fi and have to agree to the terms and conditions before using the internet at that location. It was very off putting for me to see a blocked captive portal on my own home network. Again, for clarification, this is completely invisible and connects in the background when it's not blocked.

I did more research into captive portals in China and they're used primarily for government internet access regulation, and majority of Chinese devices are configured with captive portal servers established.

I don't know what, if any data is being transmitted, I just wanted to open the topic to discussion, should I be concerned? Should I return my RetroidPocket 5?

I emailed RetroidPocket support ([[email protected]](mailto:[email protected])) and was told to just connect on a Wi-Fi hotspot instead, which was very dismissive to my request for an explanation.

UPDATE:

I just wanted to give an update for people who have been following this. Based on the combined wealth of knowledge of people in this thread, I've concluded the following:

All devices, even US based devices connect to a captive portal to determine internet connectivity on that device. They do this by connecting to a "captive portal" in the background. In the US majority of our devices do this by connecting to one of Google's captive portal servers. In this particular case the captive portal Retroid is using is not Google's, as they're not a US based company. Failure to connect to this captive portal makes the device "think" it's offline, I received popups that I was not connected to the internet and my device gave an X over the wifi icon indicating I was offline. As far as my device was concerned, it was offline, since it failed the captive portal check. Internet browsing will still work in this case.

At this point I don't believe there is anything to be concerned about, and I will be personally whitelisting this domain and not returning my RetroidPocket 5. The whole point of this thread was because I saw something that was concerning, and wanted to open it for discussion, as a result I learned a lot and can now rest easy.