Just so you know, here's what's happening.
This is being done to deal with an "open" WiFi which is not actually open; because it wants you to agree to its ToS (Target, Panera, McDonalds etc.) or wants you to pay (airport or hotel) or authenticate as a customer (cablewifi). It does this by waiting until you browse any insecure website (on http or port 80), then gives you its authentication page instead of the website you asked for. It blocks all other traffic, which makes the Internet seem broken if your first activity is email, https:, apps, or anything other than browsing an insecure web site.
- OS X is detecting a WiFi network that you have already logged into in the past. Under normal circumstances, it would just auto-join this network in the background, as it does on your home network.
- As a routine test, OS X tests whether the network is actually working. It sends traffic to captive.apple.com and sees if it receives the expected response. If it does not, that means the network is not working.
- In that case, OS X assumes one of those "open, not open" WiFi's. So it opens a browser window to help you hit "agree", authenticate, whatever the WiFi is looking for. The window has a "cancel" button.
- Meanwhile, OS X knocks on captive.apple.com periodicially to see if the WiFi has granted you access. Once that works, it changes the "cancel" button to "done", so you can keep interacting with it if you really want to.
- I suspect if you don't interact with the browser window, OS X just closes it. This might be the case on a network whose connectivity is poor, where its first ping failed due to network issues.
IOS does the same thing, more or less.
Mind you, it will only do this on networks you've already used in the past. including very generically named ones like GUEST or NETGEAR. On a genuinely new network, you'd need to pick it out of the WiFi dropdown.
Having lived in the age where you would bang your head against the wall trying to undertand why the VPN would not connect... I can tell you, this way is better.