Comcast does it via intercepting all DNS and replacing it with redirects to a captive portal requesting comcast credentials. Ive seen you can get a handful of packets out to a dedicated IP as soon as you connect and before they poison you. I managed to send about 4 pings out and get replies before blackhole
Once you enter the captive portal your MAC is stored in routers ram as approved and ready to roll. You could spoof the MAC of an approved device but you would need to find such an approved device, Id imagine if you spoofed the MAC of a device on the secured network you might be able to have some fun.
The easiest solution is to use a comcast account on them. As long as the account is current on billing there is no limit to the number of APs you can connect to