About usage of eduroam

cdflasdkesalkjfkdfkjsdajfd

Hello,
What do you thing to connect to eduroam, the educational WiFi network from research and educational entities?
Thanks

https://eduroam.org/where/

missing-root

cdflasdkesalkjfkdfkjsdajfd

Yes use it ONLY with an always-on VPN.

Eduroam requires you to install a custom root certificate, so they can sniff on all your traffic. Pretty creepy tbh.

They all use the same, the Uni Oldenburg offers it here for download (the domain "uol.de" is valid, but only download if you trust it)

Then in the network settings you need to add that certificate and the correct username with the domain of your uni.

privacysimp

cdflasdkesalkjfkdfkjsdajfd

Since credentials are required for access, network administrators could monitor activity per user easier.
Additionally, the implementation of a custom network certificate by institutions introduces potential security risks. In my opinion, Eduroam is worse for privacy and security than general to public Wi-Fi networks.

dc32f0cfe84def651e0e

cdflasdkesalkjfkdfkjsdajfd Hi, there was a discussion on Reddit about the same matter.

Unfortunately there is two very different thing with similar names.

Accepting WiFi certificate is a good thing and the school will not be able to spy on you (more than anyone would be able whose WiFi you connect to).

I have only found user-flow from an iPhone, it is ok to do this:

https://www.youtube.com/watch?v=oX9I6o8UThY

Accepting a root certificate or a CA certificate is a really bad thing, and it will make it possible to read all the encrypted communication you make from that device.

Never do this:

https://www.youtube.com/watch?v=7foynJOm_bc

Sources:

Hope it helps.

Newb

Like any public, or semi-public wifi, only via trusted vpn only.

Titan_M2

missing-root Eduroam requires you to install a custom root certificate, so they can sniff on all your traffic. Pretty creepy tbh.

AFAIK that certificate is used to authenticate the EAP-TLS server which is used to verify your Wi-Fi credentials (username and password). It's NOT installed as a trusted root able to MiTM your connection.

https://source.android.com/docs/core/connect/wifi-tofu

de0u

missing-root Eduroam requires you to install a custom root certificate, so they can sniff on all your traffic. Pretty creepy tbh.

That would be creepy if it were true, but I don't believe it is. If you have a source supporting that claim, sharing it would be great.

The architecture is documented in RFC 7593 (which I have not yet read).

missing-root

Does a wireguard VPN help against a MITM attack using a custom rootcert? @GrapheneOS

It is strictly required to use the network

missing-root

privacysimp if it is true that this is only for intranet-like authentification, that is kinda fine.

It is not at all anonymous but well that is how it is.

Public wifis may be insecure. Their routers are often Cisco etc, so we can expect some kind or security.

IcyScroll

I wanted to get access to a similar network which requires authentication via PEAP. Of course, the official documentation wants to push another proprietary app down your throat, so I wanted to do this the right way - manually.

Here's a short story. Feel free to skip the next paragraph if you don't care.

I had IT guys help me manually connect to a network that uses PEAP or some other gimmick. I told them that after having filled the identity and password I was unable to connect, without having selected some option for the certificate. At first they wanted me to pick something like "ignore certificate". Which I honestly don't think would make any sense as then the WiFi wouldn't be encrypted at all. At this point why wouldn't it be just open? Are the IT folks misinformed/ignorant? Correct me if I'm wrong, please. Upon realizing there was no such option they asked if they could take my phone and promptly selected "Certificate: Trust On First Use" (TOFU). They didn't care about verifying SHA256 of the certificate. Like at all. I even asked them if it's possible to verify it with the official website or some other trusted place but got completely ignored. When the OS asked if I trust the "WiFi which uses the following info", they just chose "yes, connect" without giving it a second thought. If you ask me, the whole process felt like downloading a random Android app, from a semi-random website, over HTTP, with the "maybe it will be alright this time" attitude. Given that, I do not feel comfortable using this WiFi.

Now, I have the following questions:

Is the certificate that has been trusted upon connecting to the WiFi network used strictly only for connecting to it?
Does it open up additional attack surface of any kind, for example in a manner that would be similar to having an imported CA in GOS' settings?
Should I even worry about it?

TL;DR My device has trusted a random WiFi certificate on first use and I'm not sure if there are any consequences to it.

de0u

IcyScroll A while ago I asked an expert. The core of the answer I got was that as long as the "inner" authentication is MSCHAPv2 (instead of, e.g., PAP), your password never leaves your device, because the various RADIUS servers (the one on the network you are joining, the one at your home institution, and maybe one in between) proxy a challenge/response protocol between your device and your home network's authentication service.

IcyScroll At first they wanted me to pick something like "ignore certificate". Which I honestly don't think would make any sense as then the WiFi wouldn't be encrypted at all.

A general pattern in public-key encryption with asymmetric ciphers is that one party generates a random session key and sends it to another party via an asymmetric cipher, at which point the two parties share an encryption key which other parties do not. That is not at all the same as "not encrypted at all": even if everybody connecting to a Wi-Fi network relies on the same public key to send their random session keys, the random session keys are different and only the network being connected to knows them.

There are complexities, such as how to avoid MiTM attacks, but there are standard ways to address those. Fetching a network's certificate from a web page signed by TLS may not be perfect but it is not clearly unreasonable.

fph

IcyScroll If you use the Geteduroam app to configure your network, the correct certificates are selected, and you don't have to trust anything on first use or click "ignore". As others have already written, this certificate is used only to authenticate the Radius server, and it is not installed as a root SSL certificate that can be used to MITM https connections.
Geteduroam is open source (BSD licensed).
There seems to be lots of FUD, but actually the whole installation process is secure, when done properly, and the network itself is as safe as using any other ISP: the ISP can know which user is connected, see which IPs you connect to, and read all unencrypted traffic. If that's an issue you can use a VPN (and then the VPN provider can know which user is connected, see which IPs you connect to, and read all unencrypted traffic).

IcyScroll

de0u Thanks, that provided some insight.

I do not necessarily worry about my password being visible to the intended server on the network, in this scenario. Nonetheless, it's nice to know that a challenge/response protocol should be in use.

What worries me is trusting a certificate that hasn't been validated in any way. I can only hope that the router, at the time, has served me a legitimate cert for use in certificate pinning, which seems ludicrous.
I refuse to believe that should be the way things are handled.

missing-root

Yes that wifi cert is something else and not a root cert

de0u

IcyScroll What worries me is trusting a certificate that hasn't been validated in any way. I can only hope that the router, at the time, has served me a legitimate cert for use in certificate pinning, which seems ludicrous.
I refuse to believe that should be the way things are handled.

As I mentioned, some host networks provide their campus wireless certificate via https, which does constitute a signature. A search for "eduroam wireless certificate" will turn some up, and a search targeted at a site you plan to visit may well turn up that site's certificate.

The system may not be perfect, but there is lots of room between "perfect" and "ludicrous".

IcyScroll

de0u Well, yes, of course. I believe we are on the same page here. I might have overreacted a bit but not without a reason. It's just something more in my specific scenario that caused such emotions. I don't want to go into greater detail on a public forum, however. Thank you :)