> ...and the "enterprise" solutions using MSCHAPv2 where passwords can be almost trivially recovered... Those enterprise solutions are almost certainly wrappin

> ...and the "enterprise" solutions using MSCHAPv2 where passwords can be almost trivially recovered... Those enterprise solutions are almost certainly wrapping the MSCHAPv2 exchange in TLS. e.g. PEAP-MSCHAPv2 or TTLS-MSCHAPv2. Additionally, I'm not sure, but I think that plain EAP-MSCHAPv2 can't generate the keys required for a wireless client to establish an encrypted session with an AP and -thus- would never be used by a WiFi client. > The terrible certificate support in e.g. Android is just icing on the top. Eh? In my experience both Android and OS X's UIs for WPA-EAP are substantially superior to the UI that Windows offers.