4 ms·

My dream is to eliminate PSK from all the networks I care about/am responsible for, but it's really challenging to deploy 802.1X in anything but a fully managed

by rdl 8y ago

My dream is to eliminate PSK from all the networks I care about/am responsible for, but it's really challenging to deploy 802.1X in anything but a fully managed enterprise (and also hard when you also have random other IOT/etc. type devices; usually the "important" ones you can just put onto wired network, and the unimportant ones go onto dedicated psk, but it's still a pain. Still hate it all less than captive portals (which I hate so so much), but it's pretty annoying.

mschuster91 8y ago
> and also hard when you also have random other IOT/etc. type devices Chromecast and Apple TV can't do 802.1x at all, same for every brand of Smart TV I've encountered. Android is a hit and miss, while Samsung and HTC support tends to be decent, cheaper phones don't have it in their test paths. IoT devices? Gotta be lucky if you can get normal WPA2 running stable against enterprise-class APs. That's a whole new house of cards. At work I actually had to put up a completely separate wifi network including access points and DSL uplink. Crap gear bought for testing isn't going to get access to the corp network for security reasons anyway and we had lots of issues with using an alternative virtual network on the enterprise APs as most of it seems to be tested against consumer FritzBoxes and 20€ APs, not against Cisco stuff worth hundreds of €.
xoa 8y ago
Agreed all around, it'd be really nice if there were better general standards for friendly ways to deploy and utilize 802.1x. IOT is definitely a big hold up there, support is quite spotty even amongst new major device manufacturers. I recently was asked to deploy a bunch of Nest smoke alarms at a business for example (they are genuinely nice, and the testing I've seen indicate their dual wavelength photoelectric sensors do a very good job), and they don't support it. But even outside of IOT I'm quite surprised sometimes by mainstream devices that make it more of an effort then it needs to be, such as Chromebooks. I was surprised mainly because one place user/pass auth for WiFi isn't at all uncommon is colleges, and I'd have assumed students there were a significant enough general market to be worth more attention. On a Mac 802.1x is all a single flow at the simplest level, select the network, enter the credentials, it'll ask about the cert if it's self-signed, and that's it. Compare to the Chromebook procedure [1], it's not like it's horribly involved but why the whole separate cert procedure? Granted, authentication in general remains a lot of spaghetti across the entire industry. I don't think there is a lot of relief overall on the horizon, though at least in some areas like with WebAuthn there is hopeful progress. Maybe progress in separate areas will ultimately make a foundation that can be further expanded. 1: https://support.google.com/chromebook/answer/1047420?hl=en https://support.google.com/chromebook/answer/1047420?hl=en

by rdl 8y ago

mschuster91 8y ago

> and also hard when you also have random other IOT/etc. type devices Chromecast and Apple TV can't do 802.1x at all, same for every brand of Smart TV I've encountered. Android is a hit and miss, while Samsung and HTC support tends to be decent, cheaper phones don't have it in their test paths. IoT devices? Gotta be lucky if you can get normal WPA2 running stable against enterprise-class APs. That's a whole new house of cards. At work I actually had to put up a completely separate wifi network including access points and DSL uplink. Crap gear bought for testing isn't going to get access to the corp network for security reasons anyway and we had lots of issues with using an alternative virtual network on the enterprise APs as most of it seems to be tested against consumer FritzBoxes and 20€ APs, not against Cisco stuff worth hundreds of €.

xoa 8y ago

Agreed all around, it'd be really nice if there were better general standards for friendly ways to deploy and utilize 802.1x. IOT is definitely a big hold up there, support is quite spotty even amongst new major device manufacturers. I recently was asked to deploy a bunch of Nest smoke alarms at a business for example (they are genuinely nice, and the testing I've seen indicate their dual wavelength photoelectric sensors do a very good job), and they don't support it. But even outside of IOT I'm quite surprised sometimes by mainstream devices that make it more of an effort then it needs to be, such as Chromebooks. I was surprised mainly because one place user/pass auth for WiFi isn't at all uncommon is colleges, and I'd have assumed students there were a significant enough general market to be worth more attention. On a Mac 802.1x is all a single flow at the simplest level, select the network, enter the credentials, it'll ask about the cert if it's self-signed, and that's it. Compare to the Chromebook procedure [1], it's not like it's horribly involved but why the whole separate cert procedure? Granted, authentication in general remains a lot of spaghetti across the entire industry. I don't think there is a lot of relief overall on the horizon, though at least in some areas like with WebAuthn there is hopeful progress. Maybe progress in separate areas will ultimately make a foundation that can be further expanded. 1: https://support.google.com/chromebook/answer/1047420?hl=en https://support.google.com/chromebook/answer/1047420?hl=en