suggests dangerous settings for Supplicants

New here suggests dangerous settings for Supplicants



you seriously suggest to disable certificate validation in the Android supplicant.

8. Choose  Do Not Validate from the CA Certificate drop-down menu



So I go and set up an AP broadcasting some company's SSID, along with some fake cert of mine.

And all the employee's phones come along, log on to my fake AP and leave their credentials with me.

Nice, eh? We have been discussing this in the eduroam community for > 10 years.

You simply don't do this or otherwise kick yourself out as a security company.


Sorry for my wording, but this is really bad.

Martin Pauly

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.