On
https://documentation.meraki.com/MR/Encryption_and_Authentication/WPA2_Enterprise_Profile_Setup_on_A...
you seriously suggest to disable certificate validation in the Android supplicant.
8. Choose Do Not Validate from the CA Certificate drop-down menu
WHAT THE HECK??
So I go and set up an AP broadcasting some company's SSID, along with some fake cert of mine.
And all the employee's phones come along, log on to my fake AP and leave their credentials with me.
Nice, eh? We have been discussing this in the eduroam community for > 10 years.
You simply don't do this or otherwise kick yourself out as a security company.
Sorry for my wording, but this is really bad.
Martin Pauly
