Today I'm getting into the details of WPA-Enterprise. Most of what I saw was difference between protocols that use certificates. Most posts say that EAP-TLS is the most secure authentication protocol and that it addresses the Evil Twin attack problem.
Does it really though?
When using a protocol with a server side certificate (EAP-PEAP) the clients may still accept an invalid server certificate. Can be misconfigured client or by user error when manually accepting the certificate.
In case of EAP-TLS (or EAP-TTLS with client certificate enabled) the client needs to have his certificate in order to authenticate to the network as well. But taking into account that the client may trust an untrusted certificate he will still send his certificate to the hacker, right? then the hacker could use the certificate to login into the real network, right?
Am I missing something in EAP-TLS??