Context: I have a laptop supplied by my organisation. I am trying to connect to eduroam, but I cannot do it using my organisation's laptop. When I use a personal computer, it asks me for a username and password, just as a standard wifi network asks for password.
I found the text below in the internal IT policy. I need help understanding it. To me it's totally counterintuitive:
Using hotel, coffee shop and public WiFi hotspots
You may be able to connect your laptop to use the WiFi in hotels, coffee shops etc but this depends on how the WiFi is set up:
- if it’s “open” (that is, you don’t need any password to connect) then you should be OK
- if it’s set up so that you need a password to connect to the WiFi (and this password is given to you by the establishment) then again, you should be OK
- if however you can readily connect to the WiFi but you need to enter a username and/or password in your web browser software, then you will not be able to access the service.
The security standards to which our laptops are built, means that they cannot connect directly to a “dirty” or insecure internet connection – everything goes via the secure VPN connection into our IT network. So the user can’t get to the web page where they’d need to type in a password, without first connecting to the VPN – and they can’t connect to the VPN without first getting to the web page.
So basically, I can use my work's laptop in a coffee shop where the network is shared by anyone (for which so much has been written against, e.g. here). I can also use it in a network with password security only, for which there is even a WikiHow (!) guide on hacking. And yet, I cannot use it in a network that requires both username and password, which surely must be much more difficult to hack into.
What is this sense of security that underlies my organisation? Am I missing something?