3

The higher education institution that I attend uses Eduroam, a infrastructure and IT company that often caters for the infrastructure and network needs of research and educational organisations. I am a bit concerned about the risk of sensitive information (such as login details) being stolen while I use the internet at the institute I attend (such as through other malicious users on the institutes LAN intercepting my traffic.) This may just be my paranoida, but do I have anything to worry about my information being stolen while connecting my personal laptop to my educational institutes network?

  • 2
    Large education institutes normally have a higher budget and are aware of potential attacks within the college. It is likely that the connection is fully encrypted with SSL/TLS. – tungsten Sep 26 at 15:36
  • Please note that eduroam is international and different institutions implement it differently. – schroeder Sep 27 at 17:01
  • @schroeder Why were some comments removed? – Boolean Sep 27 at 17:20
  • @Boolean Since the question now is about Eduroam and not your institution, the comments about your institution size no longer apply. – schroeder Sep 27 at 22:12
6

The higher education institution that I attend uses Eduroam

If you are using eduroam, then you are connecting to your wireless network with some form of 802.1X authentication and the wireless infrastructure must support WPA2/AES per eduroam requirements (they may additionally support WPA or TKIP).

802.1X uses a supplicant on the client device that connects to a RADIUS server to authenticate. The vast majority of eduroam authentications use EAP methods that utilize a TLS tunnel from the supplicant to the RADIUS server to protect user credentials. (I have only personally seen statistics from eduroam US, but for those 99.99% of authentication attempts use EAP-PEAP, EAP-TTLS, or EAP-TLS).

Once you are authenticated, unless the wireless deployment is old (pre-802.11n) or poorly implemented AND your wireless device doesn't prefer WPA2/AES, your wireless traffic is secured using AES encryption that is negotiated using unique keying material generated during your authentication. The use of TKIP (predecessor to AES) causes a wireless network to disable HT/VHT data rates (802.11n and newer data rates) so isn't even available on most wireless networks utilizing 802.1X authentication today.

I am a bit concerned about the risk of sensitive information (such as login details) being stolen while I use the internet at the institute I attend (such as through other malicious users on the institutes LAN intercepting my traffic.)

Since you seem primarily concerned about malicious users on the network (and in the sake of brevity), I am going to disregard concerns about your school/staff intercepting traffic or your data being captured due to compromises on your device. Especially since you don't provide any information in those regards.

Assuming the use of AES encryption, your traffic is secure between your device and the access point (AP) of your school. Since AES encryption employed in wireless is still considered secure, no other device will be able to capture and decrypt this traffic.

Once your traffic reaches the AP, there would need to be some sort of compromise on your school's network for your data to be compromised. But then most services you access will be using TLS to encrypt traffic between your application and the server (for example, HTTPS in your web browser), especially when passing sensitive information (and if it isn't I would be more worried about that information being passed unencrypted on the Internet than even a compromised school network).

There is a possibility of compromised data if you let your device connect to rogue AP impersonating your school's wireless network. Most EAP supplicants provide protection from this in some way, either through configuration or at least providing you the option to confirm that the RADIUS server/SSL certificate your device is presented is valid. So make sure you configure this in your EAP supplicant or actually confirm the information you a about to approve is valid.

This may just be my paranoida, but do I have anything to worry about my information being stolen while connecting my personal laptop to my educational institutes network?

Never hurts to worry about information being stolen, and not just when connecting to [insert service here].

During your authentication when connecting to a "eduroam" wireless network? No (as long as you are connecting to your school's RADIUS server). Even if you connect to eduroam at another school, the TLS tunnel is formed between the EAP supplicant on your device and your school's RADIUS server.

From users capturing wireless traffic between your device and the AP? No, 802.1X and AES on wireless is still generally considered the most secure method of connecting to wireless (as long as you are connecting to your school's RADIUS server).

From your school's network being compromised? No more so than any other traffic you send over the Internet (i.e. you should assume traffic over the Internet is compromised so sensitive information should be encrypted).

From your school or their staff capturing data? Possible but probably unlikely. Of most concern would be if your school is one that has implemented some form of TLS intercept (most school's do not).

From your device connecting to a rogue AP or your device being compromised? Absolutely, but then again in the first case you aren't really connected to your school's network (and there isn't a good reason for someone to impersonate your school's network) and in the second case it wouldn't matter to which network you were connected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.