2

I'm a freshman in university, and I recently moved into residence. Pretty quickly, I logged into campus wifi so I can actually do classes and things.

My laptop and primary phone logged in with minimal complaining, but my secondary/legacy phone had problems. I went to the site that explained how to log into the wifi, but one step told me to choose as my CA certificate "Use system certificates". No such option was available. I wound up having to go to yet another university website, and download a certificate they provided, but it still refused to connect. I never even saw the "Domain" textbox open like it wanted me to.

Today, I revisited the issue. I checked wifi connection instructions for other OSs, and one (Chromebook) said to leave it as "Do not check/None installed". I tried it out, telling it to not use a certificate, and, lo and behold, it connected. I checked the network settings, and it had spontaneously added the university certificate I'd gotten off of the website. Now I'm a little worried there was or now is some kind of vulnerability.

TL;DR: Joined a network with CA Certificate set to "Don't validate" out of desperation. It connected, and set itself to a safety certificate I had downloaded, and now seems to work fine. Is there anything to be worried about?

Improve this question

1 Answer 1

Reset to default
1

By not validating the certificate you're vulnerable to a man in the middle attack. Without that validation you can't be sure you're connecting to a legitimate site or not. The certificate may be expired, or invalidated too.

When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.

That being said, as you are using the same certificate on other devices that are doing validation, I suspect your risk is minimal in this situation.

References

Improper Certificate Validation

Improve this answer
1
  • 1
    Well ... vulnerable to another man in the middle attack anyway. The whole point of your university getting you to install it is so that they can decrypt your traffic and monitor it.
    – CaffeineAddiction
    Sep 17, 2021 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .