This probably uses WPE-Entreprise (WPA2-EAP) with EAP-TTLS (or similar).
This approach seems to be quite better than WPA2-Personal (WPA2-PSK) based on shared passphrase from a security point of view:
- With WPA2-PSK, anyone in possession of the passphrase can passively decrypt the communications. This is not true for this solution.
- This provides forward secrecy assuming a suitable TLS ciphersuite is used.
- With PSA2-PSK, anyone in possession of the passphrase can impersonate the access point. With this solution, it is possible so impersonate the access point if we assume the user does not validate the certificate. The user could be tricked into accepting a new (malicious) certificate but if a strict TOFU approach is used, only the first connection is vulnerable.
However with this approach, if the station is configured to accept any certificate (of if the user blindly trusts any new certificate), an attacker could impersonate the access point and learn the passphrase, in particular with authentication methods such as PEP over EAP-TTLS where the password is sent in cleartext over the TLS channel. This is not such a big problem in your example where the passphrase is quasi-public anyway.
The main problem is probably in the configuration (usability) of the approach for standard users:
- there are different EAP methods (EAP-TTLS, EAP-FAST, TEAP) which could be used and in many UIs, the user is expected to select the correct one;
- at best (from a usability point of view), the user is asked to accept a certificate and must decide whether to blindly accept it;
- otherwise, the user has to manually provision the certificate;
- the user usually has no information which would allow them to verify the certificate;
- there is no solution for provisioning WPA-Entreprise credentials with a QR code (in contrast to WPA-Personal).
User interface on NetworkManager:
Android user interface: https://documentation.meraki.com/@api/deki/files/20327/Android_RADIUS.png?revision=1&size=bestfit&width=395&height=878
WPA3-Personal has several features which makes it more secure than WPA2-Personal and quite similar to this solution:
- protection against passive eavesdropping;
- forward secrecy;
- optional protection against Acces Point impersonation using WPA3-SAE-PK (which can be provisioned through QR code).