Recently my educational institution officially switched over from the their own wireless network to eduroam.
If I understand correctly from the FAQ, credential authentication is performed on the servers at my educational institution no matter where I log in from:
When a user tries to log on to the wireless network of a visited eduroam-enabled institution, the user's authentication request is sent to the user's home institution. This is done via a hierarchical system of RADIUS servers. The user's home institution verifies the user's credentials and sends to the visited institution (via the RADIUS servers) the result of such a verification.
In addition, it states that:
In eduroam, communication between the access point and the user's home institution is based on IEEE 802.1X standard; 802.1X encompasses the use of EAP, the Extensible Authentication Protocol, which allows for different authentication methods. Depending on the type of EAP method used, either a secure tunnel will be established from the user’s computer to his home institution through which the actual authentication information (username/password etc.) will be carried (EAP-TTLS or PEAP), or mutual authentication by public X.509 certificates, which is not vulnerable to eavesdropping, will be used (EAP-TLS).
Some questions that I have are:
- How is eduroam different from a VPN in terms of security?
- Is it any less secure to connect to eduroam somewhere other than my home institution?
- How do I know that my credentials are encrypted between my device, the access point I'm connected to, and the authentication servers?
- Is there a centralized database of domains and authentication servers (i.e. how does it know which server to check for