  WPA2 Enterprise is a fundamental technology for secure communication in
enterprise wireless networks. A key requirement of this technology is that
WiFi-enabled devices (i.e., supplicants) be correctly configured before
connecting to the enterprise wireless network. Supplicants that are not
configured correctly may fall prey of attacks aimed at stealing the network
credentials very easily. Such credentials have an enormous value because they
usually unlock access to all enterprise services.
  In this work we investigate whether users and technicians are aware of these
important and widespread risks. We conducted two extensive analyses: a survey
among approximately 1000 users about how they configured their WiFi devices for
enterprise network access; and, a review of approximately 310 network
configuration guides made available by enterprise network administrators. The
results provide strong indications that the key requirement of WPA2 Enterprise
is violated systematically and thus can no longer be considered realistic.
