大學 WiFi 安全嗎？學生專用指南

IEEE 802.1X

一種網路驗證協定，僅在使用者身分透過集中式伺服器成功授權後，才會開放網路存取連接埠。

將場域從共享密碼升級至企業級、單一使用者專屬安全防護的基本標準。

RADIUS (Remote Authentication Dial-In User Service)

一種網路協定，為連線並使用網路服務的使用者提供集中式的驗證、授權和計費 (AAA) 管理。

用於驗證憑證並告知基地台 (Access Point) 應將使用者指派至哪個 VLAN 的後端伺服器。

EAP (Extensible Authentication Protocol)

一種常用於無線網路和點對點連線的驗證框架，支援憑證或安全密碼等多種驗證方法。

在登入過程中，使用者裝置與 RADIUS 伺服器之間溝通的「語言」。

eduroam

一項針對研究、高等教育和進修教育機構使用者的國際漫遊服務，在參與計劃的機構間提供安全的網路存取。

聯盟式 802.1X 架構如何在全球規模化應用的首要研究案例。

Supplicant

終端使用者裝置 (筆記型電腦、智慧型手機) 上的軟體用戶端，負責與網路進行 EAP 驗證交涉。

常見的單點故障來源；如果作業系統的用戶端程式 (supplicant) 設定錯誤，使用者將無法安全連線。

Evil Twin 攻擊

一種惡意的無線存取點，偽裝成合法的 WiFi 網路，以竊聽無線通訊或竊取憑證。

正確的 EAP 憑證驗證旨在防範的首要威脅向量。

VLAN Steering (Dynamic VLAN Assignment)

RADIUS 伺服器根據使用者的身分或角色，指示存取點將特定使用者放入特定虛擬網路分段的過程。

對網路分段至關重要，可確保訪客裝置無法將流量路由到管理伺服器。

OpenRoaming

由 WBA 創建的聯盟標準，允許行動使用者在 WiFi 網路和行動網路之間自動且安全地漫遊，無需 Captive Portal。

eduroam 的商業等價方案，允許零售和旅宿場所提供安全、無摩擦的連線。

Is university WiFi safe for students and campus visitors?

Yes, university WiFi is safe when students connect to secure 802.1X networks such as eduroam using valid configuration profiles and encrypted protocols. Most universities operate two primary wireless tiers: an authenticated enterprise network (eduroam or university staff/student SSID) with individual WPA2 or WPA3-Enterprise encryption, and an unencrypted guest portal network. While eduroam encrypts wireless transmissions between your device and the access point, connecting to open university visitor networks leaves transmissions visible to local eavesdroppers unless protected by end-to-end TLS encryption or a VPN.

How do rogue access points and evil twin attacks target eduroam on campus?

Rogue access points mimic legitimate campus networks by broadcasting identical SSIDs such as eduroam or University-Guest. When student devices attempt to connect without certificate validation, an attacker-controlled RADIUS server captures MSCHAPv2 password hashes or prompts users to accept untrusted identity certificates. To defend against evil twin attacks, students should configure connections using official eduroam Configuration Assistant Tool (CAT) profiles, which pin the institution's root Certificate Authority (CA) and server common name, preventing connection to unauthorized access points.

Why is client isolation critical in university residence halls?

Residence halls feature dense student populations with high concentrations of laptops, gaming consoles, smart TVs, and IoT hardware. Without Layer 2 client isolation or Private VLANs (PVLANs), infected student computers can scan local subnets, propagate malware, or intercept unencrypted broadcast traffic from neighboring dorm rooms. Enterprise campus networks enforce isolated switch ports and access point station separation, preventing direct peer-to-peer communication between dorm rooms while still allowing access to campus gateways and the internet.

Can university IT administrators monitor student browsing history and personal files?

University network administrators can observe destination IP addresses, DNS queries, domain names, and data consumption volumes across campus gateways, but they cannot read encrypted message content or stored personal files. Over 95 percent of modern web traffic uses HTTPS (TLS 1.3), meaning web pages, login credentials, and form entries are shielded in transit. Universities track connection logs, RADIUS authentication records, and device MAC addresses in compliance with institutional acceptable use policies and regulatory obligations such as FERPA or UK GDPR.

How does Purple enable universities to deliver secure guest and visitor WiFi?

Purple provides cloud-managed guest WiFi that integrates seamlessly alongside academic eduroam infrastructure. For visiting scholars, event attendees, prospective students, and conference delegates, Purple automates captive portal onboarding with social logins, SMS verification, or sponsored access. Purple isolates guest traffic from sensitive academic research networks, enforces bandwidth quotas to safeguard airtime, and delivers campus footfall and dwell time analytics without collecting confidential student records or compromising student privacy.