EAP-TLS: Secure Authentication Explained

This blog assesses EAP-TLS security, highlighting two main weaknesses: username enumeration through EAP-Response/Identity and misconfigured or disabled server-certificate validation that enables evil-twin (rogue AP) attacks. The author demonstrates how attackers can harvest usernames and impersonate enterprise Wi‑Fi when clients accept untrusted certificates or fail to validate server names, documents Windows-specific behaviors and prompts that exacerbate the risk, and recommends mitigations (privacy NAI, computer authentication, enforce server validation, restrict trusted CAs) to reduce exposure.