WPA3 Enterprise 192-bit mode at home

Original Article ↗ Hacker News Discussion ↗

Pursuing “NSA-grade” Wi‑Fi at home with WPA3 Enterprise, EAP‑TLS, and 192‑bit CNSA‑aligned cryptography raises a trade-off between strong authentication and real-world complexity. Commenters note that while certificate-based Wi‑Fi with RADIUS, VLANs, and per-device identities can improve security and segmentation—especially for enterprises and power users—it’s fragile if outsourced to cloud AAA providers, hard to provision on consumer and IoT devices, and often overkill compared to simpler models like WPA3‑Personal plus VPNs and network isolation. Many argue the more practical priority for home networks is robust router configuration, segmentation of guests and IoT, and treating the LAN as untrusted, rather than relying on increasingly intricate Wi‑Fi protocols alone.

Home network segmentation & IoT handling

  • Many run multiple SSIDs on the same AP with VLANs: e.g., main, guest, IoT, work, kids.
  • Common patterns:
    • IoT on its own VLAN/SSID, often with no or tightly filtered internet, and no access back to trusted LAN.
    • Guest SSIDs with client isolation and no LAN access; some still let guests cast to TVs via mDNS/broadcast relays.
    • Some treat the LAN as non-sensitive and rely on higher-layer security instead.
  • Segmentation is also used to avoid rotating IoT credentials when guest passwords change and to prevent cloud devices from “phoning home.”

WPA3 Enterprise / EAP-TLS vs PSK

  • EAP-TLS is praised for strong authentication and resistance to “evil twin” / MITM vs password-based EAP like PEAP.
  • It enables per-device identity, policy, and dynamic VLAN assignment from a single SSID.
  • Limitations noted:
    • Doesn’t inherently stop MAC spoofing; RFC5216 lacks channel binding.
    • Some APs reportedly mis-handle RADIUS (e.g., ARP spoofing of RADIUS IP) leading to serious vulnerabilities.
    • Hosted RADIUS can make WiFi unusable when WAN/ISP fails.

Multi-PSK, per-device credentials, and VLANs

  • Multi-PSK/PPSK per SSID is valued for micro-segmentation and attribution, especially for BYOD.
  • Enterprise vendors support it widely; Unifi recently added WPA2-based PPSK.
  • WPA3 + PPSK support is limited; some recommend just multiple SSIDs for WPA3.
  • hostapd already supports multiple PSKs/SAE passwords, per-MAC, and per-VLAN mapping.

Trust, CAs, and hosted services

  • Strong debate around the article’s use of a cloud RADIUS + CA:
    • Critics worry about trusting an external root CA, long-term SaaS viability, and lack of warning about root CA risks.
    • Proponents argue most orgs benefit from outsourcing complex PKI/RADIUS and note on-prem/open-source options exist.
  • Using public CAs (e.g., ACME) vs internal PKI is contentious; some see internal roots as safer, others as operationally brittle.

Compatibility, WPA3 limitations, and practical value

  • Many consumer/IoT devices lack WPA3 or WPA-Enterprise support; PMF and WPA2/3 mixed modes often break older gear.
  • Some see WPA3/WPA3-Enterprise at home as overkill or “security blanket,” preferring to treat all WiFi as untrusted and rely on TLS/VPN (e.g., WireGuard) for real protection.
  • Others view robust WiFi auth and segmentation as a reasonable first layer, especially against untrusted IoT and guests.

Provisioning, UX, and missing features

  • Certificate provisioning and client trust UI (especially on mobile) are widely seen as the main barrier to EAP-TLS at home.
  • Desire for: per-device onboarding flows, short-lived certs, native per-account WiFi policies, and a standard provisioning mechanism in WPA3.
  • WPS is cited as an example of a good idea with poor security/implementation; proposed interactive approval schemes risk DoS from repeated connection attempts.