WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?
We are using, as default, PEAP and MS-CHAPv2 as inner authentication.
I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured clients.
He told me there are risks only for clients with WiFi not preconfigured, because most users would trust a fake certificate. Instead, for preconfigured clients, all supplicants would drop or reject the connection and the user wouldn't be allowed to trust a fake certificate. But why's that? Maybe because the supplicants check if there is already a certificate installed for that SSID?
Also, supplicants have always have been this safe regarding this matter? Or patches have been applied during time? If the latter is the case, how would I know when the patches have been applied and in which OS versions? It would be helpful because, for instance, I could suggest for Apple mobile devices to use only from iOS 7 and above (I just took a guess, I don't know if it's the correct version).
