0

At my school, when logging into wifi for the first time, we enter our ID & password into a normal wifi login page, then we download a certificate. I cannot confirm if the certificate changes depending on which student logs in. After downloading the certificate, we must install it as a Trusted Root CA Certificate. My Samsung phone says that "your network may be monitored" after installing this certificate.

My main question is if this can:

  1. Allow the school to see what websites i visit
  2. Cause security vulnerabilities
  3. Slow down my web browsing
  4. Route my internet traffic through a middle man

Thanks everyone for the help

Improve this question
3
  • 2
    I think there is a pretty big disconnect between what is theoretically possible and what a school is likely to be doing. If you are that worried about it then something is obviously wrong
    – James
    Sep 22, 2022 at 17:23
  • @James Im not worried, I am just curious. In the day and age where some schools (in the news some time ago) gave punishments to students for actions students did at home using the camera and microphone of a school-issued laptop, I am curious just how much privacy my school could take from me, in theory. I am in a very good school district and am not saying this is likely, but I want to know what is possible.
    – anonymous
    Sep 22, 2022 at 21:07
  • @James Also, Ive heard that such certs can open up issues with MITM attacks and slow down traffic. If these are true, these are inherent flaws with the system, not an action the school is deliberately taking. If such issues are true, then I'll consider using my limited mobile data.
    – anonymous
    Sep 22, 2022 at 21:09

2 Answers 2

Reset to default
3

It is unclear what the school says the certificate is for. It may be for WPA-Enterprise Wi-Fi authentication. It may also be for HTTPS interception. Please expand on that. Surely there’s some information on why you’re supposed to install the certificate…?

I will provide an answer about installing a CA certificate in the trusted root CA store. Going by the fact that it goes into the trusted root CA store, the certificate would not be unique per student.

There are two environments to consider. Your school network and other networks.

When you are connected to the school network, your school

  • can intercept your connections, even when encrypted (see also last bullet)
  • could accidentally leak the certificate’s private key
  • can slow your web browsing either way
  • can route your traffic any way they like, middle man or otherwise

Routing is unrelated to any certificates. Certificates are for trust. Having a CA certificate provided by the MITM installed makes security warnings go away, because you now trust the MITM.

When not connected to the school network

  • the school cannot see where you browse
  • the CA makes you more vulnerable (see above)
  • browsing speed is unaffected
  • the school cannot redirect or intercept your traffic

If you do not trust the school to properly manage this security-critical data, you should not trust their CA. This will probably make using their Wi-Fi impossible.

Improve this answer
2
  • Considering that nearly all Android apps don't trust user CAs (each app has to explicitly trust user CAs) the likeliest choice is the WPA enterprise authentication.
    – Robert
    Sep 22, 2022 at 19:16
  • It is for HTTPS. You can use the wifi without the certificate, but HTTPS will not work without thr certificate. A common issue among less tech-oriented students who do not install the certificate correctly is that on HTTPS websites, the "this website has a bad certificate” error comes up in the broswer, and it also can block external images from loading on webpages.
    – anonymous
    Sep 22, 2022 at 21:10
0

The school certificate is probably to authenticate the connection. The school can't do anything other than that unless it has been enrolled in the organization.

Improve this answer
1
  • 1
    Or this could be just a web certification. Most schools require their devices to have a certificate located in the computers internal storage so the network can verify that its a trusted device and knows it's allowed to connect.
    – Alexander Mayer
    Sep 23, 2022 at 13:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .