City inspectors must use hotel and conference Wi-Fi while traveling…

Question

City inspectors must use hotel and conference Wi-Fi while traveling. What role should a VPN overlay play relative to the untrusted wireless LAN?

Accepted Answer

Treat the offsite Wi-Fi as untrusted and use a VPN to protect confidentiality and integrity of city sessions traversing that path. — Hotel Wi-Fi is somebody else's living room. Assume it's hostile and wrap city traffic in a VPN. Trying to teach the hotel EAP-TLS or dusting off WEP is the wrong toolbox for an untrusted hop.

Answer

Disable the VPN so NAT on the hotel router can rewrite RADIUS EAPOL frames correctly.

Answer

Require hotel staff to issue city-managed EAP-TLS certificates to every guest room TV.

Answer

Replace the VPN with WEP on the laptop so hotel APs learn the city PSK.

City inspectors must use hotel and conference Wi-Fi while traveling. What role should a VPN overlay play relative to the untrusted wireless LAN?

Short Explanation

Full Explanation