To my knowledge no. I believe organizations usually use WPA2-Enterprise for their enterprise network and then offer WPA2-PSK for their "Visitors" segment. You may want to consider locking down WPA2-PSK to whitelist content. If users can't access twitter, facebook, instagram, etc, they may be less motivated to try and get on the network.

WPA2-Enterprise is the most technically complete solution. The problem with portals is that they are basically duct tape solutions trying to make it harder to defeat but not impossible. For example, the portal needs to intercept all traffic until a computer is "authorized", but identifying the computer is dependent on either the MAC address or IP address, either of which can be stolen.

Well they can set up a TLS connection for the authentication so credentials can be securely transmitted without interception. However, once the computer is authorized, the system has no way of retaining which computer sent those credentials. It cant leave a cookie, because the cookie only works on the domain in which authorization occurred. Thus it tried to rely on things like MAC addresses and IP addresses.

Let us continue this discussion in chat.

iPhones are jailbroken, androids are rooted.

+1 for WPA2 enterprise, but you must be very careful that teachers have strong passwords. If you can use certificates instead, I strongly suggest you do that. I was hired to do this for a school, and this was the most effective option.

Not impressed with the https thing. Bad Lenovo rep, very bad!

@alec yeah, I debated a bit with that suggestion. Https interception is fairly common place in Enterprises though, and is extremely helpful when used for defense. It's a shame most people would just click through the warnings but could offer a really good teaching opportunity.

Great technical suggestions, but I don't think it's reasonable to assume that the admins are able to 1) detect that someone logged in is a student, 2) figure out exactly which machine it belongs to, and 3) figure out who was using the machine at the time (it might not be the owner).

The last suggestion is bad and merits a -1. It is arguably illegal and certainly immoral. And even if you don't care about those aspects, it seriously compromises the security and privacy of all legitimate, authorized users, including yourself.

@R.. First, the student has accessed a network they are not authorized to access. Second the student will be warned about the risks of browsing a HTTPS website when there is a certificate mismatch. It is their choice to ignore that warning. You could argue that Apps, unlike browsers may not sufficiently warn the student, to which I would remind you that the student is still accessing a network they are not authorized to access. The network administrator needs to be able to do his or her job, and many organizations need HTTPS interception in order for administrators to be effective.

@amccormack reread what R. wrote: compromises the security and privacy of all legitimate, authorized users, including yourself.

Consequences? Best idea possible. WPA2-Enterprise? Always a good idea. The rest? Jesus what a terrible set of measures: unmaintainable (mac filtering), bypassable or at best risky (captive portal) and security-weakening (https). I would add an answer of my own but basically I'd just copy the first two bits from your post and leave out the rest.

@Mew If a student uses a teacher's account, that is a direct attack on the teacher. More consequences. But what's more is that you can keep count of how often a certain teacher's password was used. If one or two teachers can't keep their passwords to themselves it can have consequences for them as well. Nevertheless a certificate is a good idea.

@Luc Thanks for the feedback, I clarified my answer a bit. I was attempting to give multiple solutions for the specific problem of keeping student devices off the network and not necessarily force the larger issues of using a PSK as a way to maintain a network. I don't know the details of the school network, so I try to offer multiple solutions with a fair amount of commentary about the benefits or drawbacks.

Two major, glaring issues with this answer: A compromised WPA-PSK key does not allow one user to snoop on another user's traffic, and WPA-Enterprise does not require installing anything, nor does it require client certificates. Enterprise does not provide any advantages over PSK when it comes to encrypting traffic over the air. link

@qasdfdsaq You're right in that more than the PSK is required when sniffing traffic in WPA, but read the other answers, you can decrypt the other traffic when you have the password.

@AlecTeal When debating whether to use some system, "Unrelated Company X did Unrelated Bad Thing Y with it" is not a useful argument in either direction, unless you're specifically considering PR impacts.

@amccormack: If you had the knowledge to perform those rather exotic attacks it becomes rather academic since there'd be no need to decrypt any traffic anyway, you may as well set up a MITM AP. We're talking about school kids here.

All that actions is purely useless because you know...i can always use my 3g/4g so why bother to connect to wifi? My data speed is more than fast enough for my needs on a phone. And kids know how to use google and follow step-by-step guides too

@freedom The question is not about keeping students off their devices. It is about preventing unauthorized access to a network

@immibis you didn't get the ref. Nvm.

@qasdfdsaq Decrypting WPA-PSK traffic isn't particularly exotic - it can be done with off-the-shelf tools. I certainly remember using similarly sophisticated attacks when I was in high-school.