&gt; ...and the &quot;enterprise&quot; solutions using MSCHAPv2 where passwords can be almost trivially recovered...<p>Those enterprise solutions are almost <i>certainly</i> wrapping the MSCHAPv2 exchange in TLS. e.g. PEAP-MSCHAPv2 or TTLS-MSCHAPv2. Additionally, I&#x27;m not <i>sure</i>, but I <i>think</i> that plain EAP-MSCHAPv2 can&#x27;t generate the keys required for a wireless client to establish an encrypted session with an AP and -thus- would <i>never</i> be used by a WiFi client.<p>&gt; The terrible certificate support in e.g. Android is just icing on the top.<p>Eh? In my experience both Android and OS X&#x27;s UIs for WPA-EAP are <i>substantially</i> superior to the UI that Windows offers.