&gt; this also allows you to finally get around to rolling out eap<p>* WPA2-Enterprise is not universally supported. (Ferinstance, <i>no</i> Chromecast can connect via WPA2-Enterpise. :( )<p>* Which EAP? EAP-TLS? EAP-MD5? [0] EAP-MSCHAPv2? Or perhaps EAP-GTC? [1][2]<p>&gt; this also allows you to finally get around to rolling out eap so the scourge of shared wifi keys can die out<p>Unrelated to the issue at hand... I <i>really</i> wish OS X and Windows supported EAP-WFA-UNAUTH-TLS (and that EAP-UNAUTH-TLS would become an &quot;actual&quot; EAP method, rather than languishing as a vendor specific extension. Securely encrypted zero-configuration public WiFi can&#x27;t come fast enough! :)<p>[0] God no! ;)<p>[1] It probably <i>sounds</i> like I&#x27;m trying to imply that WPA2-Enterprise is too complicated. Frankly (speaking as a guy who&#x27;s implementing his own RADIUS server as a hobby project), it&#x27;s <i>really</i> not. There are just many, many options available to you... and not all of them are supported by all RADIUS servers.<p>[2] Anyway... given what <i>very</i> little I know about EAP-GTC, I would suggest that -if we&#x27;re going for a near-zero-configuration deployment- it would be the most suitable for the situation that we&#x27;re talking about... The trick would be hooking the verification logic for the security token in the device into the RADIUS server. :)