Not just that, but not all 802.1x methods actually provide mutual authentication either. In order to avoid this attack, the user device needs to authenticate the access point (and keys have to be distributed somehow!) At the very least, ensuring that an access point is the same access point as it was before, which would mitigate spoofing.

Authentication in one direction (or lack of authentication entirely) is what leads to this attack, since the fake access point can just say "OK" to anybody trying to connect.

It works just fine for universities. The experience is perfectly fine on iOS, Android, OSX, and Windows.

Apparently NYC is trying...