So now there’s significant complexity to getting on the network. Seems like a poor choice for a co-working space. And, as I say, plenty of large companies with competent IT departments don’t seem to think that’s necessarily.

And how about when you’re having a meeting with outside people who need to get onto a network?

Most universities and schools have a similar setup. No idea how WeWork works but I assume you have some sort of user account already (how do you pay them otherwise?) that you can use to authenticate yourself. Then your AP just needs to talk to a auth gateway (usually RADIUS) which then talks to your actual auth backend (LDAP, AD, or whatever online login form they use).

For guests you either generate guest account or just have a guest network. We don't care if guests fight over the guest network because there aren't that many of them around at any one time... the problem is that actual WeWork customers shouldn't be fighting over insecure APs.

Every WeWork member has a dedicated account which is tied to their company and badge (which is used for building access). This account is also used for reserving rooms.

Fair enough. Although I'm familiar with quite a few situations where most people just use a single network for wireless (whether employees or guests) and confidential company resources are put behind SSO and/or VPN using 2FA.

Others do have separate networks of course and maybe that makes sense in the case of something like WeWork that probably has more people who aren't employees/paying customers coming in and out and getting on the network than the typical company office does.

I think the problem is that providing internet access is part of WeWork's core product. It doesn't matter if your accountant's office just has one shitty wifi connection for everyone -- you'd still go visit them even if they didn't have wifi. But literally the entire point of WeWork is renting space to work, with internet. They should be held to a higher standard in this regard, IMO.

> So now there’s significant complexity to getting on the network

Not really, every OS (even Network Manager does a good job) has support for the WPA enterprise login flow. You basically get 1 prompt to trust a cert, then enter your username + pass (usually tied to AD) which you can save to your OS keychain. I've never had to fiddle with the one at my corporate network since first signing in months ago.

I don't know about the actual security benefits, but I do know it stops the typical "capture the handshake & game over"

> And how about when you’re having a meeting with outside people who need to get onto a network?

You set up a crappy rinky-dink "FooBarGuest" network with a PSK that has no real access to the rest of the network and pretty much can just be used for web browsing.

It's not hard to automate guest accounts.