The basic idea

I started with a vague picture of one giant login system. Maybe each university uploaded its users somewhere, and every eduroam access point checked the same list. If you have never stopped to think about it, that explanation almost sounds reasonable. It would also mean copying sensitive account data between institutions, so I went looking for the actual handoff.

I used my own account to make the handoff concrete. Say I am visiting a university in Berlin, but my account belongs to Waterloo. Berlin should not have a copy of my password, and it does not need one. Its network asks Waterloo, “Is this one of your people?” Waterloo checks my login and sends back yes or no. If your home institution is somewhere else, the same basic exchange applies.

The split that made the system click for me was simple: the campus you are visiting provides the connection, while your home institution confirms who you are. The way I now understand eduroam is as the shared way to ask that question, not one enormous Wi-Fi network or one central account list.

What happens after I press connect

The official explanations quickly led me into 802.1X, EAP, and RADIUS. If those labels sound dense, they did to me too. I kept treating them as one complicated system until I gave each name one small job: 802.1X keeps ordinary traffic blocked during login, EAP is the login conversation, and RADIUS passes that conversation to the right university.

You may also run into the words “supplicant” for your device and “authenticator” for the access point. I found it easier to picture a device asking to enter and a network waiting for an answer. The access point is not trying to understand your university password. It passes the conversation along and waits for your university's decision.

How the username is protected

The next terms that slowed me down were “outer identity” and “inner identity.” If they sound like two accounts, that is how I first read them. I eventually understood them as two layers of one login: an address on the outside and the private details inside.

In my example, the outside can say anonymous@uwaterloo.ca. The part after the@ tells the network where to send the request, so Waterloo's name remains visible along the route. Your connection would carry your own institution's realm there instead. The real username and private part of the login stay inside an encrypted tunnel that ends at the home institution.

This was where I corrected another assumption: hiding the username is not the same as becoming anonymous. The visiting network can still see where your account comes from, along with normal connection details. The privacy gain is simply that it does not need your full username or password to find your university.

Where my internet traffic goes

At this point I realized I had mixed up two different paths. Because Waterloo checks the login, I assumed the rest of my connection might keep running through Waterloo. If you have thought of eduroam as a kind of university VPN, the answer surprised me: it does not work that way.

Once you are connected, normal internet traffic goes through the campus you are visiting. In my Berlin example, Waterloo does not carry the browsing and nothing makes a round trip through Ontario. Berlin provides the connection, so its firewall and local network rules apply to me while I am there.

The way I picture it now is simple: your home institution confirms who you are for the connection, then the place you are visiting carries the traffic that follows. Separating those two paths cleared up most of my confusion.

Why the setup profile matters

Reading the security guidance changed how I thought about the first-time setup. I had treated the university installer as a convenient way to avoid typing settings by hand. If you have done the same, the missing piece is that the profile also teaches your device which university sign-in server is real.

Anyone can name a Wi-Fi network eduroam, so the name by itself does not prove much. Before sending anything private, your device checks the server certificate against the details your institution gave it. That certificate check is what I had overlooked when I thought the network name was enough.

I now read an unexpected certificate warning differently. It is not just another setup prompt to clear. It may mean your device cannot prove that it reached the right sign-in server, which is a good reason to stop and check your institution's instructions.

• Use the setup instructions, CAT profile, or geteduroam app from your institution.
• Do not turn off certificate validation or accept an unexpected certificate.
• Do not enter eduroam credentials into a web page. eduroam does not use a captive portal.

Your institution may use a different login method or keep different logs. The username privacy shown above also depends on anonymous outer identity being configured correctly.