Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

LEAP user ID transmitted in clear text

It appears that the LEAP user ID is transmitted in clear text over the airwaves (password is not) and anyone with a wireless sniffer can see it. Is this normal? Or is there a setting to change this?

3 REPLIES
Community Member

Re: LEAP user ID transmitted in clear text

This is normal. Most usernames are derivatives of their real name or email address or something similar so they can be easily guessed or learned form e-mails, etc. So usernames are not a secure item to start with so it doesn’t matter that they’re in clear text.

Community Member

Re: LEAP user ID transmitted in clear text

Yea but why start out by giving 50% of the solution to an outsider seeking unauthorized access.

A valid username is one half of the data needed to obtain login privs. Why would you not just encrypt it? Its computationally cheap -- seems like a gimme to me.

-brkn!

Cisco Employee

Re: LEAP user ID transmitted in clear text

You can't encrypt it because you don't have an encryption key yet! LEAPs whole purpose is to dynamically derive (at the client and the RADIUS server) a dynamic WEP key, until this is done, you can't encrypt anything.

258
Views
0
Helpful
3
Replies
CreatePlease to create content