LEAP user ID transmitted in clear text

[rsumpter]

It appears that the LEAP user ID is transmitted in clear text over the airwaves (password is not) and anyone with a wireless sniffer can see it. Is this normal? Or is there a setting to change this?

[mmellet]

This is normal. Most usernames are derivatives of their real name or email address or something similar so they can be easily guessed or learned form e-mails, etc. So usernames are not a secure item to start with so it doesn’t matter that they’re in clear text.

[brok3n]

Yea but why start out by giving 50% of the solution to an outsider seeking unauthorized access.

A valid username is one half of the data needed to obtain login privs. Why would you not just encrypt it? Its computationally cheap -- seems like a gimme to me.

-brkn!

[bmcmurdo]

You can't encrypt it because you don't have an encryption key yet! LEAPs whole purpose is to dynamically derive (at the client and the RADIUS server) a dynamic WEP key, until this is done, you can't encrypt anything.