-: When implementing remote access to your network,
you have to carefully select
the method of network authentication.
There are various options to choose from,
including the PAP, the Password Authentication Protocol,
the CHAP, the Challenge Handshake Authentication Protocol,
and EAP, the Extensible Authentication Protocol,
that we talked about earlier in this section.
The first remote access authentication
that was widely used is known as PAP,
the Password Authentication Protocol.
Now, PAP is a really old protocol and because of that,
it was never built with security in mind.
In fact, whenever they sent the username and passwords,
those user credentials over the network
during the authentication,
it didn't even encrypt them.
They were sent in plain text.
This makes PAP an insecure choice for any modern network
and you simply shouldn't use it.
Why do we even mention PAP?
Well, because after PAP, came CHAP and with CHAP,
it's an evolution to PAP,
and it's the Challenge Handshake Authentication Protocol.
This is going to solve the problem of sending credentials
over the network in clear text.
Instead, they're going to have the server
send the client a string of random text called a challenge.
This random text is then encrypted by the client
using their password
and this text is then sent back to the server.
The server then unencrypts that text
using the user's stored password
and checks if the encrypted text
matches the original text that it sent in the challenge.
Using this method,
the password is never sent across the network
and the security can be achieved
and ensure that we have it safe.
Now, CHAP was popular for many years
and Microsoft even created
their own proprietary version called MS-CHAP.
MS-CHAP provides stronger encryption keys
and mutual authentication
so, it was an improvement over standard CHAP.
Now, while the CHAP and MS-CHAP were used widely
for many, many years,
both of these have been overtaken by EAP,
the Extensible Authentication Protocol,
that we discussed earlier in this section.
Now, lucky for us, PAP and CHAP are both dying out
because most of these were used for dial-up connections.
Instead, most people who require remote access now
opt for a VPN connection
which we're going to discuss in the next video.