A network administrator has had issues with clients giving out their username and password to other employees to authenticate to the internal wireless SSID. Which 802.1x authentication stops users…

EAP-TLS requires each client to present a unique X.509 digital certificate signed by a trusted CA, and the corresponding private key never leaves the client device. Because the private key cannot be practically extracted and shared, users cannot hand off their authentication material to another person, unlike a simple username and password.

EAP-MSCHAPv2 authenticates with a username and password hash, which users can trivially share verbally or in writing.

LEAP uses a username and password for authentication and is also considered cryptographically weak, so credentials are both shareable and easily compromised.

EAP-FAST can fall back to username and password credentials in its inner tunnel authentication phase, which still allows users to share those credentials.