Please make winbox logins with radius as a backend not CHAP-only.
CHAP seems like a good idea at first, until you have to severely compromise password security on the radius server by storing all passwords in cleartext.
Also, usage of two factor authentication is not possible with CHAP.
So please enable use of PAP for that. SSH and telnet already do this, I’m not sure on why winbox doesn’t.
+1. I’m using OTP on an external radius and With CHAP IS A BIG PROBLEM!
Thanks!
PAP works fine for radius-based AAA for webfig, but Winbox forces CHAP.
I asked Sergejs (I think it was him - may have been another dev) about this in person back at MUM USA 2012.
He basically said “just use Webfig.” I didn’t want to argue so I just nodded and moved on to talk to other people, but this leads me to believe that this is another one of those cases where Mikrotik knows better than you do what sort of auth protocol should be used. 
Folks,
+1 here.
Almost 10 years passed and it’s still an issue. Why not to introduce an option to use PAP for Winbox?
Thank you!
Similar thread is here - winbox login - RADIUS PAP vs CHAP.
+1! (exclamation point because I needed 3 characters…now there are many more)
+1
Allows for better management.
I prefer tacacs but mikrotik is not supported.
In the distant future I might change to Diameter
MS-CHAPv2 would also be nice for Winbox AAA login verification.
All CHAP algorithm variants require clear-text password storage on the server, which is a clear no-go in many environments. To be able to store passwords in hashed format, they need to be transmitted "in the clear" (with transport encryption, which Radius + PAP provides). Both are less than ideal, but admins need to be given the choice according to local policies.
So, +1 on PAP support, please.
+1
Maybe with RADSEC, PAP is secure enough.