The year was 1991.
The web was just getting started. “Terminator 2” was in theaters. Most of us hadn’t even sent an email.
And that’s when RADIUS was born.
Fast forward three decades, and here we are — still using the same Remote Authentication Dial-In User Service (RADIUS) protocol as the backbone of enterprise authentication.
Thirty years in tech is an eternity. Why are we still leaning on it?
Why RADIUS Won’t Die
To be fair, RADIUS was brilliant for its time. It gave ISPs and enterprises a way to centralize Authentication, Authorization, and Accounting (AAA). It’s lightweight, it works with dial-up (yes, dial-up), and it became the default glue holding networks together.
But let’s be honest:
- It runs on UDP by default (fragile, easy to spoof).
- It was never built for modern encryption demands.
- Extending it for today’s cloud-native, hybrid, multi-device environments often feels like duct-taping rockets onto a horse cart.
The Patchwork of Extensions
Over the years, we’ve “fixed” RADIUS with patches:
- EAP for wireless authentication
- RADIUS over TLS (RadSec) for security
- Vendor-specific attributes that turn every deployment into a snowflake
The result? A Frankenstein protocol that somehow still powers wireless enterprise authentication, VPNs, and even some cloud services.
Do We Need a Successor?
Here’s the uncomfortable truth:
Every time you connect to enterprise Wi-Fi with 802.1X, you’re leaning on 30+ year-old tech.
It’s like building the smart cities of tomorrow on top of COBOL mainframes. Possible? Sure. Sustainable? Questionable.
Maybe it’s time we admit that authentication in 2025 deserves something cloud-native, extensible, and quantum-resistant out of the box.
What Would a Modern AAA Look Like?
If we were to start fresh today, a modern AAA system should:
- Be cloud-native, distributed, and resilient by design
- Support modern identity standards (OIDC, SAML, FIDO2) natively
- Be secure by default (TLS everywhere, mutual authentication mandatory)
- Handle device context, posture, and risk scoring in real time
- Be extensible without duct-tape extensions
In other words: not RADIUS.
The fact that RADIUS is still here shows just how sticky infrastructure can be. Once something works “good enough,” we keep patching instead of replacing.
But here’s the question security engineers and architects need to ask themselves:
Are we going to keep duct-taping the future to the past, or is it time to design authentication that was actually born in the cloud era?
Top comments (0)