The choice of EAP method used has other potential privacy implications. For example, if the EAP method in use does not support mutual authentication, then there are no guarantees that the IdP is who it claims to be, and thus the full NAI, including a username and a realm, might be sent to any entity masquerading as a particular IdP.