Someone with access to the computer can masquerade as the User and never be required to enter a password. CHAP should replace fixed cleartext passwords wherever possible. It offers greatly enhanced security and has no impact on the User. However, CHAP is only as secure as the password selected by the User. A much more secure means of access control is through hardware or software tokens.
Tokens use a random encryption key to create a one-time password.
If the system is well designed, the adversary has no method of attack except to try every possible key until they find the correct one. This is computationally impractical for a single login. The challenge is entered into the token. The token, with its unique embedded token key, uses encryption technology to convert the challenge to a response. This response is sent back to the central site, which is the only other party that can validate this response.