A few thoughts

* WPA2 hasn't been 'cracked' * Without 'passwording', all your traffic is unencrypted and can be trivially sniffed * Spoofing one of your whitelisted MAC addresses in order to use your network is easy

First: thanks to ALL of you who answered. This was very informative. If I understand correctly:

1) I would define something as "not cracked" if it is as strong as its password--in other words, there's no way to circumvent it that isn't a general vulnerability (peek through my window, get a keylogger on my machine, etc.) I assume you're telling me that this is the case with WPA2.

2) It sounds as though you are saying that something like WPA2 doesn't just authenticate a login but remains in use as an encryption key for subsequent wireless data interchange between client and base station. If I'm understanding correctly, that's a powerful point.

3) I knew that MAC addresses could be spoofed, but I was thinking they wouldn't know WHICH MAC address to pretend to have. Of course, if I'd been a little smarter, I would have noticed that my own linux process was using the MAC address a client claimed to have to throw out unrecognized machines (before I had MAC address filtering as a built-in router feature). If they were sending their MAC address to me, then my own client machine would be sending its MAC address in clear text to them, telling them which MAC address to pretend to have. Duh.

Well, I feel a little dumber and a little smarter. Time to go change my network. Thanks again.

It is also trivial to see which MAC addresses are associated with which APs.

This approach is very easy to bypass by any knowledgable hacker.

Since you said your WiFi is open, the only thing that needs to be done is fire up the aircrack-ng airdump and sniff, there I would see your MAC, in the clear. Then I could set my own to it or select any other mac I have seen connecting to for a longer while ,and use it and access your router and add my other mac on its whitelist.

This works great until someone comes along and spoofs the MAC address of your base station. Then the real fun begins.

Someone's said in the Ars Technica comments that MAC addresses are freely available in the packets-in-flight, and MACs are spoofable, so MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access.

> MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access.

Isn't that true of WPA and WPA2 though also?

WPA2 with good password, at least, would put up a non-negligable barrier in terms of the number crunching required; in contrast, getting around MAC filtering would take effectively no time at all.

The only in-the-wild attacks against WPA2 are variations of brute-force attacks.

There are precomputed rainbow tables of common SSID+passphrase combinations floating around, but as a general rule, WPA2 with a sufficiently complex passphrase should be secure against anyone who doesn't have a massive compute cluster at their disposal.

WPA2 is as strong as the password used on it, so it can easily be strong enough to deter any attacker from that perspective.

This provides no security at all. A good solution would be to use a VPN like OpenVPN; i.e., you treat the wifi as an insecure channel just as the internet, and only after connecting to the VPN you would be able to get to the internal network and the uplink.

Unfortunately, MAC addresses can be spoofed by a dedicated attacker. It prevents your neighbor from using your connection without paying, until they decide to listen to what your address is and then just use your address when you go to bed.

I'm chagrined to admit that this simple approach didn't even occur to me. I'm interested as well; are there any disadvantages to this?

It's a terrible way to secure a network. MAC addresses are easily spoofed, and without encryption anyone can sniff your traffic anyway. Even using WEP is better since then there's (usually) a requirement to see a connected client for longer than a few seconds in order to break the encryption. The only reasonable approach for a home network imo in practice is WPA2 PSK with a decent password.

Convenience. Easier to give a visitor a password than get the device's MAC address and enter it into the router's whitelist.