Very neat hack! Although I thought most people turn off the WIFI when not using it.
Every time I drive past that retail store with the saved wifi it tries really, really hard to connect to the store causing pause/stuttering on the bluetooth audio for about 3 seconds about 90% of the time.
People are good at pattern matching, after a couple hundred events on a couple hundred commutes you pick up on the exact telephone pole I drive by where I expect my audio playback to stutter.
For something like a podcast or audio book its just a word or two hardly noticeable, but for music its very annoying and I'll shut off the wifi to avoid the interference.
If you try hard you can find just the wrong spot in the gym or office or restaurant where the phone goes nuts trying to connect to a very weak wifi over and over and failing and causing chaos in which case you have to shut off the wifi to get any work done over the more reliable data plan.
While a mac address isn't personally identifiable it can be used as a tracking mechanism. MAC X was seen at place Y and place Z etc... Combine with some fun data exploration of hotspots you've connected to (and other phones that have also connected to the same hotspots) and you can get some interesting results like MACs 1, 2, 3 have all been at the best western while 1 and 3 have also both been on network Y which is located in the general vicinity of this address. (I can't for the life of me find the Defcon video of this, was maybe Defcon 20 or 21).
Sooner or later someone will be selling the police a service of these MAC addrs or BT addresses or tire pressure sensors have been sighted near the XYZ protest and you just pulled one of those listed devices over so someone in that car is a protestor or was sniffed nearby a shooting crime scene or ...
To avoid the law enforcement entanglements, look how expensive underaged alcohol serving tickets are, now here is a low sensitivity device that sniffs very nearby wireless traffic and a subscription list of serial numbers seen entering and leaving the mostly underage college dorms and/or high school, now if the LED over the door of the bar turns red it doesn't prove your ID is fake but maybe it has a nice bright yellow warning LED to indicate the bouncer or guard should triple check your ID because its on a suspicious list.
Legally most anything is fair with house arrest and parole, register your smartphone and expect severe response if your MAC address shows up anywhere near a bar (assuming your parole forbids drinking establishments etc)
Think of the profiling legacy retail stores will start doing. Hmm this MAC address is recorded to be mostly sniffed around jail, the homeless shelter, and the low income walmart, what is it doing in the electronics department ten miles away from home? Better have someone watch them on camera or in person.
Imagine at a personal level subscribing to a service where you upload every tracking serial number you sniff continuously and in response get a threat indicator. Are there any threat smartphones in this dark alley? Is the clientele of this bar generally safe or dangerous? Based on the MAC addresses currently present, is this a safe neighborhood or should I drive on to the next gas station?
Then, a malicious person can advertise an SSID of "duggan's network", and in certain cases, could get your device to connect to that network without you interacting with your device, or even realizing that something has changed.
Ask most infosec people, and they'll tell you that they _always_ turn off their wifi when they leave a trusted location.
Specifically having a completely open and unsecured wifi. If you put much of any security on it, that protects your users. Which is where the seemingly weird advice comes from for guest wifi to not use completely unsecured connections and at least try some kind of password.
So if you connect to completely unsecured wide open "Car Dealer Last Name Service Guest" network while you're getting your oil changed or whatever, someone can set up "Car Dealer Last Name Service Guest" at starbux and MITM you a bit, or at least mess with you. On the other hand if your car dealer has a wifi named "Guest Network" with a WEP key of the car dealers last name then its hard for a guy hours later at starbux to set up a WEP secured "Guest Network" that you can connect to and get MITM'd.
For a real good time ask yourself what stops someone from MITM you at the car dealer by setting up a WEP secured wifi with the same name as the dealership and the password thats the same as the sign on the wall. Well, basically nothing. This can make life entertaining.
[1]: https://security.stackexchange.com/questions/137104/is-hacki...