Basic concept:<p>Unicast traffic has safeguards against spoofing. Multicast does not. Spoof yourself as the AP, send out multicast traffic, and clients respond with unicast traffic <i>with their key</i>.<p>OK... seriously? <i>Session keys!</i> If you never send them out after negotiating them, the attacker would never get the key, and all your past traffic would still be secure.<p>The state of "security" with wireless communications continually strikes me as an ass-backwards place... wtf keeps going wrong? A couple standard, basic security techniques would seem to resolve nearly every cracking problem, and a large number of MITM ones too (certificates!).