in WEP's case, your AP would receive an auth response encrypted with the keyphrase... you'd have to get quite a few of these to deduce the password, in general.

in WEP's case, your AP would receive an auth response encrypted with the keyphrase... you'd have to get quite a few of these to deduce the password, in general. people find it easier to just sniff traffic and deduce the key from all the traffic generated from someone downloading crap. i don't think this is at all realistic with wpa. you could just set up an open network with an equivalent essid, but that's nothing new is it? :)