Update: The answer [0] is basically that if the probe request is for an SSID of an open network, then a malicious access point can say "that's me" and the clien

Update: The answer [0] is basically that if the probe request is for an SSID of an open network, then a malicious access point can say "that's me" and the client will connect. (Also, note the "that's me" is not a response per se, but a separate advertisement for a network with that name.) But if it's for a WEP or WPA/2 network, the client won't connect unless the malicious router also knows the password for that network, because the handshake used to generate encryption keys requires that the client and access point agree on a shared secret. A malicious router doesn't know ahead of time whether the SSID in a probe request refers to an open network, so it could try to establish it and see if the client connects. (Even for closed networks, it's also possible there is a bug in some client software that would ignore errors caused by the server supplying the wrong key?) [0] https://security.stackexchange.com/a/210798/76104 https://security.stackexchange.com/a/210798/76104