It depends how that data is being sent from the user device to the authorization system. Is it transmitted in the clear, or is the MoveFreeWi-Fi.com login page secured with https? If secured, then as long as the connection between MoveFreeWi-Fi's system and GO for the authorization request is similarly secured (and this would be on the satellite backhaul and probably invisible to the guy a few seats away) then there's not a concern. It sounds like your device' MAC address is added to a white-list for future login-free use, and yes an eavesdropping hacker a few seats away could clone that to get onto the system in the future without an address and Presto number of their own, but that wouldn't give away any of your personal data. The way they describe it ("No PRESTO information is used aside from the number and it will be deleted after it is validated."), the white-listed MAC address does not remain associated to your account.
Excellent post. I didn't want to conjecture too far without having the terms and processes understood, but it appears that there might be some reverse leakage for the eml addies, and with that, the ability to put a personal identity to the number. This may not in itself seem that great a security concern, but as we've seen with the 'mining' of layers of info from other sources, and Facebook is a classic, much of that info can be vertically stacked to discern behaviours that are arguably private data.
I'll dig further on this later, as your point on http v https is an important one, even on this very site! I found myself being logged in here in http some time back, had to force it to be https. I'm not fully aware of the degree of exposure, but do know that some browsers wouldn't allow it without an alert being posted.
I look forward to further discussion with you on this. If there is an exposure, there may be a way to mitigate it....not that a lot of people care....ended up having a huge discussion with some friends on Apple SSO (Single Sign On) and their wondering why sending links to everyone wasn't necessarily working.
Like many users, they were completely unaware of how licensing from Apple, MS and others allows a 'seamless experience'....but at the cost of security by using an SSO.
And that's what folks will be looking for with their 'wi-fi on GO'. I have to wonder why it can't be openly available for all to use on the car, without even having to sign-in at all....download and rate limits can be applied to all users if need be. That may be my limitation of not knowing the latest security protocols however.
