[economistbob]

It requires disassociating and reassociating to the MAC so it requires two, which would cause a denial of service one would notice while watching it. Whether they can denial of service their way to the key, while someone is not actively watching, was not addressed. The paper is about essentially getting data from clients when there are two MACs. They glossed over the one MAC situation by saying someone would notice it so it was not useful.

My concern is doing it asynchronously against things when no one is watching.

Basically it takes turn being the client and the AP both so that it can get the traffic from both. It is an evil twin attack doubled.

It might have broken EAP TLS.

If your wifi is off when you are not using it and you are not getting denial of serviced while using it and you have only one Mac for your SSID, this attack is not occuring.