I have read a lot of comments that suggest allowing specific mac addresses is not effective as anyone can spoof a mac address. I have a couple of questions;
How would they obtain a list of approved mac addresses if they are not connected to the network?
If someone has previously obtained the network key, and you change the password, are they still able to connect with just the key? (I am assuming the passphrase you pick is just converted to the key, is this assumption wrong?)
I ask because I am in the process of improving my network security after discovering others on it. Currently I have implemented the following;
Disabled WPS, New solid WPA-2 Personal Passphrase, Implemented an "allowed access" list of MAC addresses.