In WPA 4-Way Handshake, SNonce, ANonce, AP MAC addr and STA MAC addr are exposed to an eavesdropper Eve. But I think it is still safe unless PSK (password) is exposed to Eve.
If PSK is exposed, however, I think connection is not secure any more since Eve can acquire all parameters to derive PTK. (PTK is a function of PSK, ANonce, SNonce, AP MAC addr, and STA MAC addr)
Is my understanding is correct?
I ask this question because some shops provide free access point service in WPA-PSK mode and they expose a password. In such a case, I think using such free access points is not secure any more, even though they are operating in WPA-PSK mode.