  The IEEE 802.11mc standard introduces fine time measurement (Wi-Fi FTM),
allowing high-precision synchronization between peers and round-trip time
calculation (Wi-Fi RTT) for location estimation - typically with a precision of
one to two meters. This has considerable advantages over received signal
strength (RSS)-based trilateration, which is prone to errors due to multipath
reflections. We examine different commercial radios which support Wi-Fi RTT and
benchmark Wi-Fi FTM ranging over different spectrums and bandwidths.
Importantly, we find that while Wi-Fi FTM supports localization accuracy to
within one to two meters in ideal conditions during outdoor line-of-sight
experiments, for indoor environments at short ranges similar accuracy was only
achievable on chipsets supporting Wi-Fi FTM on wider (VHT80) channel bandwidths
rather than narrower (HT20) channel bandwidths. Finally, we explore the
security implications of Wi-Fi FTM and use an on-air sniffer to demonstrate
that Wi-Fi FTM messages are unprotected. We consequently propose a threat model
with possible mitigations and directions for further research.
