mac addresses can be spoofed. your best bet (if your worried about someone leeching off your bandwidth is to go aes) But i dont thats necessary.

if you would like to learn more, the best place for security info is to go to www.grc.com. Steve Gibson is awesome at explaining things. I remember him mentioning with a wpa 128 bit encryption it would take someone months if not years to crack. he has a lot of podcast going back several years. he also has a random password generator i would recommend using called perfect passwords thats on his website. Hope this helps and good luck.