https://github.com/youngBuger/esp8266-s ... hread.java
It seems to be like TI's approach - the ESP8266 monitors all packets and looks for patterns in the size of the packets. Encoded in the size of the packets is a string containing the SSID and key.