Hector Martin

I think you basically hijack the connection at this point and go into a MITM position. Client using 0-key to communicate with you. Not AP

How do *you* intend to talk to the AP if you can't authenticate against it?

You don't. The client just thinks it's connected to original AP but you are not. You route them through some other network.

That makes the impact negligible. This affects mostly private LANs. You're already owned if you trust the internet.

I mean, sure, you could spoof a LAN and recover some auth credentials, but not MITM properly. And you need to know what to expect.

Mh? At this point you emulate an AP with a negotiated all-zero key. It's full MITM, just not through orig AP. At least how I understood it.

MITM means you're in the middle. He's not in the middle, he's routing to a totally different network. You can't MITM an intranet with this.

you both are correct. Just a matter of how you define the intended MITM "outcome".