Hector Martin

That makes the impact negligible. This affects mostly private LANs. You're already owned if you trust the internet.

I mean, sure, you could spoof a LAN and recover some auth credentials, but not MITM properly. And you need to know what to expect.

Mh? At this point you emulate an AP with a negotiated all-zero key. It's full MITM, just not through orig AP. At least how I understood it.

MITM means you're in the middle. He's not in the middle, he's routing to a totally different network. You can't MITM an intranet with this.

you both are correct. Just a matter of how you define the intended MITM "outcome".

also, if you are basing your security model ONLY on the "security" of your physical network (wired or wireless), you are doing it wrong.

Indeed. Sadly, many, *many* still do.

In a way I appreciate the FUD in the sense that it might help make people stop doing that. Maybe. I can have dreams, OK?