Hector Martin

most sites don't use HSTS, so you can SSLStrip and MITM internet access easily

this implies the user is "trusting WAN", yes, but most people don't even know what that means

usually the expectation is that local WPA2 will protect against attacks on a local network, because attacking the uplink is harder

same applies to a home network (but not to a public network with a public PSK, since you could just impersonate the AP anyway)

and a lot of stuff on LAN _trusts the LAN_; sure, you can't transparently MITM those with wpa_supplicant, but you can impersonate

Sure, it's not zero impact by any means, but it's also not "I'm going to walk up to your office and sniff/MITM everything".

well, you could walk up to an office and impersonate everything, which might be just as good

But I can already walk up to the office and impersonate the local Starbucks SSID and deauth people & MITM all your internet access too :-)