<div dir="ltr"><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">Let's say I'm at a place with open wifi, like McDonalds. You have to<br>
agree to their TOS to get on, but there's no password. In that case,<br>
then, all the traffic in the room is clearly visible, and readable, and<br>
copyable, including mine, unless I'm using SSL or a VPN.<br></blockquote><div> <br>SSL can be MITM. As long as the user accepts the invalid cert, then SSL is broken. This is on top of ARP poisoning, so you can properly view all traffic passing through the router. So a VPN is your best bet. Then setup a firewall rule to<br>
1. only accept packets from vpn.<br>2. drop everything on wlan0 except vpn traffic.<br>3. forward wlan0 to tun0 just to make sure everything is going through the tunnel.<br><br></div></div>