>>13755>>137531 actually be the WLAN access point
1b or unencrypted WLAN and ARP poisoning
1c or wlan with soykaf encryption you can break and ARP poisoning
2 now targets traffic gets routed over your machine
3 breaking into their HTTPS is a bit tricky, either you have a fake cert for *.facebook.com or whatever that IS SIGNED by a root cert authority trusted by their system who abused their power, or they get a big fat warning and you just tell them to click on "stfu i know what im doing trust this fake cert so he can read eyverthing". the "explanation" text is notoriously bas even on firefox you have to like click a tiny arrow to read wtf is going on, but the reason browsers make such a huge fuss about certs that are self signed or something is because of situations like that