Note that in the demo video they use SSLStrip to cancel attempts of websites to switch to https.

The only protection here is HSTS (which is not enabled by most websites, but major ones like banks will usually have them) and manually typing https:// in your address.

I'm seeing HSTS on 0/3 of Australian banks (I'm even seeing RC4 on one of them).

https://www.ssllabs.com/ssltest/analyze.html?d=commbank.com.... https://www.ssllabs.com/ssltest/analyze.html?d=nab.com.au&s=... https://www.ssllabs.com/ssltest/analyze.html?d=westpac.com.a...

Commonwealth's online banking is actually at my.commbank.com.au and does have HSTS - https://www.ssllabs.com/ssltest/analyze.html?d=www.my.commba...

CUA does have it - https://www.ssllabs.com/ssltest/analyze.html?d=ob.cua.com.au

Bankwest does but has some awful problems elsewhere - https://www.ssllabs.com/ssltest/analyze.html?d=ibs.bankwest....

But yeah, Westpac and NAB don't, and in addition to the ones you tested, ANZ and St. George don't have it either. That's pretty unacceptable really.

These are real issues that you can report to them.

You can (and should) also be using HTTPS Everywhere: https://www.eff.org/https-everywhere.

I think it's a nice plugin until you forget that you're using it and you rage for minutes/hours trying to understand why you can't access some website.

It might be worth it.

I remember spending hours trying to figure out why Google Adsense wouldn't render correctly. In the end I figured out that it was Adblock's fault :))

This only applies to websites which land on a plain HTTP page and then load links to HTTPS pages. Entering “ https:// “ explicitly before any URL accessed will fully mitigate this.

Exactly, this particular sentence seems to overly dramatise the situation.

Is this issue any different to using open wifi at a cafe, which many many people do, relying on HTTPS for their security? (This is an honest question)

At its worst, this attack reduces a protected network to an open wifi, yes.

The risk is that you may do things on a protected network assuming it really is protected - this is more of a thing for organisations rather than consumers, for example organisations might have unprotected services accessible over their office wifi.

Or if combined with some other vulnerabilities...

Somewhat pointless remark as WPA only protects up to the access point. Any vulnerability after that has wider implications regardless of the WPA status.

It's not really pointless. MiTM attacks become much easier to accomplish with something like sslstrip once access to the network is gained.