She doesn't necessarily have to go offline given that everyone has a phone with internet access nowadays. Also, with week passwords, dictionary attacks, rainbow

She doesn't necessarily have to go offline given that everyone has a phone with internet access nowadays. Also, with week passwords, dictionary attacks, rainbow tables etc you might actually get compromised in minutes. And instead of de-auth, she might just as well wait. As for "I doubt anybody would do that" - it's not really a good security argument when we have the means easily available.