It's only slightly hypothetical. http://www.csoonline.com/article/2865806/cloud-security/gogo-inflight-internet-serves-up-man-in-the-middle-with-fake-ssl.html

It's only slightly hypothetical. http://www.csoonline.com/article/2865806/cloud-security/gogo-inflight-internet-serves-up-man-in-the-middle-with-fake-ssl.html http://www.csoonline.com/article/2865806/cloud-security/gogo... Gogo didn't require installing a root cert, but they DID issue forged certificates to MitM connections to *.google.com (and others). Also, remember "Superfish"? Their root cert was pre-installed by Lenovo.