Once someone is on your LAN, HTTPS isn't the end-all-be-all protection. If, for example, a website hasn't enabled HSTS, or they have but they don't have HSTS p

Once someone is on your LAN, HTTPS isn't the end-all-be-all protection. If, for example, a website hasn't enabled HSTS, or they have but they don't have HSTS preload and the user hasn't visited them before.