Sure practicality is always an issue. It's an issue that attackers will go to great lengths to resolve too.
What if it's the Starbucks at 1730 Pennsylvania Ave NW, Washington, DC 20006 for an extended period of time? Compounded with other security issues like password reuse...
We can always draw a line and say, "that's not practical". The assessment an attacker is likely to do is going to be "is this practical inside my budget for the value I hope to acquire?" or maybe even just "waow, lulz".
Except it won't impact gmail unless you're accessing it through curl. The browsers already distrusted the compromised intermediates via CRL within hours of disclosure, and removed the affected root via update.
I have, but good luck predicting where I'm going to have my next cuppa.
Outside of petty crimes mentioned, I don't see how it could be industrially weaponised to make actual damage.
Regardless, real bad actors are busy compromising your next `npm install` anyway. Much better reward.
If they are specificly targeting you, then they probably dont need to use the coffee shop. The coffee shop is for low skill attackers targeting people at random.
If someone has it in for you and hired a high skill attacker, its not a stretch to imagine they compromised your home network.
> good luck predicting where I’m going to have my next cuppa.
Why are you assuming there isn’t someone else trying to hack you at the next cafe? Actual damage can happen one person at a time, and can occasionally lead to larger scale compromises. Randomizing your location isn’t going to reduce your risk. Now that everyone who’s paying attention knows they can MITM your Mac, you shouldn’t trust any network.
Physical access to networks isn't that hard to come by.