[edeirme]

That is correct. However it's trivial for a MiTM attacker to perform an SSL stripping attacks when the victim is communicating with sites that support plain HTTP.

[jp3141]

even with HSTS?

[edeirme]

If a website employs the use of HSTS all traffic will be redirected to HTTPS, rendering the support for HTTP redundant.

[marichards]

Hmm, if you can control the plaintext network isn't there an NTP attack to reverse time and use old compromisable certificates or move it forward past hsts max age?