[devinj]

Can you MITM public wifi? Real question, but I thought the answer was "no", which would make public wifi a compelling counter-example.

[nknighthb]

I have no idea where you'd get the idea that the answer is "no". The answer is emphatically yes.

[syshax]

Yes. You arp poison the default gateway and route traffic through your own host instead.

[caf]

Or spoof DNS responses to point to a machine under your control.

[sp332]

Or spoof a disassociation frame, then impersonate the access point so the victim connects to your computer instead.