Yikes! Unsecured WiFiI knew this was possible but always relied on the assumption that some sophistication was required to make use of it, and that it was unlikely on individual hotspots I'd be sharing with such a person.
Was I ever wrong!
This is not only frightening but may also explain the hijacking a couple of months ago of my Facebook account, which has caussed me to essentially stop using Facebook.
Apparently there are mitigations but I prefer to simply avoid accessing any site I care about much when on an open network.
What utter malice!
h/t Ann Althouse.