> - How HTTPS prevents ARP poisoning (it doesn't - this happens at Layer 2)
HTTPS doesn't need to prevent ARP poisoning itself, because if you try to MITM my connection with it, HTTPS will prevent that, and if you don't, then ARP spoofing hasn't accomplished anything.
> - How HTTPS prevents port scanning of your device (it doesn't - attackers scan your listening services directly)
Firewalls protect you from that.
> - How HTTPS prevents DNS manipulation when 80% of users don't use DoH/DoT
Exact same answer as for ARP spoofing.
> - How HTTPS prevents SNI leakage when ECH adoption is <5%
SNI leakage happens over the Internet in cleartext even with mobile hotspots. What does this have to do with public Wi-Fi?
> - What specific mitigations you've deployed against the network service exploitation you acknowledged
Which things specifically do you mean by "network service exploitation" that I haven't already covered?
> TLS operates at layers 5-7. The attacks you listed in Q6 happen at layers 2-4. Your HTTPS traffic is irrelevant to these attacks.
See my responses above.
> The quiz asked about everyone, not just you:
> This isn't about how well you've personally secured your device. It's about whether the general public should be told "public WiFi is safe because HTTPS."
Nothing I answered was about my specific devices. Everything I've said is about how mainstream devices work out-of-the-box today.
> Most people:
> - Don't know what services are listening on their network interfaces
Mainstream devices are configured out-of-the-box with deny-by-default firewalls.
> - Are running unpatched software (Q8: personal computers lack defense-in-depth)
Mainstream devices are configured out-of-the-box with automatic updates.
> - Aren't using DoH/DoT
> - Aren't aware SNI is unencrypted
> - and the rest
Again, that happens over the Internet in cleartext even with mobile hotspots. What does this have to do with public Wi-Fi?
> What exact technical controls are you deploying? What does the average person need to configure to achieve your level of protection?
Nothing, assuming usage of a modern mainstream Windows/macOS/Linux/iOS/Android device.