Hacker News Reader

What you are describing doesn't seem to be a MITM attack on https traffic, but something else, which is why I stated "sans CA cert".

They're describing what would be required to MITM HTTPS traffic. You're correct that they essentially need to get the cert.