It's obviously a joke, but ARP spoofing to mitm your gateway will easily work on a WPA2 network, WPA2-enterprise or even a wired network. This isn't passive eavesdropping.
It's a decent approach, though in most cases like that an sslstrip type of attack would still fool a majority. A certificate based VPN may be the most practical client only defense.
Engineering wise this is really a problem to solve at the local LAN, employing individual vlans or other techniques to strictly segment traffic on top of encryption, or simply implementing port based network access control via 802.1x.
There are still ways around this, easiest being to issue a redirect back to HTTP versions of the site when a HTTPS is requested - together with other tweaks it can still be made to fool a regular user - see http://www.thoughtcrime.org/software/sslstrip/
Another possible process would be to issue a self signed certificate when a session is being requested - obviously the user would be notified of the certificate issue, but depending on the level of knowledge of the end user, they may just accept the faked certificate. See http://crypto.stanford.edu/ssl-mitm/
