He who is J.O. Aho said on Mon, 16 Oct 2017 21:08:48 +0200:

They do use a tool commonly used in man-in-the-middle attacks, to strip
away the tls and send the content to the client machine unencrypted. As
they did explain in the video, many don't check in their mobile devices
that they have tls communication or not and those they will be able to
carry out the attack to see the the login credentials in this example.

This has nothing to do with KRACK itself.

Thanks for explaining *how* they manage to unencrypt *some* encrypted web
sites but not others, as I wasn't sure how they did that.

I was wrong in assuming it was the KRACK attack, which seems to be that
they simply hijack the third of the four handshakes, usually from the
client side, and force it to be resent where in some cases, it's resent as
all zeroes where in other cases it's just resent as a known nonce.

Is that a decent summary or can you summarize the attack mode better?