> You'll inevitably have to disable it every time you use public wifi (to get the captive portal to show up). In my experience, captive portals use a MITM on H

> You'll inevitably have to disable it every time you use public wifi (to get the captive portal to show up). In my experience, captive portals use a MITM on HTTP connections, not a DNS hijack. If they hijacked the DNS request, the browser's DNS cache would keep the wrong response, breaking access to the real website even after login to the captive portal. > Using TLS adds latency, because of the tcp handshake required (unless they're using DTLS), and it exposes all the domain names you visit to google, so it's actually worse than regular dns. The TCP handshake latency would be only on the first request, the same connection can be reused for further queries, especially if you are using a single recursive resolver for all queries, which is the case if it "exposes all the domain names you visit to google".