I think the point that some of the naysayers here are missing is that while SSL and a VPN aren't _perfect_ security, they're more than enough for Joe NineToFive

I think the point that some of the naysayers here are missing is that while SSL and a VPN aren't _perfect_ security, they're more than enough for Joe NineToFive. They eliminate the vector of a random person running a honeypot network trying to scoop up low-hanging banking credentials. If you have a knowledgable, perhaps state-level adversary trying to get you in particular, then yes, connecting to random hotspots is probably not a great idea, but you either already knew that or were compromised long ago.