This may be impossible to prevent (for non-https users) but can't it at least be detected, i.e. in a coffee house setting, since the probability of two devices

This may be impossible to prevent (for non-https users) but can't it at least be detected, i.e. in a coffee house setting, since the probability of two devices requesting the same user's FB page under normal circumstances is almost nil. Then you can let all requesters know and block any further traffic. IDEABOLT: How about a startup selling self-contained routers to e.g. Panera, Starbucks, or B&N that can add this extra security. Then they can advertise this as an extra differentiating feature.