I think using TLS is largely the right solution, and "shouldn't be hard" (a $400 certificate is the hardest bit). However, the article assumes that modify attac

I think using TLS is largely the right solution, and "shouldn't be hard" (a $400 certificate is the hardest bit). However, the article assumes that modify attacks are as simple as intercepted, which I do not believe is true. It's not about GUIs. Re-routing DNS requires holes and access that a properly configured infrastructure won't give you. However, as long as you can put up a competing DHCP server at an open Starbucks network, you can probably own anything non-TLS.