> The only instance in which I’d really urge caution is that public Wi-Fi scenario, particularly when you’re in an environment surrounded by other people with technical know-how.
The first condition is satisfied whenever you're in a coffee shop, airport, hotel, university campus, wifi-enabled public transportation ... i.e. pretty much everywhere except your own home and possibly your workplace. Some of these places use WPA, but most I've seen don't use any encryption. The second condition shouldn't be too easy to satisfy, either, particularly when you're in a place like the Bay Area.
Blacklisting isn't good enough when it comes to security, we all know that. So the advice should rather be: Anyone can steal your Stack Overflow session at any time whatsoever, unless you're using an Ethernet cable or your own secure Wi-Fi. (Even then, your ISP or a three-letter government agency could see your traffic, but they're probably more interested in watching you than impersonating you.)
I don't think it's a safe assumption that the only parties upstream from you are ISPs and TLA government agencies. If script kiddies are hacking major corporations I think it's a safe bet that ISPs are vulnerable, too. Your Stack Overflow "identity" may not be of great value, but it's worth keeping in mind that any cleartext traffic is vulnerable. Being cognizant of sending data over the Internet in cleartext is a good thing, to me.
The first condition is satisfied whenever you're in a coffee shop, airport, hotel, university campus, wifi-enabled public transportation ... i.e. pretty much everywhere except your own home and possibly your workplace. Some of these places use WPA, but most I've seen don't use any encryption. The second condition shouldn't be too easy to satisfy, either, particularly when you're in a place like the Bay Area.
Blacklisting isn't good enough when it comes to security, we all know that. So the advice should rather be: Anyone can steal your Stack Overflow session at any time whatsoever, unless you're using an Ethernet cable or your own secure Wi-Fi. (Even then, your ISP or a three-letter government agency could see your traffic, but they're probably more interested in watching you than impersonating you.)