I don't worry about being randomly stabbed, that seems to be more likely than someone hacking my https connections on a public wifi.

Just like there certainly are some cities or places you should actually worry about being randomly stabbed, there are some public open access networks that should raise your concerns.

I believe you are very much mistaken. The risk/reward profile of both acts are wildly different: the chances of getting caught while operating a honeypot AP in a public environment are vanishingly small, not so with running around brandishing a knife. Think of it like gas station card skimmers (where the risk is substantially higher than the rogue AP) where the financial motivation is already enough for some people to try it. I might be a tad cynical on this, but since there's money to be made I bet it happens more often than we hear about.

I don't say that you should always be overly concerned when using a wifi. Though, you should pay attention at which wifi you log on and what services you access while doing that.

Do you really need to check you email on a public wifi? If it's not necessary, then just don't do it. It's the small things. Sure you can take this into the extreme (which is never a bad thing in this case), but even if we don't, then we should not teach people that every public wifi is perfectly fine. Please remain thoughtful.

Your threat model should be localized. There are plenty of places where the threat of stabbing is low, and should not occupy your mind. There are plenty of places where the threat of stabbing is high, and you should be aware of your surroundings.

Likewise, your threat of being preyed upon on an open AP is dependent on what you're doing on that AP. Surfing HN? Who cares. But if I'm checking my bank account balance or touching sensitive info, I'm absolutely going to fire up a vpn first.

    > No, they are not. They will never be. They might be secure, but not completely...

You are right in that nothing is ever "completely" secure.

But we take risks ALL THE TIME. In a primitive sense, risk assessment can be thought of as a product...

    risk = severity_of_outcome x probability_of_occurence

Just how risky is it to get on a public wifi? What could happen? What does happen? Are there "safe" things you can do on a public wifi? Are we talking about giving up treasure to casual script-kiddies? Or is it only nation-state-actors that we need to worry about, or maybe jealous-obsessive hacker boyfriends? What can happen if I just leave wifi enabled on my phone? What can happen if I connect and do nothing? What are the exploits?

A lot of these things are unclear-- even for "experts" on HN.

In the absence of actual credible stories about the bad things that happen on public wifi, people will DISMISS the risk. Some may choose a more paranoid approach and never use public wifi, but I think that's just about as unreasonable as the opposite.