Most conferences that have encrypted WiFi will use PSK. Given the pre-shared key and observation of the handshake, you can calculate the session key and decrypt all traffic between a user and the access point. Compiling aircrack is no longer "grandmother" territory, but it is certainly "average linux geek" territory. Aircrack creates a virtual network interface, so you can even use it with Firesheep with no extra modification.

So turning off encryption is really not that bad when you consider that all it did was hog CPU and give people a false sense of security.

These are good points. (And indeed, I intended to write 'Firesheep' and not 'Firecookie').

This is, in fact, what happened. An enterprising douchebag used Firesheep to sniff Twitter credentials, then #poopin'd a bunch of attendees. Malte makes oblique reference to this in the post.

I'm not convinced it's the WiFi provider's job to hold users' hands here. Most of us don't maintain separate browsing habits for public networks and private networks. I know that I never had an "aha, should use Twitter over HTTPS now" moment once I started using the WiFi at JSConf, and that's my fault.

In other words, session stealing can be resolved by the site itself (by forcing everything onto https, like GitHub has done), by the WiFi provider (by selectively redirecting traffic onto https and reminding people that the network is unencrypted), or by the end user (by being justifiably paranoid). In my mind, the former two aren't _obligated_ to help here, but may do it anyway just to avoid headaches all around.