What's wrong about (1)? Https or not, there are still MitM attacks, and the URLs you are accessing are still trackable. As to why I'd trust my VPN more than my ISP, who's CEO has got more to lose once word gets out that his company cooperated with authorities to turn over my logs?

This is maybe a nit-pick, but https prevents tracking of URLs - they can still see what hosts you're connecting to, but they don't get the full URL string.

More or less everything your computer does online is protected through HTTPS or similar protocols, with proper certificate checking to protect against MitM attacks. By now, enough time has passed to get most incompetent vendors who had auto updaters doing insufficient checking to fix their software.

As someone else pointed out, URLs are not trackable, host names are, but the advice often comes in the form of "don't do sensitive stuff like online banking from untrusted networks". Since especially this has had HTTPS for 10+ years now, this advice is far outdated.

> 4) Bypassing geoblocking

> 1 + 2 is what the VPNs advertise, but I think 3 + 4 are what people actually use them for.

I don't know, I've seen two different "household" gaming Youtube channels advertise VPNs with a focus on geoblocking. I was kind of shocked at how brazen it was.

> 1)

Open wifi networks still exist. When last I was at my public library (a year ago... covid) they still had an open wifi network for public use. I think for them it's a matter of principle, since it means nobody has to ask permission to use it.

But HTTPS has become (nearly) universal. There's little risk of someone on your network snooping on your traffic, because it's just not possible anymore.

>1) people believing long-outdated guidance about not using open WiFi networks without a VPN

Long-outdated? It's more important today than it was 10 years ago. That public wifi you're on is tracking your every move and correlating your devices back to you if you happened to purchase anything in the store with a credit card.

What every move? Wifi APs can only see the domain names/IP, everything else is under HTTPS.

All your clicks getting tracked and sold and resold to the point anyone can know more about you than your wife does.

Wait,, what's wrong about 1?

Almost everything is over https now, and with it, the wifi network security doesn't matter much.

Wifi isn't only browsing the web..

But web browsing is the vast majority of network usage now. The only big exception I can think of that don't go through standard HTTP/HTTPS rails is email. And even then desktop email clients are pretty rare now and they're pretty universally encrypted now.

No, but HTTPS isn't only browsing the web either. Very little that the average person will do on the go doesn't use TLS (or other effective encryption) in some form.