> LOL either the real one will be up or someone running a MITM attack.

Your big mistake was thinking that you should ever trust a network instead of using secure protocols like HTTPS or SSH.

This is more of a standards problem then a start up problem. Minimally, you need to get something standardized using public key Identification.

Another option is to deploy something like secure in band wireless pairing[1] which prevents anyone trying to spoof an access point while you are in range of the existing access point. Essentially, the access point uses transmit/not transmit as an encoding mechanism for secure announcements. Anyone attempting to jam that can't because forging an announcement requires you to not transmit at key points [1] http://people.csail.mit.edu/nabeel/TEP.pdf

802.11u and Passpoint (the WiFi Alliance's implementation of 802.11u) do this.

In order for that to work, I think you necessarily need the cooperation of the network owner, and an informed end user. Given that, it seems like the technical solution is basic public key cryptography. Give the access point a public key (possible the same key it uses for https), then all the user has to do is validate that the access point is using the appropriate certificate. You could provide software that automatically validates networks when you connect, and/or provides a more user friendly way to do so.

The biggest problem I see is that their is no way to automatically distinguish between a MITM, and the vendor simply not participating.

"informed end user." Or it could be a free automatic feature of Android 4.4. The almighty GOOG has the unusual situational advantage of being the same guy doing the WIFI and doing the phone/tablet OS. The only place AAPL has them beat is they sell the wifi access point devices too.

They could release an ITMS app for iDevices, I suppose.

My relatively new android phone is running 2.3.7, so somehow shoehorning it into an android app would be more useful than adding to a OS I probably won't have access to for years.

Its going to need to be cross platform for the laptop users anyway.

Note that as a startup idea you don't need to be .mil grade and encrypt and verify every packet. Something as simple as a notification pop up along the lines of "Holy Cow you are in Great Danger!" would be more useful than the present nothing.

Last time I went to Starbucks, couldn't get onto my vpn. Do they block them?

That's no different from how it is today, except the SSID will be slightly different. You have no way to tell whether you're logging into the official Starbucks WiFi or some black hat's stand-in.

There are quite a few VPN products out there advertised specifically to protect you while connecting to untrusted public WiFi networks.

A MITM would steal your VPN credentials would it?

I don't know how all VPN systems work, but if you are using ssh -D I believe that your first connection creates keys for your computer pair in ~/.ssh/authorized_keys and then future connections are fairly secure regardless of who is eavesdropping.

Cool thanks for the insight! As oppose to others who just down voted me...