As Julian said, the lack of HTTPS allows for man-in-the-middle attacks. He also mentioned access point spoofing, which are relatively common, especially in certain countries.
What else should I be aware of?
I'm of the opinion that authentication is the least of your worries.
https, a man-in-the-middle attack - which can be performed by a state-level actor (think Chinese government, GCHQ, or the NSA) - or anyone with access to the network you're connecting to - attackers can inject malicious payloads into the website in question. All of your traffic can be snooped and replaced with malicious content.
Imagine you request
jQuery.js, but the website in question serves you
Even worse, since websites can check to see whether or not you have a Flash installed and running, along with it's version, there could be an injection of a malicious, albeit invisible Flash plugin into your webpage. I've experienced this attack in several places abroad.
At that point, it would not matter if you were behind seven proxies. Once remote code execution happens, or they use Flash to poll your unique hardware information, you're screwed.
Options to Help Protect Sensitive Information
Since this is a website about information security, and a lot of things we do here at our jobs include keeping information secure, then you should be aware of what can happen, and also take the necessary steps to avoid an information breach.
You'd do well to avoid all open WiFis (including hotels) unless you don't care about the device and it's contents. I personally use unsecured WiFi all the time simply because I don't care about the devices or it's contents, and also because I intend to study the spooky action going on behind the scenes.
Here's what I'd do if I had to protect sensitive information such as
protected health information,
personal information (customer data), or even
- Do not use public WiFi.
- Do not use Flash. Ever.
- Use HTTPS Everywhere.
- Do not use Java in your browser. Ever.