I am having a disagreement with a friend concerning how best to defend oneself against an evil twin attack at the local coffee shop, airport, or hotel. According to what I have read it is best to always use a VPN when connecting to a public network period. My friend claims that it is sufficient to just connect to websites that support HTTPS connections. Who is right and why? Thanks!
In general, HTTPS should be enough as long as you don't do anything crazy like installing extra trusted root certificates, or bypassing warnings because you want to see the page.
But, that assumes only HTTPS sites are visited, and there is NO OTHER network activity. How many apps do you have that use the network in the background? Do you know if all of them encrypt their communications? How often do you explicitly type
https://? If you browse the web normally you'll be vulnerable to sslstrip.
So yes, in theory just visiting HTTPS site is ok, but if you're on a malicious network, you probably don't want to risk something slipping by you.