It is common knowledge that connecting to open public WIFI networks can pose a security risk (e.g. to man-in-the-middle attacks). However, I have come across 'open' WIFI networks that require no password to connect to but do require a user login before gaining access to the internet.
What are these types of networks called and are they safer than fully open/public networks?
Any network which is not under your full control or under the full control of somebody you can trust should be considered potentially compromised or even malicious. This does not matter if this is an open WiFi, password protected, free or payed for. This is also true for cable, fiber, DSL etc. It also does not matter if the WiFi requires a login or "accept terms and conditions" to access the internet, i.e. has a captive portal.
Who controls the network controls the traffic, i.e. can sniff, block and modify it and can also inject traffic by its own. That's exactly how such captive portals work: redirect (which means modify) the traffic to a login page unless the device has logged in or accept the T&C. So if you are confronted with a network you can not fully trust, then you should use measures to protect your traffic (VPN into a trusted network, HTTPS, ...) and protect your computer (firewall blocking any direct access to your system).
No, it is not. First of all, the local network traffic itself will be unencrypted, meaning any device on the network can easily read all traffic sent or received over it, and with a little effort can spoof other hosts on the network. The captive portal doesn't change that at all. Second, any local network that allows untrusted parties to join is potentially hazardous; there are various attacks (like ARP spoofing or DNS spoofing or port-scanning your machine without either hardware firewall or NAT in the way) that can be carried out any time you have a local network position, and most of them don't care at all whether the network itself is encrypted.
With that said, if you follow best practices for untrusted networks in general - use a secure connection for everything (either TLS such as HTTPS, SSH, or other network security protocols like IPSec which is commonly used for VPNs), don't run any unnecessary servers and configure a machine firewall just in case, use an up-to-date system that is actively maintained and has with no known remote security flaws - then this kind of network isn't really any less safe than most others. The problem is, people are really really bad about following all those best practices. They'll log into games or apps that use unsecured connections, use email clients that only opportunistically use encryption and fall back to plain text if encrypted doesn't work, run overly-promiscuous servers with no firewall, and defer updates because restarting is annoying and probably nobody has weaponized that anyhow, right? It's in states like that where being on a hostile network - whether "open" or not - becomes extra dangerous.
