I suppose another approach is "punt on public AP whenever possible, and tether to a VPN connection over your phone instead". Chews up data though.
You have basically two strategies for your risk (surfing on a public AP).
- Elimination: Not using it
- Mitigation: Taking precautions to reduce the probability and impact of having information disclosed.
How much should I worry about the window of time where I am in the captive portal (the agreement screen) and have not yet started my VPN?
VPN will just help you by encrypting your data traffic, which I understood as your major concern when surfing on a public AP. You will be unable to surf anyway until you pass the "captive portal", so I don't see a lot of risk here from a browsing perspective, as long as the only tab you have opened is "agreement screen".
However, once you boot your Mac, some of your applications are very excited awaiting for a network connection. As soon as you connect to the public AP they will try to connect to the Internet (which will fail since they will be probably faster than you opening the "captive portal". Depending on how they were built there is a risk of revealing information. e.g.:
- Password in an url [Caught by a sniffer]
- DNS spoofing [An application pretending to be the one your application is expecting]
- Browser tabs previously opened or installed addons [Although here you could be protected by a time-out])
You are heavily focused on the disclosure of data in transit, however there are other risks when connecting to an unknown AP.
However keep in mind (one example of many others) that someone could by scanning your ports in order to attack open ones which have vulnerable applications listening to it. VPN won't help you here.