1 of 2

Why isn't HTTP enough to defeat an evil twin attack?

I am having a disagreement with a friend concerning how best to defend oneself against an evil twin attack at the local coffee shop, airport, or hotel. According to what I have read it is best to always use a VPN when connecting to a public network period. My friend claims that it is sufficient to just connect to websites that support HTTPS connections. Who is right and why? Thanks!